What Is Conduct of Operations? DOE Order 422.1 Requirements

Conduct of operations is a formal management framework, mandated by Department of Energy Order 422.1, that governs how personnel perform work at nuclear and other high-hazard DOE facilities. It converts broad safety goals into documented daily practices, defined lines of authority, and enforceable accountability, with the explicit aim of minimizing human error and organizational system failures.¹ Every person working at a covered facility falls under the program, from the newest technician to the site manager.

What DOE Order 422.1 Requires

Order 422.1 is a binding directive, not guidance. It requires all DOE and National Nuclear Security Administration contractors to establish and implement a formal conduct of operations program that protects workers, the public, and the environment.¹ The order identifies more than a dozen operational elements each program must address, and facilities document how they meet each one.

Violations carry financial consequences. Under the Price-Anderson Amendments Act, DOE can impose civil penalties on indemnified contractors, subcontractors, and suppliers for nuclear safety violations.² The maximum penalty is $262,614 per violation per day, and each day a continuing violation persists counts as a separate offense.³ That figure was not adjusted for 2026 inflation because the Bureau of Labor Statistics did not publish the required Consumer Price Index data during the federal government shutdown, so the 2025 level carries forward.

One boundary is worth naming up front. Commercial power reactors licensed by the Nuclear Regulatory Commission do not operate under Order 422.1. They meet parallel operational discipline requirements through 10 CFR Part 50, which requires each licensed facility to maintain technical specifications covering safety limits, limiting conditions for operation, surveillance requirements, and administrative controls.⁴ If the facility in question is a licensed commercial reactor rather than a DOE site, the framework below is the wrong reference point.

The Program Elements Every Facility Must Cover

The heart of Order 422.1 is its list of required operational elements. These are mandatory program components, not best practices to consider.

Shift Turnover

Shift turnover is where information gets lost when the process is informal. The order requires thorough, accurate transfer of information and responsibilities at every relief to ensure continued safe operation.⁵ The outgoing operator walks the incoming operator through active work permits, pending alarms, current equipment configurations, and any abnormal conditions. Shift routines also have to keep operators alert, informed, and ready to respond throughout their watch.

Control of Equipment and System Status

Knowing the exact configuration of every valve, breaker, and switch at every moment is non-negotiable. The order requires operations practices for initial equipment lineups and subsequent changes so the facility runs with a known, proper configuration as designed.⁵ Every status change to a piece of safety equipment gets tracked, and new configurations are confirmed against approved operating documents before work moves forward.

Lockout and Tagout

Lockout and tagout protects personnel during servicing or maintenance by physically preventing unexpected startup of equipment or release of stored energy. Order 422.1 requires programs addressing installation and removal of lockout/tagout devices for personnel protection.⁵ Where OSHA jurisdiction applies, the program must also meet 29 CFR 1910.147, which requires employers to establish energy control procedures, train employees, and conduct periodic inspections.⁶ Only authorized employees apply or remove devices, and they follow a defined sequence: identify energy sources, shut down the equipment, isolate energy, apply locks or tags, and verify isolation before starting work.

Communications

Miscommunication in a control room causes errors that no engineered safeguard catches in time. The order requires practices that ensure accurate, unambiguous communications among operations personnel.⁵ The industry-standard technique is three-way communication: the sender states a message, the receiver paraphrases it back, and the sender confirms the receiver’s understanding is correct. Equipment designators and component names are repeated word for word rather than paraphrased, because approximate names send people to the wrong valve.

Independent Verification

Independent verification is the safety net for the moments when a single operator makes an honest mistake. The order requires practices to verify that critical equipment configuration matches controlling documents.⁵ A second qualified person physically confirms component status against the procedure or lineup sheet, rather than relying on the first operator’s word.

The Remaining Required Elements

Order 422.1 also requires programs for:

Control area activities, maintaining an orderly, business-like environment in the control room so operators can concentrate without unnecessary distractions.
Logkeeping, recording equipment information thoroughly and accurately for performance analysis and trend detection.
Investigation of abnormal events, analyzing unexpected conditions to determine safety impact and prevent recurrence.
Required reading, keeping operators updated on equipment changes, procedure revisions, and lessons learned from other facilities.
Control of interrelated processes, ensuring that activities in one part of the facility do not compromise safety in another.
On-shift training, controlling how trainees interact with equipment so they cannot make unauthorized manipulations.

Who Has Authority and Who Can Stop Work

A conduct of operations program depends on everyone knowing exactly who holds decision-making authority at every moment. Responsibility for safely operating a DOE facility rests with on-shift personnel, and the authority for facility operations is vested in the cognizant supervisor or manager.⁵ Authority transfers only through a formal turnover to a qualified relief, never informally.

During abnormal conditions, special tests, or unusual evolutions, the on-duty supervisor retains full operational authority. No individual may bypass or overrule the supervisor’s operational judgment without escalating to a higher operational authority.⁵ Operators execute tasks and technical support staff provide analysis, but the shift supervisor owns the final call on what happens and what stops.

Every person at a covered facility has the right to stop work when they believe a condition poses an imminent safety threat, and that authority exists independently of rank. Effective programs make raising a legitimate safety concern protected behavior and include a formal process for reviewing stop-work decisions without discouraging good-faith interventions. Under the OSH Act, employees may refuse dangerous work when they hold a good-faith belief of imminent danger, a reasonable person would agree, and there is not enough time to go through normal enforcement channels. Retaliation for raising safety concerns is prohibited, and whistleblower complaints must be filed with OSHA within 30 days of any retaliatory action.

Human Performance Tools

Even well-trained operators in well-run facilities make mistakes. Human performance tools are structured techniques that catch errors before they reach the equipment.

The most widely used individual tool is STAR: Stop, Think, Act, Review. Before performing a task, the operator pauses to eliminate distractions, mentally confirms what action is being taken and what result is expected, physically points to the component label and reads it aloud before manipulating it, then verifies the actual response matches the expected response.⁷ Reading aloud engages speech and hearing alongside vision, making it harder for the brain to skip over a wrong label. If the response is unexpected, the operator takes conservative action rather than troubleshooting on the fly.

Before any significant work activity, supervisors lead a structured pre-job briefing covering the hazards, work procedures, energy-source controls, special precautions, and personal protective equipment requirements.⁸ Every topic is addressed regardless of how routine the task appears. Post-job critiques review what went well and what went wrong while the work is still fresh, feeding lessons back into the program.

Facilities draw from a broader toolkit depending on the risk of the activity, including procedure use and adherence (reading and following each step rather than working from memory), flagging (physically marking a component to draw attention to its status), co-worker coaching, and “stop when unsure,” which halts work until uncertainty is resolved.⁷ Supervisors identify which tools apply during the pre-job briefing and observe their use in the field.

Documentation and Logkeeping

If it isn’t written down, it didn’t happen, and in a regulated facility that cliché carries legal weight. The logkeeping element of Order 422.1 requires thorough, accurate, and timely recording of equipment information for performance analysis and trend detection.⁵ Official logs capture the chronological progression of facility states, including equipment status changes, alarm responses, and the start and completion of significant activities.

Practices vary by site but share conventions rooted in record integrity. Entries are time-stamped in 24-hour format and attributed to a named individual. Corrections are made by drawing a single line through the error, initialing and dating the correction, then writing the correct information on the next available line. Correction fluids are prohibited because they destroy the ability to reconstruct what originally happened. Shift turnover checklists require personnel to mark off specific items, including active work permits, pending alarms, and current equipment configurations. Fields that don’t apply are marked accordingly rather than left blank, so investigators can tell the difference between “did not apply” and “forgot to fill in.”

Procedures for complex tasks function as step-by-step checklists. Operators sign or initial each step as it is completed, creating a traceable record. These documents are controlled by the facility’s document management system and cannot be revised without going through a formal change process.

Training and Qualification

You cannot perform safety-significant work at a DOE facility until you have been formally qualified, and, for certain positions, certified. DOE Order 426.2 sets training requirements for personnel at hazardous facilities using the Systematic Approach to Training, a five-phase methodology: analysis of the job, design of learning objectives, development of training materials, implementation, and evaluation of whether trained personnel actually perform correctly on the job.⁹

Qualification is defined in terms of education, experience, training, examination, and any special requirements for the role. For positions requiring certification, contractor management must endorse and document in writing that the individual has satisfactorily completed the qualification program. Certified operators and supervisors must pass an initial medical examination and be reexamined at least every two years. Continuing training maintains knowledge and skills throughout employment, and personnel who fail to complete all requalification elements within the two-year cycle cannot continue to function in their qualified positions.⁹

Safety Basis and Operating Limits

Every DOE nuclear facility operates within a documented safety basis defining the conditions, safe boundaries, and hazard controls necessary to protect workers, the public, and the environment. Under 10 CFR 830, the contractor analyzes the facility, the work to be performed, and the associated hazards, then identifies the controls needed to prevent adverse consequences.¹⁰ This analysis becomes the safety basis both the contractor and DOE rely on to conclude the facility can be operated safely.

Technical Safety Requirements flow from the safety basis and set hard boundaries on operations. There are three types of limits: safety limits, limiting control settings, and limiting conditions for operation. A limiting condition for operation represents the lowest functional capability of safety systems required to perform an activity safely.¹⁰ When a limiting condition is not met, the facility must initiate action within one hour to restore the capability, implement compensatory measures, or transition to a mode where the requirement does not apply.

In genuine emergencies, a contractor may take actions that depart from an approved Technical Safety Requirement when no compliant action is immediately apparent and the departure is needed to protect people or the environment from imminent harm. Emergency departures must be approved by a certified operator at a reactor or a designated authority at a nonreactor facility, and reported to DOE as soon as practicable.¹⁰

Reporting and Enforcement

When something goes wrong at a DOE facility, reporting is not optional and the clock starts immediately. After discovery of a reportable event or condition, the facility must determine within two hours whether the event meets the threshold for reporting into the Occurrence Reporting and Processing System. Within two hours of that categorization, the facility must notify the DOE or NNSA facility representative and other required contacts, including federal counterparts and, where applicable, state or local authorities.¹¹

Reportable events span ten categories, from operational emergencies and personnel safety incidents to nuclear safety basis violations, environmental releases, contamination and radiation control events, and transportation incidents. Operational emergencies and the most significant occurrences require prompt notification to DOE Headquarters. Reportable events also include near misses and management concerns significant enough to warrant investigation and corrective action. Noncompliance notifications from outside regulatory agencies involving ten or more violations or fines exceeding $10,000 are also reportable.¹²

Before a nuclear facility can begin or resume operations, DOE line management evaluates whether a formal readiness review is required. Initial startup of a newly constructed nuclear facility requires an Operational Readiness Review. DOE Readiness Assessments are required for new hazard category 1 or 2 activities, restart after extended shutdowns, and startup following substantial modifications.¹³ For the highest-hazard new facilities, the Secretary of Energy or a designee must personally approve startup.

Once operating, facilities face ongoing scrutiny through the contractor assurance system. DOE evaluates whether the contractor is adequately identifying, correcting, and preventing recurrence of issues that affect environment, safety, health, and mission, including whether the contractor’s own self-assessment and feedback systems are effective and whether the responsible DOE field office is providing adequate oversight.¹⁴

When violations are identified, DOE’s enforcement office issues a Preliminary Notice of Violation, which may include a proposed civil penalty. The contractor has 30 days to respond by admitting the violation and paying, admitting while asserting mitigating circumstances, or denying the violation and providing its basis for doing so.¹⁵ After evaluating the response, DOE may determine no violation occurred, reduce the penalty, or issue a Final Notice of Violation affirming the original findings. In any confirmed violation, the contractor must describe corrective steps already taken, planned remedial actions to prevent recurrence, and the date by which full compliance will be achieved.

1
U.S. Department of Energy. DOE O 422.1 – Conduct of Operations
2
U.S. Department of Energy. Report to Congress on the Price-Anderson Act
3
eCFR. 10 CFR Part 820 – Procedural Rules for DOE Nuclear Activities
4
eCFR. Domestic Licensing of Production and Utilization Facilities
5
U.S. Department of Energy. DOE Order 422.1 Conduct of Operations Familiar Level
6
eCFR. 29 CFR 1910.147 – The Control of Hazardous Energy
7
U.S. Nuclear Regulatory Commission. Human Performance Tools
8
Occupational Safety and Health Administration. 1926.952 – Job Briefing
9
U.S. Department of Energy. DOE O 426.2 – Personnel Selection, Training, Qualification, and Certification Requirements
10
U.S. Department of Energy. 10 CFR 830 Safety Basis Documentation
11
U.S. Department of Energy. DOE O 232.2A – Occurrence Reporting Training
12
U.S. Department of Energy. ORPS Reporting Criteria
13
U.S. Department of Energy. DOE O 425.1D – Verification of Readiness to Start Up or Restart Nuclear Facilities
14
U.S. Department of Energy. EA CRAD Contractor Assurance System
15
Legal Information Institute. 10 CFR Appendix B to Subpart E of Part 851