# FAILED TSR 

# SAFETY MANAGEMENT PROGRAMS

**AND WHAT TO DO ABOUT IT**

(Detailed speaker notes and key

correspondences with the contractor)

Dave Luke

NNSA FR for Chemistry Metallurgy Research Building (CMR)

Los Alamos Site Office

dluke@doeal.gov

\(505\) 665-0503

Objectives:

-   Problem recognition: An awareness/recognition of weaknesses in
    Safety Management Programs (SMP)

-   Structure of a robust SMP

-   Approaches to strengthen SMPs

> **Administrative Controls 101**
>
> (as I know them)

######## Technical Safety Requirements

-   Part of facility safety basis (license)

```{=html}
<!-- -->
```
-   Controls the contractor is held to, to ensure safe operation
    (controls to keep you within your safety basis)

Technical Safety Requirements controls: Mitigate or minimize accidents.

-   [Engineered controls]{.underline}- first choice to minimize,
    mitigate. Hardware related,

-   [Administrative controls]{.underline}: Soft controls, non-hardware
    related.

    -   [Specific AC's]{.underline}-specific limits not controlled by
        hardware

        -   For example, combustible loading, nuclear material limits

        -   DNFSB recc. 2002-3, at least same pedigree as TSR engineered
            features

        -   [Programmatic AC's]{.underline}: (also called non-specific
            ACs, = SMPs):

        -   Not all SMPs are TSR SMPs

        -   (CMR has 19) rad protection, fire protection, configuration
            management, QA.

        -   Most are similar for all nuclear facilities

```{=html}
<!-- -->
```
-   [DOE-STD-3009-94]{.underline} (what a DSA is and what should go in
    it)

    -   Ch's 6-17, SMPs, "prevention of criticality, radiation
        protection)

    -   have to address those chapters that apply.

    -   not much done in a nuc facility that is not associated with one
        or more SMP.

**SMP FAILURES**

> (Last year, 3 SMP-related TSR violations within a four-month time
> frame )

ALO-LA-LANL-CMR-2003-0012: Room numbers update without a review of
safety basis

-   Emergency responder drawings (not updated)

-   Wrong room numbers in the TSRs (led to violation)

-   Configuration Management SMP

ALO-LA-LANL-CMR-2003-0014: Significant quantity of sub-accountable
nuclear material (in MC&A world) not reported in TSR nuc material
inventories. Went on for years.

-   Unaware of TSR (scientists).

-   QA SMP (too informal). Facility unaware certain groups not
    reporting.

-   Training SMP

    -   I requested a matrix demonstrating the relationship between what
        activities personnel perform, how those activities could impact
        Technical Safety Requirements (TSRs) and the SMPs, and to show
        that those personnel are receiving the appropriate (or targeted)
        safety basis training.

ALO-LA-LANL-CMR-2003-0015: Nuc Material packaging not in accordance with
facility requirements

-   Containerization program is an SMP

```{=html}
<!-- -->
```
-   Historical commitments and requirements were forgotten. Credited.

-   50% failure rate

-   No one in charge of program.

-   Discrepancies were so gross that .the overall safety function of the
    SMP is lost (TSR violation)

-   FR involvement: Requested ORPS Investigator look for common ties
    regarding 3 events.

    -   "The root cause of this event is the lack of a formal process to
        ensure TSR level Administrative Control Programs are effectively
        implemented."

    -   "The absence of a monitoring and verification program resulted
        in an extended time period elapsing before the facility detected
        the condition." I.e., no self assessment program

[As FR]{.underline}: documentation,

Building facility support,

Cheerleading eforts,

Getting commitments (in writing)

[Common causes for violations]{.underline}:

Lack of structure of AC's

Lack of appropriate rigor

Lack of an in-house self-assessment program.

**Characteristics of a Good SMP**

###### [Designation of credited attributes of AC program]{.underline}

-   Specific aspect, principle, or concept that is important to nuclear
    safety and is recognized either inherently or explicitly in the
    nuclear safety accident analysis.

-   Parts of the SMP that are credited in the safety basis accident
    analyses/hazard analyses for prevention and/or mitigation

```{=html}
<!-- -->
```
-   Must be implemented and periodically evaluated.

-   Found in "Derivation of TSRs" chapter of SB. Purpose is to provide
    linkage between AA and TSR controls (CMR doesn't have this)

    -   Should state which TSR controls and SMPs you're crediting for
        preventing/mitigating each accident

    -   Next level of detail: Should tell you which credited attributes
        of SMP that the accident cares about.

    -   e.g., spill: hazmat program is the SMP (credited attribute of
        this SMP is proper packaging)

####### [Formal AC program structure]{.underline}

-   functional elements: significant components of a program. (same for
    all SMPs)

-   E.g., management, self assessment, responsibilities, staffing,
    training, documentation, etc.

#### [program manager for each SMP]{.underline}

-   Needs to have responsibility, ownership, ability to affect change

-   Needs a Qual program to ensure trained on the technical content,
    basis, scope etc., of respective SMP (or knowledgeable of enough of
    program to effectively manage)

##### [Documentation]{.underline}

-   Maintain a file for each SMP. NNSA technical direction letters,
    white papers, other historical documents (avoid searches during
    crisis, don't have to call up safety analyst that left 2 years ago)

-   Document credited attributes from the basis (accident analysis) for
    each SMP

-   Identify specific structure of SMP (organization, procedures,
    processes, and/or actions that ensure that those features are
    achieved).

-   Configuration management/change control for procedures, instructions
    that flow down from AC. Also applies for site wide high tier
    documents that could impact SMPs

    -   Researched SB impact and wrote a white paper. Citing five
        examples and describing process flow down at Los Alamos

    -   Concluded process for implementing site-wide changes does not
        identify potential impacts to individual nuclear facilities\'
        safety bases. As a result, these corporate decisions, made
        without the formal concurrence from the nuclear facilities can
        and will impact nuclear safety and nuclear facilities\' safety
        bases.

    -   My office has for action.

-   Identify the surveillances, inspections, and ongoing assessments for
    the AC programs

-   Tracking and trending data

[AC self Assessment Program]{.underline}: good management practice to
determine overall effectiveness of the programs and their
implementation.

-   SMP reviewed on annual basis to ensure they are properly maintained
    and deficiencies tracked and corrected.

-   assessed each functional element and credited attribute.

-   Assessments shall determine if each attribute has documented flow
    down from the safety basis accident analysis.

-   Assessments shall determine if SMPs are performing their function
    and determine if they are improving or deteriorating?

-   Facility plans to create crads. Divide by 12. 4 hours per month.
    Cover all CRADs in a one year period. SMP PMs asses each other.

-   Key is SMP assessment coordinator. Must have. Set up and drive
    assessments, track findings to completion, Maintains ongoing
    assessment card files and assessment records

-   Trending and trending analysis of deficiencies (RIRs missed surveys,
    other minor deficiencies) shall be performed. Results shall be
    documented and negative trends corrected.

Graded approach to problems

-   Violation (TSR violation or safety basis violation):

```{=html}
<!-- -->
```
-   TSR violation if discrepancies are so gross that .the overall safety
    function of the SMP is lost

    -   SB violation when prompt action to place the facility in a safe
        configuration is not taken.

```{=html}
<!-- -->
```
-   Deficiencies (less severe)

    -   Failure to do survey, fire extinguisher expired, RIRs.

    -   Violation if constitutes a programmatic deficiencies (multiple).
        Subjective with collaboration with DOE)

-   Describe in TSRs. Makes compliance clearer. Everybody inderstands
    what the rules are.

-   Have to know what is a credited control in the basis to determine
    severity of problem

**Summary**

Need to have formalized structure

Does your SMP PMs know the credible attributes

-Look for ties to SMPs during critiques, lessons learned, and during
walkarounds, observations, etc. (SMPs control so much of what happens
there are usually ties)

-Are the various groups in your building at least have an awareness
level knowledge of your SMPs (most can impact in some way).

-Look at safety basis to see what degree the SMPs are credited. (if you
are ambitious). Verify flowdown from accident analysis, or have a safety
analist show you.

-Partner with the facility, show them the way if they don't have a good
model

-Work with safety basis team. I am writing a white paper to show that we
need one more SMP, for SMP self assessment.

SMPs are part of the TSRs and thus we should provide oversight. Often
fertile ground for improvement. (especially if your SB is not 3009
compliant).

-If SMPs have high level of rigor, it is a great way to change (or
initiate) safety and Conops culture

email me for my write-ups. My scripted version has high level of detail,
also has detailed write-ups from quarterlies etc.

**FR Comments on last related ORPS Report**: "Three TSR violations in
four months, all centering around different TSR administrative control
(AC) programs. FR\'s view is that the common cause is 1) lack of
appropriate rigor for CMR\'s TSR-mandated AC programs (addressed in this
ORPS report) and 2) lack of a strong, in-house, management self
assessment program. CMR management is aggressively pursuing a high level
of rigor to AC programs (not there yet but making significant progress).
On the second issue, the FR would like to see, at a minimum, an approved
implementation plan for a robust management self assessment program in
the near future (i.e., this first quarter 04)."

**2003 4th Quarter Report**:

"...The FR and CMR management agree that common causes among the
violations were 1) historical lack of appropriate rigor for CMR\'s
nineteen TSR-mandated Safety Management Programs (SMPs), and 2)
historical lack of an in-house management self-assessment program. CMR
management is aggressively pursuing a higher level of rigor to AC
programs (SMPs are one type of AC), and has made some notable SMP
improvements, including basic actions such as assigning personnel to be
in charge of each TSR SMP. Also, an effort is underway to collect
historical information relevant to each SMP and organize the material in
nineteen individual SMP binders. The binders are intended to be an
organizational tool and to replace having to interview the safety basis
authors when an interpretation is needed. A third action underway is to
write high-tier, implementing instructions for those SMPs that do not
have such. Another topic under discussion is the need for an SMP program
manual (a manual on how to manage CMR SMPs), which the FR strongly
supports.

On the second issue, the FR and CMR management have discussed the need
for a strong management assessment program (MAP). A few important
features the FR would expect in a robust MAP include: formal review of
all important parts of each SMP on an annual basis, preferably a portion
every month via crads or similar, assessments to be performed by other
owners of SMPs (i.e., don\'t review your own program), a single person
acting as a MAP coordinator (track corrective actions and ensure
assessments take place and by the right personnel), plus an a MAP
implementing instruction. Via other correspondence, the FR is expecting
at least a MAP implementation plan by the end of first quarter 04. As a
final note, the FR applauds CMR management for self reporting all of the
above, and identifying a strong path forward. Because CMR management is
proactively addressing weaknesses in the SMPs, there will not be a
finding at this time. The FR will continue to closely monitor the
performance and the expected improvements of CMR SMPs."

**2004 1^st^ Quarter Report**:

[TSR Administrative Control Programs]{.underline}: As discussed in the
FR's 2004 4^th^ quarter report (2003-4-CMR), a process is to be created
to ensure the CMR facility has adequately implemented the administrative
controls (AC's), a subset of which are the nineteen safety management
programs, mandated in the CMR Technical Safety Requirements (TSRs).
Subject matter experts from each of the AC disciplines are currently
assigned as the responsible AC Program Manager for their respective area
of expertise. The AC Program Managers' roles are to develop the
self-assessment criteria for their programs, evaluate the health and
rigor of the programs implementation plus ensure deficiencies are
identified, corrected and reoccurrence trending is performed.

A management self assessment program (MAP) is in development to assess
the full set of program features that each AC uses to distinguish the
boundaries for the program's required safety function. These features
are defined by specific controls or limits and by key elements in each
AC. Acceptance criteria will be derived from sources such as Hazard
Analyses/ Accident Analyses and will establish what is the important
attributes to each of the AC Program's safety features. By compiling
this information for each program, the SME can make informed decisions
about the performance of their respective programs, understanding what
the primary safety function is, be able to distinguish the significance
of issues when deficiencies are discovered, and to present a documented
self-assessment that will demonstrate management compliance with the
program elements. This type of rigorous and continuous self assessment
is of utmost importance to the survivability of CMR as a nuclear
facility until the CMR Replacement Project is completed. CMR is an old
facility that requires constant attention to detail and a heavy reliance
on administrative controls. It is also noted that the MAP has a long
term goal of regularly assessing the TSRs in their entirety (in lieu of
just the AC's), which the FR strongly supports.

The FR questions the ability to bring the MAP from a conceptual stage to
full implementation. The MAP is now two months behind its original
schedule. Because of the importance of the MAP succeeding,
**Observation** 2004-1-CMR-O.1 is written to document the lack of
adequate progress in preparation and submittal of a MAP Implementation
Plan by the end of the first quarter 04, as requested in the last
Quarterly Report. The Facility Representative is requesting that the
facility submit a schedule for implementation of the program by June 30,
2004.

**2004 1^st^ Quarter Report**:

[Safety Basis Training]{.underline}: During a site-wide training audit
conducted by LASO, the FR identified that activity-based Safety Basis
training does not exist at CMR. Specifically, the FR requested a matrix
demonstrating the relationship between what activities personnel
perform, how those activities could impact Technical Safety Requirements
(TSRs) and the TSR administrative control programs, and to show that
those personnel are receiving the appropriate (or targeted) safety basis
training. In response, facility management has identified the need for
three distinct levels of authorization basis training (for resident
personnel, operations center staff, and personnel performing TSR
Surveillances). The different training plans are currently being
developed.

The above actions are a strong start. The FR recommends CMR consider
targeted or job specific Safety Basis training for other groups that
impact the Safety Basis but who may be unfamiliar with TSRs, such as the
trades (electricians, welders, pipefitters) and glovebox workers. This
level of training should pay for itself in reduced violations from
increased licensure compliance.

## 

**[2004 1^st^ Quarter Report]{.underline}**:

[Site-Wide changes that affect the Safety Basis]{.underline}: The FR
assessed CMR's methodology for reviewing and responding to LANL
institutional changes that have the potential to affect the CMR safety
Basis. The FR concluded that a process does not exist and that this is
an institutional issue. Examples include:

-   Rerouting a high level of traffic behind CMR building. In 2001, this
    change was put into effect, and resulted in an unanalyzed situation
    in CMR\'s Basis of Interim Operation (BIO). A TSR violation
    resulted.

-   The 2003 FWO reorganization was not placed through the USQ process
    at an early stage. This resulted in a delay in the submittal of TSR
    changes, which ultimately lead to a LANL-wide TSR violation. It is
    noted that the FWO implementation plan (IP) would not necessarily
    have entered the USQ process, but there is nothing preventing IPs to
    be screened.

-   LIR 402-300-01.0, Criticality Safety, is specifically mentioned in
    CMR\'s Interim Technical Safety Requirements (ITSRs), in the
    Administrative Control Programs section. The LANL USQ process
    implicitly mandates that changes, both at a high level and a low
    level, that can impact the implementing instruction for an AC
    program shall be put through the USQ process. Currently, there is no
    vehicle in place to ensure changes to the Criticality Safety LIR are
    vetted through CMR to ensure the USQ process is used. As an added
    note, other LIRs are specifically mentioned in CMR\'s ITSR book. The
    discussion above would have the same applicability.

```{=html}
<!-- -->
```
-   In the CMR BIO (page 3-17), an assumption is made that flammable
    liquid trucks driving on Diamond Drive will never carry greater than
    200 gallons of a bulk gasoline/diesel fuel. Additionally, the BIO
    states that high explosives (HE) will never be transported on
    Diamond drive in front of CMR. CMR management had no way of knowing
    if the LANL policies controlling HE and flammable liquids will
    continue to protect the above assumptions. The FR investigated the
    validity of these assumptions and on 4-20-04 informed CMR management
    that HE is in fact transported via Diamond Drive in front of CMR,
    although in small (less than two pound) quantities, and that a
    requirement to limit bulk shipments of flammable fuel to 200 gallons
    could not be found in the Packaging and Transportation LIR (LIR
    405-10-01) nor in other reviewed applicable documents. On May 7,
    2004 CMR management declared a Potentially Inadequate Safety
    Analysis (PISA).

```{=html}
<!-- -->
```
-   In 2003, the Integrated Nuclear Material Information System, or
    INMIS, (to replace the Material Accountability & Safeguards System,
    or MASS) project did not identify safety basis impact. Only material
    control and accountability (MC&A) issues were considered. CMR
    personnel identified safety basis impact long after the program was
    developed. Resultant actions included INMIS submitting a USQD and
    software validation incorporated into the INMIS process.

Regarding some of the above bullets, since TSR administrative control
(AC) programs for most nuclear facilities include commitments regarding
organization and management, changes that may affect these commitments
should be reviewed for impact. Most sets of AC programs from
facility-to-facility have standard content (e.g., programs such as rad
protection, hazardous materials, organizational/management, USQ,
configuration management, maintenance, etc.), so identifying proposed
changes to these \"standard\" AC programs at the institutional level so
they receive a USQ review for affected facilities should be a standard
business practice.

To summarize, the process for implementing LANL-wide changes does not
identify potential impacts to individual nuclear facilities\' safety
bases. LANL-wide **Finding** 2004-1-LANL-F.1 is written to address that
corporate decisions, made without the formal concurrence from the
nuclear facilities can and will impact nuclear safety and nuclear
facilities\' safety bases. LANL is noncompliant with 10 CFR
830.202(c)(1), "In maintaining the safety basis for a hazard category 1,
2, or 3 DOE nuclear facility, the contractor responsible for the
facility must: (1) Update the safety basis to keep it current and to
reflect changes in the facility, the work and the hazards as they are
analyzed in the documented safety analysis". Additionally, LANL is
noncompliant with 830.203(d)(1) and (4), "The contractor responsible for
a hazard category 1, 2, or 3 DOE nuclear facility must implement the
DOE-approved USQ procedure in situations where there is a: (1) Temporary
or permanent change in the facility as described in the existing
documented safety analysis;... (4) Potential inadequacy of the
documented safety analysis because the analysis potentially may not be
bounding or may be otherwise inadequate." The FR, consulting with the
LASO Safety Authorization Basis Manager, confirmed the above-mentioned
concerns regarding adequate implementation of 10 CFR 830.202 and 10 CFR
830.203.

**CREATE A SEPARATE AC FOR AN**

## AC SELF-ASSESSMENT PROGRAM

(my safety basis was just updated and sent for NNSA approval. (Major
changes)

(This would ensure structure, rigor, and proper manning)

(This is rough. Will work with facility management and safety analysts
to deliver a finished product)

[Suggested key elements]{.underline} (to be specifically described in
the TSRs):

-   Each SMP shall be reviewed on annual basis to ensure they are
    properly maintained and deficiencies tracked and corrected. Each key
    element shall be assessed.

-   Assessments shall determine if SMP programs are performing their
    function and determine if they are improving or deteriorating?

-   Trending and trending analysis of sub-key elements shall be
    performed. Results shall be documented and negative trends
    corrected.

-   Assessments shall determine if each SMP attribute has documented
    flow down from the safety basis accident analysis.