DOE-HDBK-1226-2019, Conduct of Operations Implementation

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-HDBK-1226-2019 MARCH 2019 DOE HANDBOOK Conduct of Operations Implementation U.S. Department of Energy Washington, D.C.20585 NOT MEASUREMENT SENSITIVE DOE-HDBK-1226-2019 Conduct of Operations Implementation Prepared by the Office of Quality Assurance and Nuclear Safety Management Programs, AU-32. Available to the public on the Technical Standards Program web site at https://www.standards.doe.gov https://www.standards.doe.gov/ https://www.standards.doe.gov/ DOE-HDBK-1226-2019 Conduct of Operations Implementation i FOREWORD This Department of Energy (DOE) Handbook is approved for use by all DOE Components and their contractors. The original order DOE O 5480.19, Conduct of Operations Requirement for DOE Facilities, was developed in 1989 from an Institute of Nuclear Power Operations publication. Within a short time, the Department developed a series of DOE Technical Standards that provided additional information for each of the original Order’s eighteen chapters on conduct of operations topical areas. In 2010, the original order was revised into DOE O 422.1, Conduct of Operations. The principles of disciplined operations set forth in 1989 remain a constant in DOE operations and a cornerstone of worker, public, and environmental protection. This Handbook replaces the original Technical Standards with a single document to assist DOE program offices, field elements, and contractors in carrying out the requirements of DOE O 422.1. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to nuclearsafety@hq.doe.gov or addressed to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 DOE-HDBK-1226-2019 Conduct of Operations Implementation ii Contents FOREWORD................................................................................................................................................ i EXHIBITS, TABLES AND FIGURES .................................................................................................. viii ACRONYMS AND ABBREVIATIONS .................................................................................................. ix 1.0 SCOPE, PURPOSE, AND APPLICABILITY ............................................................................. 1 2.0 OPERATIONS ORGANIZATION AND ADMINISTRATION ................................................ 2 POLICIES ..................................................................................................................................... 3 GOALS ......................................................................................................................................... 4 ACCOUNTABILITY ................................................................................................................... 5 PERFORMANCE STANDARDS ................................................................................................ 6 FACILITY RESOURCES ............................................................................................................ 6 HUMAN RESOURCES ............................................................................................................... 7

MATERIAL RESOURCES .......................................................................................................... 7 MONITORING OPERATING PERFORMANCE ....................................................................... 7 2.8.1 Management Tours ............................................................................................................... 8 2.8.2 Performance Reports ............................................................................................................. 9 2.8.3 Management Assessment of Operating Performance ........................................................... 9 CORRECTIVE ACTIONS ......................................................................................................... 10 MANAGEMENT TRAINING ................................................................................................... 10 PLANNING FOR SAFETY ....................................................................................................... 11 2.11.1 Planning .............................................................................................................................. 11 2.11.2 Training ............................................................................................................................... 11 3.0 SHIFT ROUTINES AND OPERATING PRACTICES ............................................................ 12 STATUS AWARENESS AND OPERATING PRACTICES .................................................... 13 AUTHORITY TO OPERATE EQUIPMENT ............................................................................ 13 NOTIFICATION OF STATUS CHANGES .............................................................................. 14 OPERATOR ROUNDS .............................................................................................................. 15 3.4.1 Area Inspection ................................................................................................................... 16 3.4.2 Equipment Status Checks .................................................................................................... 18 3.4.3 Operator Round Sheets ....................................................................................................... 19 RESPONSE TO INDICATIONS ................................................................................................ 23 RESETTING PROTECTIVE DEVICES .................................................................................... 23 SAFETY PRACTICES ............................................................................................................... 23 3.7.1 Use of Safety Equipment .................................................................................................... 23 3.7.2 Personnel Exposure ............................................................................................................. 24 3.7.3 Operating Bases .................................................................................................................. 24 3.7.4 Potentially Distracting Written Material and Devices ........................................................ 25 DOE-HDBK-1226-2019 Conduct of Operations Implementation iii 4.0 CONTROL AREA ACTIVITIES ................................................................................................ 26 CONTROL AREA ACCESS ...................................................................................................... 27

PROFESSIONAL BEHAVIOR .................................................................................................. 28 MONITORING THE MAIN CONTROL PANELS ................................................................... 28 OPERATION OF CONTROL AREA EQUIPMENT ................................................................ 28 CONTROL AREA ANCILLARY DUTIES ............................................................................... 29 5.0 COMMUNICATIONS.................................................................................................................. 30 EMERGENCY COMMUNICATION SYSTEMS ..................................................................... 30 TESTING COMMUNICATION SYSTEMS ............................................................................. 30 COMMUNICATION SYSTEMS ............................................................................................... 31 5.3.1 Party-line Communication Systems .................................................................................... 31 5.3.2 Point-to-Point Communication Systems ............................................................................. 32 5.3.3 Public Address Systems ...................................................................................................... 32 COMMUNICATION EQUIPMENT .......................................................................................... 33 5.4.1 Portable Radios ................................................................................................................... 33 5.4.2 Sound Powered Phones ....................................................................................................... 34 5.4.3 Pagers .................................................................................................................................. 34 5.4.4 Wired Telephones ............................................................................................................... 34 5.4.5 Cellular Telephones ............................................................................................................ 34 5.4.6 Data Network-Connected Devices ...................................................................................... 34 VERBAL COMMUNICATIONS ATTRIBUTES ..................................................................... 35 5.5.1 Clear .................................................................................................................................... 35 5.5.2 Concise ................................................................................................................................ 36 5.5.3 Correct ................................................................................................................................. 36 FORMAT .................................................................................................................................... 36 ESTABLISHING COMMUNICATIONS .................................................................................. 36 5.7.1 Transmitting the Message ................................................................................................... 37 5.7.2 Repeat-back ......................................................................................................................... 37 5.7.3 Confirmation ....................................................................................................................... 37 5.7.4 Report-backs ....................................................................................................................... 38 5.7.5 Briefings for Operators ....................................................................................................... 38 5.7.6 Face-to-Face Communication ............................................................................................. 38

6.0 CONTROL OF ON-SHIFT TRAINING .................................................................................... 39 ADMINISTRATIVE CONTROLS FOR THE CONDUCT OF ON-SHIFT TRAINING ......... 40 6.1.1 Trainee Prerequisites ........................................................................................................... 40 6.1.2 Coordination of Training in the Operating Environment .................................................... 40 6.1.3 Approval of the Operator Qualification Program ............................................................... 41 6.1.4 Instructor Qualification ....................................................................................................... 41 SUPERVISION AND CONTROL OF ON-SHIFT TRAINING ................................................ 41 DOE-HDBK-1226-2019 Conduct of Operations Implementation iv 6.2.1 Pre-Training Briefing .......................................................................................................... 42 6.2.2 Setting the Ground Rules .................................................................................................... 42 6.2.3 Previewing Scheduled Training .......................................................................................... 42 6.2.4 Knowledge Spot Check ....................................................................................................... 43 6.2.5 Supervising On-Shift Trainees ............................................................................................ 43 6.2.6 Placing the Trainee at Ease ................................................................................................. 43 6.2.7 Commencing Training ........................................................................................................ 43 6.2.8 Control of Trainees ............................................................................................................. 43 6.2.9 Communications During Training ...................................................................................... 44 6.2.10 Suspension of Training ....................................................................................................... 44 6.2.11 Maximum Number of Trainees ........................................................................................... 45 6.2.12 Concluding On-Shift Training ............................................................................................ 45 TRAINING DOCUMENTATION ............................................................................................. 45 USING TRAINEES TO SUPPORT OPERATIONS ................................................................. 46 OPERATIONS MANAGEMENT INVOLVEMENT IN TRAINING ...................................... 46 7.0 INVESTIGATION OF ABNORMAL EVENTS ........................................................................ 47 EVENTS REQUIRING INVESTIGATION............................................................................... 47

7.1.1 Responsibility and Qualification ......................................................................................... 48 7.1.2 Investigative Process ........................................................................................................... 49 7.1.3 Event Reconstruction .......................................................................................................... 49 7.1.4 Event Analysis and Evaluation ........................................................................................... 49 7.1.5 Root Cause Determination .................................................................................................. 49 7.1.6 Corrective Action Determination ........................................................................................ 50 7.1.7 Investigative Report ............................................................................................................ 51 7.1.8 Further Evaluation............................................................................................................... 51 SABOTAGE ............................................................................................................................... 51 HUMAN PERFORMANCE IMPROVEMENT ......................................................................... 52 8.0 NOTIFICATIONS ........................................................................................................................ 53 PROGRAM OBJECTIVES ........................................................................................................ 53 NOTIFICATION PROCEDURES ............................................................................................. 54 DOCUMENTATION ................................................................................................................. 54 9.0 CONTROL OF EQUIPMENT AND SYSTEMS ....................................................................... 56 STATUS CHANGE AUTHORIZATION AND REPORTING ................................................. 57 EQUIPMENT AND SYSTEM ALIGNMENT .......................................................................... 57 9.2.1 Equipment Lockout and Tagout .......................................................................................... 58 9.2.2 Operational Limits Compliance .......................................................................................... 59 9.2.3 Alarm Status ........................................................................................................................ 59 9.2.4 Equipment Deficiency Identification and Documentation .................................................. 60 9.2.5 Work Authorization and Documentation ............................................................................ 60 DOE-HDBK-1226-2019 Conduct of Operations Implementation v 9.2.6 Equipment Post-Maintenance Testing and Return to Service ............................................. 61 9.2.7 Temporary Modification Control ........................................................................................ 61 9.2.8 Distribution and Control of Equipment and System Documents ........................................ 62 10.0 LOCKOUTS AND TAGOUTS .................................................................................................... 63 CONTROL OF HAZARDOUS ENERGY ................................................................................. 63

CAUTION TAGS ....................................................................................................................... 64 11.0 INDEPENDENT VERIFICATION ............................................................................................. 66 SYSTEMS/COMPONENTS REQUIRING INDEPENDENT VERIFICATION ...................... 68 11.1.1 Nuclear Safety Functions .................................................................................................... 68 11.1.2 Environment, Safety, and Health (ES&H) Functions ......................................................... 68 11.1.3 Mission-Critical Functions .................................................................................................. 68 11.1.4 Components Excluded from Independent Verification Requirements................................ 69 SITUATIONS REQUIRING INDEPENDENT VERIFICATION............................................. 69 11.2.1 Removing Equipment from Service .................................................................................... 70 11.2.2 Placing Equipment in Service ............................................................................................. 70 11.2.3 Periodic Checks during Facility Operation ......................................................................... 71 11.2.4 Temporary Modifications ................................................................................................... 71 VERIFICATION TECHNIQUES ............................................................................................... 71 11.3.1 Verifying Valve Position .................................................................................................... 72 11.3.2 Verifying Throttled Valves ................................................................................................. 73 11.3.3 Checking Process Parameters ............................................................................................. 73 11.3.4 Checking Remote Position Indicators ................................................................................. 73 11.3.5 Surveillance (Operational) Testing ..................................................................................... 74 11.3.6 Verifying Operational Processes ......................................................................................... 74 11.3.7 Verifying Locked/Tagged Components .............................................................................. 74 11.3.8 Resolving Inconsistencies Discovered during Independent Verification ........................... 75 OPERATIONS SELF-APPRAISAL AND VERIFICATION .................................................... 75 12.0 LOGKEEPING ............................................................................................................................. 76 ESTABLISHING OPERATING LOGS ..................................................................................... 76 INFORMATION TO BE RECORDED ...................................................................................... 80 TIMELINESS OF RECORDINGS ............................................................................................. 81 LEGIBILITY AND FORMAT ................................................................................................... 82

12.4.1 General Format ................................................................................................................... 82 12.4.2 Initial Entry ......................................................................................................................... 82 12.4.3 Incomplete Tasks ................................................................................................................ 83 12.4.4 Final Entry .......................................................................................................................... 83 12.4.5 Correcting Errors................................................................................................................. 83 LOG REVIEWS .......................................................................................................................... 83 STORAGE OF COMPLETED LOGS ........................................................................................ 84 DOE-HDBK-1226-2019 Conduct of Operations Implementation vi COMPUTERIZED LOGS .......................................................................................................... 84 13.0 OPERATIONS TURNOVER ...................................................................................................... 85 TURNOVER PROCESS............................................................................................................. 86 13.1.1 Turnover Checklists ............................................................................................................ 86 13.1.2 Turnover Checklist Verification ......................................................................................... 87 13.1.3 Turnover Checklist Information .......................................................................................... 87 13.1.4 Using Turnover Checklists .................................................................................................. 90 DOCUMENT REVIEW ............................................................................................................. 90 PRE-SHIFT WALKDOWN ....................................................................................................... 91 13.3.1 Panel Walkdown ................................................................................................................. 91 13.3.2 Supervisor Walkdown ......................................................................................................... 91 INFORMATION EXCHANGE AND RESPONSIBILITY TRANSFER .................................. 92 SHIFT BRIEFING ...................................................................................................................... 92 RELIEFS OCCURRING DURING THE SHIFT ....................................................................... 93 TURNOVER TO UNSTAFFED CONDITION AND RESUMPTION OF OPERATIONS ..... 94 14.0 CONTROL OF INTERRELATED PROCESSES ..................................................................... 95 OPERATOR RESPONSIBILITIES ........................................................................................... 97 14.1.1 Operator Knowledge ........................................................................................................... 97 14.1.2 Operator Response to Process Problems ............................................................................. 97 COMMUNICATION BETWEEN OPERATORS AND PROCESS PERSONNEL ................. 98

15.0 REQUIRED READING ............................................................................................................... 99 FILE INDEX ............................................................................................................................... 99 READING ASSIGNMENTS .................................................................................................... 100 REQUIRED DATES FOR COMPLETING READING ASSIGNMENTS ............................. 100 DOCUMENTATION ............................................................................................................... 101 15.4.1 Example Documentation for Large Organizations............................................................ 101 15.4.2 Example Documentation for Small Organizations ........................................................... 104 REVIEW ................................................................................................................................... 105 ELECTRONIC REQUIRED READING SYSTEMS ............................................................... 106 16.0 TIMELY INSTRUCTIONS/ORDERS ..................................................................................... 107 ISSUING, SEGREGATING, REVIEWING, AND REMOVING TIMELY ORDERS .......... 107 16.1.1 Issuing Timely Orders ....................................................................................................... 107 16.1.2 Segregating Timely Orders ............................................................................................... 107 16.1.3 Reviewing Timely Orders ................................................................................................. 107 16.1.4 Removing Timely Orders .................................................................................................. 108 16.1.5 Electronic Systems ............................................................................................................ 108 CONTENT AND FORMAT ..................................................................................................... 108 16.2.1 Content .............................................................................................................................. 108 DOE-HDBK-1226-2019 Conduct of Operations Implementation vii 16.2.2 Format ............................................................................................................................... 108 17.0 TECHNICAL PROCEDURES .................................................................................................. 111 18.0 OPERATOR AID POSTINGS .................................................................................................. 111 OPERATOR AID DEVELOPMENT ....................................................................................... 112 APPROVAL ............................................................................................................................. 113 DOCUMENTATION ............................................................................................................... 114 PLACEMENT ........................................................................................................................... 117 USE OF OPERATOR AIDS..................................................................................................... 117 REVIEW OF OPERATOR AIDS ............................................................................................. 118

19.0 EQUIPMENT AND PIPING LABELING ............................................................................... 122 COMPONENTS REQUIRING LABELING ............................................................................ 123 LABEL INFORMATION ......................................................................................................... 123 LABEL DESIGN AND PLACEMENT ................................................................................... 125 19.3.1 Label Materials and Attachment ....................................................................................... 125 19.3.2 Label Readability .............................................................................................................. 126 19.3.3 Label Placement ................................................................................................................ 127 COLOR CODING .................................................................................................................... 130 19.4.1 Highlighting Critical Component Controls or Groups of Controls ................................... 130 19.4.2 Associating Related Controls and Displays ...................................................................... 131 19.4.3 Preventing Wrong-Unit, Wrong-System, or Wrong-Train Errors .................................... 131 19.4.4 Showing Functional Demarcation of Controls .................................................................. 131 PIPING LABELS ...................................................................................................................... 134 19.5.1 Pipe Label Placement ........................................................................................................ 135 19.5.2 Pipe Label Size.................................................................................................................. 135 REPLACING LABELS ............................................................................................................ 135 19.6.1 Identifying Lost or Damaged Labels................................................................................. 135 19.6.2 Providing New Labels ....................................................................................................... 136 REFERENCED DOCUMENTS ............................................................................................................ 137 DOE-HDBK-1226-2019 Conduct of Operations Implementation viii EXHIBITS, TABLES AND FIGURES

Exhibit 3-1: Sample List of Inspection Items ......................................................................................... 16 Exhibit 3-2: Example of Operator Round Sheet ..................................................................................... 22 Exhibit 5-1: Phonetic Alphabet .............................................................................................................. 35 Exhibit 7-1: Sample Personal Statement ................................................................................................ 50 Exhibit 12-1: Example Log Entries .......................................................................................................... 77 Exhibit 13-1: Work Station ‘A’ Turnover Checklist ................................................................................ 89 Exhibit 15-1: Example Sign-Off Sheet ................................................................................................... 102 Exhibit 15-2: Example Required Reading Document Log ..................................................................... 103 Exhibit 15-3: Required Reading Sign-Off Matrix .................................................................................. 105 Exhibit 16-1: Example Daily Order ........................................................................................................ 109 Exhibit 16-2: Example Long-Term Order .............................................................................................. 110 Exhibit 18-1: Sample Operator Aid Approval/Audit Sheet .................................................................... 115 Exhibit 18-2: Sample Operator Aid Index Sheets .................................................................................. 116 Exhibit 18-3: Sample Operator Aids ...................................................................................................... 119 Exhibit 19-1: Label Information ............................................................................................................. 124 Exhibit 19-2: Example System Designator and Component Function Codes ........................................ 125 Exhibit 19-3: Samples of Component Labels ......................................................................................... 126 Exhibit 19-4: Labels Evenly Spaced Between Components .................................................................. 127 Exhibit 19-5: Labels Tied to Components .............................................................................................. 128 Exhibit 19-6: Labels Placed near the Component They Identify ............................................................ 129 Exhibit 19-7: Simple Escutcheon Plate Label ........................................................................................ 130 Exhibit 19-8: Graphic Escutcheon Plate Labels ..................................................................................... 130 Exhibit 19-9: Demarcation Lines on a Control Panel ............................................................................. 132 Exhibit 19-10: Color Patch Method on a Control Panel ........................................................................... 133 Exhibit 19-11: ANSI Practices for Labeling Piping Systems (ANSI/ASME A13.1-2015)...................... 134 Exhibit 19-12: Pipe Diameter Determines Label and Text Sizes ............................................................. 135

DOE-HDBK-1226-2019 Conduct of Operations Implementation ix ACRONYMS AND ABBREVIATIONS ALARA As Low As Reasonably Achievable ANSI American National Standards Institute AO Auxiliary Operator CFR Code of Federal Regulations CRO Control Room Operator DOE Department of Energy ECP Estimated Critical Position ES&H Environment, Safety and Health FEO Facility Equipment Operator G Guide HDBK Handbook LCO Limiting Condition for Operation NTC National Training Center O Order OJT On-the-Job Training OSHA Occupational Safety and Health Administration SSC Structure, System, or Component STD Standard DOE-HDBK-1226-2019 Conduct of Operations Implementation 1 1.0 SCOPE, PURPOSE, AND APPLICABILITY This Handbook provides supplemental information, explanations, examples, and background to support implementation of disciplined operations described in DOE Order (O) 422.1, Administrative Change 2, Conduct of Operations. Its purpose is to provide a broader understanding of conduct of operations concepts and help operators implement the requirements in DOE O 422.1. It is applicable wherever the Order is implemented. It does not contain any additional requirements. This Handbook replaces DOE Standards 1030-1045, the former Guides to Good Practices associated with former DOE O 5480.19, Conduct of Operations Requirements for DOE Facilities. This Handbook follows the organization of DOE O 422.1, with explanatory material for most of the conduct of operations topical areas. The Handbook does not discuss Technical Procedures because the Department adopted national consensus standards AP-907-001, Procedure Process Description and AP-907-005, Procedure Writers’ Manual, published by the Procedure Professionals Association and available free online at http://www.ppaweb.org. DOE-HDBK-1226-2019 Conduct of Operations Implementation 2 2.0 OPERATIONS ORGANIZATION AND ADMINISTRATION General Concepts Expectations. The organization and administration of facility operations supports safe, reliable, and efficient conduct of all facility activities. Management clearly defines and documents the organizational structure, administrative controls, and staff authorities, responsibilities, interfaces and chains of accountability. The organization should expect individual accountability in following policies and accomplishing goals. Conversely, personnel should have the opportunity to supply input to the policies, goals, and standards so that they have a sense of ownership of the facility. Given this opportunity, personnel will more willingly support standards and accept accountability. Role of Management. Management fosters successful operations by providing adequate resources, both material and human capital, for accomplishing tasks safely and efficiently. Restricting or delaying resources will only hinder operational effectiveness and may result in adverse consequences. Because personnel are one of the resources required to operate a facility, management should develop a plan to retain sufficient personnel to safely and efficiently operate the facility Conservative Decision Making. Management should endorse and model the concept of conservative decision making during all operations, and especially when faced with an unplanned event or condition. Personnel can apply the key principles when planning work or in response to unplanned events or conditions: • Follow approved procedures and operate in accordance with established safety and administrative programs.

• Comply with laws, regulations, permits, and local requirements. • Believe all indications, alarms, and other process inputs, but confirm them. • Engage supervision and appropriate support organizations early in the planning process or in the response to an unplanned event or condition. The key to the better decision making is better advanced planning that addresses potential abnormal or emergency events or conditions. However, when faced with making a decision for which planning was inadequate or non-existent, take action that appears to have little or no negative safety impact, tends to eliminate or reduce any uncontrolled energy, tends to reduce the rate of changing conditions, appears to reduce risk, and generally calms the situation. Above all else, when faced with an unplanned event or condition, take necessary actions to ensure the safety of the public, the workers, the environment, and national security. Monitoring of Performance. Monitoring facility operating performance is the best way to measure the facility’s effectiveness in accomplishing goals. Monitoring activities such as audits, reviews, tours, and self-assessments are part of an effective operating program to ensure that management has a clear picture of facility operations. Touring also allows management to interface with facility personnel and reinforce policies and goals. Audits, reviews, investigations, and self-assessments supply information for facility performance reports which document the operating performance of the facility. Facility performance DOE-HDBK-1226-2019 Conduct of Operations Implementation 3 reports enable tracking and trending of performance indicators and can be used to adjust goals. When operating problems or undesirable performance trends are noted during monitoring, timely corrective actions can redirect performance. Follow-up monitoring activities allow management to verify the effectiveness of the corrective actions. Management Training. Managers need training to effectively monitor operations and manage resources. A management development program will enhance the skills and knowledge of upcoming managers and supervisors, especially first-line supervisors who usually have no previous management experience. Communication. Management sets the standard and example of a proper safety attitude in all facility personnel. This is communicated through staff training in safe operating practices and the need to identify potential personnel hazards at their work stations. Management monitoring of performance, stressing safety and planning for safety, will reinforce safety awareness. A comprehensive safety program includes planning for safety alongside planning for work tasks so safety issues will be confronted before actual work is started. Planning will minimize work holdups and operating schedule delays that result from correcting safety issues. POLICIES Written policies are developed to ensure consistency in the organization and administration of facility activities. Good practices for policies include the following: • Facility-wide policies are developed for activities that affect the entire facility or that apply to multiple organizations (departments) within the facility. • Policies for activities specific to an organization are developed at the organization level. • Policies are written in a consistent format for effective development and implementation. The required format (procedures, checklists) is clearly defined.

• Policy documentation includes a description of the controls necessary to implement the policy and specifies when and how changes should be made to the policy. • Policies are easily understood and adequately address the subject matter. Therefore, standard names for facility work groups, positions, locations, systems, and equipment are established. • Lower-tier policies are consistent with those at the facility level to ensure continuity. • Policies that are no longer needed, or have been superseded, are canceled and removed from use. Personnel should understand their (a) authorities, responsibilities, and accountabilities associated with policies, and (b) interfaces with other organizations, such as engineering, maintenance, and security, especially during back-shifts and weekends. Once policies have been established, personnel should be instructed on their purpose, the benefits of following them, and the potential consequences of not following them. DOE-HDBK-1226-2019 Conduct of Operations Implementation 4 GOALS Thoughtful operating, environmental, and safety goals provide motivation for improvement, and the process of developing goals gives facility management an opportunity to involve workers and different groups in a cross-cutting effort that promotes communication and cooperation. Management can also focus attention on priorities and areas needing improvement through goal-setting. However, ill- considered goals can cause problems. Examples are goals of zero incidents, injuries, and occurrences that would encourage under-reporting, gaming the system, or obfuscation. Similarly, an arbitrary time for closing corrective actions for any event, regardless of complexity or scope, would encourage hasty closure and incomplete correction of underlying causes. These are attributes of excellent administration and organization programs in the area of goal setting: • Facility management develops goals that support established DOE and corporate goals. • All goals are coordinated among the various levels of management to ensure that they are consistent and mutually supportive and that they reflect the overall mission of the facility. • Goals are: o Realistic yet challenging—easily achievable goals should be avoided. o Measurable, allowing specific measurement of progress and clear determination of achievement. o Limited in number so that employees can effectively focus their efforts. o Controlled by the individual or group responsible for their accomplishment. o Clearly communicated, understood, and supported by all members of the responsible organization. o Composed of input from all levels in the organization responsible for achieving the goals. When the performance of support groups not reporting to the facility’s operations manager directly affects facility activities, the operations manager should review the goals of the support groups to ensure that they are consistent with, and complementary to, those developed by facility line management. Where appropriate, action plans should be developed for achieving goals. The action plans should specify the actions and responsibilities of each individual contributing to achieving the goal. Milestones should be established to track progress.

Management should periodically review progress toward accomplishing goals. Formal reviews should be conducted and results communicated to facility personnel. If results show a significant variance from the desired progress in achieving goals, management should review the action plan to ensure that it is adequate and being effectively executed and resources are sufficiently allocated. Based on the results of the review, changes to goals should be considered if operating or budgetary conditions have changed since the time the goals were established. Examples of operational goals: DOE-HDBK-1226-2019 Conduct of Operations Implementation 5 • Preventing unavailability of safety systems • Preventing personnel error • Maintaining exposure as low as reasonably achievable (ALARA) • Preventing lost facility capability (lowered output, less effective) • Preventing unscheduled facility shutdowns • Maximizing the timely completion of scheduled surveillances • Minimizing the amount of overtime • Maintaining complete staffing and training of shift positions • Minimizing or preventing waste, as appropriate • Minimizing the number of lighted annunciators and out-of-specification parameters Examples of management work environment goals: • Foster a working environment that encourages individual performance and teamwork to achieve its goals • Encourage an atmosphere conducive to constructive criticism and feedback • Respond to feedback and communicate the actions taken as a result of the feedback to encourage continued participation ACCOUNTABILITY The following are attributes of excellent organization and administration programs in the area of accountability: • Management ensures that all personnel understand the requirements for their assigned work stations and that they are being held accountable for their actions or inactions. However, personnel error is not the default cause of all issues. Breakdowns in systems, programs or culture are evaluated to address the root causes of events. • Personnel are instructed on the benefits of proper operating performance and the possible consequences of inappropriate operating performance. • An accountability program is established that defines the requirements for handling operating performance problems. • Personnel involved in any infraction of operating practices are counseled on the deviation. Those involved in significant or frequent violations of operating practices are counseled, retrained, or disciplined, as appropriate. DOE-HDBK-1226-2019 Conduct of Operations Implementation 6 • Personnel are held accountable for achieving their assigned goals. They are also recognized for achieving goals and for actions performed in support of goals. Accountability and recognition are administered in conjunction with the personnel performance appraisal system. • Supervisor performance appraisals and promotions include an assessment of operating performance. PERFORMANCE STANDARDS Performance standards are a good means to serve as the basis for accountable behavior. Comparing personnel performance to performance standards ensures consistency of accountability. Management should positively foster good performance by example. Management should communicate new or revised performance standards to all personnel so that everyone understands and supports the standards. Benefits for exceeding performance standards should also be communicated.

High performance standards for all activities are established by facility management. Management’s expectations for the level of performance should be clearly defined in management policies, procedures, and directives. Management should require uniform adherence to these high standards, with safe, reliable facility operation being the primary goal. Management’s day-to-day interactions with the work force should reinforce these performance level expectations. Facility activities should be conducted in a professional and businesslike manner. Management should develop a statement of desired performance that encompasses its expectations for safe and compliant operations. FACILITY RESOURCES The operations manager is responsible for identifying to DOE and corporate management the resources required for safe, reliable facility operation. The operations manager should also be responsible for providing lower-level managers with resources to accomplish assigned tasks. The resources provided include: • Sufficient personnel to limit overtime • Adequate permanent work areas to conduct facility activities • Necessary spare parts and equipment to operate and maintain the facility • Technical services in areas such as maintenance planning, engineering support, nuclear safety reviews, and interfacing with regulatory agencies • Administrative services, including contract administration, budget and cost control, and personnel administration • Personnel, facilities, and materials for training If a lack of resources compromises the ability to operate safely and efficiently within environmental, safety, and health requirements, the cognizant manager should take necessary actions to correct the problem. DOE-HDBK-1226-2019 Conduct of Operations Implementation 7 HUMAN RESOURCES A facility staffing plan, tied to the organization’s long-range goals, should be developed to anticipate future personnel needs. The plan should be reviewed periodically and updated to verify adequacy. Elements of this long-range plan should include anticipated changes in staffing levels, potential succession plans for key management positions, job rotation for developing professional and managerial experience, and a forecast of personnel needs, considering losses resulting from attrition. The long-range staffing plan should allow sufficient time for individuals to turn over job responsibilities and maintain continuity in performance. In conjunction with continuity planning, staffing plans should also include contingency planning for the loss of key personnel. Hiring should be regulated so that newly hired personnel meet the established minimum standards. The human resource group should emphasize retaining and developing employees. Personnel should understand management policies and goals concerning career progression, management and professional development activities, performance appraisals, and the compensation and reward system. Human resource policies and programs should be effectively communicated to all personnel and monitored periodically to determine their effectiveness. Managerial, supervisory, and technical skills should be developed through training, project assignments, and rotating job activities. Personnel performance should be evaluated through regular performance appraisals, and promotions should be based on performance and ability. Policies should be written to identify and deal with behavioral problems, including drug and alcohol abuse. MATERIAL RESOURCES

The facility should have sufficient material resources to conduct operations. Management should ensure that consumable materials such as administrative supplies, oils, and chemicals are replenished to support facility operations and that non-consumable materials such as repair parts and new equipment are available to minimize the effect on facility operations. In addition, management should ensure that all safety equipment required to perform operations, such as hearing protectors and chemical spill kits, is available and ready for use. MONITORING OPERATING PERFORMANCE Policies should be established to monitor and document operating performance with the primary goal of improving operations. To accomplish this, managers should be knowledgeable of personnel performance, facility activities, and facility conditions within their areas of responsibility. Managers should be actively involved with the work activities under their cognizance to assess performance and reinforce management standards. Monitoring of facility activities should ensure that they are conducted according to appropriate standards, policies, and procedures and that problems are promptly identified and corrected. There should be a high degree of management involvement and observation in day-to-day facility activities; a manager’s routine should include frequent tours of the work place, including discussions with personnel. Management and supervisors should directly observe operations frequently, providing feedback as needed. Monitoring by management should also include a program for monitoring facility performance through reporting and trending selected parameters. The monitoring program should provide operational data that are trended, analyzed, and forwarded to appropriate levels of upper management. More DOE-HDBK-1226-2019 Conduct of Operations Implementation 8 guidance on monitoring performance is provided in DOE O 226.1, Implementation of Department of Energy Oversight Policy. Managers and supervisors should clearly understand their responsibilities for setting a professional example and should monitor and correct problems related to failures to adhere to facility policies and procedures. 2.8.1 Management Tours Periodic tours of facility areas are part of the manager’s routine. Some of the criteria for establishing periodicity include the risk associated with operations and the amount of operational activities occurring. For example, tours of warehouses may be conducted less frequently than tours of production lines. Monitoring also includes actual observations of work in progress. The practice of scheduling blocks of time for conducting such observations has proven effective. An inspection tour of the facility is a walk-around by a facility operator or supervisor to gain an appreciation of facility status and identify conditions that may require further action. The person may use a checklist or guide to assist in covering all desired areas and may document items for follow-up or corrective actions. Inspection tours normally do not require formal logs or recorded instrument readings. Management tours should cover all areas, including hazardous and unmanned areas within the specific manager’s purview. Tours should occur during all operating shifts. Besides observing personnel performing their specific jobs, managers should observe safety conditions and practices, radiological conditions and practices, material conditions, and housekeeping to ensure that expected standards are maintained. Before conducting a tour, managers may review lessons learned from in-house and industry operating experience so they can check to see if similar conditions or circumstances exist at their facility.

Deficiencies noted during tours should be documented and provided to responsible managers and supervisors for correction. If items are corrected during the tour, they should also be documented for information purposes. Follow-up tours should be carried out to ensure that timely and effective corrective action has occurred. Routine activities that should be monitored include: • Operational evolutions or work in progress to observe radiological protection and safety practices, procedural compliance, work habits, teamwork, and communications • Shift turnovers in the control area and other work locations to observe formality, thoroughness, and continuity of activities • Planning and scheduling • Training activities, including content, methods, and control Some non-routine activities that should be monitored include: • Implementing new or revised procedures DOE-HDBK-1226-2019 Conduct of Operations Implementation 9 • Coordinating actions in different locations, such as fire or other emergency preparedness drills for the facility • Completion of maintenance activities or work by other areas for material condition, housekeeping, and cleanliness Management may assign other groups, such as quality assurance, to periodically monitor, audit, review and assess operating performance. These activities can assist managers and supervisors in identifying good and bad practices and correcting problems. Data obtained from tours should be evaluated and integrated into an overall assessment of facility condition and status. In addition to tours, other processes should be used to provide management with accurate information regarding facility performance, such as audits, reviews, investigations, and self- assessments. 2.8.2 Performance Reports Performance reports should be issued regularly. Updating reports monthly has been most effective in balancing timely analysis and minimizing administrative burden. Specific performance indicators should be analyzed for trends and early initiation of corrective action. A graphic format is preferable to compare actual results, facility goals, and overall industry progress over time. A management summary that highlights and explains reasons for undesirable trends enhances the usefulness of the reports. The summary should cover problem areas, needed improvements, and actions taken to effect improvement. Responsibilities should be assigned for collecting and analyzing data for each indicator. A coordinator should be assigned responsibility for developing, producing, and distributing the report. Reports should be tailored to the particular needs of the appropriate recipient. Potential recipients include contractor management, DOE management, and federal, state, and local agency representatives. Guidelines should be developed to determine which performance indicators apply to each level of management. For example, the operations manager’s report could provide general performance indicators, other selected indicators, and an executive summary section noting unusual results and significant trends. A brief explanation of the causes of adverse trends and the corrective actions to be taken should also be provided. Reports to other managers should provide the information in the operation supervisor’s report and other selected indicators applicable to their areas of responsibility.

Periodic reports addressing the status of programs and action items should also be developed. An integrated management information system may be used to provide the information for these reports. Items near completion should be monitored to ensure that due dates will be met. When items become overdue, they should be reviewed, appropriate actions taken, and the items rescheduled. Closeout methods should be streamlined to prevent completed items from being carried forward. 2.8.3 Management Assessment of Operating Performance Management should evaluate performance and trends for lessons learned and good practices. Operating problems should be evaluated and corrective actions should be taken to improve the performance of DOE-HDBK-1226-2019 Conduct of Operations Implementation 10 operations. Negative performance trends evidenced in reports should be assessed to determine root causes. Corrective actions can then be developed and implemented. CORRECTIVE ACTIONS Corrective actions should address causes instead of symptoms. Corrective actions should be developed by appropriate personnel, including those tasked with implementing the actions. Managers and supervisors should provide input to the corrective action completion schedule, which should consider the complexity, available resources, regulatory requirements and limitations, and other functional considerations rather than arbitrary periods. The situation may require immediate compensatory actions and/or intermediate corrective actions to safely operate while making long-term corrections. Facility line management should approve corrective actions and ensure implementation in a timely manner. Input from organizations, such as quality assurance, should be considered when determining actions in response to deficient conditions identified by these organizations. When developing corrective actions, management should consider whether to conduct an extent-of-condition review to determine if the issue or condition is isolated or may affect other systems, processes, or facilities. A widespread condition may indicate fundamental issues with management systems. Management should track corrective actions to completion. More guidance on corrective actions is provided in DOE O 226.1, Implementation of Department of Energy Oversight Policy. Managers and supervisors should be held accountable for timely and effective implementation of corrective actions. Delays in completing approved corrective actions should be reported to the manager who assigned the actions. An escalation process will provide attention from higher levels of management to problem areas for which corrective action continues to be ineffective. Follow-up on the effectiveness of corrective actions is an integral part of management’s monitoring program. Follow-up monitoring should determine if the immediate condition has been corrected and the root causes eliminated. This may require monitoring the immediate corrective actions, followed by subsequent monitoring to determine whether recurrence of the condition has been eliminated. Depending upon the results of follow-up monitoring, the item can be closed or new corrective actions formulated. MANAGEMENT TRAINING Management training and professional development should be conducted to ensure the facility is staffed by highly capable and experienced individuals. This training should enhance the managerial and technical skills of facility personnel, such as written and oral communications and specialized technical subjects. The unique needs for each level of management and for each individual should be considered in the management development program.

Management should assess the management needs of the facility and define job prerequisites, including necessary training, experience, professional certifications, and skills development. Criteria should be established for selecting personnel to participate in management development. The training and job rotation assignments that constitute management development activities should be defined and communicated to participating personnel. Adequate resources should be available to support the training and career-broadening assignments necessary for developing personnel. DOE-HDBK-1226-2019 Conduct of Operations Implementation 11 A major goal of the management development effort should be to have qualified personnel in the facility organization ready to be promoted to the next level of management. PLANNING FOR SAFETY Facility management and personnel should assume direct responsibility to always conduct activities and functions in a manner that emphasizes safety and minimizes personnel exposure and the potential for challenges to safety limits. When unexpected conditions that are outside the scope of normal conditions arise, personnel should always exercise conservative judgment and obtain management guidance before proceeding, unless immediate action is required to place the facility in a safe, stable configuration, protect human life, or prevent significant environmental damage. 2.11.1 Planning Each facility should have guidelines that describe safety planning requirements for all operational activities. These guidelines should explain the role of safety analysis reports, job safety analyses, and the handling of safety matters. Operational activities should be reviewed to ensure that they address safety planning. This review may be conducted by a formal safety review committee, which will ensure that all aspects of safety, including local, state, and federal requirements, are properly addressed. The accompanying documentation should identify personnel protective equipment, system alignments, and operator qualifications needed for safe operation. Safety planning should occur as part of the work planning process. Safety analysis reports and job safety analyses, if available, should be used in planning. If these analyses are not available, performing one or both may be useful to determine the safety and health risks at the facility or for a given job. These two tools will help when determining safety and health risks for existing, new, or modified facility operations. 2.11.2 Training All operations personnel should understand safety planning, including requirements and procedures for worker and public protection, for each phase of the operation. This understanding should be imparted to operations personnel via facility training programs that adequately describe the importance of safety planning and the processes by which safety planning is instituted in the facility. DOE-HDBK-1226-2019 Conduct of Operations Implementation 12 3.0 SHIFT ROUTINES AND OPERATING PRACTICES General Concepts Scope. This section of the handbook addresses normal operations of facilities: operator assumption of duties, actions during their period of duty, and professional conduct that results in suitable attention to facility conditions. This topical area also covers the authority to operate equipment and the status control that is essential to controlling and coordinating facility activities, effective equipment monitoring and data recording, and promptly notifying supervisors of unusual or unexpected situations. This notification process ensures proper attention is given to changing and off-normal conditions. Industrial safety practices, including radioactive and hazardous material protection, are also addressed.

Formality and Ownership. Industrial, military, and commercial utility operating experience has shown that professional conduct and sound operating practices result in a safer, more efficiently run facility. Two key principles to professional conduct and sound operating practices are formality and ownership. Formality is performing all duties according to approved practices and procedures. This contributes to consistency of operations and business-like atmosphere. Ownership is an attitude whereby individuals accept total responsibility for maintaining their assigned work station in the best possible operating condition. Safe Operations. The responsibility for safely operating a DOE facility rests with the on-shift personnel. Safe operation is accomplished by properly trained and qualified personnel adhering to procedures, technical safety requirements, and sound operating practices. The authority and responsibility for facility operations should be vested in the cognizant supervisor or manager and be transferred only through formal turnover to a qualified relief. Lines of Authority. Establishing clear lines of authority and responsibility for controlling facility operations, including equipment and systems, will enhance facility operations. The authority for operating certain equipment and systems may be given to specific work stations; however, the supervisor maintaining ultimate responsibility for the equipment should be notified prior to changes in status. During emergencies, operators should be authorized to take the necessary actions to place the facility in a safe operating or shutdown condition. In this case, the change in status would be reported to the supervisor after the fact. Abnormal Conditions. During special tests, evolutions, or abnormal conditions, personnel should be aware that the responsibility and authority to decide corresponding operating conditions, system alignments, or equipment manipulations rests fully with the on-duty supervisor. This supervisor should not permit any individual to bypass or overrule his/her operational judgment without bringing the matter to the attention of a higher operational authority. Monitoring Program. An effective equipment and area monitoring program will help ensure that abnormal conditions and adverse trends are detected in a timely manner. The program should address the equipment and areas to be monitored and the monitoring frequency. This monitoring or inspecting can be accomplished through operator inspection tours. A list of areas and associated equipment under an operator’s control should be used to assist personnel in performing inspection tours. DOE-HDBK-1226-2019 Conduct of Operations Implementation 13 Recording Data. Round inspection sheets (round sheets) or electronic devices (tablet computers with appropriate applications or dedicated logging devices) should be used to record equipment parameters during inspection tours. Recording these parameters will assist personnel in detecting trends and serve as a historical record of facility operations. Trending is necessary to detect abnormal conditions or adverse trends so appropriate action can be taken before equipment malfunction occurs. Establishing procedures which specify when to take readings, how to record readings, how to identify out-of-specification readings, how to make corrections on the round sheets, and what actions to take for out-of-specification readings will improve the accuracy, completeness, and neatness of round sheets. Facilities should establish procedures for personnel qualifications for watch stations, and to have qualified personnel make inspection tours and record round sheet data. Procedures should also specify a program for developing and maintaining round inspection sheets. Training on these procedures will ensure the proper round sheet information is communicated to all affected personnel.

Personnel Practices. Sound operating practices also include a strong emphasis on personnel safety practices required to perform a job. Following personnel safety practices should keep personnel alert to detect, prevent, and mitigate all possible hazards. The correct safety practices should be demonstrated to personnel during their initial training and during continuing training, and reinforced continuously by all personnel while on the job. Safe work station practices also include minimizing exposure to personnel hazards. STATUS AWARENESS AND OPERATING PRACTICES The primary function of an operator is to monitor and control all assigned equipment safely within the applicable facility guidelines. DOE Order 422.1 discusses “Control of Equipment and System Status” and identifies specific facility programs that are designed to aid in safe reliable operation. In addition to those programs, routine operating practices should ensure that the responsible personnel are continuously aware of the status of assigned equipment, and all operations are properly authorized, performed, and monitored. This section describes the routine practices that lead to effective operation. AUTHORITY TO OPERATE EQUIPMENT Designated supervisors direct the overall operation of the facility. The following are good practices in this area: • The overall operation of the facility is directed by the operations manager. Day-to-day direction of operations may be delegated to a shift or daily operations supervisor. The chain of responsibility and authority is documented and available to all staff. • The operations manager ensures that only trained and qualified personnel operate facility equipment and determines, with the assistance of the Training Department, work station training and qualification requirements. • As part of developing details of authorized operators and operations, facility work stations and the equipment at each work station are reviewed to ensure all work stations and equipment are identified. • Personnel are informed of the equipment they are authorized to operate and under what conditions the equipment can be operated. This is done during the training and qualification process. DOE-HDBK-1226-2019 Conduct of Operations Implementation 14 • Support group and subcontractor personnel are informed of the facility’s policy for operation of equipment. This is done during a general training session before support or subcontractor personnel start work. • Facility policies specify the activities that may normally be performed by an operator without requesting permission. Examples of activities include the following: o Pumping specified sumps o Adjusting controls such as throttle valves and rheostats necessary for maintaining stable process conditions o Testing local alarm panel lights and sounds • Personnel are instructed that safety to personnel, facility, and environment take priority over facility production regardless of the situation. • Non-routine operation of controls are not performed without specific approval by the cognizant supervisor. However, during emergencies, operators should take the actions necessary to ensure the safety of personnel, facility, and the environment. After placing the process in a stable condition, the relevant supervisors should be immediately informed.

• Personnel are informed of all activities affecting equipment at their work station. Support personnel and subcontractors should contact the responsible person to obtain written or verbal authorization before commencing work, especially if the work will require changing present work station status. • To ensure that facility equipment is properly operated at all times, guidance may be established allowing only facility-qualified personnel to operate equipment, even during testing and maintenance evolutions. NOTIFICATION OF STATUS CHANGES Operating personnel should be aware of the status of equipment through inspection, conducting checks, and tours of equipment and work areas. The following are good practices in this area: • A notification chain or network is established to ensure that status information is communicated to the appropriate personnel. • Policies or procedures are established for the timely notification of status changes. Specifics that should be addressed include who needs to be notified, what information needs to be communicated, and the method of communication. • Personnel notify their supervisor of all changes in work station status, especially abnormal and unexpected situations. • Supervisors, in turn, notify facility management. Any person affecting the condition of a piece of equipment not under his/her responsibility for any reason should be authorized to change/affect the equipment, and should notify the responsible person before changing the equipment’s status, and again afterwards, to inform that status has changed. This would DOE-HDBK-1226-2019 Conduct of Operations Implementation 15 include starting up or shutting down equipment as well as adjusting controls. In addition, if an individual finds an unsafe facility condition, he or she should take immediate actions consistent with training and procedures. Generally such actions involve reaching an emergency contact, and in some cases such as fires, sounding an alarm. OPERATOR ROUNDS An operator round is an inspection tour conducted as part of a shift routine, and normally is done on a schedule. Operator rounds normally include reading and recording instrumentation, and recording pertinent observations such as operating mode or equipment configuration. Operator rounds are documented in logs or round sheets. Management approves round sheets, including the frequency and time of inspections and readings. Responsibility for maintaining round sheets should be designated by management. The following are good practices in this area: • Periodic work station rounds are performed as part of an operator’s shift routine. These are in addition to the work station walkdowns performed as part of the turnover process. • Operator rounds are frequent and detailed enough to ensure that the status of equipment and condition of the work station is known. Each facility should decide the optimum frequency for conducting rounds. • The frequency and detail of rounds take into account the safety risk associated with the work station. In addition, facility maintenance engineers, equipment vendors, and experienced operators should provide input when determining round frequency. • The minimum round frequency should be at least once per shift. However, the operations manager may designate specific areas to be inspected less frequently because of adverse radiological or equivalent personnel safety conditions, or more frequently if problems have been encountered in the past. In these cases, the operations manager should specify an alternate schedule.

• Facility security concerns do not override personnel safety assessment duties. • Operator rounds in radiation and hazardous material areas are carefully reviewed, planned, and coordinated with the ALARA program to minimize personnel exposure. These areas still require rounds, but the frequency and duration should strike a balance with personnel exposure. Rounds in these areas should be coordinated with other duties and responsibilities, such as system alignments or equipment startup and shutdown to minimize exposure. Operators can also minimize exposure to radiation or hazardous materials by installing microphones and surveillance cameras or using binoculars for observation of hazardous areas. • Personnel conduct a thorough tour of their work station at the designated times. They should make a tour early in the shift, before attending to other duties, to become familiar with the condition and status of equipment at the work station. During the tour, personnel should inspect equipment to ensure that it is operating properly or, for standby equipment, that it is fully operable. To ensure the tour is effective and efficient, personnel should remain inquisitive, following up questions about their work station and remaining alert to what they see, hear, smell and touch on the tour. DOE-HDBK-1226-2019 Conduct of Operations Implementation 16 • Personnel are instructed on proper round techniques during initial training and qualification. The amount of instruction should depend on the complexity of the work station. Training should include how to read parameter-indicating devices, how to check equipment temperature, and how to check for system leakage. In addition, training should include information on acceptable equipment and system operating parameters (such as temperature and pressure) for all approved operating conditions. • Each facility establishes guidance for handling deficiencies found during rounds. At a minimum, abnormal conditions should be reported to the appropriate supervisor and documented in the narrative log. Each facility should also decide which types of problems can be immediately corrected by personnel before notifying their supervisors, and which types should be immediately reported to a control area so that supervisors can initiate corrective action. Employees should be informed on the procedures for reporting potential safety hazards to management. • Personnel are encouraged to clean up trash and oil, grease, and water spots discovered during rounds to prevent small problems from deteriorating into safety or operational hazards. • Problems that might distract personnel from their normal duties are reported, and then handled by other personnel. • Equipment deficiencies that cannot be immediately remedied are documented according to the facility’s work control system. Guidelines and information related to work control systems are contained in DOE G 433.1-1A, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B. 3.4.1 Area Inspection Personnel should perform a thorough inspection of their work station and note any deficiencies. Personnel should document and correct deficiencies (see also deficiency correction items in section 3.4, Operator Rounds). Approved supplemental lighting such as flashlights should be used to inspect dimly lit work station areas. A checklist may be used to ensure that all items are inspected, and may be used with Round Sheets (Section 3.4.3) to aid in area inspection consistency. A list of some possible inspection items is contained in Exhibit 3-1.

Exhibit 3-1: Sample Area Inspection Checklist Items Sample Area Inspection Checklist Items General Area • Satisfactory area cleanliness • Vent and drain caps installed • Electrical box covers installed and tight • All hoses and cords properly stored or installed • Equipment/component labels installed and readable • Insulation installed and undamaged • Noise and vibration levels normal • Equipment access satisfactory and unhampered by scaffolding or other material DOE-HDBK-1226-2019 Conduct of Operations Implementation 17 Sample Area Inspection Checklist Items • Minimum steam, oil, and water leakage • Building integrity (physical integrity of structures) • Safety tags properly completed, adequately attached, and authorized (spot check) • Maintenance tags applicable and accurate (spot check) • Fire barriers intact • No fire hazards present • Radiation/contamination areas clearly identified • Hazardous material storage areas clearly identified • Floor drains open and accessible • Facility lighting adequate and operative. Instrumentation and Control Panels • Power supply available • Alarms not in alarmed condition • Recorders operating properly • Indications within normal ranges (bands) • Status lights operable • Alarms operable Motor Control Centers (MCCs) • Breakers properly aligned • Breaker enclosure temperatures normal • No unusual smells • Breaker position indicating lights operating properly • Charging springs charged and control power available • Breaker trips reset • Transformers • Liquid levels normal • Temperatures and pressures normal Wires and Cables • Disconnected wires and jumpers properly identified • Hold-down straps secure • Grounding devices intact Doors and Gates • Fire doors closed and not blocked • Other doors closed and locked as required • Doors and gates close properly Sumps • Liquid levels in normal range • Sump pumps operating as required DOE-HDBK-1226-2019 Conduct of Operations Implementation 18 Sample Area Inspection Checklist Items • No oil or organics in sumps Pumps • Suction and discharge valves properly aligned • Suction and discharge pressures in normal range • Gland seal leakage in normal range Safety Hazards • Ladders properly positioned or stored • Gas bottles properly positioned or stored • Use of proper equipment, such as non-sparking tools, ladders • No water or steam leakage • No water, oil, or other possible slip, trip, or fall hazards on walking surfaces • No open electrical panels • No potential electrical hazards • Scaffolds properly erected • General compliance with facility’s industrial safety program requirements • Open trenches or work areas roped off and posted • Machine guards and shrouds properly installed 3.4.2 Equipment Status Checks The status of equipment (“status” meaning operating, standby, work-in-progress, or out-of-service) is determined to ensure proper response to any problems that may arise. Some possible status checks are as follows: • Operating Equipment: o Motor and pump housing temperatures are within acceptable limits o System temperatures, pressures, and flows are within acceptable limits o Proper belt and coupling tightness o System leakage is within acceptable limits o Noise and vibration is within acceptable limits o Ventilation system intakes clear of debris o Equipment grounding straps connected o Power consumption (Amps, Fuel Oil) • Standby Equipment: o Proper valve/circuit breaker lineup (spot check) DOE-HDBK-1226-2019 Conduct of Operations Implementation

19 o Oil levels are within acceptable limits o No unusual noises, smells, temperatures, or pressures • Out-of-Service Equipment: o Boundary components in correct position (spot check) 3.4.3 Operator Round Sheets Operator round sheets are an effective method for providing personnel with guidance on the extent to which equipment and areas should be inspected during rounds. Recording equipment parameters during tours provides a record of equipment performance that permits short-term trending for timely identification and correction of undesirable trends and equipment problems. This record can also be used to reconstruct events leading up to unusual occurrences or system malfunctions. Round sheets also facilitate the turnover of equipment status and are an effective aid in the training and qualification of new personnel. While the following discussion focuses on paper documents, round sheets may also be implemented on portable computers (tablets). Electronic round sheets offer the advantages of reduced administrative overhead to process paper, electronic routing for review and archiving, and potential automatic trending and statistical analysis for maintenance and reliability performance measures. When electronic round sheets are used, the system should include provisions for providing devices (tablets), version control, electronic signatures, supervisory review, data backup to preclude unacceptable data loss, and, if the round sheets also incorporate narrative logs, features to support electronic logs. • Round sheets should be comprehensive, including all areas within the purview of a particular work station and all important parameters for equipment. Round sheets assist personnel in identifying abnormal and emergency situations. Equipment parameters should include minimum and maximum values or expected operating ranges to enable personnel to recognize abnormal readings quickly. • When equipment is not in an operating status, the associated parameter blocks should reflect the status of the equipment. This may be accomplished by the use of codes or notes and annotation in the remarks section. • Safety limits derived from Technical Safety Requirements should be highlighted. • The program should ensure that all round sheets are current and correctly maintained. • Round sheets should be developed and approved by the operations manager, obtaining input from cognizant experts such as vendors and maintenance engineers. • Work station personnel and supervisors should supply the input for the sequence in which the parameters appear on round sheets to ensure that tours are conducted efficiently. Equipment and corresponding parameters should be listed on round sheets in a logical order that closely parallels the order encountered during a normal round. • If changes to equipment and systems will require modifications to the round sheet data, the sheets should be updated to accommodate the new data before the affected system or equipment is returned to operation. DOE-HDBK-1226-2019 Conduct of Operations Implementation 20 • Changes to round sheets should also be communicated to the appropriate work station personnel. If round sheets change frequently, they should have an approval-for-use signature, revision number, and effective date (Exhibit 3-2). Round sheets may be developed for temporary systems and equipment, depending on the risk to facility operation, proposed length of use, and complexity of configuration. In such cases, the review and approval process stated above should be followed. Personnel should be instructed on the new round sheets before they use them.

A master copy of each round sheet should be kept for updating and restocking the sheet as needed. The program for maintaining round sheets should incorporate a means for verifying that the sheets being used are current and correct. As round sheets are revised, outdated ones should be discarded. Blank round sheets should be kept in a place accessible to personnel such as a file cabinet easy to locate. During the revision process, it may be necessary to use round sheets with pen and ink changes until the master copy can be updated and revised round sheets distributed. Policies and procedures should address how this situation is handled and personnel should be instructed on their use. Each round sheet should have enough room to record 24 hours of data or at least a normal shift’s worth of data. If more than one data sheet is needed to record all work station data, the round sheets should be numbered. The space for recording data should be large enough to allow the full range of values to be recorded legibly. In addition to a place for recording data, round sheets should have the applicable work station printed on the sheet to prevent confusion. There should also be a space for recording the date and the times the rounds were conducted. This information will help when round sheets are reviewed or used to reconstruct events in a chronological order. Round sheets may include a narrative section if a separate work station narrative log does not exist. Personnel should use the narrative section or the log to document major evolutions, causes of abnormal conditions, and actions taken to correct abnormal conditions. Facility administrative policies and procedures should address the method for identifying out-of- specification parameters. Parameters exceeding the specified maximum or minimum values should be circled in red or otherwise highlighted on the round sheet. If a recorded parameter exceeds the highest or lowest acceptable value, or exceeds a minimum or maximum value, the causes of the abnormal indication should be promptly investigated and reported to the appropriate supervisor, manager, or control area. Supervisors should be kept aware of the situation and ensure that timely corrective action is taken. The cause and status of the abnormal parameters should be explained in the round sheet’s narrative section or the log. Data should be recorded on round sheets at the times specified. When round sheet data is not obtained within one hour of the specified time, the actual time the data was obtained should be noted on the round sheet. The reason for the recording delay should be annotated in the log or the narrative section of the round sheet and reported to the appropriate supervisor. The recorded data should be legible and should be recorded with an ink pen dark enough to be copied. If an incorrect entry is made on the round sheet, the mistake should be corrected. Facility policies and procedures should provide guidance for making round sheet corrections. One method for correcting a mistake is to make a single line through the mistake, initial and date the lineout, and write the correct data in the same block as the mistake. Since it is DOE-HDBK-1226-2019 Conduct of Operations Implementation 21 impossible to predict when a person will make a mistake, personnel should use only part of the block to record data. This will allow the person to make neat corrections within the same block. Correction fluid and other opaque agents should not be used to make corrections.

Personnel should know equipment parameters, where to find indicating devices such as voltmeters, the scale of the indicating devices, and expected normal values. Personnel should understand the significance of each value recorded on the round sheet, whether recorded by him/her or by a previous person. This is particularly true of out-of-specification readings. The round sheet data should be reviewed by a supervisor each shift to help identify trends or abnormal readings and to verify that the data has been properly recorded. This will require the supervisors be at least as knowledgeable of the subordinate work stations as the assigned personnel. Supervisors should periodically monitor assigned personnel performing rounds to ensure that comprehensive tours continue to be conducted. (Exhibit 3-2 is an example of an Operator Round Sheet.) DOE-HDBK-1226-2019 Conduct of Operations Implementation 22 Exhibit 3-2: Example of Operator Round Sheet Page No. 1 of ______ Date________________ Fu el O il St or ag e Ta nk 1 A (In ch es ) Lu be O il St or ag e Ta nk 1 A (In ch es ) W as te O il St or ag e Ta nk 1 A (In ch es ) Po ta bl e W at er St or ag e Ta nk 1 A (In ch es ) D C C on tro l P ow er Vo lta ge (V D C ) AC C on tro l P ow er Vo lta ge (V AC ) Ba tte ry V ol ta ge (V D C ) Lu be o il Pu m p D is ch ar ge P re ss ur e (P SI G ) Lu be O il R et ur n Te m pe ra tu re (º F) Fu el O il Pu m p D is ch ar ge P re ss ur e (P SI G ) Fl oo r S um p Le ve l (In ch es ) C oo lin g W at er Su pp ly T em pe ra tu re (º F) C oo lin g W at er P um p D is ch ar ge P re ss ur e (P SI G ) M ai n R oo m A ir Fl ow (S C FH ) Au xi lia ry R oo m A ir Fl ow (S C FH ) M ai n R oo m A m bi en t Te m pe ra tu re (º F) Maximum 60 38 25 50 28 130 28 40 180 75 24 30 30 95 High Normal 54 32 26 125 26 35 150 62 70 25 Low Normal 20 15 22 115 22 30 110 58 40 20 Minimum 10 8 5 20 110 20 251 90 55 5 5 50 Time 0000 0200 0400 0600 0800 1000 1200 1400 1600 1800 2000 2200 Shift Status Checks Shift Shift N D E N D E Main Room Emergency Equipment Check    Supervisor review    Auxiliary Room Emergency Equipment Check    Fire Suppression System Check    1 The lube oil pump automatic shutdown occurs at 24 psig. Main Room Safety Check    Auxiliary Room Safety Check    Remarks Always record operator name and shift turnovers. DOE-HDBK-1226-2019 Conduct of Operations Implementation 23 RESPONSE TO INDICATIONS Personnel should treat instrument indications as accurate unless there is reason to suspect a problem. In situations of doubt, personnel, environmental, and facility safety take priority over facility production. Ignoring an unusual reading because the person believes an instrument is faulty can cause abnormal conditions to go undetected. Personnel should use other indications, if possible, to confirm unusual readings. Redundant indicators, backup indications, or other process parameters could be used to verify an unusual reading. Personnel should also be alert for trends or a deviation from expected trends, such as cooling water temperatures rising with no increase in heat load. Prompt action should be taken to investigate the cause of abnormal or unusual indications to allow timely corrective action. When malfunctioning or inaccurate instruments are discovered, they should be tagged and repaired promptly.

RESETTING PROTECTIVE DEVICES Protective devices are mechanisms that protect a piece of equipment, a system, the facility, personnel, and the environment. Examples include circuit breakers, fuses, low-level pump shutdowns, or engineered safeguard system trips. When an automatic protective action occurs, the cause should be known, understood, and corrected, and proper authorization granted, before resetting the protective devices. Good judgment and specific guidance are necessary when resetting protective devices. Management should (a) provide such guidance and procedures, (b) specify the types of protective devices that can be reset without formal investigation, and (c) state how many times a device can be reset before investigating the problem. For example, if a protective device is reset and trips for a second time for no apparent reason, the device should not be reset until the cause is known and corrected. If a protective device causes an operational shutdown, a thorough investigation should be performed. SAFETY PRACTICES 3.7.1 Use of Safety Equipment Personnel should be instructed on the importance of adhering to the facility’s industrial safety program. In addition, they should be informed of the potential safety hazards in their work spaces. Ladders or other approved means such as a man lift or scaffold should be used to access equipment located in the overhead when permanent steps or catwalks are not available. Personnel should not climb or walk on facility components and insulation that are not designated as walking or stepping areas. Each facility should have a policy and checklist for working on or around energized equipment, considering the type and amount of energy. General considerations for energized work include: • Work on or around energized equipment should be performed only when there is no other recourse. Examples include emergency situations, adjustments that can only be made while equipment is operating, or corrective maintenance where an equipment failure, such as inoperative switchgear, that makes it impossible to determine whether the equipment is fully de-energized. • Personnel required to work under these conditions should be trained on the policy and the use of the checklist. DOE-HDBK-1226-2019 Conduct of Operations Implementation 24 • Personnel should exercise suitable precautions when entering or working on or around energized panels or equipment. Examples include proper PPE, standoff distances, and ensuring that electrical panel closures are securely fastened before making breakers operable to energize equipment. This reduces the potential for personnel injury if a fault causes breaker arcing during operation. Personnel working on or around high-pressure or high-temperature systems should exercise suitable precautions: • Facilities should have policies for these situations and train personnel who might encounter them. • Policies should include provisions for working with high pressure systems and around pressure relief devices. • Policies should include provisions for PPE when working around high temperature systems. 3.7.2 Personnel Exposure Personnel should be trained to follow good personnel protection practices and minimize their exposure to radiation, chemicals, electromagnetic fields, toxic materials, high heat, high noise levels and other personnel hazards. In particular, personnel should observe the following requirements: • Adhere to all posted requirements and observe proper practices and precautions.

• Wear proper hearing, eye, head, foot, and respiratory protection in designated areas to prevent injury. • Use prescribed monitoring instruments. • Know their own exposure levels and minimize additional exposure. • Know the proper use of radiation work permits and safe work permits. • Know inhalation limits, where applicable. • Report protection deficiencies or hazards promptly to supervisors. In addition, take immediate actions to reduce or correct the hazards in accordance with facility procedures. • Inform environment, safety and health personnel before performing evolutions or activities that may change personnel hazard conditions in the facility. • Inform personnel working within the work station of the personnel hazards present at the work station. Factors contributing to personnel exposure should be determined and actions taken to minimize exposure. Supervisors should periodically review the status of exposure for personnel under their supervision. An individual’s current exposure should then be compared to the relevant limit so a determination can be made if any additional controls are necessary to prevent personnel from exceeding allowable limits. 3.7.3 Operating Bases An operating base should be established and approved by management for each work station. Each operating base should be equipped with office equipment that allows personnel to maintain necessary DOE-HDBK-1226-2019 Conduct of Operations Implementation 25 procedures and references and to conduct administrative duties. Communication equipment should be available at the operating base. The operating bases should be located conveniently within the area of responsibility, with an alternate area designated in the event the normal area cannot be used because of maintenance or construction. Management should account for the noise level, radiation, and hazardous material conditions before approving an area since turnovers and other duties will be performed here. 3.7.4 Potentially Distracting Written Material and Devices On-shift operators may read training bulletins or technical manuals when shift duties permit. Reading of other materials not related to work should be limited to break periods taken away from the duty station. Personal phone calls, texting or emails should be forbidden at the work station except in emergencies. Operators should not engage in web browsing, watch or listen to video or music, play electronic or other games, or any other non-work-related applications or functions on smart phones, tablet computers, electronic smart watches, or other devices. Management should post rules on distractions at every work station. DOE-HDBK-1226-2019 Conduct of Operations Implementation 26 4.0 CONTROL AREA ACTIVITIES General Concepts Importance of Control Area Operations. The basic aim of a conduct of operations program is to minimize the likelihood and consequences of human fallibility or technical and organizational system failures. The program’s disciplined, structured operations seek to ensure professional, businesslike behavior by all personnel in all operations and areas, and this program is of the utmost importance in the control area. Large facilities may have a central control area for coordinating overall facility operations and several other areas designated as control areas for specific portions of the facility. Similarly, small facilities may have only one designated area that controls operations. The good practices provided in this section of the handbook can be used to enhance facility operations in any type of control area.

Control Area Purpose. The control area of a DOE facility is the focal point of safe and efficient facility operations. It is a central operating base and coordination point for important facility activities. A control area may range in size from a desk or computer terminal to a room of instrumentation and control panels. Although some of the parameters displayed in the control area may also be displayed locally, the control area provides a central area for displays, communications equipment, local and remote equipment controls, and an operating space for directing normal operations or casualty response. A professional atmosphere should be maintained so activities performed in the control area remain focused on the operation of the facility. A properly organized and structured control area should enhance safe and efficient operations. Good Practices: the following are good practices in this area: • Maintain a clean, quiet, neat and orderly environment to enhance control area professionalism, make it easier to operate, and make a positive statement about the personnel working there. • Limit the number of personnel in the control area to minimize noise, confusion, and possible distractions and to promote a formal, disciplined atmosphere. Control areas are generally small and can become noisy and distracting to operators unless the number of occupants is controlled and kept to the minimum necessary. • Monitor the instrumentation and control panels in the control area to provide personnel with current facility operating information and a means of detecting abnormal conditions before they become problem situations. • Limit or eliminate ancillary responsibilities assigned to the control area personnel. o When ancillary responsibilities are assigned, they compete with the primary responsibilities of monitoring and operating the instrumentation and control panels for the time and attention of control area personnel. o Overburdening control area personnel with ancillary responsibilities will distract them from properly monitoring facility parameters. o A structured program for assigning ancillary duties will prevent this situation DOE-HDBK-1226-2019 Conduct of Operations Implementation 27 CONTROL AREA ACCESS Facility policies should state access requirements for control areas. In many facilities, the control area is a marked-off portion of the facility, not a separate walled control room. Control area practices apply to both situations. In special cases involving security concerns, access may need to be more rigidly enforced through security policies and procedures. Access requirements include: • Asking permission to enter • Designating who may grant permission • Establishing time periods and operating conditions when personnel may or may not enter The policies also indicate the positions of personnel who have authorization to enter the control area without permission. Such personnel might include the Operations Manager or the on-duty Shift Supervisor. Personnel are to be instructed to adhere to procedures and restrictions for entering a control area. As a reminder to personnel, post the access requirements at control area entrances. Access to control areas that are without walls or partitions may require additional guidance, such as communicating from outside the control area into the area and what constitutes entry into the control area.

Access to the control areas of a facility should be limited to personnel on official business. Access should not be granted when additional personnel would obstruct the ability to monitor or control. Since information transfer in the control area is crucial to safe operations, during periods of turnover, access should be restricted to oncoming control area personnel needed for the turnover to reduce distractions and noise. During abnormal or emergency operations, entry should be limited to personnel attending to the situation. Reports should be communicated from outside work stations through work station communication equipment instead of attempting to access the control area. Access for non-work-related reasons should be prohibited. Necessary facility-related technical and administrative business should be conducted at a location that compromises neither control area personnel attentiveness nor the professional atmosphere. Access to a control area should be controlled by a designated individual, normally the lead control area person (cognizant manager, cognizant supervisor, or lead operator) who grants permission to enter. All facility staff should know who is designated to grant access. Control areas may contain one or more control panels. These panels should be clearly identified as “at- the-controls” areas. Control boundaries should be marked in an obvious way, for example, by using colored tape on the floor or chains limiting access. Facility policy should state who may grant permission to enter the “at-the-controls” areas. Permission should be obtained from this person before entry. A list of personnel who have authorization to enter, based on their job duties and responsibilities, should be established so that these persons can access the area without acquiring additional permission. Such persons might include control panel operators and control area supervisors. Access for additional persons into “at-the-controls” areas should be restricted to those personnel who have a work-related need to be in the area. DOE-HDBK-1226-2019 Conduct of Operations Implementation 28 PROFESSIONAL BEHAVIOR A formal, professional atmosphere is necessary in the control area. Only activities essential to supporting facility operation and activities authorized by management should be conducted in the control area. Control area personnel should direct their full attention to monitoring and controlling their facility operations. Potentially distracting activities such as internet surfing or texting should be prohibited. Personnel should not linger in the control area; they should exit the control area when their business is complete. Non-work-related discussions should be minimized. MONITORING THE MAIN CONTROL PANELS Control area personnel monitor instrumentation and control panels to ensure that the facility is operating safely. They should be alert and attentive to indications and alarms. They should frequently scan control panel indications, with emphasis on trending and detecting problem situations early, and taking prompt action to determine the cause of abnormalities and correct them. Facilities should develop procedures for timely alarm response actions. Control area personnel should inform the lead control area person of each alarm and take actions to identify and correct its causes. Operators should take all reasonable action to clear alarming conditions and monitor abnormal conditions resulting from the alarm more frequently until they have returned to normal.

During evolutions, operators should monitor affected instrumentation and control panel indications more frequently until indications stabilize. The number of concurrent evolutions affecting instrumentation and control panel indications should be limited so that personnel can detect and properly respond to abnormal conditions. If necessary, the lead control area person should stop one or more of the evolutions or assign additional personnel to assist in monitoring. The lead control area person should ensure that monitoring of non-affected indications continues during these situations. If computer or automated monitoring and control systems are used, they should be monitored for proper operation. In addition, manual response should back up these systems. For example, if a variable exceeds an action setpoint and the action does not occur, personnel should initiate manual action. In these cases, control area personnel still have the responsibility to monitor and control facility operation. OPERATION OF CONTROL AREA EQUIPMENT Duties and responsibilities for control area personnel during normal, abnormal, and emergency situations should be well defined. Administrative policies and procedures should specify the personnel requirements for operation of control area equipment. Operation of control area equipment should be performed only by authorized personnel. Equipment to be controlled and monitored by each control area person should be specified. Control area personnel should receive training on their duties and responsibilities. A list of personnel authorized to operate control area equipment should be maintained in the control area. Trainees who operate control area equipment should be supervised and controlled by the person who is authorized to operate that equipment. The person supervising should not allow the trainee to perform operations without direct supervision. DOE-HDBK-1226-2019 Conduct of Operations Implementation 29 The equipment controls in a control area may operate emergency equipment or remote equipment in hazardous areas such as high radiation zones. In either case, unauthorized operation of controls may hinder facility operation, stop facility operation, or create an adverse environmental, safety, or health situation. These situations can be avoided by identifying who has the authority and responsibility to operate control area equipment. CONTROL AREA ANCILLARY DUTIES Ancillary duties of control area personnel should not affect their ability to monitor and operate instrumentation and control panels. Their administrative duties should be minimized. Activities such as preparation of lockouts and tagouts, review of maintenance work activities, assisting maintenance groups, required reading, or housekeeping should be conducted in a manner to minimize the effect on their primary duties and responsibilities. Administrative activities should not normally be performed by personnel within the “at-the-controls” area. Facility policies and procedures should address ancillary duties and responsibilities. Within the control area, the lead control area person should have the responsibility for ensuring that ancillary duties do not compromise primary job duties. Ancillary duties should not be performed during off-normal or emergency situations. These situations should command the complete attention of the control area personnel. Control area personnel should be instructed on the importance of not allowing their ancillary duties to interfere with their primary duties and responsibilities.

DOE-HDBK-1226-2019 Conduct of Operations Implementation 30 5.0 COMMUNICATIONS Communication problems have caused many adverse situations in DOE facilities. Inadequate verbal communication practices can be identified as a causal or contributing factor in human performance- related events. Principal areas in which poor verbal communications practices can cause problems include shift turnover, pre-job briefings, and during job performance. Facilities can reduce the contribution of poor communications practices to adverse situations by ensuring that verbal communications are conducted in a formal and disciplined manner and that communication systems are properly used. Formality in communication is especially important when personnel safety is involved or complex evolutions are performed. Just as there are different messages to be communicated, there are different methods of audible communication: face-to-face, party-line, point-to-point, and public address announcements. Each method requires the use of specific techniques to effectively communicate the necessary information. This section presents communication techniques that have proved successful in the commercial industry, government, and the military. EMERGENCY COMMUNICATION SYSTEMS The facility emergency communication system should provide for prompt alerting to all personnel for facility emergencies. The public address system should normally be used to make emergency announcements. Alternate methods, such as flashing lights, personal pagers, and individuals dedicated to notifying in person should be used to alert personnel in high-noise areas. The emergency communications system should also allow personnel from any point in the facility to make emergency communications to the control area (throughout section 5.0, “control area” is the location where central communications originate). Designated facility telephone numbers should be established to report concerns or problems. Numbers should be easy to remember, such as: • 111 (Security problem) • 222 (Radiological concern) • 333 (Fire, personnel injury, abnormal or emergency operational condition Channel 3 on the public address system, while normally used for operations, may also be used for emergency communications. Direct telephone communication lines should be provided between the control area and the emergency response facilities to improve emergency response to accidents. These communication links should only be used during a declared emergency event, during authorized testing, or when authorized by the shift supervisor. Specific guidance for the use of these communication links should be in the site emergency plan and implementing procedures. TESTING COMMUNICATION SYSTEMS Policies and procedures should address testing of communication systems. At a minimum, emergency communication systems should be tested periodically to ensure that they are operable, and it is advisable DOE-HDBK-1226-2019 Conduct of Operations Implementation 31 to test all communication systems. Testing periodicity for certain emergency communication systems is generally governed by federal and state requirements. The test periodicity for non-emergency communication systems should correlate to the risk associated with not being able to use the communication system. In addition, a test of a communication system should be performed prior to conducting procedures that require use of the system, and anytime system operability is in doubt. A physical inspection of all communication equipment, system connections, transmitters, and antennas should also be performed.

A check of all facility areas should be periodically performed to make certain that facility personnel can be alerted to emergency conditions. As part of the operability check of the emergency communication system, personnel throughout the facility should make reports to the control area, acknowledging an acceptable test. The following external emergency communication systems/paths should be periodically tested: • Communications between the facility and DOE • Communications between the facility and state and local government agencies • Communications between the control area and offsite facility support centers, if they exist COMMUNICATION SYSTEMS Communications systems should be implemented to ensure that control areas can quickly contact personnel throughout the facility. In addition, these systems should allow contact between personnel outside of the control area. 5.3.1 Party-line Communication Systems A party-line communication system allows more than two work stations to communicate on the same communication line at the same time. If a party line communication system is used, the sender should check the line to verify that the line is clear prior to establishing communications. This should prevent “cutting in” on other conversations. In addition, the sender and receiver identification should be included in each message. To gain access to a party line in the event of an emergency, the phrase “Silence on the line, this is an emergency” should be used to clear the line for priority communications. Example party-line radio communications concerning filling and venting of Service Water piping: Auxiliary Operator (AO) to Outside Facility Equipment Operator (FEO): “Outside FEO, this is the AO. Vent service water header one Bravo using valve Sierra Whiskey one seven.” Response by Outside FEO: “AO, this is the Outside FEO. Vent service water header one Bravo using valve Sierra Whiskey one seven.” Acknowledgment by the AO: DOE-HDBK-1226-2019 Conduct of Operations Implementation 32 “Outside FEO, this is the AO. That is correct.” 5.3.2 Point-to-Point Communication Systems A point-to-point communication system allows only two work stations to communicate on a communication line at one time. If a point-to-point circuit is used, the sender and receiver identification need only be established on the initial contact. Example point-to-point telephone communications concerning a Waste Evaporator Distillate Tank: Radwaste Facility Equipment Operator (FEO) to Control Room Operator (CRO): “CRO, this is the Radwaste FEO. The Waste Evaporator Distillate Tank is full. Request to pump the Waste Evaporator Distillate Tank to Waste Holdup Tank Alpha.” CRO to Radwaste FEO: “Radwaste FEO, pump the Waste Evaporator Distillate Tank to Waste Holdup Tank Alpha.” Response by Radwaste FEO: “Pump the Waste Evaporator Distillate Tank to Waste Holdup Tank Alpha.” Acknowledgment by CRO: “That’s correct.” 5.3.3 Public Address Systems Public address systems may be used to update facility personnel of the status of an abnormal or emergency condition, changes in facility status, or major facility events either in progress or anticipated. Administrative policies and procedures should address the effective control of the public address system. Public address systems, if used, should be designed to be heard throughout a facility. When using the public address system, senders should speak slowly, deliberately, and in a normal tone of voice. Since the system is heard throughout the facility, the sender normally need not specify a receiver. An exception to this rule would be during casualties when the control area would direct actions using the public address system.

Announcements of abnormal or emergency conditions should be made twice. If an audible alarm signal is used in conjunction with the public address system to warn personnel of an abnormal or emergency condition, the alarm should be activated once, before the announcement. The alarm signal will alert personnel to listen for the message that follows. Where noise levels are excessive, other means of communicating emergencies should be considered, such as flashing lights. Repeat-backs and the identification of sender and receiver may be omitted. When using the public address system to announce remote starting of major equipment, the announcement should be made, followed by a short pause, and then the equipment started. The pause is required to allow personnel to move away from the equipment. DOE-HDBK-1226-2019 Conduct of Operations Implementation 33 If other communication systems (such as telephones) can be used to access the public address system, the control area or management should have the capability to override those systems. The use of the override should be authorized only for emergency announcements and authorized tests. Policies and procedures should clearly define who may use the public address system from these other sources, and in what circumstances. COMMUNICATION EQUIPMENT Facilities should ensure that adequate communication equipment is accessible to meet notification requirements. They should evaluate their potential for public endangerment or harm to the environment, and determine what alternate methods of notification are needed in the event of primary communications equipment failure. High-risk facilities commonly use dedicated phone lines or data links as the primary method for emergency notifications, backed up by ordinary phone lines, radio networks, cellular phones, and other methods. Low-risk facilities may be adequately served by ordinary phone lines, supplemented by paging devices or cellular phones if notifications may be required for off-shift or roving personnel. 5.4.1 Portable Radios Portable radios systems have at least one station that is remote and portable, and usually includes at least one fixed base station. In radio systems, all stations are capable of direct communication with other stations and do not require each device to connect to a radio network to connect with other devices the way a cellular telephone system does. They are an effective means of communicating with personnel who tour large work stations, especially when the tour takes them away from stationary communication equipment. Portable radios used in normal facility operations may also be used in an emergency to communicate with mobile units. Prior to assigning a portable radio to a work station, it should be tested from all areas within the work station. This test will ensure that communications can be established, especially during emergency situations. Because of structural interference from walls, large equipment, and support structures, power output of the radio may be insufficient to communicate. In this situation, consideration may be given to raising the output power of the radio. If a portable radio cannot be used from specific areas within a work station, alternate communication equipment is needed. Since portable radios are a large contributor to control area noise levels and radio frequency interference, their use needs special attention. A list of all electronic cabinets that are susceptible to radio frequency interference should be established and posted with signs prohibiting use. Portable radios should not be keyed within approximately 10 feet of posted electronic cabinets.

Facilities may dedicate specific channel frequencies for different organizations. For example: • Channel 3 for operations department personnel and for other personnel when reporting abnormal operational conditions to the control area (In this case the control area should continuously monitor channel 3.) • Channel 4 for dedicated support groups, such as maintenance and facility services • Channel 5 for security force personnel DOE-HDBK-1226-2019 Conduct of Operations Implementation 34 5.4.2 Sound Powered Phones Sound powered phones allow communications between two or more specific stations without the need for external power. Sound powered phones may be used with party-line or point-to-point communication systems. Since sound-powered phones require no external power, they can be used during power outages. When available, this is the preferred communication equipment for routine testing, post-maintenance testing, or special operational situations that require coordination through communication. 5.4.3 Pagers Pagers may be provided to operating personnel working in areas where the public address system cannot be heard. Pagers that vibrate and can be felt may also be used in work areas with high noise levels. Pagers may also be appropriate for areas where security considerations preclude the use of two-way radios or cellular phones. 5.4.4 Wired Telephones Wired telephones, those used for normal telephone communication, are an acceptable form of facility communications. Since telephone lines already exist in most facilities, spending additional money to install extra systems may not be needed. One drawback to standard telephone systems is that they are normally point-to-point systems and a sender may get a busy signal when trying to make an emergency communication. Alternate emergency communication devices should be used to preclude this situation. 5.4.5 Cellular Telephones Cellular telephones may provide adequate communications for some operations, especially for outdoor operations in undeveloped areas, such as remote monitoring wells or airborne sampling points, isolated equipment, or for roving or mobile services. Facilities should bear in mind special considerations, including adequate signal coverage, equipment expenses, battery life, and whether to use personal or organizational mobile devices. Cellular telephone networks can be overloaded and fail due to call volume in emergencies, and may not provide viable emergency communications for operations or emergency response. 5.4.6 Data Network-Connected Devices For facilities with wired or wireless data networks (Ethernet or Wi-Fi), communications devices may include computer workstations or tablet devices with text, voice, or data communications applications. If a facility uses such systems, the communications plan should include provisions for system integrity from cyber-attacks and unauthorized uses, ensuring system reliability and availability under upset conditions, and backup communications methods in the case of a system failure. This type of communications system has special considerations since it may be subject to “internet of things” attacks and vulnerabilities, software-related failure modes, operators loading unauthorized and distracting applications, and other information technology issues. If tablet devices are cellular data capable, they can provide text, instant message, or e-mail communications via a cellular network as well as a data network, but could suffer the same network overload failures as cellular telephones during emergencies.

DOE-HDBK-1226-2019 Conduct of Operations Implementation 35 VERBAL COMMUNICATIONS ATTRIBUTES All of us depend on verbal communication for the exchange of information or instructions. Depending on the job, an individual may be responsible for transmitting or receiving information in the form of operating instructions, feedback on the results of operations, reports of operational data, or emergency warnings and instructions. Whether through face-to-face or electronic communication, information has to be (a) transmitted and received, (b) accurate and complete, and (c) most importantly, understood. Verbal instructions should be clear, concise, and correct. Before sending instructions, a sender should plan what to say and then say it to him/herself to ensure that it has all of the message attributes. Then the sender should say it to the intended receiver. 5.5.1 Clear Operational communications need to be free from ambiguity. Messages that contain words with multiple meanings or similar sounds may be confusing. Using alternate words may help, for example, say “raise” and “lower” instead of “increase” and “decrease.” Another example is using “shut” instead of “close” because “close” sounds similar to “open,” particularly in a noisy environment. Slang and expletives should not be used. Equipment noun names and numbers should be used, as in “open feedwater pump discharge valve one six.” When communicating alphanumeric information, both sender and receiver should use a phonetic alphabet to ensure clarity and minimize the potential for misunderstanding. Exhibit 5-1 is a suggested phonetic alphabet (the International Radiotelephony Spelling Alphabet). This practice may be used together with approved and well-known standard abbreviations such as “ACW” for auxiliary cooling water. Exhibit 5-1: Phonetic Alphabet A Alfa B Bravo C Charlie D Delta E Echo F Foxtrot G Golf H Hotel I India J Juliett K Kilo L Lima M Mike N November O Oscar P Papa Q Quebec R Romeo S Sierra T Tango U Uniform V Victor W Whiskey X X-ray Y Yankee Z Zulu DOE-HDBK-1226-2019 Conduct of Operations Implementation 36 Only facility-approved terminology, equipment identifications, and abbreviations should be used. A list should be developed of standardized and facility-specific terminology to be used during communications. This list should include the terms, applicable written abbreviations, and verbal acronyms. 5.5.2 Concise Operational communications should be as brief as possible. The key is to keep the message as short as possible while still effectively communicating the information. Using approved verbal acronyms should keep messages short. This is especially important during emergencies, for example, when a work station reports an emergency condition to the control area. However, when using the public address system to announce emergencies such as a fire, the use of acronyms should be avoided. 5.5.3 Correct The message should be specific to ensure that the correct unit or component (Alfa or Bravo; 1 or 2) is identified. Noun names and equipment numbers should be used together to ensure that the message is properly transmitted and received. FORMAT Operational communication should use a standard format to ensure consistency and effectiveness. The suggested format is: • Establish communication • Transmit message • Repeat-back message • Confirm repeat-back ESTABLISHING COMMUNICATIONS

Before transmitting a message, communications are established between the sender and the intended receiver. The sender should identify the intended receiver and then him/herself. Either formal names or work station titles may be used as identification; however, work station titles are preferred. Example: “Control Room Operator, this is the Auxiliary Operator.” This lets the person receiving the message know who is directing an action or requesting information. When answering a phone or radio, the receiver should identify the work station followed by his/her title or name. Example: “Control Area, Control Room Operator.” This lets the sender know if he/she has contacted the intended location and person. DOE-HDBK-1226-2019 Conduct of Operations Implementation 37 5.7.1 Transmitting the Message Once communications have been established, the message text can be transmitted. The message attributes presented earlier should be used during transmission. Example: “Building Operator, this is the Control Area Operator. Open Cooling Water Suction Valve, Foxtrot two five.” The receiver should make notations when receiving complex or lengthy communications to ensure that important information is not forgotten. For example, operators should write down valve numbers and final valve position when directed to reposition valves in a specific sequence. This ensures that actions are correct and in the required sequence. If the receiver does not understand the message, he/she should ask the sender to repeat or rephrase the message. If the message is an abnormal or emergency condition report, personnel should exercise additional care to speak slowly, clearly, and accurately. These reports should include the nature, severity, and location of the problem. During abnormal or emergency reports, communication lines should be kept open for subsequent reports. If conditions require immediate evacuation, contact should be reestablished with the Control Area after evacuation is complete. 5.7.2 Repeat-back In operational communications, the receiver should repeat the message back to the sender. This is especially important when receiving instructions involving operation of facility equipment to assure the sender that the instruction is correctly understood. A verbatim repeat-back is preferred, although paraphrasing may be used as long as the intent of the message is clearly stated. If notations of equipment, numbers, and positions were made during the original transmission, the repeat-back should contain the same information. Example: “Control Area, this is the Building Operator. Understand, open Cooling Water Suction Valve, Foxtrot two five.” The sender listens carefully to repeated messages to ensure the receiver understands the message. If the receiver repeats the message incorrectly, the sender should immediately correct the receiver by saying “Wrong” and repeat the message until properly received. 5.7.3 Confirmation After the repeat-back, the sender should confirm or correct the receiver. The absence of the confirmation step may result in miscommunication because the receiver may have misheard the instructions and repeated erroneous information. A lack of response by the sender may be misinterpreted as silent confirmation that the repeated message was correct. However, the receiver should not carry out the action until confirmation is received. Example: “Building Operator, this is the Control Area Operator. That is correct.”

DOE-HDBK-1226-2019 Conduct of Operations Implementation 38 5.7.4 Report-backs Another part of operational communication is the report-back. When directed to perform a task, a report should be made concerning the completion of the task or difficulties encountered as soon as possible. The appropriate supervisor or control area operator should acknowledge this communication so that the sender is confident the report was received. 5.7.5 Briefings for Operators Briefings can provide information to operators during normal and emergency operating conditions. Information should be concisely transferred among the operators by well-organized briefings. Managers can ask questions or review assignments to verify that the operators understand the information presented, after completion of the briefings. During facility operation, the briefings should be held before facility activities such as surveillances, maintenance troubleshooting, or component manipulations. Briefings should be conducted frequently during abnormal or emergency operating conditions, to confirm that operators understand facility conditions and emergency procedures. 5.7.6 Face-to-Face Communication Face-to-face communication is performed when the sender and the receiver are in the presence of each other. The sender’s title may be omitted from the message; however, the sender should ensure that the intended receiver receives the message when two or more people are in the immediate area. The use of sign language in lieu of audible communications should only be performed in accordance with prescribed guidelines. Example: Face-to-face operator communications to increase Service Air Header pressure: Control Room Operator (CRO) to Facility Equipment Operator (FEO): “Facility Equipment Operator, raise Service Air Header pressure to one five zero pounds.” Response by FEO Operator: “Raise Service Air Header pressure to one five zero pounds.” Acknowledgment by CRO: “That’s correct.” DOE-HDBK-1226-2019 Conduct of Operations Implementation 39 6.0 CONTROL OF ON-SHIFT TRAINING General Concepts Need For Hands-On Training. On-shift training provides the mechanism for applying the knowledge and skills learned in the classroom, through self-study, and in the laboratory to operating the facility. On- shift training activities are required to provide the trainee with hands-on experience, because neither an outstanding classroom presentation of fundamentals and facility-specific knowledge nor specific laboratory exercises sufficiently prepares an operator to operate a facility safely and efficiently. Purpose of Controls. Since on-shift training allows unqualified personnel the opportunity to operate the facility, controls are to be implemented during the performance of on-shift training to ensure that the facility is operated safely and reliably. These controls should prevent accidental, inadvertent, or incorrect manipulation of components, equipment, or systems by trainees. Both on-shift instructors and trainees should clearly understand the controls that regulate the performance of on-shift training.

OJT Methods. On-shift training is commonly conducted using the instructional method of on-the-job training (OJT). This form of training has proven very effective in qualifying trainees. OJT addresses the steps necessary to successfully train an individual in the performance of a task, but does not specifically address the controls of the training process and their relationship to the operation of the facility. This Conduct of Operations Handbook section addresses the formal, disciplined controls that are required in the operating environment to ensure that on-shift training is conducted safely and efficiently. For information concerning the OJT process, refer to the National Training Center’s (NTC) Training Best Practices website: https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx. The web site archives a number of training-related Handbooks formerly in the DOE Technical Standards Program, plus other training techniques. Content of Training. On-shift training includes: • Activities that a trainee performs in the operating environment under supervision • Training activities that are performed in the operating environment as part of the operator continuing training program The primary purpose of on-shift training is to allow personnel to acquire first-hand experience by performing or observing operations, special processes, tests, inspections, and other work activities. Need for Qualified Instructors. In addition to the necessary administrative controls, personnel qualified both as instructors and as operators are also important to the successful control of on-shift training for the following reasons: • Competent instructors ensure quality and consistent training of potential operators without compromising the safety and reliability of facility operations. https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx DOE-HDBK-1226-2019 Conduct of Operations Implementation 40 • Trainees receive the best and most consistent training concurrent with meeting the production goals of the facility when the instructors are proficient in performing their assigned operational duties while conducting on-shift training. • These instructors are best able to interrupt the training when a compromise to safety becomes evident. ADMINISTRATIVE CONTROLS FOR THE CONDUCT OF ON-SHIFT TRAINING The Training Department should specify the requirements for a formal on-shift training process to ensure consistent performance of on-shift training activities. Administrative policies or procedures should be established to govern trainee prerequisites, instructor qualifications, and training program coordination. Cognizant line managers and supervisors should be involved in determining training program content, establishing performance standards, and implementing the program through proper coordination. Involving managers and supervisors helps provide resources, technical input, and commitment to schedules. This involvement also provides the managers and supervisors with insight to the qualification process and its relation to the work assignment. 6.1.1 Trainee Prerequisites Prior to beginning the on-shift training process, the trainee should be taught fundamental technical and administrative knowledge. The fundamental technical knowledge should be derived from a task analysis to ensure that the training is appropriate for the actual job performance. The Training Program Handbook DOE-HDBK-1078-94, Training Program Handbook: A Systematic Approach to Training, and DOE O 426.2, Personnel Selection, Training, Qualification, and Certification Requirements for DOE Nuclear Facilities, contain procedures and information to systematically determine training needs.

The trainee should understand safety practices and procedures, work station responsibilities and authorities, and administrative procedures. The instructor should ensure that the trainee understands basic information affecting attention to detail, attitude toward the job, and awareness of the work station’s relationship to plant reliability and safety. 6.1.2 Coordination of Training in the Operating Environment On-shift training activities should be scheduled based on the operating schedules of the facility. This allows trainees to take full advantage of the facility’s schedule, minimizing effects on the facility and maximizing the effectiveness of training. In order to maximize training within the operating schedule, the Training Department and the Operations Department need to integrate their respective schedules. In addition, policies and procedures should assign responsibility to a specific individual for coordinating on- shift training. For the purposes of this Handbook, the person with this responsibility will be referred to as the training coordinator. For facilities using a rotating shift or multiple-shift crews, this responsibility may be delegated to one training coordinator per shift. Using one person per shift should increase training efficiency because training can be rescheduled as necessary to take advantage of unusual or infrequent activities that might arise during a shift. DOE-HDBK-1226-2019 Conduct of Operations Implementation 41 6.1.3 Approval of the Operator Qualification Program The operator qualification program should be approved by the operations manager and the training manager to ensure that both operational needs and training requirements are satisfied. Changes to the program should be coordinated with the Training Department. 6.1.4 Instructor Qualification To ensure that training is effectively performed in the operating environment, on-shift training should be conducted by specially selected, qualified operators. The selection should be based on items such as communication skills, technical knowledge, and the ability to impart hands-on experience to trainees. This may require dedicated on-shift instructor training for operators. At a minimum, this training would cover special instructor techniques on avoiding misoperation or damage to equipment by, for example, inadvertently throwing a breaker. Training Department personnel or Operations line management may conduct on-shift training as long as they remain current in their operator qualifications. The requirements for maintaining operator proficiency should be specified in facility procedures. Potential instructors should complete an instructor internship prior to conducting training in the operating environment. During an instructor internship, a potential instructor would conduct on-shift instruction while under the observation of a qualified instructor or member of training department management. This allows the candidate to acquire supervised practical training similar to mentoring. An instructor internship is designed to verify and strengthen the instructor candidate’s instructional abilities within the operating environment. It also gives a candidate’s supervisor the opportunity to monitor and evaluate the candidate’s instructional and technical competency in a specific training setting.

A qualified instructor should train the instructor candidate on the facility’s on-shift training requirements. To ensure consistency in training, items to be performed should be outlined on a qualification card. When the qualified instructor is satisfied that the instructor candidate has demonstrated adequate instructional skills, the qualified instructor should sign the qualification card and recommend the individual for a final evaluation. The cognizant supervisor should conduct a final evaluation of the instructor candidate’s instructional abilities and competencies during an actual on-shift training session. If the instructor candidate is evaluated as satisfactory, the supervisor should sign the qualification card and ensure that the individual’s name is entered in the appropriate documents (such as personnel/training records) for tracking qualifications. For more information on instructor training, refer to archived DOE-HDBK-1001-96, Guide to Good Practices for Training and Qualification of Instructors on the NTC resources site at https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx. SUPERVISION AND CONTROL OF ON-SHIFT TRAINING The classroom, self-study, and laboratory training portions of the qualification program should provide a trainee with the knowledge and basic skills to perform tasks at a work station. The on-shift training portion of the qualification program should provide the trainee with actual hands-on operation of the facility while under instruction. Unlike training conducted in a simulator or training facility, on-shift training causes the trainee to affect the status of facility operations. For this reason, the on-shift training https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx DOE-HDBK-1226-2019 Conduct of Operations Implementation 42 is closely supervised and controlled in a way that prevents the trainee from accidentally operating a component, piece of equipment, or system that might cause danger to personnel, to the environment, or adversely affect the operation of the facility. 6.2.1 Pre-Training Briefing Prior to beginning an on-shift training session, the instructor and the trainee should meet to discuss the upcoming session. This meeting is designed to set the ground rules for the session, discuss the events that will take place, and advise the trainee of the information he or she will be responsible for. This requires that the instructor and the trainee have full knowledge of the scheduled training items. 6.2.2 Setting the Ground Rules Before beginning on-shift training, the trainee should understand what is expected. A standard for control of on-shift training that can be easily understood and followed by the trainee and the instructor should be defined in the administrative policies. This should provide a stable on-shift training environment. All trainees should understand that they are actually operating the facility when performing a task. Unlike training that is performed in a training center or simulator, an incorrectly operated valve, switch, or control may adversely affect a process, an experiment, or the operation of the facility. Trainees should have a clear understanding of what they are about to do, why they are doing it, and the expected effects their actions will have on the equipment, system, or process. If the trainee cannot answer these questions, he/she should get clarification prior to performing the actions.

The trainee should also be aware of the mobility limitations and should remain in sight of the instructor at all times so that the instructor can maintain control of the trainee during the hands-on situation. A good practice is to have the trainee stay within arm’s length of the instructor when the trainee operates equipment. Although it is the responsibility of the instructor to supervise the trainee, it is the trainee’s responsibility to be in a position to be supervised. Trainees should also understand that any official round sheets or narrative logs that they use to record facility parameters or remarks are formal documents. Although it is the instructor’s responsibility to ensure that all data or remarks are correctly recorded, it is the trainee’s responsibility to correctly and accurately record the information in a legible, precise, and understandable manner. 6.2.3 Previewing Scheduled Training The on-shift training schedule should contain a list of all training that is scheduled for a given period. The training coordinator is responsible for developing the schedule. Discussing the scheduled training prior to its occurrence will help the instructor determine how well the trainee is prepared and may also help the trainee gain an understanding of the relationship between upcoming training activities and the operational schedule. If the scheduled training conflicts with the operational schedule, the training coordinator should be contacted to modify the training schedule. DOE-HDBK-1226-2019 Conduct of Operations Implementation 43 6.2.4 Knowledge Spot Check The instructor may use the pre-training briefing to determine if the trainee has the required knowledge and skills to perform the training tasks. If the trainee does not have the required knowledge and skills, the instructor should not let the trainee operate equipment; however, the trainee may be allowed to observe the tasks to gain more knowledge. Information on suitable methods for conducting a knowledge spot check can be found in the OJT Guide to Good Practices (NTC Training Best Practices Website, item 0, sub item 04). 6.2.5 Supervising On-Shift Trainees An on-shift training session allows a trainee to operate portions of the facility from a specific work station. Because each action performed by the trainee actually changes the status of the facility, the trainee is closely supervised to prevent an adverse situation from arising. Careful and competent supervision of a trainee will prevent mistakes that could lead to an adverse situation. 6.2.6 Placing the Trainee at Ease Immediately prior to beginning a period of on-shift training, the instructor should try to put the trainee at ease. Although the trainee may have had some prior basic instruction, the trainee may not have had experience with this particular type of work. The trainee should be fully briefed on all aspects of operations prior to the start of hands-on performance. 6.2.7 Commencing Training Since an on-shift training session allows a trainee to operate equipment at a particular work station, the trainee should perform a turnover with the instructor and also sign into the narrative log, if applicable. The trainee should annotate in the log that he/she is assuming the duties and responsibilities for the work station under instruction. (See also sections 12.0, Logkeeping, and 13.0, Operations Turnover.) 6.2.8 Control of Trainees

Instructors are responsible for maintaining control of trainees assigned to their work stations. A trainee is not permitted to operate equipment without direct instructor supervision. Prior to allowing a trainee to operate equipment, the instructor should: • Have the trainee review the procedures and reference documents required for performing the task. • Have the trainee explain the action to be performed, including any cautions and notes. • Have the trainee physically identify the component to be manipulated. • Assume a position to observe the trainee’s action and to prevent the trainee from incorrectly operating the equipment. These steps should be followed every time a trainee operates equipment until the trainee has demonstrated proficiency in performing the action. Even after a trainee has shown proficiency for a task, the instructor should not become complacent. The trainee may still not be aware of all problems that could occur. DOE-HDBK-1226-2019 Conduct of Operations Implementation 44 Since the instructor still has the ultimate responsibility for the work station, he/she should remain in a position to intervene. 6.2.9 Communications During Training Since communications are an important aspect of operations, proper communication techniques should be reinforced during on-shift training. The need to pass information to operators or supervisors is an essential part of operations in all facilities. This is especially true if the position requires communicating with other work stations during the normal performance of work station activities. The trainee should perform the proper communications as part of the training. The instructor should monitor all trainee communications, correct the trainee when necessary, and not allow incorrect information to be transmitted. See Section 5.0, Communications, of this Handbook for additional information. Specific factors that can help promote successful communication training are: • Using dual communication devices (walkie-talkies, handsets, phones) • Requiring the trainee to say the information to the instructor prior to the actual communication • Correcting errors in trainee communications immediately 6.2.10 Suspension of Training Suspension of training is a formal cessation of the training session that may or may not be resumed depending on the situation. When this is necessary, the instructor should inform the trainee that training is suspended and that the instructor now has control of the work station. The trainee should have no doubt that training is terminated and that the trainee is to immediately stop whatever he/she is doing. The use of a clear, mutually understandable phrase, such as “hands off,” should be spoken in conjunction with the suspension. When the phrase is used, it should be a clear signal to the trainee that the instructor has taken over the control of the work station. If training is later resumed, the instructor should ensure the trainee is aware of the resumption and acknowledges the condition. Suspension and resumption (if applicable) of training should be recorded in the narrative log. Training should be immediately suspended in the event of unanticipated or abnormal situations. Since the instructor is responsible for operating the facility, training should also be suspended whenever the instructor believes suspension is necessary to ensure safe and reliable facility operation. The responsibility for assessing all abnormal and accident conditions and taking action remains with the instructor.

During abnormal or emergency conditions, trainees may provide assistance such as making log entries if the instructor determines that the trainee is knowledgeable and skillful enough to assist in responding to the situation. When a training session is suspended for the remainder of a shift, the trainee should sign out of the narrative log. This signifies the official conclusion of the training session. In order to achieve some DOE-HDBK-1226-2019 Conduct of Operations Implementation 45 benefit from a suspended training session, the instructor may allow the trainee to remain at the work station to observe the instructor perform the assigned tasks. The trainee should stay in a position to observe without obstructing the instructor. An exception to this practice would be if training was suspended for an abnormal or emergency condition, and the condition required evacuation of all unnecessary personnel. In this case, the trainee should evacuate from the premises. 6.2.11 Maximum Number of Trainees Normally, on-shift training, when performing OJT, should be conducted one-on-one. Because of operational commitments or task performance frequency, it may become necessary to simultaneously train more than one person on a task. In these cases, management should determine the maximum number of trainees allowed to participate in a training evolution. This determination should consider the potential for adverse effects on the facility and ensure effective, high-quality training. Supervisors should ensure that established limits for number of trainees are observed. In addition to trainees assigned as operators under instruction on a station, other trainees may be observing a task or studying components and systems at the work station. They should be supervised or at least instructed of their responsibilities while at the work station. Although there might not be prescribed limits for this situation, operators should limit the number of trainees so that they can continue to operate safely and efficiently. 6.2.12 Concluding On-Shift Training If training concludes before the end of the shift, the instructor should formally conclude the on-shift training session by informing the trainee and receiving a turnover from the trainee. If training continues for an entire shift, the trainee should conduct a turnover to the oncoming operator (or trainee, if there is one) and the instructor should conduct a turnover to the next instructor or operator, either in entirety or supplementing the trainee’s turnover, but always ensuring a complete turnover. The instructor should evaluate the training session after conclusion. If the instructor remains on shift while the trainee goes off, the instructor should be careful to conduct the evaluation without letting it interfere with their ability to continue operating. For information on performing evaluations, refer to the OJT guide on the NTC resources site at https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx. TRAINING DOCUMENTATION On-shift training documentation should be consistent with Training Department requirements and should be formally documented. The use of qualification cards has proven effective for documenting training. The documentation requirements, including who, how, and when to document training, should be clearly defined and understood by the instructors and the trainees. For additional information on training documentation refer to the OJT guide on the NTC resources site.

In addition to documenting training in the qualification card, training events should be annotated in the work station narrative log, if applicable. Since narrative logs contain a chronological list of all operational activities that occurred during a specific shift and since most training events are operational activities, the majority of events should already be recorded. Using the narrative log to record events https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx DOE-HDBK-1226-2019 Conduct of Operations Implementation 46 performed during a training session will make it easier to document all training that occurred during a session. USING TRAINEES TO SUPPORT OPERATIONS Facility policies should address how trainees may be used to support operations. Trainees should not be asked to perform tasks that they are not qualified to perform. An example of effective use of trainees would be qualifying trainees to carry out fire watches. Prior to assigning trainees to assist with administrative tasks, supervisors should verify that the trainee can carry the new workload. OPERATIONS MANAGEMENT INVOLVEMENT IN TRAINING Operations line managers should be personally involved in identifying training needs and verifying that initial and continuing training programs meet these needs. Operations managers approve and periodically review the effectiveness of operations training programs. This includes observing personnel performance, both on shift and during simulator training sessions, and providing feedback to the training department to initiate training program improvements. Performance standards established by operations managers should be presented, discussed, and reinforced during initial and continuing training. Operations managers should instill a sense of ownership with each shift manager for the training of his or her crew. Shift managers should help identify crew weaknesses and work with operations and training managers to provide training that will strengthen overall crew performance. DOE-HDBK-1226-2019 Conduct of Operations Implementation 47 7.0 INVESTIGATION OF ABNORMAL EVENTS General Concepts Importance of Investigations. Prompt investigation of abnormal events and conditions is important so facilities can assess the effect of each event or condition, determine the root cause, and identify corrective actions to prevent recurrence. Abnormal events and conditions include all occurrences requiring formal notification under DOE O 232.2A, Occurrence Reporting and Processing of Operations Information. Investigation is also appropriate for all events, conditions, “near misses,” or other indications of situations within or outside the operations organization that, if uncorrected, can affect safety or reliability. Acts of actual or suspected sabotage represent a special case for investigation. All aspects of investigations should be open DOE representatives so the Department can effectively evaluate causal analyses and corrective actions determined by the operating organization. More guidance on investigating abnormal events is provided in DOE O 226.1, Implementation of Department of Energy Oversight Policy. Purpose. The investigative process described here is intended to assist the operating organization in evaluating and responding to operational abnormalities. These investigations are not intended to replace the formal investigations required for certain occurrences in accordance with DOE O 225.1B, Accident Investigations.

Use of Written Materials. To ensure consistency, facilities should provide written guidelines to address all aspects of the investigative process. Concise instructions will aid the supervisor in properly collecting and preserving physical evidence that may be needed in the investigation. Standard forms, or an example format, will aid in documenting statements from the personnel present during the event. Checklists may be useful for ensuring that all relevant operating records (recorder charts, round sheets, logs) are collected or copied for use in the investigation. Finally, clear instructions for conducting the investigation will make effective use of time and will aid personnel in evaluating the corrective actions taken and the results of those actions. This process will enable personnel to determine the current safety status of the facility and the capability for continued operation. Abnormal Events. Facilities should establish specific guidelines for investigations of abnormal events. The guidelines should help personnel determine when investigation is required, who is responsible for the investigation, how the investigation is to be conducted, and what documentation is required. The guidelines should emphasize that the purpose of investigations is to improve operations. EVENTS REQUIRING INVESTIGATION Facility guidelines should define events that will require investigation. All events that could adversely affect operations or safety should be investigated at an appropriate level. The following examples suggest the type’s events that should be investigated: • Technical Safety Requirement (TSR) violation • Abnormal or unexplained safety system malfunction • Safety or system features improperly positioned DOE-HDBK-1226-2019 Conduct of Operations Implementation 48 • Equipment failure that could affect facility capability or safety • Unplanned shutdown or significant loss of operation time • Procedural violation having potentially serious consequences • Radioactive or toxic materials released or unaccounted for • Chemistry or process parameters out of specification or indicate unexplained trends; • Actual or attempted sabotage “Near miss” situations often serve as indicators of underlying problems and should therefore be investigated. Examples: • An operator action was not performed, or was performed improperly, but the error was identified and corrected before the process was damaged. The near miss may indicate a problem in the operator’s training or in the operating procedures. • A maintenance activity, such as calibration or testing, produced a transient in an operating system; the system was prevented from upset only by the response of an attentive operator. The near miss may indicate a problem in the maintenance procedures or may point to a need for better coordination of operations and maintenance activities. All events that require notification to DOE (in accordance with DOE O 232.2) or reporting to other agencies such as the Environmental Protection Agency should be investigated. 7.1.1 Responsibility and Qualification Responsibility for investigating, reporting on, and identifying corrective actions for abnormal events rests with management, although specific investigative tasks may be delegated. A manager has overall responsibility for the event investigation process. However, the manager may delegate specific tasks in the investigation process to other personnel. When the causes of the event have been determined and documented, management should ensure that corrective action is initiated to prevent recurrence of this or similar events.

Personnel assigned as investigators should be: • Technically qualified • Knowledgeable of factors affecting human performance • Trained in investigative methods, such as root cause analysis and interviewing techniques They should maintain an unbiased attitude in relation to the event under investigation and the personnel involved at the time of the occurrence. The operations manager is responsible for event investigations involving plant operations. The operations manager may delegate specific investigations or portions of investigations to other personnel. For DOE-HDBK-1226-2019 Conduct of Operations Implementation 49 example, the initial review following a plant transient might be conducted by the on-shift shift manager; the results of this investigation will establish the need for further review. 7.1.2 Investigative Process The process of investigation begins with collecting data. Facility guidelines should identify the types of information that will be needed in an investigation, and the methods that should be used to collect and preserve the information. Operations logs, round sheets, and statements from persons present during the event would typically be required for any investigation. Use of prepared forms for personal statements can aid in obtaining and documenting relevant information for the investigation. A sample personal statement form is shown in Exhibit 7.1. Some events may warrant collection of physical evidence such as: recorder charts, printouts from monitoring equipment, photographs and drawings of the area, procedures, technical documents, broken or failed components, and laboratory analyses. In some situations, it may be necessary to quarantine certain equipment or systems until the investigation is finished. As soon as possible after an event, personnel should be assigned responsibility to collect and preserve information and evidence. A structured review of the abnormal event should be initiated when all data has been collected. The format of the investigation depends on the significance of the event. The steps detailed below should be included in each investigation. 7.1.3 Event Reconstruction The abnormal event should be reconstructed as a chronological list of events. The collected data should be studied for details and integrated to provide a picture of events. If available, an event recorder printout can serve as the basis of the reconstruction. Personnel involved in the event should be included in the reconstruction process. 7.1.4 Event Analysis and Evaluation Once the facts have been established, the event may be analyzed to determine the responses of equipment and personnel. During the analysis, actual and expected responses of facility systems, adequacy of procedures, and factors affecting human performance are compared. Since the Department uses Defense in Depth, with multiple layers of safeguards, the analysis should attempt to identify the multiple failures that allowed the event to occur. An evaluation to identify any detrimental effects on plant equipment should be included. The event should be compared with previous investigations of similar events or transients. If the event was a reactor trip or other engineered safety system shutdown the acceptability of restart should be determined. 7.1.5 Root Cause Determination

The root causes of the event should be determined whenever possible. Root causes are those fundamental causes that would have prevented the event from occurring and, if corrected, prevent recurrence. Typically correctable without additional research or analysis, root causes explain why direct causes existed. DOE-HDBK-1226-2019 Conduct of Operations Implementation 50 Exhibit 7-1: Sample Personal Statement Subject or Title of Event: Event Date/Time: Occurrence Report Number or other identifier: In your own words, write down what happened in the event. Include any relevant information from before the event began until after it was over. Include the following: 1. Facility or system conditions as you know them prior to the event. 2. What you were doing immediately prior to the event. 3. Any indications that a problem existed. 4. Your actions in response to the indications. 5. Any equipment malfunctions. 6. Any inadequacies in the procedures, practices, or training Completed By Signature Date/Time If additional sheets are used, each sheet should contain: signature, date, time, event title, and occurrence report or other identifying number. 7.1.6 Corrective Action Determination Each event investigation should result in the development of corrective actions and assignment of specific personnel responsibilities the actions. Corrective actions can be procedure changes, training, design modifications, and administrative controls changes, and may include better supervisory involvement and oversight of work activities and increased worker accountability. Interim compensatory actions may be used while longer-term corrective actions are being developed. Cognizant managers should agree to each corrective action before it is assigned, and the facility manager approves it. Management should focus on correcting root causes to prevent recurrence or similar events, and not take immediate actions that may not address the underlying causes. Management should be careful not to exclusively ascribe events to operators when management systems or practices are the real root cause. Any disciplinary action DOE-HDBK-1226-2019 Conduct of Operations Implementation 51 investigation should be conducted separately from the engineering and process improvement analysis to encourage open exchanges of information. 7.1.7 Investigative Report An essential part of the investigation is informing others, so recurrence of the event can be prevented. A report of the investigation, including discussion and explanation of the results of the analysis and identification of the corrective actions, should be prepared in accordance with facility guidelines. The investigation report should be reviewed by managers, supervisors, and the safety review committee to ensure that lessons learned from the event are identified and incorporated into applicable facility programs. The final report should be reviewed and approved by the facility manager. 7.1.8 Further Evaluation The final phase of the investigation consists of follow-up activities, to determine if the corrective action has been effective in resolving the problem. Facilities should analyze events to determine trends or patterns of deficiencies. Facilities should establish a mechanism for periodically summarizing events, causes, and trends, and reporting this information to the facility manager, department heads, and managers.

In many cases, information related to an event may be used in both initial operator training and continuing training to maintain operator qualification. Operating experience should also be incorporated into other facility programs and documents such as procurement specifications, work control and planning, and radiation control manuals. The operations manager should evaluate all in-house events to determine whether training is required on an immediate basis for operations personnel. Training on events of immediate concern should be provided before personnel begin work on their next shift. Methods to address immediate training needs include: • Ad hoc training sessions • Shift briefings conducted by the supervisor or other appropriate personnel • Written instructions to oncoming operating shifts • Required reading materials SABOTAGE If an act of sabotage is discovered or suspected, the investigative process is essentially the same as that described for other abnormal events, although different priorities may apply. The following items should be considered when setting priorities in sabotage investigations. • Investigation should be started immediately to determine the condition of the affected systems and the operability of all safety-related systems. • Personnel should consider the possibility that: DOE-HDBK-1226-2019 Conduct of Operations Implementation 52 o Multiple acts of sabotage may have been committed. o Safety-related or other critical systems may have been specifically targeted. o Deliberate steps may have been taken to prevent discovery. o The event may be an instance of insider threat, with special security considerations. • The appropriate manager or supervisor should determine the capability for continued operation or safe shutdown. This may include independent verification of lineups for some critical safety systems. • Corrective actions should include steps to minimize the impact of the sabotage and steps to deter further acts through enhanced security at the facility. HUMAN PERFORMANCE IMPROVEMENT Minimizing human performance errors and their consequences is key to reducing the frequency and severity of events. DOE’s Human Performance Improvement Handbook, DOE-HDBK-1028-2009, describes individual, leadership, and organizational techniques for promoting excellence in human performance. Human performance issues discovered during event investigation should be addressed using the Handbook as a guide. DOE-HDBK-1226-2019 Conduct of Operations Implementation 53 8.0 NOTIFICATIONS General Concepts Value of Notifications. An effective notification program provides a positive means for the facility to respond to public health and safety concerns. DOE policy encourages a positive attitude toward reporting occurrences. Facilities should develop notification guidelines that are directed toward ensuring uniformity, efficiency, and thoroughness of notifications consistent with the requirements of DOE Orders covering operational, emergency, and security events. Requirements and Forms. Facility procedures should integrate notification requirements from DOE senior leadership and program-specific direction and requirements in DOE O 232.2A, DOE O 151.1D, Comprehensive Emergency Management System, DOE O 470.4B, Safeguards and Security Program, and DOE O 205.1B, Department of Energy Cyber Security Program. Notifications may include computer system data entries, written forms or correspondence, e-mail, texts, or telephone calls. For urgent events, notification may flow from a facility to a local 24-hour operating station or emergency operations center, to DOE headquarters, and to local, state, and tribal stakeholders. For small organizations, there may not be a local round-the-clock operations center, and all levels of notifications would flow from the facility.

Facility Guidelines. The need for facility-specific notification guidelines is apparent if one considers the situation of a supervisor during, and immediately after, a serious operating event. The supervisor’s first priority is to ensure safety. This may involve implementing emergency operating procedures, reassigning operating personnel, and personally supervising immediate actions. In the midst of this activity, the supervisor requires concise notification guidelines that clearly indicate the appropriate level of notification for the specific event, based on an evaluation of its potential to affect safety, health, security, the environment, or operations. The supervisor also needs to know the time available to make the notification within regulatory requirements, the individuals to be notified, and the method to be used to notify each. Well-designed guidelines will ensure that notifications do not interfere with the immediate actions that are needed in response to abnormal conditions. They should also ensure that notifications are regarded as an integral part of the response, not an action to be considered after conditions have returned to normal. PROGRAM OBJECTIVES The notification program should ensure that DOE and DOE contractor line management are kept fully and currently informed of all occurrences that could: • Endanger the health and safety of workers. • Affect the health and safety of the public; • Seriously affect the intended function of DOE facilities; • Have a noticeable adverse effect on the environment, or • Impact physical, cyber, or information security of the facility; DOE-HDBK-1226-2019 Conduct of Operations Implementation 54 Responsibility for the event has no bearing on the notification process; the agencies and organizations that respond to the event require prompt notification so that necessary emergency procedures can be implemented. Notification may be required for instances of equipment failure, fire, loss of electric power, or even dangerous weather conditions that are capable of causing a release of hazardous or radioactive materials. Certain classes of security incidents may also require prompt notification. Another function of the notification program is keeping DOE and facility management informed of conditions that could affect the facility’s ability to perform its mission. This is necessary to enable proper allocation of human and material resources. For example, non-availability of spare parts for an aging pump may threaten to disable a critical system. Timely notification of this condition will alert management to the problem. Management may then initiate an engineering review, leading to a budgetary request for a replacement pump of a newer design, for which spare parts are available. NOTIFICATION PROCEDURES Facilities should establish notification procedures that include: • Guidelines identifying facility events and conditions that require notifications • Specific responsibilities for categorizing occurrences and making notifications • Up-to-date list of primary and alternate personnel to be notified, together with their contact information • Guidelines for timely provision of details and follow-up reports after initial notification • Time requirements for notifications consistent with the facility emergency plan Notifications for some categories of occurrences can be made electronically through the Occurrence Reporting and Processing System. DOE O 232.2A includes specific instructions for completing each data field in the occurrence report.

Facilities should provide training to ensure consistent application of the notification procedures. The training for involved personnel should include categorization, notification, and associated reporting requirements. In addition, training for all personnel should address the philosophy of occurrence reporting to develop a positive attitude toward reporting occurrences and to emphasize the importance of timely reporting and follow-up notification. Persons at the “worker” level in the organization may not have formal responsibilities for the notification program; however, their input through normal reporting to their supervisors is essential to the success of the program. More information concerning reporting of abnormal operating conditions is contained in this Handbook’s Section 3.0, Shift Routines and Operating Practices. DOCUMENTATION Documentation is an essential part of the notification process. From a practical viewpoint, documenting the reason for the notification, time, and identity of the persons notified can prevent confusion and permit more focused attention on the immediate actions necessary to mitigate an ongoing event. In some DOE-HDBK-1226-2019 Conduct of Operations Implementation 55 situations, the documentation can help persons on the scene of an occurrence determine what type of assistance they may expect and when it should arrive. All notifications made in accordance with DOE O 232.2A follow documentation requirements in the Order. Facility procedures should establish a format for documenting notifications at all levels and consider the use of fill-in-the-blank forms to simplify the process. These forms can serve as a checklist, helping ensure that all notifications are made as required. DOE-HDBK-1226-2019 Conduct of Operations Implementation 56 9.0 CONTROL OF EQUIPMENT AND SYSTEMS General Concepts Maintaining System Operability. DOE facilities are required to establish administrative programs to control equipment and systems status. A program for controlling equipment and system status, or status control, will be broad in scope. It should incorporate measures to ensure awareness by operating personnel concerning the physical configuration and operating status of equipment and systems. It should contain methods to maintain system operability in accordance with design requirements. Several other individual programs comprise portions of the status control program and are referenced where appropriate. Authority and Responsibility. Proper control of equipment and systems requires clear lines of responsibility and authority. The facility status control program should clearly designate the authority and responsibility for controlling status to ensure proper configuration. All personnel need to understand the importance of keeping the facility operations manager, shift or daily operations supervisors, and other designated operations personnel informed of activities that could affect the status or operability of equipment. Deficiencies. Effective control of equipment and system status also means coordinating operations and maintenance activities. Equipment deficiencies should be promptly identified for correction in the work control system, and deferred maintenance items should be documented to ensure any operational limitations are considered and made known to operators.

Work Control. The operations manager or delegated daily or shift operations supervisors should sign the work control documents to authorize the start of all maintenance activities, including testing, calibration, and related activities. Lockout and Tagout should be performed by authorized employees to ensure that all energy and hazardous material sources are properly isolated and required safety functions are not inadvertently disabled. A process for post-maintenance testing should be in place to confirm proper operation of equipment after maintenance, ensure that all equipment operation is controlled by approved operating procedures, and that maintenance and operations personnel are represented during the testing. The status or alignment of equipment should be verified as part of restoring the equipment to service following outages for maintenance or design modifications. Special Controls. Special administrative controls are required whenever equipment is operated with temporary modifications such as jumpers in place. These controls should include methods for ensuring that operators are aware of the modified status of the equipment and its operating limitations. The controls should provide for safety and technical reviews, documentation, updating of procedures and drawings, and training. Status Control Documentation. The status control program requires specific methods for verifying and documenting the configuration of equipment and systems, changes in equipment status, and compliance with operational and safety limits. Status control documentation may include checklists, logs, status boards, or a combination of these. Requirements for status control documentation should be coordinated with other documentation requirements such as logkeeping to avoid unnecessary forms or duplication of DOE-HDBK-1226-2019 Conduct of Operations Implementation 57 information. This ensures that status information is updated as a regular part of the job, not treated as an added administrative task. It also provides those personnel having operating responsibility with simple, direct access to current status information. STATUS CHANGE AUTHORIZATION AND REPORTING An effective program for control of equipment and system status is based upon the designation of responsibility for status control and authority to effect status changes. During the operation of any facility process or project, there is one individual who is responsible for operational control and who has authority to make changes. That person is usually a daily or shift operations supervisor delegated by the facility operations manager, and will be referred to as the operations supervisor. The operations supervisor is typically the senior operating person present. The supervisor is tasked with maintaining a broad perspective of all facility operations; however, when abnormal or emergency conditions occur, the supervisor’s response should be based on current knowledge of system status. Therefore, changes in the status of safety-related systems or other equipment critical to the operation of the facility should be pre-authorized by the operations supervisor. This means that the supervisor’s perspective of status is the focal point for all operations. Status updates to the supervisor may be required, even for actions that have already been authorized. For example: during the morning shift briefing, a supervisor gives instructions for operational testing of a control system, to be performed later during that shift. In the afternoon, when the operator or technician is ready to begin the test, it is appropriate to check back with the supervisor, both to verify that the process or equipment status still supports the test, and to inform the supervisor of the current status.

To facilitate operation of equipment or processes, the operations supervisor may delegate the authority to operate and make status changes in systems or equipment that are not critical to facility safety or process output. When delegating authority to operate, the supervisor ensures that all pertinent operating information is provided to the designated operator in charge. Each designated operator ensures that the supervisor is periodically updated on the status of the delegated systems. The operations supervisor should ensure that all facility personnel are aware of the potential effect their activities may have on the status of equipment and systems and that they obtain concurrence prior to beginning work that could change the status of equipment. Any status changes that occur during the progress of work should be reported to the responsible operator or the operations supervisor. EQUIPMENT AND SYSTEM ALIGNMENT Operations personnel should be aware of the alignment of systems and equipment within their area, whatever the current mode of operation. Several methods for documenting and tracking system alignment are acceptable. Alignment checklists could be developed for all modes of operation and incorporated into pertinent procedures, and used as guides for establishing the correct component positions when placing systems and equipment into service or other operating modes. Another method is to develop system alignment checklists for the standard shutdown configuration, and then base startup and operations alignments on that configuration as the standard starting point. Shutdown would return the system to the original standard configuration. In either system, changes in configuration for DOE-HDBK-1226-2019 Conduct of Operations Implementation 58 evolutions would be tracked by logs, status boards, or a combination. In any system, checklists should identify each component by the exact name and identifying number that appears on the component label and indicate the required alignment position. The checklist should also make provision for signature or initials verifying the component position and provide space to note any deviation. Checklists that cover initial positioning of components as well as independent verification should provide space for both processes. See Section 11.0, Independent Verification, of this Handbook for more information. The frequency for performing or verifying system alignments depends on the level of control required and the level of operating activity. For example, if a system has minimal effect on safety or process output and is maintained in a steady-state operating mode (normal operation, standby, shut down) with few changes in component status, then it may not be necessary to perform complete or frequent alignment checks. However, if a system is critical to safety or process output or is constantly undergoing component status changes such as valve manipulations, then more frequent alignment checks would be called for. Equipment and system alignment should be verified following any maintenance activity, including testing, if the activity could have placed components in a position other than that required for normal operation. Functional testing prior to startup, and periodic surveillance during operation, may be required for equipment that is subject to technical safety requirements. Techniques for verifying component positions and additional information are contained in Section 11.0, Independent Verification.

When alignment checklists have been completed, they should be signed and approved by the operations supervisor. Completed checklists serve as documentation of the system and equipment status and provide a basis for verification. They should be retained in an accessible location until the next time the checklist is completed, at which time the superseded checklist may be filed. A system to track deviations from the normal alignment should be established. One method commonly used for this purpose is the status board. Status boards typically contain a graphic or schematic representation of the system, or a listing of system components. When status changes are made, the status board is annotated to indicate the current status of equipment. The status board (or other tracking system) should be promptly updated when a change to system or equipment alignment occurs. In addition, all status changes should be documented in the narrative log. Section 12.0, Logkeeping, provides additional information for maintaining narrative logs. The status board or other tracking system should be controlled by the operations supervisor and designated system operators. The status control information recorded in the narrative logs and reflected in updates to the tracking system should be incorporated into the operations turnover process. 9.2.1 Equipment Lockout and Tagout Lockout and tagout requirements are found in Occupational Safety and Health Administration (OSHA) regulation 29 CFR §1910.147, The Control of Hazardous Energy. This rule is intended to prevent energizing or operating equipment during maintenance or testing. Administrative control locks and tags are used for circumstances requiring special administrative controls to prevent inadvertent or unauthorized operation of equipment, components, and systems for reasons other than protection of personnel. DOE-HDBK-1226-2019 Conduct of Operations Implementation 59 Because lockout/tagout changes the operational status of the affected equipment, lockout/tagout activities should be approved by the operations supervisor. All personnel should receive training on the requirements of the facility lockout/tagout program and their individual responsibilities under the program, and clearly understand that operation or manipulation of equipment under lockout/tagout control is strictly forbidden. 9.2.2 Operational Limits Compliance Those facilities subject to technical safety requirements have administrative controls to ensure proper adherence to limiting conditions for operation (LCO). These operational limits are usually expressed as specific conditions (for example, a redundant ventilation blower is not operable) requiring specific response actions (for example, curtail some operations). The operations supervisor should direct, or be aware of, all actions that are taken in response to the operational limit requirements or actions to mitigate adverse consequences to the facility. All appropriate personnel should be informed of the operational limit requirements. All personnel having responsibility for actions under operational limits should periodically review the conditions for operation and ensure that the required actions are performed.

One method for facilities to document actions taken to comply with operational limits is to initiate an operating limit tracking document or file each time a designated condition is encountered. Examples are an LCO log, a Material at Risk (MAR) log, or environmental discharge log. The Operating Limit/LCO Log would include information derived from operator logs, alignment checklists, turnover checklists, or other documentation to indicate the initial conditions and circumstances that resulted in restricting operations. All actions taken in response to the operational limit requirements and other actions to mitigate the consequences to the facility would be documented. When normal operations are resumed, the Operating Limit/LCO Log would provide data to evaluate the event. 9.2.3 Alarm Status Reliable, up-to-date information on the status of important processes and systems is essential to the safe and reliable operation of any facility. Much of this information is transmitted to the operator by control panel or local panel meters, gauges, and alarms. Checking the status of indicating devices and alarms should be part of each operator’s routine inspection tours and rounds. Performance of operator rounds and response to alarm actuation are discussed in greater detail in Section 3.0, Shift Routines and Operating Practices. Alarm systems provide a valuable backup to the operator’s monitoring and control of system status. But just like the systems they monitor, alarms require periodic maintenance and are subject to breakdown. Operators should know the status of alarms in their areas of responsibility. Within their program for control of equipment and system status, facilities should include measures to ensure that personnel are aware of the status of alarms. The following specific areas should be addressed: • Alarms that are totally disabled should be identified to operators through the tagout program, if applicable, or through the use of deficiency stickers, color coding of alarm windows, or other positive means of identification. Instructions for operating personnel should be provided to ensure that DOE-HDBK-1226-2019 Conduct of Operations Implementation 60 equipment parameters are more closely monitored by operators during the period when alarm indication is not available. • Alarms with individual inputs disabled should be identified to operators and documentation should be available reflecting the changed alarm characteristics. Operators should devote extra equipment monitoring to those parameters with disabled alarm inputs. For example, a particular alarm is designed to receive inputs for system pressure and temperature, and actuate if either is out of specification. If the temperature input to the alarm is disabled, the operator compensates by monitoring the system temperature more closely to compensate for the lack of alarm capability. • Alarms with temporarily changed setpoints should be documented for operator reference, and may be further identified by color coded alarm windows or other positive means. • Alarms that are lighted during normal operation should be identified by color coded alarm windows, distinctive labeling, or other positive means. • Alarms that may be activated by more than one input, but that do not re-activate when subsequent inputs are received, should be identified within the alarm response procedures and operator training. Operator training and operations procedures should specify when operators should perform additional equipment parameter monitoring to ensure that abnormal conditions are not masked by alarms that do not re-activate.

• Procedures for response to alarm actuation should be controlled and updated to reflect any changes in alarm status. Changes in the alarm status should be transmitted to all activities that may be affected. 9.2.4 Equipment Deficiency Identification and Documentation When equipment deficiencies are discovered, the operations supervisor should be notified. Then, two distinct actions should be taken. First, the deficiency should be documented and identified for correction in accordance with the facility’s work control system. Guidelines and information related to work control systems are contained in DOE G 433.1-1A, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B. Second, the deficiency should be communicated to other affected personnel. One method is through the use of a deficiency tag. A deficiency tag may be attached to the affected component to indicate that a deficiency has been recognized, documented, and reported in accordance with facility procedures. When the deficiency has been corrected, the tag is removed. The deficiency tag system should be documented and controlled by management, and tags controlled by the operations supervisor at a minimum. Other methods for communicating deficiencies to affected personnel include narrative logs, turnover checklists, round sheets, and annotated status boards. Facility policies should specify the methods to be used to inform personnel of deficiencies in the equipment they operate and monitor. Any deficiency that causes a hazard to personnel or potential property damage may require the use of caution tags in accordance with 29 CFR §1910.145, Specifications for Accident Prevention Tags. 9.2.5 Work Authorization and Documentation All activities that change the status of systems or equipment important to safety, that affect operations, or that change control indications or alarms, should be authorized by the operations supervisor. These DOE-HDBK-1226-2019 Conduct of Operations Implementation 61 activities may include maintenance, testing, fuel movement, radiography, and others. The authorization should be documented in the work control package. Organizations and individuals performing work should provide status reports on the work in progress to the operations supervisor. The facility should have a system in place to ensure that status information is provided to the operations supervisor when work is performed by outside personnel such as vendors. The operations supervisor should make these status reports available to all applicable personnel. This permits coordination of interrelated activities among work groups. 9.2.6 Equipment Post-Maintenance Testing and Return to Service Before returning equipment to service following maintenance, the equipment should be tested to demonstrate that it is capable of performing its intended function. The testing should verify that (1) the maintenance was performed correctly and hence corrected the original problem, and (2) no new problems were introduced as a result of the maintenance activities. If new problems were introduced, further review should be conducted leading to a revised maintenance approach. The maintenance work control package or procedure should specify the type and duration of post- maintenance testing required. For some nuclear facilities, the specific requirements to prove operability of safety-related systems are identified in TSRs. All equipment functions that may have been affected by the maintenance should be tested.

Operation of the equipment for testing should be performed by qualified operations personnel in accordance with approved procedures. Maintenance personnel should monitor the testing. The operations supervisor is ultimately responsible for ensuring that the testing demonstrates the operability of the equipment. 9.2.7 Temporary Modification Control Facilities should establish administrative control systems for approving, installing, and monitoring temporary modifications. Temporary modifications may include electrical jumpers, lifted leads, pulled circuit boards, disabled annunciators or alarms, mechanical jumpers or bypasses, temporary setpoint changes, installed or removed blank flanges, disabled relief or safety valves, installed or removed filters or strainers, plugged floor drains, temporary pipe supports, or others. Prior to installing the temporary modification, the administrative control system should provide for the following activities: • Communicate the proposed modification to the design authority to allow for evaluation of the modification’s effect on current design activities and system characteristics, approval of the design modification by the design authority, and technical oversight of the installation • Perform and document safety reviews, and obtain all necessary concurrences for approval of the modification • Update operating procedures, drawings, labels, and documents as required, and conduct briefings and any necessary training DOE-HDBK-1226-2019 Conduct of Operations Implementation 62 The administrative control system should provide for written authorization to install the modification and independent verification of correct installation. Additional information pertaining to independent verification can be found in Section 11.0, Independent Verification. Periodic audits should be performed to evaluate the status of all outstanding modifications. Independent verification should be performed upon removal of the modification to ensure that all systems, procedures, labels, and equipment are returned to their normal configuration. 9.2.8 Distribution and Control of Equipment and System Documents It is imperative that personnel have and use up-to-date system and equipment drawings and procedures. A system should be in place to ensure that the correct documents are available and maintained in a location that is accessible during all hours of operation. The system should ensure that document changes or revisions are promptly communicated to appropriate personnel. One method to inform personnel of changes or revisions is using the programs for required reading and timely orders to operators. Required reading can provide a means for personnel to read updated procedures. Timely orders to operators can alert personnel to changes in the procedures, equipment, or priorities for operation. DOE-HDBK-1226-2019 Conduct of Operations Implementation 63 10.0 LOCKOUTS AND TAGOUTS

The Conduct of Operations Order, DOE O 422.1, Attachment 2, paragraph 2.i, covers both lockout/tagout for the control of hazardous energy and the use of caution tags for equipment protection and operational control. The term lockout/tagout refers to specific practices and procedures to safeguard employees from the unexpected energizing or startup of machinery and equipment, or the release of hazardous energy during service or maintenance activities. Service or maintenance includes erecting, installing, constructing, repairing, adjusting, inspecting, unjamming, setting up, trouble-shooting, testing, cleaning, and dismantling machines, equipment, and processes. Lockout means installing physical barriers to prevent operating valves, switches, circuit breakers or other isolation devices, for example a padlock that locks a valve operator and prevents its movement. For components that cannot be physically locked out, tags and additional protective measures that provide the same level of protection as a lockout are used. For example, a “Danger Do Not Operate” tag attached to a power switch that can’t be locked in position, plus a tagged barricade to the switch. The tag alerts employees to the hazard of operating the switch and is controlled by operating procedures. Effective use of both locks and tags depends on disciplined operations by trained and conscientious workers. Caution tags historically were part of the Department’s lockout/tagout program, which was modeled on the US Navy’s tagout system. The Department was exempt from the OSHA rules found in 29 CFR Part 1910. When the Department issued 10 CFR Part 851, Worker Safety and Health Program in 2006, the new Rule invoked the OSHA rules for lockout/tagout on the Department’s contractors. Under the OSHA rules, lockout/tagout for the control of hazardous energy is separate from the caution tag system. Caution tags were (and are) hung on equipment controls, breakers, valves, or other items that may still be operated, as opposed to “Danger Do Not Operate” tagged items. Caution tags provide precautions and amplifying information to operators before they manipulate the tagged items, usually to prevent damaging equipment. CONTROL OF HAZARDOUS ENERGY The documents listed below provide guidance for implementing lockout/tagout: • OSHA web site, Safety and Health Topics: Control of Hazardous Energy provides many documents, tools, and training. https://www.osha.gov/SLTC/controlhazardousenergy • OSHA Fact Sheet, Lockout/Tagout - describes the practices and procedures necessary to disable machinery or equipment to prevent the release of hazardous energy. https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html • OSHA Publication 3120, Control of Hazardous Energy - Lockout/Tagout - presents OSHA’s general requirements for controlling hazardous energy. https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html • OSHA eTool: Lockout-Tagout Interactive Training Program – an interactive tool that provides the user with an in-depth understanding of the lockout/tagout standard https://www.osha.gov/dts/osta/lototraining https://www.osha.gov/SLTC/controlhazardousenergy/ https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html https://www.osha.gov/dts/osta/lototraining DOE-HDBK-1226-2019 Conduct of Operations Implementation 64

• NIOSH Publication: Using Lockout and Tagout Procedures to Prevent Injury and Death during Machine Maintenance (2011–156) – recommendations relating to the development and implementation of a hazardous energy control program including lockout and tagout procedures and worker training. https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html CAUTION TAGS Caution tags provide special information to operators for the protection of equipment or operational control. They may not be used for protection of personnel performing maintenance or for energy isolation, and are administered separately from the lockout/tagout system for the control of hazardous energy. Requirements for the use of caution tags are found in 29 CFR §1910.145, Specifications for Accident Prevention Tags. Caution tags should be used only in situations where a component or system is functional, but operators need to have some precaution or other item of information for its operation. For example, if a piece of equipment having both automatic and manual operation modes develops a problem that makes automatic control unreliable, a caution tag can be used to warn operators to use manual mode only. Caution tags should not be used in place of corrective actions such as a temporary or permanent procedure change, placing an operator aid, or repairs. The instructions contained in a caution tag should not conflict with established facility procedures or technical safety requirements. DOE Order 422.1, Attachment 2, Appendix A, paragraph 2.i.(2) provides details of documenting and controlling caution tags. Below is an overview of the process. 1. The use of caution tags should be controlled and documented. 2. Caution tags should be easily identifiable and unique in appearance compared to other tags used at the facility. 3. Operations and maintenance staff should inform the responsible manager of the need for caution tags. 4. The appropriate supervisor or manager should determine the need for each caution tag and authorize its placement. 5. Caution tags should be placed so that they are readily apparent to an individual prior to operation of the tagged device, but they should not obscure indications or interfere with switches or other control devices. 6. A facility log or record should document all caution tags issued in the facility. Data elements for the log and tags include: a. Log entry identification number and tag numbers associated with the entry b. Location of tags by component identification c. Documentation of authorization, precaution and amplifying instructions, placement, verification of proper placement, and clearance, with signatures and dates/times d. Precautions and amplifying instructions (on the tag and in the log) https://www.osha.gov/SLTC/controlhazardousenergy/concepts.html DOE-HDBK-1226-2019 Conduct of Operations Implementation 65 7. All caution tags should be reviewed periodically to verify their continued need, the accuracy of records, and that suitable action is undertaken to remedy the need for long-standing (over three months) tags. DOE-HDBK-1226-2019 Conduct of Operations Implementation 66 11.0 INDEPENDENT VERIFICATION General Concepts

Value of Independent Verification. Independent verification compensates for the human element in facility operation. Any operator, no matter how proficient, can make a mistake. However, the chance that two operators will independently make the same mistake is unlikely. Therefore, independent verification provides an extra measure of safety and reliability to facility operations. Industry experience shows that verifying, or double-checking, important operating parameters and component alignments reduces the occurrence of unintended operational events (shutdowns, environmental violations). Purpose. Independent verification is an activity designed to enhance the reliability of facility operations and safety functions, and to aid in the control of equipment and system status. Its intent is similar to the quality assurance and engineering checks that are performed during design and installation of facility systems. However, independent verification is an ongoing process performed by operations personnel during operations. Independent verification activities are built on the two concepts portrayed through their name: verification and independence. Criteria. Verification is the act of checking that an operation, the status of equipment, a calculation, or the position of a component conforms to established criteria. Verification only checks for conformance with the criteria; it does not alter the status of equipment or the position of components. The criteria used for verification are normally contained in operating procedures or alignment checklists. All persons performing verification should receive specific training and qualification on the systems they will verify, and on the techniques for verifying component position or status. Meaning of Independence. Independence means that the person performing the verification will not be influenced by observation of or involvement in, the activity that establishes the component position or status. For most operating activities, independence can best be achieved by separating the operation and the verification by time and distance. For example, if a verifier watches an operator read from a procedure, check the component label, operate the component, and then mark the item off in the procedure, it would be natural for the verifier to assume that the operation was performed correctly. However, the operator could have misread the procedure, misread the label, incorrectly identified the equipment, or performed the wrong operation. If the verifier is not present during the operation (separated by distance) and performs the verification at a later time, then the verification will not be affected by the operator’s actions. If the verifier walks through the procedure, personally checking the label information and verifying the position of the components, any mistake made by the operator is likely to be detected. Concurrent Dual Verification. For some operating activities, separating the operation and the verification by time and distance may not be possible. For example, verifying the position of a throttle valve or other control may require observation of the positioning activity. Verification for the installation or removal of jumpers may require checking the intended action before it is performed, because incorrect performance could cause a shutdown of critical equipment or actuation of a safety system. For these types of operating activities, the operator and verifier should independently identify the component and

DOE-HDBK-1226-2019 Conduct of Operations Implementation 67 then concur on the action to be performed. The verifier should observe that the operation is performed correctly. This method is termed “concurrent dual verification.” Procedures and Training. Independent verification will be most effective if it is incorporated into existing operating activities. Each facility’s operating guidelines should identify the specific structures, systems, or components (SSCs) that require independent verification. Within those SSCs, the guidelines should identify the occasions when independent verification should be performed. Facility procedures should provide instructions for the independent verification techniques applicable to specific systems and components. These instructions are necessary to ensure that verification is performed consistently and that verification activities do not change the component status or upset the process. Independent verification requirements should be addressed in pre-job briefings, to identify the personnel involved and to clarify the methods that will be used. Facility training programs should include subjects related to independent verification, such as development of a questioning attitude, self-checking techniques, and methods to avoid undue influences while acting as the performer or verifier. Applications Beyond Safety Functions. While independent verification is most often applied to safety SSCs, the concept can be applied to other functions or activities that affect operations. For example, independent appraisals of operating procedures and training should be performed to verify that environmental, safety, and health considerations have been addressed in accordance with operational requirements. Personnel should apply the principles of independent verification to all operating systems in their work areas, not just those having safety functions. System parameters should be checked against each other and against expectations. When problems are identified, individuals should notify supervision and initiate corrective action in accordance with applicable procedures. This process helps ensure that problems are identified early and corrected before they cause larger problems. Written Guidelines. Each facility should provide written guidelines for implementing independent verification. Central to these guidelines are two related, but independent, criteria for independent verification: • Identify Systems. Independent verification is clearly important for certain systems and components, but is not necessary for all facility equipment. Therefore, the facility guidelines should identify the SSCs requiring independent verification. Section 11.1, Systems/Components Requiring Independent Verification, provides guidance for designating which of these systems and components should receive independent verification. • Identify Situations. For those systems, structures, or components that have been designated as requiring independent verification, there are many routine operating activities that require independent verification. Section 11.2, Situations Requiring Independent Verification, provides guidance to help determine what situations involving the designated SSCs need independent verification. The methods or techniques used to perform independent verification should be capable of verifying compliance with the operational criteria without changing the position or status of the equipment. Therefore, the facility’s guidelines should also specify how independent verifications should be performed.

DOE-HDBK-1226-2019 Conduct of Operations Implementation 68 SYSTEMS/COMPONENTS REQUIRING INDEPENDENT VERIFICATION Independent verification should be performed on SSCs that affect the safety and reliability of facility operations. Facilities should identify components requiring independent verification on the basis of safety analysis and evaluation of the effects that may be caused by mispositioning. Independent verification should be performed on SSCs that perform functions in the following categories: • Related to nuclear safety (for nuclear facilities) • Essential for preserving environmental, safety, or health controls • Critical to performance of the facility’s designated mission 11.1.1 Nuclear Safety Functions Independent verification should be carried out for all SSCs performing nuclear safety functions. The following are examples of SSCs in this category: • SSCs that prevent or mitigate the release of radioactive materials • SSCs that protect workers from exposure to radiation • SSCs that support safety systems (such as electrical power systems) 11.1.2 Environment, Safety, and Health (ES&H) Functions All facilities (not just nuclear) contain SSCs that perform safety functions such as protecting workers or preventing release of hazardous chemicals. SSCs performing these functions should also be considered for independent verification. The following are examples of SSCs having an ES&H function: • Fire detection and alarm systems • Ventilation systems • Emergency lighting systems • Effluent and stack monitors In addition to components of designated safety or environmental protection systems, certain components in virtually any system may perform a safety function when used as part of a lockout/tagout. Such components include (a) circuit breakers and valves used to isolate energy or hazardous materials from a work area, (b) grounds installed prior to service on electrical equipment, and (c) telltale bleed lines for verifying hazardous material isolations. The facility’s lockout/tagout program should address the use of these components in protecting personnel and equipment, and the verification required in connection with that use. 11.1.3 Mission-Critical Functions Independent verification is more than just an adjunct to the facility safety or environmental control programs; it is a tool that can be used to enhance the reliability of facility operations. Applying DOE-HDBK-1226-2019 Conduct of Operations Implementation 69 independent verification to production-related systems and components helps reduce unscheduled shutdowns and other unplanned reductions in the facility output. SSCs that are critical to the performance of the facility’s mission should be considered for independent verification. In addition to the SSCs that fill nuclear safety, ES&H, and mission critical functions, independent verification should also be considered for systems or components that could challenge a safety system or mission critical system. For example, testing or changing the alignment of certain components in a non- safety, non-critical system may cause spurious actuation of a safety system or a transient upset in a mission-critical system. 11.1.4 Components Excluded from Independent Verification Requirements In some systems where independent verification is required, specific components may be excluded from the requirement if certain conditions are met. Independent verification may not be required for a particular component if:

• Mispositioning the component would not affect system performance, that is, the system could perform its intended function even if the particular component were mispositioned. For example, a cooling system may be able to perform its intended function even though an air vent or water drain valve in a heat exchanger is not properly positioned. In this case, the vent or drain valve may not require independent verification. • Mispositioning the component would be known immediately to an operator, that is, a reliable indicator of component position or an alarm would alert an operator if the component position is not correct. The presence of position indicating lights for a valve is not considered sufficient justification for excluding the valve from independent verification requirements. However, the lights may be used along with other process parameters to verify the valve position. • Significant exposure to radiation or hazardous material would be received by the persons performing the independent verification. In this case, an alternative method for verification should be found, such as observing process parameters or reliable remote indication. • Any components exempted from independent verification requirements through the criteria listed above should be approved by the facility operations manager. SITUATIONS REQUIRING INDEPENDENT VERIFICATION Independent verification should be performed whenever there is a reasonable chance that the proper function of any SSC identified in Section 11.1 above is jeopardized. For example: whenever components of a system are manipulated, there is a chance that the resulting alignment is not correct; or, when operations are performed on similar, nearby systems, there is a chance of inadvertently manipulating a component in the wrong system. Independent verification of these activities would prevent further undesirable consequences. This is not meant to imply that every operation in the facility should be independently verified. The consequences of alignment errors in certain equipment systems may not justify the expenditure of resources and effort involved in independent verification. Facilities should evaluate their operations to DOE-HDBK-1226-2019 Conduct of Operations Implementation 70 determine when independent verification should be performed, then document the determinations in guidelines or procedures. The following subsections discuss four specific situations when independent verification should be performed on the SSCs designated as needing independent verification. 11.2.1 Removing Equipment from Service When nuclear safety, ES&H, or mission critical equipment is removed from service, the critical or safety functions the equipment had performed will often be transferred to other equipment or systems remaining in service. Independent verification should be performed to ensure that the critical or safety function is not inadvertently disabled. For example, consider a safety system containing two redundant pumps that discharge into a common header. One of the pumps is being removed from service for maintenance in accordance with lockout/tagout procedures. • Independent verification should be performed to ensure that the remaining pump is properly aligned for service and has not been inadvertently isolated. • Independent verification should always be performed after installation of a lockout/tagout to ensure that adequate protection for workers is provided.

For nuclear safety equipment covered by a TSR, actions to be taken in the event of unavailability will be specified in the TSR for compliance with 10 CFR Part 830, and independent verification may be required. 11.2.2 Placing Equipment in Service Whenever nuclear safety, ES&H, or mission critical equipment is placed in service, or returned to service following maintenance, testing, or an extended shutdown, independent verification should be performed. Listed below are some of the reasons for performing independent verification when placing equipment in service. • When equipment has been out of service for maintenance, the position of components within the lockout/tagout boundary could have been changed during maintenance. • Components that have been involved in a test may have been left in the test position and not reconfigured for operation. • During extended shutdowns, it is often impractical to maintain equipment in its normal operating configuration. • Startup activities may involve overlapping procedures for the lineup or testing of multiple interfacing systems, possibly resulting in uncertainty as to whether the final position of components is correct. Independent verification at the time equipment is returned to service is not the same as, nor intended to take the place of, post-maintenance testing. Post-maintenance testing is normally required for all facility equipment, whereas independent verification normally is not required on non-critical, non-safety equipment. In some limited situations, post-maintenance testing of critical or safety systems may satisfy a requirement for independent verification. However, the programs and criteria remain separate. Further information regarding post-maintenance testing is contained in Section 9.0 above and DOE G 433.1-1A, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B. DOE-HDBK-1226-2019 Conduct of Operations Implementation 71 11.2.3 Periodic Checks during Facility Operation Routine periodic checks of the operability of certain systems, structures, and components are required under a facility’s maintenance program. Routine periodic checks might include: • Testing fire protection systems to ensure that they are properly aligned for operation • Testing Continuous Emission Monitors to ensure that they detect and record regulated emissions • Testing toxic gas monitoring equipment to ensure that the equipment will detect a specific concentration of toxic gas and actuate an alarm These periodic checks (defined as surveillance tests in some facilities) are independent of the activities that established the status of the system, and therefore qualify as independent verifications. Verification may be performed using normal operating procedures, or specific checklists may be developed for the purpose. Components to be checked may be included on operator round sheets. If the position or status of a component is changed during performance of one of these checks, the check does not qualify as an independent verification. If the affected component was designated as one requiring independent verification per the criteria stated above, then a separate independent verification of the positioning change should be performed. 11.2.4 Temporary Modifications

Installing or removing temporary modifications such as jumpers should be independently verified when an error could cause the shutdown of critical equipment, actuation or disabling of a safety system, or uncontrolled start of equipment that could endanger personnel. In these situations, verification should be performed before and during performance of the activity using concurrent dual verification discussed above. VERIFICATION TECHNIQUES Each facility should develop instructions for independent verification, using input from experienced facility personnel and equipment manufacturer’s recommendations. The instructions should describe techniques for independent verification of manual valves, motor-operated and air-operated valves, solenoid-operated valves, blank flanges, circuit breakers, removable links, fuses, availability of control power, and accuracy of calculations. Techniques include visually checking component status and observing system instrumentation. The instructions should focus the verifier’s attention on the aspects of the operation that are most susceptible to errors and are most critical for proper functioning of the system. Some operations can be verified by checking the final condition or position of components against a standard (product-based approach). For example, during a lockout/tagout, it is critical that the tags be placed on the correct components. To ensure that no identification errors were made, the instructions should require the verifier to independently identify each component using the same procedures, drawings, checklists, and component label information that were used by the performer; then verify that the component is correctly tagged. DOE-HDBK-1226-2019 Conduct of Operations Implementation 72 When isolating a component or aligning a system for operation, each valve, switch, bypass, or other device should be correctly positioned according to an operating procedure or other documentation. The verifier should be instructed to independently check the physical position of these components, or perform other checks that will positively indicate that the components are properly positioned. In some operations, it is critical that the performer follow a specific process or series of sequential steps. It may be impossible for the verifier to determine that the steps were performed correctly through observation of the finished product. These operations should be verified by independently observing that the proper steps, sequence, or adjustments are performed according to a standard. This method is concurrent dual verification, discussed above. For example, when installing a bolted cover on a piece of equipment, the bolts must be tightened to a specific torque value in a specific sequence to prevent damaging the cover. Instructions for verifying this operation should have the verifier independently observe that the correct torque is applied and that the bolts are tightened in the required sequence. In all cases, the instructions should minimize the interaction between the performer and the verifier to preserve the independence of each. Once the instructions are developed, personnel involved in performing independent verification should be trained on the techniques. Operating experience alone may not provide adequate knowledge for performing independent verification. Specific training on the techniques for independent verification enhances their reliability. The training may be performed as part of the operator qualification program and the facility continuing training program.

The general guidelines that follow should be considered when developing specific verification techniques. When possible, verification should be performed using more than one indication or technique, for example performing a physical verification and checking system parameters. 11.3.1 Verifying Valve Position It is not always possible to determine if a valve has been completely closed or opened by merely observing the action. The relative height of a valve stem is not considered a reliable position indicator for independent verification. Lines scribed on the valve stem or other positive indicators of stem position can aid in accurately determining the valve position. However, a mechanical indicator may not accurately reflect the position after maintenance has been performed on the valve, or even after a period of normal use. The preferred method for verifying valve position is a physical verification. A visual check of the stem position or position indicators should be used whenever possible to confirm the physical verification. Physical verification of a manually operated valve should be performed by attempting to turn the valve in the closed direction. The effects of this are: • If the valve is closed, attempting to turn the valve in the closed direction will not affect its position. Closed valves should NOT be opened for verification to prevent adversely affecting system integrity, because even a slight opening can pressurize or release hazardous materials into the downstream piping. DOE-HDBK-1226-2019 Conduct of Operations Implementation 73 • If the valve is open, the verifier will be able to turn the valve in the closed direction. Only a slight movement in this direction is needed to confirm that the valve is open, without affecting the flow or process. The verifier should then restore the valve to its original position. If the valve position is not in accordance with the requirements, the verifier should NOT operate the valve further, and should notify the cognizant supervisor. 11.3.2 Verifying Throttled Valves Some valves are required to be in a throttled position, that is, intermediate between fully open and fully closed. Often the procedure for establishing the throttled position is to close the valve, then count a specific number of turns in the open direction. If this same action were to be performed by a verifier, the original positioning would be nullified, constituting no verification. If possible, alternate means should be established for verifying throttled valves. If the position of the valve stem would provide visible indication of the valve position, the facility may place a label or scribe marks on the valve stem to use in independent verification. Other types of valve position indicators may be approved by the facility. In these cases, the throttled valve position may be independently verified by visually checking the valve and the position indicator. If it is necessary to close and reopen the valve to establish its position, it is preferable to have both the positioner and the verifier present and perform concurrent dual verification. The verifier should independently verify that the correct valve was identified, its required position was correctly determined according to the procedure, the positioning was performed correctly, and process parameters, if available, confirm the correct positioning. 11.3.3 Checking Process Parameters

Observation of process parameters (such as pressure and flow) may help verify the correct position of components. However, process parameters alone may not give an accurate indication of component status, because alternate flow paths or other factors may cause misleading indications. For example, • Voltage on a circuit does not prove that a particular supply breaker is closed unless there is no alternate power supply • Flow and pressure do not necessarily prove that a valve is fully open Observation of process parameters should be combined with other verification methods, such as physical checks of component position, whenever possible. Facility guidelines should specify where and when process parameters alone are acceptable indicators of component position. 11.3.4 Checking Remote Position Indicators Independent verification should always be performed locally, unless precluded by exposure to radiation, hazards, or other overriding factors. In those limited situations, independent verification may be performed using remote position indicators. The most common of these are indicating lights. DOE-HDBK-1226-2019 Conduct of Operations Implementation 74 Remote position indicators may seem to represent an ideal method for independent verification. However, equipment failures in the sensor, signal transmission, or display device can cause valve- position-indicating lights and other control board indications to be incorrect. Some failures of this type have gone undetected for a significant length of time. Independent verification using remote position indicators should be checked using other verification methods, such as process parameters, whenever possible. 11.3.5 Surveillance (Operational) Testing Certain systems and components are subject to periodic surveillance (operational) tests due to regulatory requirements. In many cases, the nature of the test qualifies it as an independent verification of system alignment and capability. For example, a full-flow test of a system can prove that the alignment of components and positioning of flow-controlling valves is correct. This means of proving operability is not the same as the means used to establish the position of the components, and therefore is independent of the original activity. Some surveillance tests may not test the components in their operating configuration, or they may not include all the components that would be required for operation. For example, running a pump in recirculation to verify discharge pressure would not prove that the main flow-path valves were correctly positioned, and may not prove that external cooling or backup lubrication pumps are properly aligned. Surveillance testing may be used to satisfy independent verification requirements ONLY if it is shown conclusively that the test proves the required position of the components in question. Because surveillance testing involves operation of equipment, the operations supervisor should approve any performance of surveillance tests. 11.3.6 Verifying Operational Processes Sometimes verification is required for an operational process or proper completion of a series of procedural steps. Concurrent dual verification is one method for accomplishing this. For other processes, such as calculating a reactor estimated critical position or calculating chemical loading for a batch process, two operators can independently perform the calculations using the same input parameters. For processes where a computer code generates the results, two operators can independently verify the input parameters, and concurrent dual verification can be used to verify the data entry. Facilities should carefully consider their verification processes to ensure independence is maintained in these situations.

11.3.7 Verifying Locked/Tagged Components Components that are danger tagged in accordance with the facility’s lockout/tagout procedure should not be manipulated in the performance of an operating procedure or for the purpose of independent verification. If such components are encountered during independent verification, the verifier should not attempt to physically verify the position. The verifier should verify that the correct component has been identified, determine the required position in accordance with the procedure, determine the position of the component as recorded on the danger tag, and use all other available methods (such as remote indicators) to verify that the component is positioned as stated on the danger tag. DOE-HDBK-1226-2019 Conduct of Operations Implementation 75 11.3.8 Resolving Inconsistencies Discovered during Independent Verification The underlying principle of independent verification is that anyone can make a mistake. This also means that any inconsistency identified by the verifier could be the verifier’s mistake. The verifier should not change the position or status of a component to correct an inconsistency. Whenever an inconsistency is discovered, the verifier should immediately stop and notify the appropriate supervisor. Facility procedures should identify the supervisory position responsible for resolving independent verification inconsistencies. When informed of the inconsistency, the supervisor should resolve the issue by means suitable to the problem. If repositioning is required, it should be approved by the supervisor. For components subject to controls such as a lockout/tagout for control of hazardous energy or an administrative control lockout tagout, the supervisor should ensure compliance with those controls during physical verification or repositioning. Such components found out of position warrant investigation to find out how that occurred. OPERATIONS SELF-APPRAISAL AND VERIFICATION Independent verification is a formal process for ensuring safety and reliability in facility systems. However, the concepts of verification and independence have a wider application. Programs and activities that affect operations should receive independent appraisals or verifications to ensure that they meet established criteria relating to safety, health, environmental protection, and operational practices. For example, procedure development and training are activities that have a direct effect on operations. These activities should be evaluated through self-appraisal and independent review to ensure that they accomplish their intended purpose and are consistent with applicable regulatory and operational guidelines. DOE-HDBK-1226-2019 Conduct of Operations Implementation 76 12.0 LOGKEEPING General Concepts Purpose of Logs. Logs are part of the overall program for controlling equipment and system status. Logs have many characteristics in common with round sheets, in that both provide information concerning the condition and status of equipment, and both are treated as legal records. Round sheets normally record only data collected from instruments. Logs are used to record an understandable account of the changes in the status of equipment, information obtained from sources in addition to instruments, and explanations for unusual data readings. This information makes logs a valuable tool in reconstructing events. If an unusual event occurs, its precursors and its progress can often be traced by analyzing logs, round sheets, and other records.

Use of Log Information. Logs provide a method for transferring information from one person or shift, to another, and are an important part of the operations turnover. The transfer of information through logs enables current personnel to benefit from the experiences of previous operators of the equipment. The record of problems and attempted solutions may be reviewed whenever a new or similar problem occurs. The lessons learned can save time and effort in the search for solutions to current problems, and can help personnel avoid situations that caused problems in the past. The information contained in logs is also often used by engineers to track the performance of components or processes, by training personnel to provide examples for instruction, and by others requiring specific information concerning operations. Formality and Accountability. Logkeeping enhances the formality that characterizes good operating practices and encourages individual accountability for operating decisions and actions. Logkeeping may also reduce paperwork by providing a single location and format for documenting operating activities. Personnel Covered. All key shift or process operator positions should keep a log. Key positions include daily or shift supervisors, control area operators, operators of remote or isolated equipment, operators who start, stop, or adjust process equipment such as confinement ventilation, cooling, or power generation equipment (not an exhaustive list), or other operators whose actions and log entries would be needed for event reconstruction in the case of an accident. Facility operators should not define “key position” narrowly to avoid keeping logs. Since logs are regarded as legal documents, they should meet high standards for accuracy and consistency. Facility guidelines should specify the positions required to maintain logs, the type of information to be recorded, and the requirements for format, timeliness, and legibility. Facility guidelines should also provide instructions for correcting errors in logs, periodic review of logs, and disposition of completed logs. ESTABLISHING OPERATING LOGS Narrative logs should be an accurate history of facility operations. Logs should be established and maintained for all key positions, including positions that are filled only on a part-time basis. A narrative log may be a separate log book or a narrative section on round sheets. An example of a narrative log is shown in Exhibit 12-1. DOE-HDBK-1226-2019 Conduct of Operations Implementation 77 Exhibit 12-1: Example Log Entries 1 41 2 05/15/2017 1415 Maintenance reported completion of work on Building 202 fire main. 1428 Cleared tagout TO-14-098 for Building 202 fire main and began post-maintenance testing; Senior Mechanic William Jones monitored testing for maintenance. 1445 Building 202 fire main post-maintenance testing completed satisfactorily; fire main placed in service; fire watch cancelled. 1530 Inspected Building 202 fire main; no problems noted. 3 1559 Relieved by John A. Smith. Tim Anderson 4 05/15/2017 1559 Assumed shift. John A. Smith 1600-2400 Plant status as above. C Shift 1635 Rotated process supply water pumps. Status: Pump 1 - Standby, Pump 2 - On-line, Pump 3 - Standby. 1655 Noticed potential safety problem outside south entrance to Building 205. Runoff has eroded ground beside walk. Roped off area and informed Shift Supervisor. Completed work request WR-1038-14 to

have hole filled. 6 1715 Relieved by Janet Black. John A. Smith 1715 Assumed the shift. Janet Black 1805 Process Control operator requested 500 gallons of de-ionized (DI) water. Notified Shift Supervisor and aligned DI Unit 2 to supply water to process. 1850 Relieved by John A Smith. Janet Black 1850 Assumed shift. John A Smith 1910 Process Control operator reported delivery of 500 gallons DI water 7 completed. Informed Shift Supervisor. DI Unit 3 JAS 05/15/2017 Unit 2 is 8 due for regeneration during midnight shift. 2125 Informed by Shift Supervisor of National Weather Service severe Thunderstorm watch in effect until 2230. 2130 Checked that all doors and windows are secured in Building 202 and 204 DOE-HDBK-1226-2019 Conduct of Operations Implementation 78 42 9 05/15/2017 2220 Packing leakage on process supply water Pump 2 is out-of-specification per round sheet. Leakage rate is approximately 3-5 gallons per minute (gpm), specification is 1 gpm. Cause appears to be packing failure. Notified Shift Supervisor and placed Pump 3 on-line. Took Pump 2 out of service and placed caution tag C-087-14. Pump 2 status is now Emergency Use Only. 10 2252 Reviewed log. James Campbell, Shift Supervisor. 11 Incorrect 2254 Maintenance reported work completed on process cooling water Pump 3. data, See 2315 Cleared caution tag C-087-14 and installed tagout TO-14-105 for process 05/16/2017 supply water Pump 2. 12 0045. TD. 2345 LATE ENTRY: 2225 Wrote Work Request WR-1039-14 for process supply water Pump 2 and delivered to Shift Supervisor. 05/16/2017 0003 Relieved by Tony Diaz. John A. Smith 13 05/16/2017 0003 Assumed shift. Tony Diaz 0000-0800 Process Facility status: Normal operation; Water plant status: Operational B Shift Process cooling water (PCW) system: Pump 1 - Tagged out Pump 2 - On line Pump 3 - Tagged out Process supply water (PSW) system; Pump 1 - Standby Pump 2 - Tagged out Pump 3 - On line Incomplete tasks: 05/15/2017, 1910 - Regenerate DI Unit 2 14 0045 Incorrect entry identified. Entry of 05/15/2017, 2254, states that Maintenance reported completion of work on PCW Pump 3. Work is still in progress on PCW Pump 3. Entry should read: “work completed on PCW Pump 1,” as confirmed by Shift Supervisor. 0120 Started regeneration of Deionizer Unit 2. 0240 Maintenance reported completion of packing gland adjustment on PSW Pump 2. Verified that packing leakage is now 1 gpm. 0255 Cleared tagout TO-14-105. PSW Pump 2 status is now Standby. (Numbers in left margin refer to notes below) DOE-HDBK-1226-2019 Conduct of Operations Implementation 79 NOTES: 1. No entries are made in unruled margin at the top of the page, nor in the partial line at the bottom of the page. 2. The date is entered at top of each page. Each entry is preceded by the time, using a 24-hour clock system. 3. The final entry at the completion of a shift identifies the relief and contains the signature of the person keeping the log. 4. The initial entry at the beginning of a shift contains the signature of the person keeping the log. The date, shift hours, and shift designation have been included in the margin. 5. The entry for a subjective observation or problem discovered by the operator identifies what the operator found,

the actions taken, and the notifications made. 6. The entries for a relief during the shift meet the same requirements as entries at a scheduled shift turnover. 7. The person keeping the log made an error and corrected it by lining through the incorrect entry, writing the correct information, and initialing and dating the change. 8. This entry refers to a future action to be performed. 9. A log entry provides additional information related to an out-of-specification reading or indication. The entry includes a description of the out-of-specification condition, the probable cause, notifications made by the operator, and the actions taken. 10. The supervisor reviewed the log and documented his review. 11. A margin notation draws attention to an error discovered by someone other than the individual who made the log entry. See Note 13. 12. A late entry, recorded out of proper time sequence, indicates the actual time of the occurrence. 13. This initial entry includes a status update and a listing of incomplete tasks carried forward from previous shifts. 14. The person keeping the log found an error in an earlier entry made by another person. A new entry in the log identifies the incorrect information and corrects it. A notation was also made at the location of the incorrect entry. Some facilities maintain additional logs for specific items of equipment (such as emergency generators). These logs provide an equipment history, and usually record activities and information relating to both operations and maintenance. Facilities or regulatory agencies may also require additional logs for specific processes (such as wastewater treatment). These additional logs should adhere to the requirements for narrative logs. Facilities should develop written guidelines to ensure consistency in maintaining logs. The guidelines should address: • Shift positions, processes, or equipment that require logs • Personnel authorized to make entries in logs • Standards for information to be recorded in logs • Format requirements for logs and log entries • Review requirements for logs • Instructions for control of logs and disposition of completed logs DOE-HDBK-1226-2019 Conduct of Operations Implementation 80 The following sections of this Handbook provide information to assist facilities in the development of these guidelines. INFORMATION TO BE RECORDED Each facility should provide written guidance defining the type and scope of information to be included in the logs. Log entries should be concise, yet contain sufficient information to allow accurate reconstruction of events. During emergencies and abnormal or unexpected events, logkeeping should not take precedence over controlling the facility; however, as much significant information as possible should be included in the log. Entry of information into the log should not be regarded as a substitute for reporting to supervisors or other required reporting. Log entries need not duplicate information recorded in other permanent records, such as round sheets or logs for other shift positions. However, any information that is of operational interest should be recorded in at least one facility log. If the operator is in doubt as to whether the information is required, it is usually better to record. The following categories of information should be recorded in logs.

• Changes in Facility or Equipment Status - Any change in the status or operating mode of equipment, systems, and processes should be recorded in the log. The log should identify the specific procedure, or portion of a procedure, that is used. The initiation and completion of required surveillance or operational testing, and verification of status for safety-related equipment should also be recorded. • Abnormal Configurations - Occasionally a facility or system is operated in an abnormal configuration to support maintenance or testing, or to respond to emergency conditions. Examples of abnormal configurations include: electrical or hose jumpers installed to bypass certain components or functions, blocked or locked-out safety channels or instrumentation, intentionally plugged drains, pinned or blocked check valves or other flow-control devices, or power supplied from an alternate source. When equipment is placed in an abnormal configuration, the log should reflect the cause, authorizing manager, expected duration, and any special precautions taken. • Entering/Exiting Technical Safety Requirements - Any time facility conditions justify restricted operations in accordance with technical safety requirements, an entry to that effect should be made in the log. Another log entry, recording the elapsed time under technical safety requirement restriction, should be made when operations return to normal. Logging these events serves as an aid to the operator on shift, emphasizing the importance of the technical safety requirements, as well as documenting compliance with regulatory and safety limitations. • Out-of-Specification Readings - During operator rounds, the log can serve as a supplement to the round sheet by providing space for narrative comments on the condition and status of the equipment. Any out-of-specification reading or indication should be explained in the log. The log may also be used to record both objective and subjective observations regarding the condition of the equipment. Subjective observations, such as abnormal noise, vibration, odor, humidity, dust, and temperature, often enable qualified operators to identify problem precursors before process parameters exceed their permissible limits. DOE-HDBK-1226-2019 Conduct of Operations Implementation 81 Log entries documenting abnormal observations or readings should include a description of the abnormal condition, the corrective actions, and notifications made by the operator, and the cause of the condition, if it can be determined. Whether or not the abnormal condition can be corrected by the operator, the log entry will alert other operators to the potential problem. The log entry also preserves the operator’s first-hand observations and reactions in the event a more comprehensive investigation is required. The sample log in Exhibit 12-1 illustrates entries (Notes 5 and 9) for problems or out of specification conditions discovered by the operator. • Occurrence of Reportable Events - The occurrence of any event that is reportable outside the immediate operating group or shift should be recorded in the log. Log entries for reportable events should identify the persons notified, the times of notification, and the actions taken by the operator to correct the event or condition. Events and conditions that are reportable to DOE are identified in DOE O 232.2A. Other federal, state, and local agencies or other site organizations may have additional reporting requirements. See also Section 8, Notifications.

• Security Incidents - If a security incident occurs, or if there is reason to suspect that one has occurred, the individual should report the discovery in accordance with facility procedures. The circumstances of the discovery and any other information known about the incident should be recorded in the log. This information will be useful both for the security investigation of the incident and for determining the effect the incident may have had on operations. Security incidents may include discovery of improperly controlled classified material or documents, unauthorized or unknown persons in the area, and missing or damaged government property. • Shift/Personnel Relief - The assumption of responsibility for a shift position should be recorded in the log. This occurs at shift turnover and may occur at other times during a shift. The log should identify the oncoming relief person by name and should document the time of this person’s acceptance of responsibility. Additional information describing the content and format of log entries for shift or personnel relief is given in Section 12.3.2, Initial Entry, and Section 12.3.4, Final Entry. TIMELINESS OF RECORDINGS Information should be recorded promptly in the log to ensure accuracy and completeness, but logkeeping should not take precedence over controlling or monitoring the facility. All events should be recorded in chronological order. If there is a delay between the time of the occurrence and recording it in the log, the log entry should include the actual time of the occurrence. If an individual has failed to make a log entry at the proper time, and has since made additional entries, the late entry should be recorded in the next available space. The entry should indicate the actual time of the occurrence and should be identified as a late entry. A reference mark or notation may be placed in the margin, indicating that an entry has been omitted and is entered later in the log. The sample log in Exhibit 12-1 (Note 12) includes an example of a late entry. DOE-HDBK-1226-2019 Conduct of Operations Implementation 82 LEGIBILITY AND FORMAT Maintaining logs as both working documents and permanent legal records requires precautions to preserve the physical integrity of the log. For written logs, separate bound books, loose-leaf notebooks, or round sheet narrative sections are all acceptable. Pages should be numbered, and for loose-leaf and round sheets, pages should be identified (date, station) to prevent mixing pages from different stations or days, and make it easy to detect missing pages. Facilities should provide a method for identifying the persons who make entries in the log, matching written signatures and initials with legible names. One method is to list the printed name, signature, and initials of all persons making log entries, either as part of the initial entry or on a separate page or form maintained with the log. Electronic log systems should provide unambiguous identification of the person making each entry. Entries in the log should be easy for others to read and understand. All persons maintaining a written log should ensure that their handwriting can be easily read by others. The language and style of writing should be in keeping with the intent of a narrative record of operation; language should be similar to the language one would use if describing the events to another operator or supervisor. Acronyms and abbreviations should come from an approved list. Time entries should be consistent, and a 24-hour clock is recommended for concise, unambiguous entries.

Written log entries should be reproducible on standard photocopy machines. Facilities should control the use of colored ink or highlight pens to draw attention to entries, and test them to ensure that the log text is not obscured either in the original or when copying. Detailed instructions for log format should be contained in facility guidelines. The following, and the example log entries in Exhibit 12-1 contain information that may be helpful in developing the facility guidelines. 12.4.1 General Format It should be difficult or impossible to alter or add to the entries contained in the log. All lines on the page should be used, or marked in a manner that designates them as not used. As a good practice, lines should not be skipped between or within entries. Unruled spaces on the log page such as the margins should not be used for log entries. The date should be recorded on each page. Entries should be formatted so that a person reading the log can determine at a glance the date and time of the entry. 12.4.2 Initial Entry An initial entry should be made in the log at the beginning of each shift. The initial entry should be dated, should acknowledge the assumption of responsibility, and should contain the signature of the person assuming the shift position. Some facilities require a more detailed entry on a daily or per-shift basis summarizing plant conditions, equipment status, and work in progress. Examples of initial entries are shown in Exhibit 12-1 (Notes 4 and 13). DOE-HDBK-1226-2019 Conduct of Operations Implementation 83 12.4.3 Incomplete Tasks The events recorded in the log may require follow-up action by the person keeping the log. If the action cannot be performed immediately, because of plant conditions or higher priority tasks, an entry should be made in the log to identify the task as incomplete. This is a way of reminding the person keeping the log, or the person who will fill the position on another shift, that the required action has not yet been performed. The sample log in Exhibit 12-1 contains an entry identifying an action to be completed on a later shift (Note 8). 12.4.4 Final Entry The off-going operator or supervisor should make a final log entry when relieved by another person or at the end of the shift. The final entry should indicate the name of the relief person (if the position is relieved through a turnover) and should be signed by the off-going individual to authenticate the entries made during the shift. Examples of final log entries are contained in Exhibit 12-1 (Note 3). 12.4.5 Correcting Errors Facility guidelines should identify a standardized method for correcting errors in all operating records, including logs. The method of correction should not obscure or cover up the original entry; erasing or use of “white-out” should not be permitted. Treating the logs as legal records means that all entries are to remain readable. If a correction is erroneously made, vital information could be destroyed unless the method of correction preserves the readability of the original text. If the person keeping the log makes an error, a correction can be made by placing a single line through the incorrect information and writing the correct information in a nearby space. The correction should be initialed and dated. An example of this method of correction is shown in Exhibit 12-1 (Note 7).

When an error is discovered by someone other than the person who made the entry, the person making the discovery should not change the original entry. A new entry should be made in the log at the time of discovery to indicate that an error has been identified. The new entry should include the date and time of the incorrect entry and the incorrect information, and should clearly state the correct information. A note in the margin at the location of the incorrect entry, giving the date and time of the new entry, can be used to inform personnel that an error has been identified. Exhibit 12-1 (Notes 11 and 14) contains an example of an entry to correct a previous error. LOG REVIEWS At the beginning of each shift, the oncoming personnel should review the log entries since their last shift or for a time period specified in facility guidelines. This review will familiarize personnel with recent changes in the status of equipment and bring them up to date on current processes or activities. Supervisors should review the logs of subordinates during each shift. This review enables the supervisor to ensure that the entries are accurate and adequate. It also provides the supervisor with an additional perspective on the operation, since detailed equipment observations are more likely to be included in DOE-HDBK-1226-2019 Conduct of Operations Implementation 84 individual logs. The supervisor should document each log review. One method is to make an entry directly in the log at the time of review. Exhibit 12-1 (Note 10) illustrates this. Logs should also be made available for review by persons outside the operating organization. For example, system engineers and maintenance engineers can use operating logs to help detect potential problems in the equipment or procedures. Training personnel can use logs to develop instructive examples that accurately reflect facility operations or problems. STORAGE OF COMPLETED LOGS Completed logs should be retained in or near the operating area for a sufficient time to permit review by operators returning to work after extended absences. Each facility should establish written guidance for storing completed logs after they have been reviewed. Logs should be stored in a manner that will preserve them throughout the expected life of the facility. The method of storage should allow for the logs to be readily retrieved if they are needed for reference. DOE O 243.1B, Records Management Program, contains additional guidelines for document control and disposition. COMPUTERIZED LOGS For electronic logs, facilities should develop processes and hardware to provide permanent electronic records, prevent unauthorized alterations while permitting traceable supervisory staff entries, provide a record of changes, provide electronic signatures to identify log keepers, provide redundant data recording or other means to prevent loss of data due to power or equipment failures, and provide data integrity protection at least equal to that afforded by paper records. Systems may include computer workstations or portable (tablet) computers, secure data networks, code or text scanners, speech recognition devices, or other technology. Facility procedures should discuss the controls applicable to manual logging, computerized logkeeping, and backup paper systems for use in the event of computer failures. DOE-HDBK-1226-2019 Conduct of Operations Implementation 85 13.0 OPERATIONS TURNOVER General Concepts

Purpose. Turnover is the process of transferring duties and responsibilities of facility job positions between personnel. Thorough turnovers are crucial to the safety of DOE facility operation. Turnover activities ensure that oncoming personnel have an accurate picture of current facility status and provide a review of past and scheduled operations. The information obtained by oncoming personnel during turnovers promotes safe, efficient, and stable operation. To ensure the most efficient and productive transfer of facility information, the turnover should be strictly focused on the work station status and operation. The concepts and process of Operations Turnover can also be applied to facilities with intermittent operations, for example day shift only, where operators may “turnover” at the end of a work period by documenting conditions for an on-coming operator’s review when operations resume. Formality. The turnover process should be conducted in a formal, businesslike manner because it prepares oncoming personnel to operate the facility. Consistent with facility policy, oncoming personnel are responsible for arriving at the facility physically and mentally fit to assume the duties of the job. Benefits. A turnover checklist enhances the turnover process by serving as a guide for the oncoming person. Used properly, the checklist will take the oncoming person through the turnover process step-by- step. The turnover process will thus become a standard routine, thereby minimizing the possibility of missing important information during the turnover. Documents Required. Documents specified by management should be reviewed by oncoming personnel before accepting their assigned responsibility. Reviewing these documents will augment the information obtained during the remainder of the turnover. The review will refresh and supplement the oncoming person’s knowledge of past operations, as well as present and scheduled operational commitments. It can also provide information about work station status. This is especially important when a person has been absent for several days. Pre-Shift Walkdown. A pre-shift walkdown allows the oncoming person to inspect the work station before accepting responsibility. It provides the oncoming person an opportunity to check the status of the area and associated equipment. The walkdown is most beneficial when the off-going person accompanies the oncoming person. This enables the oncoming person to ask questions regarding work station status and also obtain immediate feedback. Oral Discussion. A discussion of all information concerning the work station is accomplished and the oncoming and off-going personnel are confident that an information exchange has taken place prior to transferring responsibility. If properly focused, this discussion is the most effective method of communicating work station information to the oncoming person. After the discussion, a formal transfer of the duties and responsibilities of the work station should conclude the turnover and be noted in the narrative log. This will officially end the duties and responsibilities of the off-going person and start those of the oncoming person. DOE-HDBK-1226-2019 Conduct of Operations Implementation 86

Briefings. Personnel briefings reinforce information communicated during the turnover. During the briefing, the appropriate supervisor has the chance to provide personnel with a picture of overall facility operations, both current and planned, including support group activities. A briefing of all personnel is the best way to quickly disseminate information important to everyone, and also address questions personnel have concerning the facility. Alternate Workers. A process should also be in place for turnovers to alternate workers not on the operating staff. Such turnovers might be necessitated by illness, vacation, or shift shortage. The alternate needs to have sufficient knowledge of work station status to maintain operational continuity. This knowledge can be transferred in person or in writing, or both. TURNOVER PROCESS The turnover process for the next shift should actually begin at the start of the current shift as soon as the “on-duty” person has assumed the duties and responsibilities for the work station. At that time, the operator or supervisor should begin identifying information that may be helpful to the next turnover. As information is acquired, it should be recorded in log and round sheets and on status boards, if applicable. At shift change, the oncoming person should review the logs, round sheets, status boards and other facility required documentation to gain insight into past, present and future work station status. A turnover checklist might be helpful to guide the oncoming person through the turnover, as well as guide the off-going person in preparing information for the turnover process. To acquire firsthand knowledge of present work station conditions, the oncoming person should walk through the entire work station. After walking through the work station, the oncoming and off-going person should then perform an information exchange. When all pertinent information has been exchanged, the off-going person should turn over the duties and responsibilities to the oncoming person. The oncoming person should then accept the duties and responsibilities, which in turn starts the process over again. Some work stations may consist of large areas covered in a vehicle or on long walking tours where a pre-shift walk through is impractical. In this situation, turnover procedures should compensate with thorough information exchanges and discussions. A shift personnel briefing, conducted by the supervisor, should also be a part of the turnover process. This briefing should provide the oncoming person with additional facility-wide information and should supply him/her with an overview of facility operations for the upcoming shift. 13.1.1 Turnover Checklists Turnover checklists may be developed to aid in the turnover process. The content of the checklist (normally developed on a case-by-case basis) should reflect the duties and responsibilities of the position. The need for checklists should be dictated by experience or through evaluation of activities performed at the individual work stations and their effect on facility operations. Checklists should be used as a guide during each turnover to ensure a thorough turnover of facility status and work station information. All personnel using turnover checklists should be trained on their use and importance. This training should include an explanation of how and when to complete the checklists. DOE-HDBK-1226-2019 Conduct of Operations Implementation 87

The turnover checklist should include information that is necessary for a thorough turnover, especially information that may not be readily apparent to the oncoming person. The detail of the checklist should be consistent with the risk of the operations performed at the associated work station. Sufficient space should be allowed for adding pertinent information not covered by the checklist. Turnover checklists may come in different forms. Two popular forms are paper sheets that can be used once and laminated sheets that can be reused. Paper sheets are inexpensive to reproduce and special writing instruments are not required for marking. They are subject to work station conditions and may become damaged or unreadable. Laminated sheets are useful in that they remain readable and can be cleaned as necessary. Marking on laminate requires an erasable marker or grease pencil. Each facility should decide the form that best suits its needs. 13.1.2 Turnover Checklist Verification A program should be in place to ensure that all turnover checklists are current and maintained correctly. Responsibility for developing and maintaining turnover checklists should be designated by management. Personnel should be involved in the development of their work station turnover checklist and should supply information if changes are necessary. A master copy of each checklist should be kept for ease of updating and also for restocking the checklists as needed. Changes to checklists should be communicated to work station personnel. As checklists are revised, outdated copies should be discarded. Blank checklists should be readily available to personnel. 13.1.3 Turnover Checklist Information As a minimum, each turnover checklist should include the applicable work station name, approval designation, revision number, approval-for-use signatures, and dates. Exhibit 13-1 shows an example of approval designation. There should be a space for recording the date and time the checklist was used and spaces for the oncoming and off-going persons to sign. Providing a space for the date and time is a good practice to prevent confusion when using the checklist. (If a previously used checklist was not discarded, it will have a date and time that is different from the expected). A graded approach philosophy, consistent with the risk of operations at each work station, should be used to develop turnover checklists. Answering the following question is useful when deciding whether to include information on the checklist: “What are the potential environmental, safety, health, and operational risks of forgetting to turn over this information?” The operational risks should focus on the information required to ensure continuity of operation. Checklist information should be as comprehensive as necessary to ensure that the oncoming person is provided with sufficient information to adequately control the work station immediately following the turnover. Examples of checklist information include: • Facility status • LCOs in effect, with time limits • Status of important operating parameters • Status of safety equipment DOE-HDBK-1226-2019 Conduct of Operations Implementation 88 • Required chemistry or process sample times • Equipment problems • Times specific planned actions are required • Changes in radioactive or hazardous materials areas and conditions • Temporary procedure changes in effect • Facility support group activities (such as construction)

• Maintenance, testing, and task status • Status of controlled keys • Abnormal lineups or conditions • Documents to be reviewed (such as narrative logs) If a status board is used to track equipment and system status at a work station, the turnover checklist should direct personnel to review the status board. The checklist should not duplicate this information. Rather, the checklist should guide personnel through the turnover, supplying pointers, as necessary, to information that already exists. Each turnover checklist should include a section for additional information. This section may be used for listing danger, caution, out of calibration, out of specification, and deficiency tags hanging at the work station. This space may also be used to list and explain temporary systems installed at the work station. Other uses for the additional information section may include listing temporary modifications such as: • Electrical jumpers • Lifted leads • Circuit boards removed • Disabled annunciators/alarms • Mechanical jumpers/bypasses • Temporary setpoint changes • Installed or removed blank flanges • Disabled relief or safety valves • Installed or removed filters or strainers • Plugged floor drains • Temporary pipe supports When documents are to be reviewed as part of the turnover, there should be a section listing the documents and space to document the review. Occasionally, additional documents may need to be reviewed, therefore, space for adding those documents should be included. (See Exhibit 13-1) DOE-HDBK-1226-2019 Conduct of Operations Implementation 89 Checklists developed for supervisory positions should include a summary of activities of assigned personnel. This summary should help prepare an oncoming supervisor for the pre-shift walkdown. Exhibit 13-1: Work Station ‘A’ Turnover Checklist Approved by: Approval Date: Shift:    Date: N D E  Facility Status:  Evolutions: (completed/in progress/planned)  General Information: (examples: abnormal lineups, special instructions/considerations)  Equipment Status: (examples: equipment deficiencies, equipment currently out of service/special precautions, surveillances or tests in progress, equipment maintenance in progress, maintenance completed/restoration measures outstanding)  Status of Controlled Keys: Document Review:  Narrative Log  Equipment Status Log  Tagout Log  Shift Orders  Round Sheets  Operational Limits Action Log  Temporary Modifications Log    Additional Remarks: Oncoming: Off-going: DOE-HDBK-1226-2019 Conduct of Operations Implementation 90 13.1.4 Using Turnover Checklists Items on the turnover checklist should be updated, as necessary, throughout the shift. As events occur, conditions change, or information pertinent to the turnover is obtained, entries can be made on the checklist as a reminder to discuss the information at turnover. Just prior to turnover, the off-going person should verify that the off-going portion of the turnover checklist is current and complete. The turnover checklist should be given to the oncoming person prior to starting the turnover process. The oncoming person should review the checklist before, and consult it during, a pre-shift walkdown. A provision may be made to have the off-going and oncoming person sign the checklist when it is complete. Supervisors should ensure that turnover checklists are properly used by periodically monitoring subordinate work station turnovers and reviewing completed checklists. They should also ensure used checklists are properly discarded.

DOCUMENT REVIEW Oncoming personnel should review documents specified by management prior to assuming responsibility for their shift positions. If a checklist is specified to be used by a work station, a list of these documents should appear on the checklist. Reviewing the turnover checklist cannot serve as a substitute for log reviews. Document review should be as intensive as necessary to ensure oncoming personnel understand important history, present status, and scheduled events. To ensure oncoming personnel understand events that have occurred, they should review narrative log entries for the last 24 hours or since they last worked, whichever is less. Status logs should be reviewed so oncoming personnel are familiar with all active entries, with an emphasis on what has changed since they last worked. Other documents describing important aspects of overall facility status should also be reviewed by all oncoming personnel. For personnel returning from vacation or some other extended absence (including fifth or training shift), document review requirements should be more rigorous to ensure that they have a thorough understanding of facility status. Examples of documents to review include: • Work station narrative log • Equipment status log • Tagout log • Work station round/inspection sheets • Temporary modification and jumper logs • Out-of-service annunciator log • Operational limit/LCO Log • Shift orders book (timely orders) DOE-HDBK-1226-2019 Conduct of Operations Implementation 91 In addition to the above documents, supervisors may need to review the narrative and round/inspection sheets of assigned personnel. This review can often provide detailed information concerning the operations and equipment status, supplementing the records maintained by the off-going supervisor. Supervisors may have additional responsibilities for document review, in accordance with facility operating procedures. PRE-SHIFT WALKDOWN The turnover process should include a pre-shift walkdown with a brief look at all areas of the work station. Oncoming personnel should check the status of equipment, systems, and panels, and the status of work being performed at the work station. Status control boards should be verified and any discrepancies noted for discussion. 13.3.1 Panel Walkdown Prior to assuming responsibility for the work station, the oncoming person should personally verify the status of important system operating parameters by observing instrumentation and control panels, especially those relating to safety systems. They should determine facility status through observing system lineups, switch positions, lighted annunciators, chart recorders, and status lights. Oncoming and off-going persons should conduct the walkdown together during the turnover and discuss work station status, trends, and potential problems. The turnover checklist, if specified to be used by the work station, should be used as an aid in this discussion. As a minimum, the discussion should cover items observed during the walkdown, for example: • Status of safety-related equipment • Running equipment • Inoperable equipment, including instrumentation • Technical safety requirements, including surveillance requirements • Reasons for actuated alarms or annunciators • Tagged equipment, including any surveillance/equipment work in progress • Abnormal equipment and component configurations

It is the responsibility of the off-going person to communicate all pertinent information about the work station to the oncoming person during the walkdown. The oncoming person should inquire about unfamiliar lineups, positions, indications, and tags observed during the walkdown. 13.3.2 Supervisor Walkdown Oncoming supervisors should walk down the instrumentation and control panels under their purview as a part of the turnover. This walkdown may be done with the off-going supervisor, separately, or with either off-going or oncoming personnel assigned to the work stations under the supervisor’s purview. The DOE-HDBK-1226-2019 Conduct of Operations Implementation 92 walkdown can occur before, during, or shortly after turnover, but will produce a better information exchange if performed before the turnover. INFORMATION EXCHANGE AND RESPONSIBILITY TRANSFER As a minimum, a verbal exchange of information between the off-going person and a qualified relief should conclude the turnover. This information exchange should occur when work station conditions are stable. The discussion should be performed immediately before the exchange of responsibility and within the confines of the work station. During the period of information exchange, access into control areas should be limited so control area personnel remain focused on the exchange, while simultaneously monitoring and controlling the facility. The off-going person should use the discussion time to explain any unusual events that have occurred, planned maintenance and surveillance activities, and any other pertinent information not covered during the walkdown or by the turnover checklist, if applicable. The oncoming person should use this time to resolve any questions concerning the status of the facility, ongoing maintenance or surveillances, log entries, and written guidance for the continued operation of the facility during the upcoming shift. Turnover discussion and transfer of responsibility should normally occur at the work station’s operating base (see Section 3,7, Operating Bases, in Section 3.0, Shift Routines and Operating Practices) unless abnormal situations dictate otherwise. Personnel should inform their supervisors prior to switching areas. Prior to the transfer of responsibility, the off-going person should make a decision about the physical and mental state of the oncoming person. Each facility should establish guidance concerning the physical and mental requirements for assuming work station responsibility. If the off-going person believes the oncoming person cannot manage the duties and responsibilities of the work station, the off-going person should retain the duties and responsibilities and should immediately notify the appropriate supervisor. The facility’s organization and administration guidelines should include a policy for handling this situation. When the off-going person is satisfied that the oncoming person is fully cognizant of the facility conditions, the off-going person should so inform the oncoming person. The oncoming person should then signify to the off-going person he/she is assuming the responsibility for the work station. The off- going person documents their relief in the log and the oncoming person documents their assumption in the log in accordance with Section 12.0, Logkeeping. The off-going person should not leave the work station until the oncoming person has accepted and signed for the duties and responsibilities.

SHIFT BRIEFING Facility policies and procedures should contain guidance on the time, place, and conduct of shift briefings. They should occur at a specified time and place and all facility personnel should understand the importance of attendance. Briefings should be formal and as short as necessary to communicate pertinent information and not interfere with facility operational commitments. A shift brief should occur as part of the turnover process, and all shift personnel should attend this briefing. If, as a result of operational commitments, some personnel cannot attend a briefing, DOE-HDBK-1226-2019 Conduct of Operations Implementation 93 arrangements should be made to pass on briefing information to these persons. Supervisors could pass on the information, or communication devices, such as telephone or intercom, could be used to allow those persons absent from the briefing to listen to the briefing from their work station. Failure to attend briefings for non-operational commitments, such as performing administrative duties, should be discouraged. When determining the most suitable time for a briefing, management should take into consideration the type of operation, extent or layout of the facility, extent of required shift overlap, and labor union contracts, where applicable. If an emergency or abnormal situation occurs that might affect the turnover, management should attempt to contact oncoming shift personnel to alert them to the situation and notify them of any alterations to the personnel briefing. In such cases, personnel briefings may be longer and in greater depth. In addition to shift personnel, staff from support groups such as contractors, vendors, engineering support, and maintenance groups should attend briefings when their activities can directly affect operations. This practice results in a better understanding of shift priorities and objectives among shift and support group personnel. For facilities that work only a dayshift, this briefing may take the form of a morning staff meeting. This is especially helpful if there are a number of different activities occurring which might affect each other, or if there are new personnel filling in for absent personnel. The briefing should be conducted by the appropriate supervisor and should include a review of facility status, problems with equipment, and evolutions in progress or planned for the shift. The detail of the briefing should be consistent with the amount and type of work occurring or scheduled. Additional items to cover during the briefing may include: • Shift orders • Lessons learned from events occurring elsewhere or during other shifts • Last-minute changes in facility status or operational functions • Support group work such as maintenance or construction • Changes to administrative procedures that affect methods of doing work, or changing procedural requirements • Facility maintenance shutdown schedule changes • Work/production goals Personnel briefings following days off, during times of facility shutdown, and during periods of intense support group activity may be more extensive. RELIEFS OCCURRING DURING THE SHIFT Turnovers occurring during the shift should meet the same objective as a turnover at the beginning of the shift. The oncoming person should be provided with an accurate status of the work station. Facility DOE-HDBK-1226-2019 Conduct of Operations Implementation 94

procedures should establish the requirements for relief of duties and responsibilities during the shift. If a turnover checklist is used at the work station for normal shift turnovers, that checklist or portions of it may also be considered for these reliefs. If a relief is necessary, the cognizant supervisor should be informed of the reason and expected length of time before the off-going person turns over the work station duties and responsibilities. Before authorizing the relief, the cognizant supervisor should ensure that the oncoming person is qualified and should verify that there are enough personnel to staff all required positions. At a minimum, the following turnover policies should be followed: • The transfer of duties and responsibilities should occur at a time when facility conditions are stable. • The off-going person should be confident that the oncoming person is fully capable of assuming the duties and responsibilities of the work station. • At the end of the turnover the oncoming person should signify to the off-going person that he/she is assuming the responsibility for the work station and document the transfer with an entry in the log in accordance with Section 12.0, Logkeeping. Depending on the work station, an instrumentation and control panel walkdown and document review may be necessary. The breadth and depth of the mid-shift turnover will depend on the safety importance of the job, the oncoming person’s familiarity with the work station, the length of time since the oncoming person has performed the duties and responsibilities of the work station, and the activities occurring at the work station. If a transfer of responsibility is necessary because of a physical injury, a qualified relief should assume responsibility for the work station and perform a full panel walkdown, log review, and review the most recent turnover checklist to gain the knowledge of present work station conditions. To ensure the best exchange of facility information, a discussion with the cognizant supervisor should also be performed. TURNOVER TO UNSTAFFED CONDITION AND RESUMPTION OF OPERATIONS The principles of operation turnover should also apply when the status of the facility or process is changing to unstaffed/staffed status (for example, single or periodic shift operation). Before placing the facility or operation in an unstaffed status (for example, after single-shift operation), off-going personnel should ensure that the facility or operation is in a safe and stable configuration approved by management and the narrative log accurately reflects that status. A turnover checklist may be used in conjunction with the narrative log to convey information. Work station information should be in sufficient detail to allow any person qualified at that work station to assume the position after reviewing the narrative log and turnover checklist. Since a verbal exchange of information may not occur between the off-going and oncoming personnel in this instance, the recorded information should be as clear and concise as if a face- to-face relief had occurred. Minimum turnover activities upon resuming operations should include a pre- shift walkdown, document review, shift brief, and supervisor evaluation of fitness for duty. DOE-HDBK-1226-2019 Conduct of Operations Implementation 95 14.0 CONTROL OF INTERRELATED PROCESSES General Concepts

Description. An interrelated process is a separate process that is not directly controlled by operations personnel, but can affect, or be affected by, an operator’s activities. It could be directly related to the safety or reliability of the facility, compliance with environmental and health requirements, fulfillment of the facility mission, or unrelated to any of these. An interrelated process may be the result of a specialized procedure such as testing or research (performed only once) or it may be an established routine. Control of interrelated processes consists of ensuring all operators are aware of and in control of the effects interrelated processes or activities may have on interrelated systems. Some processes that affect operations are not under the control of operations personnel, but are also not really “interrelated,” like a municipal water system providing firefighting water, or electric power and natural gas from commercial utilities. In these cases, contracts and memoranda of understanding provide the basis for operations and initial conditions for normal and emergency response procedures. Operators still should have knowledge of these processes and any limitations and precautions that may result from potential loss of services. Potential Effects. Interactions between operations and other processes can affect the safety and reliability of DOE facilities. In some cases, the interactions are anticipated in procedures and other operating documents. However, in many cases, an otherwise appropriate and permissible response to parameters in one system can produce an adverse effect in another system. To correctly interpret indications in a system, and to determine the best response, the operator needs an integrated knowledge of the process interactions within the facility. Effective operation also requires communication of relevant information between operators and process support personnel. In some cases, the operator has to communicate intended actions to the process support personnel to prevent problems in the interrelated process. In other cases, the interrelated process is capable of affecting operations, therefore requiring two-way communication between process support personnel and operators. The following examples illustrate some of the effects of interrelated process interactions. • A facility operates a chilled water system to support a variety of domestic and research needs. The system contains multiple chiller units which can be operated in combination to accommodate cooling loads. When personnel in a research project started several large pieces of equipment, the added cooling load caused the chilled water temperature to exceed the normal operating range before another chiller unit could be placed on line. This example illustrates how an interrelated process can affect an operator’s activities. The research project was an interrelated process to the chilled water system. Although the operator did not require detailed knowledge of the research project, integrated knowledge of the system interactions was needed. Effective communication with the research project personnel would have enabled the operator to anticipate the load increase and ensure that sufficient reserve cooling capacity was on line. DOE-HDBK-1226-2019 Conduct of Operations Implementation 96

• A periodic chemistry sample from a fluid system is used to evaluate the condition of the system components and determine their fitness for continued operation. Just before the sample was taken, the system operator started a pump that had been in a standby status. The change in flow characteristics caused contamination to be picked up in the sample. The indicated level of contamination normally signals equipment damage, which requires re-sampling the system and possible shutdown of equipment. This example illustrates how an interrelated process can be affected by an operator’s activity. To the operator, chemistry sampling is an interrelated process, even though it is routinely performed. To prevent adverse effects on the sample, the operator must have an integrated knowledge of the process interactions, in this case, how the sampling is affected by pump startup, and needs to inform chemistry support personnel of operating activities that can adversely affect sampling. This would permit coordination of operations and chemistry activities, and would have avoided the need for re-sampling. • Technicians working with radioactive materials needed to move the materials through an operational area of the facility. Following their procedures, they took all appropriate precautions to prevent the spread of contamination or personnel exposure during the movement; however, they failed to coordinate their movement with the operations supervisor. The materials set off an operational radiation alarm, causing the operations organization to respond as if an emergency had occurred. The movement of radioactive material may have had nothing to do with the facility operation or mission. However, the movement was capable of affecting operations and was not under the control of operations personnel; therefore, it constituted an interrelated process. If the technicians had coordinated their activities with the operations supervisor, the operations personnel would have prepared for the alarm and avoided the emergency response. In each of these events, the persons involved were properly trained and qualified to perform their own job responsibilities. What they lacked was knowledge of the effects their activities would have on other processes. Knowing how various processes were related to each other could have prevented each problem. Useful system knowledge in this regard may include: • Fundamentals of the applicable physical sciences, such as chemistry, physics, and thermodynamics • Purpose and fundamentals of system design • Normal and anticipated abnormal operating characteristics Training. Facilities should ensure that personnel at all levels have sufficient knowledge of interrelated processes to ensure safety and efficiency in the working environment. Training, job experience, and direct communication with process support personnel are all methods to provide this integrated knowledge to operators. Facilities should encourage personnel to be technically inquisitive, to detect, understand, and anticipate problems while monitoring process parameters, and to communicate effectively with process support personnel so appropriate and timely corrective actions can be initiated. DOE-HDBK-1226-2019 Conduct of Operations Implementation 97 OPERATOR RESPONSIBILITIES Management should establish written guidance specifying personnel responsibilities related to interrelated processes. Typical operator responsibilities include: • Monitoring applicable parameters

• Identifying trends, out-of-specification parameters, or adverse conditions • Initiating corrective actions • Consulting with process support personnel responsible and coordinating activities • Identifying the status of interrelated processes during operations turnover 14.1.1 Operator Knowledge Operating personnel should be knowledgeable about interrelated processes, especially aspects relating to process safety, that are affected by their work or that affect the workplace environment. This integrated knowledge enhances their ability to understand trends, problems, or potential problems. Such knowledge increases their ability to initiate corrective action, or to inform the process support personnel of the situation, and enables them to understand how their actions may affect the interrelated process. Integrated knowledge can be developed through training, experience, and communication. Facilities having formal training programs should include topics that provide a fundamental understanding of interrelated processes. Training should address the process theory, system design and components, and operating characteristics in sufficient depth that operators understand the interrelations. For example, the operator of an emergency diesel generator is not responsible for operation of the cooling water supply system, but the operator may benefit from basic training on the cooling water system to better understand the effect of diesel generator operation on the cooling water system flows and temperatures. Many facilities over the years have used cross-training (training for an alternate job) to familiarize personnel with interrelated processes. Cross-training may be part of a formal training program, or it may be performed by rotating personnel to different shift positions as part of an overall familiarization. Work experience gained through support of, or interface with, interrelated processes can enhance the integrated knowledge obtained through other methods. In some cases, direct communication between operators and process support personnel may be all that is necessary to ensure that the operator is aware of and considers the potential effects on interrelated processes. 14.1.2 Operator Response to Process Problems Personnel should be able to analyze process-related problems and take timely corrective actions. Proper response to process problems requires more than application of procedures. An understanding of the process is necessary in order to correctly interpret parameters and determine the appropriate response. Personnel should also be able to: DOE-HDBK-1226-2019 Conduct of Operations Implementation 98 • Anticipate the response in interacting systems or interrelated processes when changes are made to a process under their control • Anticipate changes in processes under their control in response to changes in processes controlled by others • Monitor facility conditions (including trends in operations), analyze available information, and diagnose problems • Evaluate degrading conditions and take action to prevent the potential consequences • Recognize the symptoms of abnormal and emergency conditions and prevent or minimize the consequences COMMUNICATION BETWEEN OPERATORS AND PROCESS PERSONNEL

Open lines of communication between operators and process support personnel are vital for interrelated process control. Prior to beginning activities that could affect an interrelated process, an operator should contact the appropriate process support personnel. This will enable work groups to coordinate interrelated activities. For the same reason, supervisors should include personnel from all affected activities in pre-job planning sessions and briefings. During abnormal and emergency situations, it is essential that all work groups function as a team to provide prompt corrective action. For groups of personnel to function effectively as a team, the individuals need both technical and teamwork skills. Team deficiencies, such as communications, considered insignificant during normal operations, become major obstacles to making decisions and initiating corrective actions during abnormal conditions. Effective communication between work groups, therefore, is an essential aspect of teamwork, and is vitally important to safe and reliable operations. DOE-HDBK-1226-2019 Conduct of Operations Implementation 99 15.0 REQUIRED READING A properly administered program for updating personnel with operations and administration information through required reading is essential to the safety of personnel, equipment, and the environment. Required reading provides a method to make employees aware of information related to their job assignments. It includes information such as lessons learned from industry operating experience, facility equipment and system changes, procedure changes, company policies, and human resource information. A required reading program can also supplement employee training by providing information that is not routinely included in a formal training program, or information that employees may be trained on at a later date. Managers should carefully consider their staff training program when assigning required reading. Personnel should be informed of the importance of questioning any information received through required reading when it is not understood. An effective required reading program will include a well-designed administrative procedure that tracks the information supplied to employees and the status of reading assignment completion. A required reading program that contains the following elements will enhance personnel knowledge and awareness, and hence enhance the safety and operations of any DOE facility. FILE INDEX The file index is a management aid for screening documents to ensure appropriate information is placed in the required reading file. It is a list of the documents, either by specific title or type, which should be screened for inclusion in required reading. Specific titles may be included so that document changes will be screened, while general types of documents would provide information that affects the operation of the facility. In addition, it should include the types of documents which require formal documentation that the information has been read. Examples of the types of documents to include in a file index are: • Procedure changes or revisions • Temporary modifications to systems or equipment • New or updated hazard communication information • Company reference manual changes • Policy changes • Related industry event reports • Occurrence reports • Regulatory changes that affect operations • Equipment operating manual changes • Industry operating experience information

• Other information necessary to keep operations department personnel aware of current area activities DOE-HDBK-1226-2019 Conduct of Operations Implementation 100 The appropriate manager or supervisor should develop the file index and include it in the administrative procedure governing the required reading program. The facility administrative systems should include subscriptions or other methods to ensure receipt and review of changes to the documents in the File Index. READING ASSIGNMENTS The appropriate manager or supervisor should assign employees to read only documents that pertain to them. Avoid the tendency to require all personnel to read all documents selected for required reading just because they work for the same organization. This will maximize program worth by maintaining personal interest in the reading assignments. For example, a document summarizing a recent occurrence may need to be read by all personnel; however, a change to a company policy regarding hazardous chemical use may not. Required reading documents should be kept in the required reading file in an accessible, known location. When documents cannot be co-located with the reading file, for example due to size or sensitivity, the required reading document log or a required reading sign-off matrix should indicate the location of the document. In the case of documents containing classified, Official Use Only, or Unclassified Controlled Nuclear Information, there are additional regulatory requirements for management to ensure that the documents are only assigned to persons with need-to-know and proper access eligibility, and that the documents are safeguarded in accordance with applicable laws, regulations, and directives. REQUIRED DATES FOR COMPLETING READING ASSIGNMENTS The appropriate manager or supervisor should assign a required completion date to the required reading document. When determining the date, the relative importance of the information to the employees should be taken into account. Some documents should be designated for immediate reading while others may be designated for general reading. Examples of immediate reading documents include: • Temporary modifications to a system • Procedure change • New or updated hazard communication information When documents are designated for immediate reading, a notification that the document has been issued should be placed in the timely orders to operators. See Section 16.0, Timely Instructions/Orders, for more information. General reading documents may have long-term or recurrent required completion dates, such as an annual requirement to review the company policy manual. In all cases, personnel are responsible to read the required reading assignments within the timeframe specified. DOE-HDBK-1226-2019 Conduct of Operations Implementation 101 DOCUMENTATION Personnel should document the completion of reading assignments by signature or initials. The documentation used should list the document title or description, required completion date, actual completion date, and a signature or initials verifying the completion of the reading assignment. The type of documentation used depends on the level of management responsible for tracking the required reading program. If the appropriate level of management is responsible for a multi-level organization, such as an Operations Manager responsible for five operating shifts, then the documents described in section 15.4.1 could be used. If the appropriate level of management is at a smaller scale, such as a first line supervisor responsible for fifteen people, then the documentation described in section 15.4.2 could be used. One additional method for documenting completion and tracking of required reading would be to use a computer-based system. Documentation that reading assignments have been completed should be retained as specified in DOE O 243.1B.

15.4.1 Example Documentation for Large Organizations This example system can be used by an organization at any level and has the ability to track several different groups of employees. An effective use of this system and forms is described as follows: The appropriate manager performs the following: • Assigns required reading documents for their staff and determine a completion date based on the urgency of the document. • Completes a Sign-off Sheet form (Exhibit 15-1). o Records the assignment group (such as the shift crew), document title or description, required completion dates, and the employee names. (Assignment groups and employee names may be preprinted on the forms.) o If a document applies to some employees but not others, records “NA” (Not Applicable) and initials the completion date block for employees who are not applicable. (Note 1 on Exhibit 15-1) • Completes a Required Reading Log entry with the document title or description, assignment group, and the required completion date (Exhibit 15-2). • Places the sign-off sheet in the correct section of the required reading file. Places the assigned document in the file as well, unless it must be located outside the file for size or other considerations. Notes the location of the document if necessary. • After all affected employees have completed the reading assignment, the manager records the completion date, initials the required reading document log, and discards the review sheet. • Retains the Required Reading Log in accordance with document control procedures. DOE-HDBK-1226-2019 Conduct of Operations Implementation 102 Exhibit 15-1: Example Sign-Off Sheet Assignment Group Mechanical Maintenance Operators Document Title or Description Detroit Diesel 16V71 Air Start Motor Replacement- new procedure, April 15, 2017. (New fastener torque specifications and lubrication process.) LOCATION: Diesel Maintenance Bookshelf, bin C-14 Required Completion Date: May 3, 2017 EMPLOYEE NAME COMPLETION DATE INIT COMMENTS Anderson Evans Graves N/A GCR Nowlin Note 1 DOE-HDBK-1226-2019 Conduct of Operations Implementation 103 Reviewed 12/29/16 Joe C Smythe No Comments Exhibit 15-2: Example Required Reading Document Log DOCUMENT TITLE OR DESCRIPTION ASSIGNMENT GROUP COMPLETION DATE SUPV INIT COMMENTS REQ’D ACTUAL Company Safety Manual, Chapter 3 All employees 10/10/2016 10/9/2016 JCS Deleted Maintenance Instruction A-53 Maint. Personnel 10/26/2016 10/26/2016 JCS Deleted Emergency Plan All Employees 11/16/2016 11/15/2016 JCS Deleted Safety Note 23 All employees 1/6/2016 1/6/2016 JCS Dead filed Detroit Diesel 16V71 Air Start Motor Repl. Proc Mechanical Maintenance Operators May 3, 2017 DOE-HDBK-1226-2019 Conduct of Operations Implementation 104 15.4.2 Example Documentation for Small Organizations A required reading sign-off matrix as shown in Exhibit 15-3 could be used by a small organization with no sub-groups. This system is simpler than the one for a large organization with several different groups of employees. An effective use of this system and form is described as follows: The appropriate manager performs the following: • Assigns required reading documents for their staff and determines a completion date based on the urgency of the document. • Records the document title or description, required completion dates, and employee names on the sign-off matrix. (Employee names may be preprinted on the form.)

• If a document applies to some employees but not others, records “NA” (Not Applicable) and initials the completion date block for employees who are not applicable. (Note 2 on Exhibit 15-3). • Places the sign-off sheet in the correct section of the required reading file. Places the assigned document in the file as well, unless it must be located outside the file for size or other considerations. Note the location of the document if necessary. Employees read the assigned documents and record completion date and initial. The organization retains the completed sign-off matrices in accordance with document control procedures. DOE-HDBK-1226-2019 Conduct of Operations Implementation 105 Exhibit 15-3: Required Reading Sign-Off Matrix D ue D at e 5 /1 2 /1 7 5 /2 2 /1 7 5 /1 6 /1 7 5 /1 8 /1 7 D oc um en t T itl e O r D es cr ip tio n C om pa ny S af et y M an ua l C h. 3 2nd Q ua rte r M ai nt en an ce O ut ag e Pl an C ha ng e 3 to st ar tu p pr oc ed ur e O P- 12 R ev ie w ed T o m C ra n d a ll NAME Date Init COMMENTS Anderson Evans Graves N/A TC Nowlin NOTE: Complete Reading Assignments and Record Actual Completion Date and Initials REVIEW The appropriate manager or supervisor should periodically review the required reading file to ensure completion of reading assignments by the required completion date. One method of formally Note 2 DOE-HDBK-1226-2019 Conduct of Operations Implementation 106 accomplishing this is by using a review sheet in the required reading file. The sheet should specify the review frequency and provide spaces for the reviewer’s signature and date of review. Another method, which is similar to that used when reviewing log books, would be to document the review on the required reading document log (see Exhibits 15-1 and 15.3). Completed required reading documents should be removed from the required reading file and retained for reference, normally at the time of the management review. If the document will ultimately become part of a permanent record such as a company policy, then the document need not be retained. ELECTRONIC REQUIRED READING SYSTEMS Facilities may elect to implement an electronic required reading program. Computer or tablet-based required reading programs offer advantages of reduced administrative burden, automatic record-keeping, linkage to watchbills to indicate people who must complete items before going on shift, and potentially reduced time for all personnel to complete requirements since duplicate copies of the material can be provided on multiple computers or tablets or on line. Electronic systems should be designed to provide features equivalent to paper systems: • Selective reading assignments with due dates and tracking of completion • Electronic signatures for employees to document completion • Copies of the assigned reading materials • Record retention per DOE O 243.1B • Notification to supervisors of completion status (both done and overdue) either in addition to or in lieu of supervisory reviews DOE-HDBK-1226-2019 Conduct of Operations Implementation 107 16.0 TIMELY INSTRUCTIONS/ORDERS Management often finds it necessary to provide written guidance and direction to employees, such as routine daily direction for operations, outlining activities during periods of maintenance, direction for operations on back shifts when management is not on site, upcoming events, or providing notice of an immediate document review located in the required reading file. Timely instructions and orders provide an efficient way for management to communicate with operating personnel and ensure important information is promulgated to the right people.

General Principles: Guidance should be provided in a formal and timely manner. Timely instructions and orders may be used whenever it is necessary to disseminate information to personnel concerning special operations, administrative details, or environmental, safety, and health issues. Timely instructions and orders should never be used to replace or change facility procedures. Timely instructions and orders should be governed by an administrative policy or procedure which specifically addresses the requirements for content, format, issuing, segregating, reviewing, and removing timely instructions and orders to ensure the process is standardized throughout the facility. ISSUING, SEGREGATING, REVIEWING, AND REMOVING TIMELY ORDERS 16.1.1 Issuing Timely Orders The cognizant manager is responsible for issuing timely orders to personnel. Orders should be issued as necessary and updated on a daily basis. The orders should be issued as either daily orders or long-term orders. Daily orders contain information such as: • The announcement of a procedure change or direction for a non-routine process. • They usually contain action items which will take place during the remaining portion of the day, the following day, or on weekends and holidays. Daily orders may be renewed by the cognizant manager when necessary. Long-term orders contain information such as a time-line of work activities during a maintenance period. When long-term orders are issued, a notice should be placed in the daily orders. 16.1.2 Segregating Timely Orders The orders should be placed in a timely orders book. This book should be maintained in a designated location for easy access. The timely orders book should be divided into two sections: daily orders and long-term orders. Daily orders include those that should be completed within one or two days. Long- term orders may take several days or longer to complete. As a general rule, orders in effect for an extensive period of time should be incorporated into a procedure or company policy. 16.1.3 Reviewing Timely Orders Daily orders should be reviewed by the appropriate individuals early in the work period prior to starting or resuming any affected activity. This review should be documented by signature or initials. Long-term orders should be reviewed periodically or when changes occur. It is a good practice to have supervisors DOE-HDBK-1226-2019 Conduct of Operations Implementation 108 review daily and long-term orders during daily briefings to ensure that the information in the order is disseminated to all personnel. The cognizant manager should be notified when action items are complete or when orders are postponed or delayed. 16.1.4 Removing Timely Orders The cognizant manager should review the timely orders book periodically to ensure that it only contains current orders. A good management practice is to review the book monthly. Timely orders that are no longer applicable should be removed or cancelled. These orders may need to be retained for reference. For requirements on the retention of documents, refer to DOE O 243.1B. 16.1.5 Electronic Systems Timely Orders can be managed electronically using computer or tablet platforms similar to the Required Reading systems in Section 15.6. CONTENT AND FORMAT 16.2.1 Content

Timely instructions or orders should be issued whenever it is necessary to communicate short-term information related to the conduct of facility business. They may be used in either shift or daily work environments, but specifically when there is a need to provide direction or information to work-force personnel in the absence of cognizant management. Examples of the types of information to include in timely orders are: • Notification of work priorities • Special operations • Non-routine tests • Data collection programs • Upcoming events and audits • Announcements of administrative items, policies, procedure changes, or specific activities • Notice of documents requiring immediate review in the Required Reading File The information in timely orders should not conflict with or change procedures; however, they may be used to notify personnel of a procedure change or revision, or issuance of a new procedure. 16.2.2 Format Timely orders should be clearly written and dated. A 24-hour clock format is recommended for concise and unambiguous entries. They should include the length of time the order is to be applicable or a cancellation date. Timely instructions and orders should include provisions to document review by DOE-HDBK-1226-2019 Conduct of Operations Implementation 109 appropriate personnel. Examples of daily and long-term orders are shown in Exhibits 16-1, and 16-2, respectively. Exhibit 16-1: Example Daily Order Initial/date after review: To: All Supervisor Allen From: Area Manager Johnson Duration Jan. 17, 2017 at 1700 to Jones Jan. 18, 2017 at 1700 Pratt Smith Turner Daily Orders A copy of a new procedure has been placed in the Required Reading File: OP-EV-0082, Pumping Out Evaporation Pit, 101-C. Ensure all applicable personnel have reviewed this procedure prior to performing the evolution or shift completion. JONES - Lock out No. 1 air compressor in 101-1A per lockout order OP-2017-531 for overhaul to be ready to work 1/18/17 at 0730. A shipment of low level waste (LLW) is expected during second shift. After receipt, begin characterization of waste for emplacement. Contact the Operations Manager if shipment has not arrived by 1830. Review long-term orders. A new order outlining the work activities for the upcoming maintenance period is in effect. General Information: 1. See attached 1/13/17 Safety Committee meeting minutes. Post in Briefing Room and Lunchroom. Quality Attention to Detail. We must pay attention to detail during our monitoring of equipment. This often means going beyond simply taking the data. It means being inquisitive, looking for problems before they arise, and observing all indications. By paying attention to detail, we can significantly reduce the number of potential problems. DOE-HDBK-1226-2019 Conduct of Operations Implementation 110 Exhibit 16-2: Example Long-Term Order Initial/date after review: To: All Supervisors Allen From: Area Manager Johnson Jones Pratt Cancellation Date: 2/15/17 Smith Turner Long-Term Orders 1. The first quarter maintenance period begins 1/20/17 and is scheduled to end on 2/14/17. Review the attached work schedule. Daily briefings will be held at the beginning of each work period throughout the maintenance period. The daily briefings will be held in Bldg. 101 conference room. All work groups involved in the maintenance must attend. At 0700 each day, all supervisors will meet in Bldg. 101 conference room and submit a written status report.

2. Transuranic (TRU) waste is no longer being accepted due to current state litigation proceedings. If a TRU waste shipment arrives, DO NOT RECEIPT THE SHIPMENT, CONTACT THE OPERATIONS MANAGER IMMEDIATELY. 3. See revised training schedule for January (attached). Post in Bldg. 101 and distribute copies to all personnel. All personnel should know when they are scheduled and should attend as scheduled. 4. Continue measuring conductivity of potable water (PW) as requested by Engineering. These measurements will be used for determining the best instrument to measure conductivity in the potable water system. Our effort now will help us in the future by having reliable instruments! DOE-HDBK-1226-2019 Conduct of Operations Implementation 111 17.0 TECHNICAL PROCEDURES The Handbook does not discuss Technical Procedures because the Department adopted national consensus standards AP-907-001, Procedure Process Description and AP-907-005, Procedure Writers’ Manual, published by the Procedure Professionals Association and available free online at http://www.ppaweb.org. 18.0 OPERATOR AID POSTINGS General Concepts Purpose and Examples. Operator aids provide ready-to-hand information for personnel to use during the performance of tasks. This information may be in the form of a system drawing, copy of a procedure, information tag or sheet, curve, chart, or graph. Posted copies of procedures or portions of procedures that are used as operator aids may be useful when the performance of a task makes it impractical to refer to a procedure in a manual, as may be the case when a task requires the use of both hands. Operator aids may help the operator identify problems that might be encountered during performance of a task, or they may present a simple diagram or schematic of equipment, systems, or areas. Other examples of operator aids include: • A list of approved facility communication terms, abbreviations, and emergency numbers posted by communication equipment • A graph of flow versus pump speed for a variable speed pump hanging beside the pump speed control switch; • A simple diagram of control knobs, valves, and switches for infrequently used equipment • Specifications for a particular step in a task Following the process below will help to ensure that only useful operator aids are posted, and that they remain updated during their use. Currency, Accuracy, and Application. Operator aids need to reflect the most current information and cannot conflict with any procedures or requirements. Using operator aids containing outdated or incorrect information may cause harm to personnel or damage to the equipment, system, area, or facility. When operator aids are developed for other than normal operations (such as emergencies), it is a good practice to clearly identify the circumstances under which they apply. Research Basis. Developing useful operator aids may require intensive research and forethought. The information presented in the operator aid should be factual and clear to all intended users. A thoroughly developed operator aid will ensure that the approver and reviewers better understand its need and usefulness. During the development process, reviews by applicable technical personnel may be helpful to ensure clarity. DOE-HDBK-1226-2019 Conduct of Operations Implementation 112

Review and Approval. An initial review and approval process verifies that the information contained in an operator aid is accurate and useful. This process officially authorizes its use. Periodic reviews will help ensure that the information is kept up-to-date and will verify the continued usefulness of the operator aid. Obsolete, conflicting, or non-useful operator aids should be promptly removed to eliminate personnel confusion when performing tasks. Document Control. Documentation of operator aids is essential to proper control. Maintaining a centrally located file of all operator aids will enhance the periodic review process. This file will help personnel quickly review and take action to correct, update, or remove obsolete operator aids as necessary. Listing reference documents used in the development process facilitates finding and updating operator aids when reference information changes. Posting Criteria. An operator aid should be posted in a conspicuous place where it can be seen by the operator who needs to use it while operating controls or reading instruments. If the operator aid blocks instruments or controls, it will be more of a hindrance than a help. Attachment methods should be suitable to the posting surface and the environment to ensure that the operator aid remains posted. An operator aid will be of little use if it comes loose and falls from its desired location. Role of the Operator. The operator is one of the most important elements in ensuring the success of the operator aid program. Using only approved and current operator aids will help ensure the operator aid promotes safe and efficient operation. Operators should identify and report unapproved or incorrect operator aids at their work stations. This will ensure that the operator aids remain a useful tool in conducting business safely at their facility. Potential Improper Uses. Facility operators should guard against using operator aids as substitutes for more appropriate systems or controls • Procedure Maintenance. Operator aids may be developed to supplement procedures, but should not be developed to correct or update procedures. Only procedure changes and revisions should be used to alter procedures. • Lockout/Tagout. Operator aids cannot substitute for lockout/tagout protection of personnel or administrative lockout for protection of equipment. The facility lockout and tagout procedures should address the correct mechanisms for protecting personnel and equipment. • Labels. Operator aids should not be used to label equipment and piping. Guidance concerning labeling should be provided in the facility’s equipment and piping labeling program discussed in Section 18.0, Equipment and Piping Labeling. OPERATOR AID DEVELOPMENT Facility personnel should be encouraged to develop needed operator aids, but management should concur on the need before expending resources on developing operator aids. Therefore, all personnel, including support personnel, should be aware of the operator aid development process. Prior to developing an operator aid, personnel should be trained on the development process. As a minimum, this training DOE-HDBK-1226-2019 Conduct of Operations Implementation 113 should cover the importance of controlling posted information and the procedure or guidelines for developing an operator aid. Information control topics should include the following: • Why it is important to use only approved operator aids

• How to tell if an operator aid is approved • What to do if it is not approved • How to verify that an operator aid is current When developing operator aids, personnel should use the most current information. This may require communicating with personnel in the facility’s document control organization to ensure that the most current revisions of reference documents are being used. To ensure the operator aid is correct, the developer should communicate with other users, competent technical authorities such as safety engineers, and the cognizant supervisor. An operator aid submitted for approval should contain the reference information that the approver will need to ensure that the operator aid is necessary and accurate in all particulars. Including this information with the operator aid will minimize the time required for approval. To ensure that the proper information accompanies each operator aid that is submitted, an operator aid approval sheet, which contains spaces for this information, could be used. Exhibit 18-1 contains a sample operator aid approval sheet. If operator aids are developed for other than normal operations, they should clearly identify their intended purpose. For example, if an operator aid is developed for a temporary system, it may contain the title “Temporary System Operator Aid” or may be developed using a different color paper. If an operator aid is only to be used for a limited time or in certain situations, it should so state. Operator aids should be prepared in a professional manner (see Exhibit 18-3). Operator aids submitted for approval should be identical, or as close as possible to the size, format, material and quality of the proposed operator aid. This will allow the approver to see how the operator aid will appear, before it is approved. Preparing an operator aid, particularly one with complex figures or drawings, may require support from specialists such as graphic artists. APPROVAL After an operator aid is developed, it requires approval before posting. At a minimum, the facility operations manager should approve the operator aid. Support organization personnel desiring an operator aid should submit the proposed information to the operations manager for approval. The person responsible for approving the operator aid should verify that: • The operator aid is necessary. This verification will limit the number of operator aids posted in the facility. • The operator aid is not taking the place of an administrative mechanism such as a procedure change. DOE-HDBK-1226-2019 Conduct of Operations Implementation 114 • The operator aid is correct and does not contradict or alter procedures. The documents and technical authorities referenced for the submitted operator aid should be consulted to verify correctness. Using an operator aid approval sheet should enhance this process since all of the information is listed in one convenient location. If the approver verifies that the operator aid is necessary and correct, the approver should sign and date the operator aid to signify approval. Once approved, the operator aid should be documented and routed for posting. If the operator aid is not approved, it should be returned to the developer with an explanation concerning its disapproval and requirements for resubmittal and final approval. DOCUMENTATION

All approved operator aids should be documented. At a minimum, a listing of all approved operator aids should be maintained, along with a reference copy of each operator aid. The reference copies should be used to replace missing or damaged operator aids. If an operator aid approval sheet is used, it should be kept with the copy of the operator aid. All operator aid documentation should be kept in a specified location such as the operation supervisor’s office. The listing of all approved operator aids, also called an index, serves as a record for all operator aids posted in the facility. This index should contain the operator aid’s control number, title, reference documents, posted location, approval signature and date, and removal signature and date. If an operator aid approval sheet, which contains this information, is used, the index would not need to duplicate all of the information. Exhibit 18-2 contains a sample operator aid index sheet for both cases. Notes for Exhibit 18-1: Operator Aid Control No. The next sequential number for operator aid issuance. Description A description of the operator aid. Reason for Posting An explanation of the need for the operator aid. Posting Location The desired location for posting the operator aid. Reference Documents Any documents that were used to obtain the operator aid information, such as procedures or drawings. If the document has a revision, the revision number should be listed. Developer The name and position of the person developing/requesting the operator aid. Department The department of the developer. Reviewers The names and positions of all additional technical personnel involved in the initial development and approval process. Approval Signature The approver’s signature, position, and date signed signifying the operator aid is necessary and correct, and approved for posting. Audited When an operator aid is audited the auditor dates and initials the next open line signifying the operator aid is still necessary and correct. DOE-HDBK-1226-2019 Conduct of Operations Implementation 115 Exhibit 18-1: Sample Operator Aid Approval/Audit Sheet Operator Aid Control No: Operator Aid Name: Description: Reason for Posting: Posting Location: Reference Documents: Rev. No.: Rev. No.: Rev. No.: Developer: Date: Department: Reviewers: Approval Signature: Date: Audited: Date Initial Date Initial Date Initial Date Initial DOE-HDBK-1226-2019 Conduct of Operations Implementation 116 Exhibit 18-2: Sample Operator Aid Index Sheets OPERATOR AID INDEX SHEET USED WITHOUT OPERATOR AID APPROVAL SHEET Operator Aid Control Number Title of Operator Aid Reference Documents Posted Location Approval Signature/Date Removal Signature/Date OPERATOR AID INDEX SHEET USED WITH OPERATOR AID APPROVAL SHEET Operator Aid Control Number Title of Operator Aid Approval Signature/Date Removal Signature/Date DOE-HDBK-1226-2019 Conduct of Operations Implementation 117 To assist in tracking operator aids, each operator aid should be assigned a unique control number. One method of assigning control numbers is to use a sequential serial number. As an example, operator aid control number 2018-02 would indicate the second operator aid issued for the year 2018. A system, such as a binder, should be used to maintain the operator aid information. This binder may include a copy of the operator aid development procedure or guidelines, the operator aid index, and a reference copy of all operator aids. If an operator aid approval sheet is used, it should be filed in the binder with its associated operator aid.

PLACEMENT Approved operator aids should be posted in proximity to the area of expected use. They should not obscure instruments or interfere with controls. An operator aid should be firmly attached at the specified location. The attachment method should be compatible with the environment. A form of attachment should be used such that when the operator aid is no longer needed, it can be readily removed, and if necessary a replacement copy can be posted. The posted operator aid should be protected from the environment. If an operator aid is located in an area where it might become wet, oil-stained, or otherwise unusable, it should be laminated, placed in a clear plastic pouch, or made of material that will withstand the environment. Using a paper copy of the operator aid placed in a clear plastic pouch is a suitable, inexpensive method. USE OF OPERATOR AIDS Operator aids should be viewed as a convenience to the individual using them, not a requirement. Although copies of procedures or portions of procedures can be used as operator aids, the requirement is to follow the procedure. The operator aid makes it easier for the operator to follow the procedure, because the procedure is conveniently posted, but there should be no requirement to use operator aids instead of the procedure in the manual. All personnel should be trained on the need for controlling posted information. This training should cover why it is important to use only approved operator aids, how to tell if an operator aid is approved, what to do if it is not approved, and how to verify that an operator aid is current. When an operator aid is used, the user should verify that it is approved. If the posted information is not approved, the person should not use it and should notify the supervisor. A decision should be made whether to submit the operator aid for approval or remove it. If the operator aid is unusable because of wear or dirt, the operator should obtain a new copy of the operator aid. When the need for an operator aid no longer exists, an operator or the developer/organization originating the operator aid should notify the appropriate supervisor and ensure that the operator aid is disposed of in accordance with facility policies and procedures. DOE-HDBK-1226-2019 Conduct of Operations Implementation 118 REVIEW OF OPERATOR AIDS Posted operator aids should be reviewed periodically to ensure that they are still correct, necessary, and do not supersede or conflict with controlled procedures or information. A person or persons should be assigned the responsibility for auditing the operator aid index to ensure that only currently posted aids are recorded on the index. This person should verify that each operator aid listed in the operator aid index is still posted and necessary. This determination should be made through discussion with the affected operators. If it is still necessary, the auditor should verify the location is the same as that recorded on the operator aid index sheet or the operator aid approval sheet and that each operator aid is legible and in good condition. No unapproved pen-and-ink changes should exist. The auditor should also verify that the information contained in the operator aid is current and applicable. If the operator aid is still needed but is missing, a new copy should be posted. If the operator aid is no longer needed, the reference copy should be removed from the operator aid binder and the operator aid should be deleted from the index and the removal signature and date block of the index should be completed.

Since operator aids may be copies of graphs, curves, or procedures, the information is subject to change as the reference documents are revised. Therefore, the reference documents should be periodically checked for the latest revision numbers. If an operator aid’s reference document has changed since the creation of the operator aid, the operator aid should be updated. One way to ensure that revisions are incorporated into operator aids is to notify document control personnel of those operator aids that are derived from controlled documents. This would effectively place the appropriate persons on the document control system distribution list for the specified parent documents. When a revision is made to one of these controlled documents, document control would notify the affected control area of the affected operator aids. The assigned reviewer for that area would then determine if operator aid changes were necessary. In addition to a formal periodic review of all operator aids, personnel should be instructed to review operator aids at their work stations to ensure they are approved and correct. This may be done during routine work station tours, or as a separate inspection. If unapproved operator aids are found, they should be reviewed and submitted for proper approval, or removed if determined to be unnecessary. DOE-HDBK-1226-2019 Conduct of Operations Implementation 119 Exhibit 18-3: Sample Operator Aids Prepared by: _____________________________ Date: _____________ Approved by: _____________________________ Date: _____________ Number: DOE-HDBK-1226-2019 Conduct of Operations Implementation 120 LUBE OIL TANK SIGHTGLASS LEVEL CONVERSION CHART Since the sight glass on the lube tank to the emergency Diesel Generator is incremented in inches and our lube oil consumption reports are in gallons, the following chart should be used to convert level in the lube oil tank to gallons. Prepared by: Date: INCHES GALLONS Approved by: Date: 20 104.0 Number 19 98.1 18 92.0 17 85.9 16 79.7 15 73.4 14 67.2 13 61.0 12 54.9 11 48.8 10 42.9 9 37.1 8 31.4 7 26.1 6 20.9 5 16.1 4 11.6 3 7.6 2 4.2 1 1.5 D O E-H D B K -1226-2019 C onduct of O perations Im plem entation 121 CIRCULATING WATER SYSTEM EAST CONDENSER WEST CONDENSER FROM INTAKE STRUCTURE ~ MOV-5311 MOV-5305 MOV-5306 M ixing Basin MOV-5312 PREPARED BY:~ DATE 5/3/2017 APPROVED BY:~ ~ DATE 5/3/2017 NUMBER: 2017-76 A B MOV-5326A MOV-53269 (DILUTION TO MIXING BASIN) (CT SLOWDOWNS) DOE-HDBK-1226-2019 Conduct of Operations Implementation 122 19.0 EQUIPMENT AND PIPING LABELING General Concepts Uses of Labeling. An effective labeling program will clearly identify each component required in the operation of the facility, warn of specific hazards, and clearly identify emergency equipment. Effective labeling will enhance training effectiveness and help reduce operator and maintenance errors resulting from incorrect identification of facility equipment. Effective labeling will help reduce personnel exposure to radiation or hazardous materials by reducing the time spent identifying components. For example: • Piping labels that identify the contents, or at least the type of hazard represented by the contents, and the normal direction of flow will aid in preventing or mitigating leaks and spills. • Labels on electrical equipment identifying the applicable feeder panel or breaker will aid in isolation for lockout/tagout, and will aid in quick and accurate response to equipment emergencies.

Design. Labels should be designed to present information in a manner that will enhance operations and maintenance. For example: • The equipment names and number designations used on labels should be consistent with those used in procedures and drawings. • Label size, placement, arrangement, fabrication materials, color coding, lettering size and type style can all affect the usability of labels. American National Standards Institute (ANSI) Standard Z535.4-2011, American National Standard for Product Safety Signs and Labels provides detailed guidance on designing effective and readable labels and signs. An effective labeling program is an ongoing process, as the following examples illustrate: • Maintenance activities involving removal or replacement of equipment may also result in loss or misplacement of component labels. • Spills, passage of time, or other environmental factors may cause labels to become damaged or unreadable. • Equipment modifications may result in new label requirements. Facility procedures should provide instructions for temporarily labeling components, and a central point of contact to ensure timely response to ongoing labeling requirements. DOE-HDBK-1226-2019 Conduct of Operations Implementation 123 COMPONENTS REQUIRING LABELING Facilities should establish written guidelines for labeling components, systems, and hazards that personnel may be expected to encounter in the course of their work. The following items should be considered for the labeling program: • Cabinets and their internal components • Circuit breakers • Electrical busses • Electrical distribution and lighting panels • Emergency equipment (such as fire alarm stations) • Equipment components (such as motors and valves) • Equipment subsystems • Exits, evacuation routes • Facility location codes (such as building numbers) • Floor drains • Fluid and gas lines (piping, ventilation, ducts) • Fire protection systems and equipment • Fuse blocks or fuse locations • Gauges, meters, and other indicators • Major equipment systems (such as HVAC) • Motor control centers • Protective equipment, first aid equipment, safety devices • Room doors (list major equipment inside hazardous or radiation areas) • Safety hazards and warnings • Storage containers, cabinets, storage spaces • Test equipment, special tools LABEL INFORMATION A label should provide a concise and meaningful verbal description of the function of an item being identified, and a unique alphanumeric code identifying the system and component, as shown in Exhibit 19-1. Noun names and alphanumeric codes used on labels should be consistent with those used in all facility procedures, round sheets, alignment checklists, engineering drawings, and piping and instrument diagrams. Information on control panel labels should be consistent with the information on labels attached to the equipment being controlled. Alphanumeric codes should be developed in a manner that DOE-HDBK-1226-2019 Conduct of Operations Implementation 124 will aid personnel in consistently identifying the correct component and prevent misidentification. For example, two parallel motor control centers may be identified as MCC-1A and MCC-1B, but identifying them as MCC-1A and MCC-1-1A may lead to confusion. Abbreviations and acronyms used on labels should come from the facility’s approved list of abbreviations and acronyms and should be commonly understood. Exhibit 19-1: Label Information

In some facilities, particularly where duplicate systems or parallel trains of equipment are used, additional identifying information may be required to ensure that each label uniquely identifies a single component. Any abbreviations or acronyms used in noun names, system designator codes, or component function codes should be standardized, commonly understood, and identified on the facility-approved list. It may be helpful to list systems and components by name and by designator to make it easier for personnel to locate the correct name associated with a label code. Example lists of system designator codes and component function codes are shown in Exhibit 19-2. Additional considerations for specific components: • Labels installed on electrical cabinets, panels, and equipment should indicate the maximum voltage present. • Labels placed outside doors to rooms should identify the major equipment items contained within. • Labels for electric motors and other electrical equipment should identify the power supply (for example, a distribution panel or circuit breaker). • Labels for pneumatic actuators should identify the respective isolation valves. • Labels on piping should indicate the contents (or hazard) and the normal flow direction. • Piping containing radioactive fluids, toxic materials, or explosive gases should be uniquely marked. DOE-HDBK-1226-2019 Conduct of Operations Implementation 125 Color coding or shape coding can enhance the information presented on a label. For example, facilities having multiple units or parallel trains of equipment may color code labels using a distinctive color for each unit or equipment train, or they may code each unit with a unique label shape (square, round, triangular). Color coding can also be used to identify functional groups of components, such as components connected to the emergency power bus. When color coding is used, it should be applied consistently and have only one meaning for each color or combination of colors. In some facilities, bar coding is added to equipment labels to facilitate automated data taking or maintenance tracking. Facilities involved in extensive relabeling of existing equipment or installation of new equipment or systems may find it worthwhile and cost effective to add bar coding. Exhibit 19-2: Example System Designator and Component Function Codes System Name Code Component Code Air, Compressed CA Air Handler AHU Air, Instrument IA Annunciator ANN Electrical, Low-Voltage (<240V) ELLV Circuit Breaker CB Electrical, Medium-Voltage (>240V, <4.16kV) ELMV Compressor CMP Fire Protection FPS Condenser COND Heating, Ventilation, & Air Conditioning HVAC Damper DMP Steam, Heating HTS Heat Exchanger HX Steam, High Pressure HPS Indicator, Current (Electric) II Waste, Process Liquid LPW Indicator, Flow FI Waste, Sanitary SWR Indicator, Voltage EI Water, Deionized DIW Motor Control Center MCC Water, Domestic DW Pump PMP Transformer XFMR Valve, Air-Operated AOV Valve, Motor-Operated MOV LABEL DESIGN AND PLACEMENT 19.3.1 Label Materials and Attachment Label materials (including adhesives and other means of attachment) should be compatible with the components and environment where they are used. Labels made with embossed plastic tape frequently curl and fall off the panels to which they have been attached. Metal labels or wire attachments made of dissimilar metals can cause galvanic corrosion of the component, label, or attachment device. Use of adhesives containing chlorides can cause corrosion of stainless steel components. High-temperature, humidity, chemical, or radiation environments may preclude the use of certain label materials.

DOE-HDBK-1226-2019 Conduct of Operations Implementation 126 Labels should normally be constructed of non-reflective materials. This helps ensure readability of the label under a variety of lighting conditions. Labels may require the use of reflective or phosphorescent materials for readability in dim light or during blackout conditions. Labels for components should be permanently attached to the components in a way that will not interfere with the normal operational use or testing of the component. For example, a valve label should be attached to the yoke, not to the handwheel. Valves operated by reach rods or chains, or other remotely operated components, should have an additional label installed at the operating device. Labels for chain operators should be attached to a small piece of tubing through which the chain passes, so the label always remains at the bottom of the chain loop. If the valve is difficult to see from the operating location, the label should indicate the open and close direction for the chain or other operator. 19.3.2 Label Readability Labels should be readable from the normal operating location or position; an operator should not be required to manipulate the label before reading it. The character height of label text should be based on the reading distance, available illumination, and importance of the information. Annex B to ANSI Z535.4-2011 provides examples and calculations for label text size. As an example, the recommended text size for word messages under favorable reading conditions at two feet reading distance is the equivalent of 12-point type. The standard provides recommendations for other reading conditions and distances. For piping labels (discussed separately below), the applicable ANSI standard calls for larger text. If possible, the text of all labels should be oriented as shown in Exhibit 19-3a. Labels for vertical runs of piping and conduit may require that the label be oriented vertically. When vertical labels are necessary, the text should be oriented as shown in Exhibit 19-3b. Labels should never be oriented like those shown in Exhibit 19-3c. Exhibit 19-3: Samples of Component Labels Exhibit 19-3a. Preferred orientation for labels. Exhibit 19-3b. Acceptable orientation for vertical labels. Exhibit 19-3c. Unacceptable label orientation DOE-HDBK-1226-2019 Conduct of Operations Implementation 127 19.3.3 Label Placement Labels should be placed on or near the components being identified in a manner that clearly associates the label with its respective component and removes any ambiguity. Labels on control panels should be consistently placed above, below, or on components so that the operator is conditioned to finding and identifying information accurately. However, even when labels are placed consistently above or below components, the results can be confusing, as shown in Exhibit 19-4. Exhibit 19-4: Labels Evenly Spaced Between Components To accurately identify the correct label with each component in the portion of the control panel illustrated above, the operator would be required to search for indications of the labeling system used, by checking the top of the panel, the bottom of the panel, or a separate legend. This increases the chance of identification errors. DOE-HDBK-1226-2019 Conduct of Operations Implementation 128 Where control panels contain many rows or columns of equally spaced components and labels, the facility can reduce the risk of misidentification by “connecting” the labels to the components they identify using brackets or tie lines, as shown in Exhibit 19-5.

Exhibit 19-5: Labels Tied to Components DOE-HDBK-1226-2019 Conduct of Operations Implementation 129 Another approach to labeling control panels is to place each label closer to the component it identifies than to any other component. The label for a control device such as a switch should be placed above the control so the operator’s hand does not block view of the label when operating the control. This method is illustrated in Exhibit 19-6. Exhibit 19-6: Labels Placed near the Component They Identify DOE-HDBK-1226-2019 Conduct of Operations Implementation 130 A final refinement for control panel labeling is the design of escutcheon plates—labels that enclose or surround each control panel device. These plates may be simple shapes, or they may be designed as graphic illustrations of the component being monitored or controlled, as shown in Exhibits 19-7 and 19-8. Exhibit 19-7: Simple Escutcheon Plate Label Exhibit 19-8: Graphic Escutcheon Plate Labels COLOR CODING Color coding may be used in a number of ways to enhance the labeling of equipment and piping, as discussed below. When color coding is used, it should be applied consistently and have only one meaning for each color or combination. 19.4.1 Highlighting Critical Component Controls or Groups of Controls One common use of label color coding is to provide easy recognition of critical controls, such as emergency stop or emergency shutdown controls. The use of red-on-white or white-on-red labels for these controls can set them apart from the standard labels used on the remainder of the control panel. To DOE-HDBK-1226-2019 Conduct of Operations Implementation 131 further accentuate critical controls or groups of controls, red functional demarcation lines can be used in association with red labels. 19.4.2 Associating Related Controls and Displays The design of some control panels places gauges, meters, and other quantitative displays on an upper section of the panel and the associated controls on the lower section of the panel. Color coding can be used to help operators rapidly make the correct associations between control-display pairs. Methods include: • Color-coded display bezels or labels, with matching color control handles or labels • Color-coded paint patches on the control panel surface surrounding displays and controls 19.4.3 Preventing Wrong-Unit, Wrong-System, or Wrong-Train Errors Wrong-unit errors can occur in the performance of operations or maintenance when identical components are used in parallel units. To reduce the errors, a unit color code can be applied to: • Labels • Floors • Walls • Doors • Equipment bases, pedestals, and curbing • Backgrounds of stencil marking • Valve handwheels • Paper used for procedures or other unit-specific documents Errors in identification also occur when similar or identical components are used in more than one system. This might occur, for example, when similar piping is used or identical electrical components are installed. Color-coded labels and other color-coding methods may be used to alleviate this problem. Some facilities have applied color-coded paint to all painted components of designated systems. For example, all piping and components of the compressed air system are painted blue, the lube oil system is painted orange, and the steam system is painted tan, and so on. 19.4.4 Showing Functional Demarcation of Controls

Functionally related groups of control panel components can be identified by using taped demarcation lines or the “paint patch” or “color patch” method. When using taped demarcation lines, standard operating controls may be grouped using black lines, critical controls red lines, and annunciator controls orange or yellow lines, as illustrated in Exhibit 19-9. The “paint patch” or “color patch” method (see Exhibit 19-10) usually consists of a different color background on the control panel for each system, matching the paint colors used on facility components and piping. Use of demarcation lines that are too bold, or extensive use of color in either of the above methods, can result in a control panel that is visually overwhelming. Consultation with graphic arts or visual communication arts personnel may help avoid problems in this area. Facilities choosing to use color coding may benefit from testing on a full-scale mockup before applying the coding system to control panels and components. DOE-HDBK-1226-2019 Conduct of Operations Implementation 132 Exhibit 19-9: Demarcation Lines on a Control Panel DOE-HDBK-1226-2019 Conduct of Operations Implementation 133 Exhibit 19-10: Color Patch Method on a Control Panel DOE-HDBK-1226-2019 Conduct of Operations Implementation 134 PIPING LABELS A standard published by the American National Standards Institute, ANSI A 13.1-2007, Scheme for the Identification of Piping Systems, specifies a method for identifying the contents and hazards in piping systems. A standard method of identification is particularly important when components in piping systems may be operated or manipulated by personnel from outside the facility, such as firefighters or outside maintenance personnel. The ANSI standard identifies the following practices for labeling piping systems: • The legend (text) of the label identifies the contents of the piping (water, sulfuric acid) and the hazard (high pressure) • Arrows indicate the direction of flow • The label and arrow, or the pipe itself, should be color-coded to indicate the contents and level of hazard Exhibit 19-11 shows the ANSI standard’s color codes. Exhibit 19-11: ANSI Practices for Labeling Piping Systems (ANSI/ASME A13.1-2015) COLOR CODE Letter color on Field color EXAMPLE Material Properties FLAMMABLE Black on Yellow →HYDROGEN → Fluids which are a vapor or produce vapors that can ignite and continue to burn in air COMBUSTIBLE White on Brown → ACETIC ACID → Fluids that may burn but are not flammable TOXIC & CORROSIVE Black on Orange → NITRIC ACID → Fluids which are corrosive or toxic or will produce corrosive or toxic substances FIRE QUENCHING White on Red → HALON → Water and other substances used in sprinkler fire fighting piping systems OTHER WATER White on Green → BOILER WATER → Any other water, except for fire fighting piping systems COMPRESSED AIR White on Blue → NITROGEN → Any vapor or gas under pressure that does not fit in a category above DEFINED BY USER White on Black → USER DEFINED → DEFINED BY USER Black on White → USER DEFINED → DEFINED BY USER White on Purple → USER DEFINED → DEFINED BY USER White on Grey → USER DEFINED → DOE-HDBK-1226-2019 Conduct of Operations Implementation 135 19.5.1 Pipe Label Placement Position pipe labels so that they can be easily seen from the normal angle of approach—for instance, below the centerline of the pipe if the pipe is overhead, and above the centerline if the pipe is below eye level. Pipe labels should be placed:

• Adjacent to all valves and flanges • Adjacent to all changes of direction • On both sides of wall or floor penetrations • At regular intervals on straight runs Fifty feet is the acceptable maximum linear spacing, but closer spacing might be necessary for visibility. On many piping systems, there will be valves, actuators, and transmitters that can be tricky to label with adhesive pipe marking. Accessories such as valve tags or pipe grabber sleeves can make labeling these awkward places quick and easy. 19.5.2 Pipe Label Size Pipe diameter determines the appropriate label and text sizes, as shown in Exhibit 18-12. Exhibit 19-12: Pipe Diameter Determines Label and Text Sizes Outside Pipe Diameter (including insulation) Minimum Length of Label Minimum Letter Height Inches mm Inches mm Inches mm .75–1.25 19–32 8 203 .5 13 1.5–2 38–51 8 203 .75 19 2.5–6 64–152 12 305 1.25 32 8–10 203–254 24 610 2.5 64 >10 >254 32 813 3.5 89 REPLACING LABELS 19.6.1 Identifying Lost or Damaged Labels Facilities should establish procedures to ensure that missing, damaged, or incorrect labels are promptly replaced. Since labels may be removed or misplaced during maintenance activities, facility procedures should require operators to verify labels when the equipment is returned to service. Operators performing component alignments or rounds should verify that labels are present, readable, and undamaged. A column can be added to valve line-up sheets or system alignment checklists to ensure that label condition DOE-HDBK-1226-2019 Conduct of Operations Implementation 136 and accuracy are checked during system line-ups. Checks may also be added to preventive maintenance or other procedures to ensure that components are correctly labeled. Operators should watch for use of informal labeling methods such as a black marker, as these may represent places where formal labeling should be applied. 19.6.2 Providing New Labels The operations manager, or other designated management authority, should review and approve all requests for new or replacement labels. Labeling requirements should also be evaluated during the planning of design changes or temporary modifications. Conflicts involving component identification (for example, inconsistent component numbers) should be resolved before labels are approved. If a new label cannot be immediately provided, a temporary label should be installed until a correct permanent label can be obtained. All labels should be installed by personnel knowledgeable of the components and their function in the system to prevent inadvertent equipment operation during label installation, and to prevent interference with normal component operation. The attachment of temporary or permanent labels should be independently verified to ensure that the label is properly attached to the correct component and all the label information is correct. Facilities may find it advantageous to obtain label-making equipment, so replacement labels can be produced on site. DOE-HDBK-1226-2019 Conduct of Operations Implementation 137 REFERENCED DOCUMENTS Department of Energy Orders and Handbooks DOE O 151.1D, Comprehensive Emergency Management System DOE O 205.1B Department of Energy Cyber Security Program DOE O 225.1B, Accident Investigations DOE O 226.1, Implementation of Department of Energy Oversight Policy DOE O 232.2A, Occurrence Reporting and Processing of Operations Information DOE O 243.1B, Records Management Program

DOE O 422.1, Conduct of Operations DOE O 426.2, Personnel Selection, Training, Qualification, and Certification Requirements for DOE Nuclear Facilities DOE G 433.1-1A, Nuclear Facility Maintenance Management Program Guide for Use with DOE O 433.1B DOE O 470.4B, Safeguards and Security Program; DOE-HDBK-1001-96, Guide to Good Practices for Training and Qualification of Instructors (archived) DOE-HDBK-1028-2009, Human Performance Improvement Handbook, Volumes 1 and 2 DOE-HDBK-1078-94, Training Program Handbook: A Systematic Approach to Training Code of Federal Regulations 10 CFR Part 851, Worker Safety and Health Program 29 CFR §1910.147, Control of Hazardous Energy DOE National Training Center DOE National Training Center Resource Site: https://sites.ntc.doe.gov/partners/tr/Training%20Best%20Practices/Forms/AllItems.aspx American National Standards Institute/American Society of Mechanical Engineers ANSI Z535.4-2011, American National Standard for Product Safety Signs and Labels, American National Standards Institute, July 19, 2011. ANSI/ASME A13.1-2015, Scheme for the Identification of Piping Systems, American National Standards Institute/The American Society of Mechanical Engineers, 2015 Procedure Professionals Association AP-907-001, Procedure Process Description, Procedure Professionals Association, http://www.ppaweb.org AP-907-005, Procedure Writers’ Manual, Procedure Professionals Association FOREWORD FOREWORD EXHIBITS, TABLES AND FIGURES ACRONYMS AND ABBREVIATIONS 1.0 SCOPE, PURPOSE, AND APPLICABILITY 2.0 OPERATIONS ORGANIZATION AND ADMINISTRATION 2.1 POLICIES 2.2 GOALS 2.3 ACCOUNTABILITY 2.4 PERFORMANCE STANDARDS 2.5 FACILITY RESOURCES 2.6 HUMAN RESOURCES 2.7 MATERIAL RESOURCES 2.8 MONITORING OPERATING PERFORMANCE 2.8.1 Management Tours 2.8.2 Performance Reports 2.8.3 Management Assessment of Operating Performance 2.9 CORRECTIVE ACTIONS 2.10 MANAGEMENT TRAINING 2.11 PLANNING FOR SAFETY 2.11.1 Planning 2.11.2 Training 3.0 SHIFT ROUTINES AND OPERATING PRACTICES 3.1 STATUS AWARENESS AND OPERATING PRACTICES 3.2 AUTHORITY TO OPERATE EQUIPMENT 3.3 NOTIFICATION OF STATUS CHANGES 3.4 OPERATOR ROUNDS 3.4.1 Area Inspection 3.4.2 Equipment Status Checks 3.4.3 Operator Round Sheets 3.5 RESPONSE TO INDICATIONS 3.6 RESETTING PROTECTIVE DEVICES 3.7 SAFETY PRACTICES 3.7.1 Use of Safety Equipment 3.7.2 Personnel Exposure 3.7.3 Operating Bases 3.7.4 Potentially Distracting Written Material and Devices 4.0 CONTROL AREA ACTIVITIES 4.1 CONTROL AREA ACCESS 4.2 PROFESSIONAL BEHAVIOR 4.3 MONITORING THE MAIN CONTROL PANELS 4.4 OPERATION OF CONTROL AREA EQUIPMENT 4.5 CONTROL AREA ANCILLARY DUTIES 5.0 COMMUNICATIONS 5.1 EMERGENCY COMMUNICATION SYSTEMS 5.2 TESTING COMMUNICATION SYSTEMS 5.3 COMMUNICATION SYSTEMS 5.3.1 Party-line Communication Systems 5.3.2 Point-to-Point Communication Systems 5.3.3 Public Address Systems 5.4 COMMUNICATION EQUIPMENT 5.4.1 Portable Radios 5.4.2 Sound Powered Phones 5.4.3 Pagers 5.4.4 Wired Telephones 5.4.5 Cellular Telephones 5.4.6 Data Network-Connected Devices 5.5 VERBAL COMMUNICATIONS ATTRIBUTES 5.5.1 Clear 5.5.2 Concise 5.5.3 Correct 5.6 FORMAT 5.7 ESTABLISHING COMMUNICATIONS 5.7.1 Transmitting the Message 5.7.2 Repeat-back 5.7.3 Confirmation 5.7.4 Report-backs 5.7.5 Briefings for Operators 5.7.6 Face-to-Face Communication

6.0 CONTROL OF ON-SHIFT TRAINING 6.1 ADMINISTRATIVE CONTROLS FOR THE CONDUCT OF ON-SHIFT TRAINING 6.1.1 Trainee Prerequisites 6.1.2 Coordination of Training in the Operating Environment 6.1.3 Approval of the Operator Qualification Program 6.1.4 Instructor Qualification 6.2 SUPERVISION AND CONTROL OF ON-SHIFT TRAINING 6.2.1 Pre-Training Briefing 6.2.2 Setting the Ground Rules 6.2.3 Previewing Scheduled Training 6.2.4 Knowledge Spot Check 6.2.5 Supervising On-Shift Trainees 6.2.6 Placing the Trainee at Ease 6.2.7 Commencing Training 6.2.8 Control of Trainees 6.2.9 Communications During Training 6.2.10 Suspension of Training 6.2.11 Maximum Number of Trainees 6.2.12 Concluding On-Shift Training 6.3 TRAINING DOCUMENTATION 6.4 USING TRAINEES TO SUPPORT OPERATIONS 6.5 OPERATIONS MANAGEMENT INVOLVEMENT IN TRAINING 7.0 INVESTIGATION OF ABNORMAL EVENTS 7.1 EVENTS REQUIRING INVESTIGATION 7.1.1 Responsibility and Qualification 7.1.2 Investigative Process 7.1.3 Event Reconstruction 7.1.4 Event Analysis and Evaluation 7.1.5 Root Cause Determination 7.1.6 Corrective Action Determination 7.1.7 Investigative Report 7.1.8 Further Evaluation 7.2 SABOTAGE 7.3 HUMAN PERFORMANCE IMPROVEMENT 8.0 NOTIFICATIONS 8.1 PROGRAM OBJECTIVES 8.2 NOTIFICATION PROCEDURES 8.3 DOCUMENTATION 9.0 CONTROL OF EQUIPMENT AND SYSTEMS 9.1 STATUS CHANGE AUTHORIZATION AND REPORTING 9.2 EQUIPMENT AND SYSTEM ALIGNMENT 9.2.1 Equipment Lockout and Tagout 9.2.2 Operational Limits Compliance 9.2.3 Alarm Status 9.2.4 Equipment Deficiency Identification and Documentation 9.2.5 Work Authorization and Documentation 9.2.6 Equipment Post-Maintenance Testing and Return to Service 9.2.7 Temporary Modification Control 9.2.8 Distribution and Control of Equipment and System Documents 10.0 LOCKOUTS AND TAGOUTS 10.1 CONTROL OF HAZARDOUS ENERGY 10.2 CAUTION TAGS 11.0 INDEPENDENT VERIFICATION 11.1 SYSTEMS/COMPONENTS REQUIRING INDEPENDENT VERIFICATION 11.1.1 Nuclear Safety Functions 11.1.2 Environment, Safety, and Health (ES&H) Functions 11.1.3 Mission-Critical Functions 11.1.4 Components Excluded from Independent Verification Requirements 11.2 SITUATIONS REQUIRING INDEPENDENT VERIFICATION 11.2.1 Removing Equipment from Service 11.2.2 Placing Equipment in Service 11.2.3 Periodic Checks during Facility Operation 11.2.4 Temporary Modifications 11.3 VERIFICATION TECHNIQUES 11.3.1 Verifying Valve Position 11.3.2 Verifying Throttled Valves 11.3.3 Checking Process Parameters 11.3.4 Checking Remote Position Indicators 11.3.5 Surveillance (Operational) Testing 11.3.6 Verifying Operational Processes 11.3.7 Verifying Locked/Tagged Components 11.3.8 Resolving Inconsistencies Discovered during Independent Verification 11.4 OPERATIONS SELF-APPRAISAL AND VERIFICATION 12.0 LOGKEEPING 12.1 ESTABLISHING OPERATING LOGS 12.2 INFORMATION TO BE RECORDED 12.3 TIMELINESS OF RECORDINGS 12.4 LEGIBILITY AND FORMAT 12.4.1 General Format 12.4.2 Initial Entry 12.4.3 Incomplete Tasks 12.4.4 Final Entry 12.4.5 Correcting Errors 12.5 LOG REVIEWS 12.6 STORAGE OF COMPLETED LOGS 12.7 COMPUTERIZED LOGS 13.0 OPERATIONS TURNOVER 13.1 TURNOVER PROCESS 13.1.1 Turnover Checklists 13.1.2 Turnover Checklist Verification 13.1.3 Turnover Checklist Information 13.1.4 Using Turnover Checklists 13.2 DOCUMENT REVIEW 13.3 PRE-SHIFT WALKDOWN 13.3.1 Panel Walkdown 13.3.2 Supervisor Walkdown

13.4 INFORMATION EXCHANGE AND RESPONSIBILITY TRANSFER 13.5 SHIFT BRIEFING 13.6 RELIEFS OCCURRING DURING THE SHIFT 13.7 TURNOVER TO UNSTAFFED CONDITION AND RESUMPTION OF OPERATIONS 14.0 CONTROL OF INTERRELATED PROCESSES 14.1 OPERATOR RESPONSIBILITIES 14.1.1 Operator Knowledge 14.1.2 Operator Response to Process Problems 14.2 COMMUNICATION BETWEEN OPERATORS AND PROCESS PERSONNEL 15.0 REQUIRED READING 15.1 FILE INDEX 15.2 READING ASSIGNMENTS 15.3 REQUIRED DATES FOR COMPLETING READING ASSIGNMENTS 15.4 DOCUMENTATION 15.4.1 Example Documentation for Large Organizations 15.4.2 Example Documentation for Small Organizations 15.5 REVIEW 15.6 ELECTRONIC REQUIRED READING SYSTEMS 16.0 TIMELY INSTRUCTIONS/ORDERS 16.1 ISSUING, SEGREGATING, REVIEWING, AND REMOVING TIMELY ORDERS 16.1.1 Issuing Timely Orders 16.1.2 Segregating Timely Orders 16.1.3 Reviewing Timely Orders 16.1.4 Removing Timely Orders 16.1.5 Electronic Systems 16.2 CONTENT AND FORMAT 16.2.1 Content 16.2.2 Format 17.0 TECHNICAL PROCEDURES 18.0 OPERATOR AID POSTINGS 18.1 OPERATOR AID DEVELOPMENT 18.2 APPROVAL 18.3 DOCUMENTATION 18.4 PLACEMENT 18.5 USE OF OPERATOR AIDS 18.6 REVIEW OF OPERATOR AIDS 19.0 EQUIPMENT AND PIPING LABELING 19.1 COMPONENTS REQUIRING LABELING 19.2 LABEL INFORMATION 19.3 LABEL DESIGN AND PLACEMENT 19.3.1 Label Materials and Attachment 19.3.2 Label Readability 19.3.3 Label Placement 19.4 COLOR CODING 19.4.1 Highlighting Critical Component Controls or Groups of Controls 19.4.2 Associating Related Controls and Displays 19.4.3 Preventing Wrong-Unit, Wrong-System, or Wrong-Train Errors 19.4.4 Showing Functional Demarcation of Controls 19.5 PIPING LABELS 19.5.1 Pipe Label Placement 19.5.2 Pipe Label Size 19.6 REPLACING LABELS 19.6.1 Identifying Lost or Damaged Labels 19.6.2 Providing New Labels REFERENCED DOCUMENTS