[DNFSB LETTERHEAD]

 

October 8, 2004

 

The Honorable Linton Brooks

Administrator

National Nuclear Security Administration

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

 

Dear Ambassador Brooks:

 

Earlier this year, the Defense Nuclear Facilities Safety Board (Board) investigated a series of activities that preceded a skin contamination incident at Sandia National Laboratories, New Mexico (SNL-NM).  As documented in the enclosed report, the Board’s investigation revealed multiple failures of the hazard analysis and work control processes.  The general weaknesses suggested by these failures had been previously identified by independent Department of Energy Integrated Safety Management reviews at SNL-NM in 1997 and 2003.  Their persistence suggests that past corrective actions may not have been as effective as desired.  Discussions with SNL-NM personnel suggest that the full implications of the weaknesses observed, particularly the need for strict formality of operations and adherence to procedures, may need to be reinforced.

 

In its report on the skin contamination incident, SNL-NM committed to develop a corrective action plan by January 2005 that will address the associated weaknesses.  The Board would like to receive a copy of this plan, and to be briefed on the schedule and actions that will be taken to ensure that Integrated Safety Management is fully implemented at SNL-NM.

 

Sincerely,

 

John T. Conway

Chairman

 

c:   Mr. Richard Black

Mr. Richard Englehart

Dr. C. Paul Robinson

Mr. Mark B. Whitaker, Jr.

 

Enclosure

 

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

 

Staff Issue Report

 

August 26, 2004

 

MEMORANDUM FOR:      J. K. Fortenberry, Technical Director

 

COPIES:                                 Board Members

 

FROM:                                   D. Nichols

 

SUBJECT:                             Integrated Safety Management at Sandia National Laboratories

 

On April 19, 2004, a radiological control technician became contaminated with fission and activation products at Sandia National Laboratories, New Mexico (SNL-NM).  An initial survey of his right arm showed 850,000 disintegrations per minute (dpm) per 100 cm2.  SNL-NM personnel provided a report on this incident to the staff of the Defense Nuclear Facilities Safety Board (Board) on August 10, 2004.  A review of the events surrounding this incident revealed significant anomalies with respect to the hazard analysis, approval, and conduct of the activities that led to the contamination.  The weaknesses suggested by these observations are similar to those previously identified by external reviews conducted by the Department of Energy (DOE) in 1997 and 2003.  The persistent nature of these weaknesses indicates the need for additional management attention to the rigor with which operations are being planned, conducted, and evaluated in SNL-NM’s nuclear facilities.

 

Background.  The technician became contaminated while working on an activity designed to produce an initial batch of radioactive reference samples for the New Brunswick Laboratory (NBL) in support of the Domestic Nuclear Event Attribution Program.  The radioactive component of these samples was produced by irradiation in the Annular Core Research Reactor (ACRR) of a 25 milliliter solution supplied by NBL.  The NBL solution contained up to 8.5 milligrams of uranium-235 (U235) as an oxide dissolved in 1 molar nitric acid, together with additional constituents designed to represent dissolved concrete.  These materials were contained in a glass vial that was designed to permit the release of any gasses generated during the irradiation.

 

The production of the reference samples had been preceded by a series of experiments conducted to establish appropriate parameters for irradiating the NBL solution.  During these preliminary tests, aluminum wires containing small amounts of U235 were immersed in a pure water bath, as surrogate for the NBL solution, and irradiated in the ACRR.  Parameters were varied to obtain the proper rates of heating and activation.

 

Once the appropriate reactor parameters had been determined from these experiments, a trial run was conducted using a diluted NBL solution to prove the overall process of irradiation and subsequent processing of the irradiated solution to form the NBL reference samples.  The Experiment Plans used for this and subsequent irradiations were apparently developed by revising the initial plan created for the experiment that had used water instead of the NBL solution.  Although the revisions increased the amount of U235 being irradiated and altered some other aspects of the experimental apparatus, they did not address the use of nitric acid or the other constituents included in the NBL sample.  Section 8.0, “TOXIC or CORROSIVE MATERIAL DESCRIPTION,” of the Experiment Plan retained the words “None Allowed” that had been used in the original plan.  Similarly, the Unreviewed Safety Question (USQ) evaluation of the initial experiment was revised to address the increase in U235; however, the revision to the USQ evaluation referenced the Experiment Plans and did not address the substitution of acid for water or the other constituents of the NBL sample.  As a result, the actual experiments conducted were not in accord with either their Experiment Plans or the USQ evaluation used to approve them, at least with respect to the material being irradiated.

 

The trial run apparently led to substantial revisions of the radiological work permit for the process, including an upgrade of the area classification from a Contamination and Radiation Area to a High Contamination and High Radiation area.  However, the activity hazard analysis was not revised.  The hazard analysis had grossly mischaracterized the irradiated NBL solution as having only a “very low activity,” so that if it were spilled, it could simply be wiped up.  Once the solution had been irradiated, the actual radiation field at the surface of the vial was measured at 4 Roentgen/hour.

 

Following the completion of test runs, the actual NBL solution was irradiated on April 14, 2004.  The solution was irradiated inside a covered, but not sealed, glass vial.  The irradiated vial and its test stand were removed from the ACRR on April 16, 2004, placed inside a plastic bag, and left in a shielded cell for the weekend.  On Monday, April 19, 2004, the vial was removed from the irradiation fixture and placed into a zip-lock bag inside a lead-filled shielding container (pig).  The combination of pig, zip-lock bag, and glass vial did not provide confinement for any gaseous fission products produced in the irradiation or for the irradiated material in the event of a drop.  The radiation field at the surface of the pig was 60 milliRoentgen/hour.  The pig was hand-carried through hallways and up a set of open metal stairs to the radiological laboratory, where it was placed in a fume hood.  There appears to have been no analysis of the hazards associated with retrieving the sample from the reactor, or with hand-carrying this unconfined sample through the facility and to the laboratory.  There appear to be no packaging requirements for transporting samples within the facility.

 

The contamination event apparently occurred during the handling of the material in the laboratory, although the exact mechanism by which the contamination occurred was never conclusively determined.

 

Technical Area V personnel prepared a report on the incident.  The report addresses, to varying degrees, issues raised by this incident.  Its treatment of personal protective equipment (PPE) and the actions associated specifically with the skin contamination event appears to be adequate.  The report identifies a number of issues associated with activities leading up to the contamination, including the following:

 

 

 

 

 

 

The report identifies 16 specific corrective actions that have been completed to address these issues.  These include (but are not limited to) performing critiques, revising PPE requirements, disseminating lessons learned regarding PPE, and issuing guidance regarding radiological controls.  Personnel directly involved with the activity were counseled “on the need to have a questioning attitude when working in nuclear facilities and on the need for accuracy and completeness in experiment planning and hazard analysis”.  A one-page interim direction was issued that advised personnel on the importance of grading the need for secondary containment when transporting radioactive material through the facility.  This interim direction did not establish a requirement for specific considerations as part of a job hazard analysis, however.

 

The completed corrective actions also included the production of a new Quality Management Procedure, a copy of which is included with the report.  The new procedure is two pages long.  It is general in nature and limited in content, making it difficult to see how the new procedure addresses issues raised by the events that led up to the skin contamination.

 

The report includes three outstanding actions.  One, due by mid-October, is to submit a formal recommendation to improve policies and procedures for the safe movement of radioactive materials.  A second, due by the end of October, is to train personnel on the new Quality Management Procedure.  The third, due by the end of January 2005, is to develop and implement a plan to improve work planning and activity-level hazard analysis.  In general, this plan is to address in a broader fashion the specific weaknesses identified in the activities that led up to the skin contamination event.

 

Discussion.  In 1997, DOE’s Office of Oversight evaluated the implementation of Integrated Safety Management (ISM) at SNL-NM.  The evaluation report noted that SNL-NM and DOE line managers had “been strong advocates for and aggressive in the implementation of integrated safety management systems at [SNL-NM]”.  However, the report also noted that “DOE and [SNL-NM] management have not adequately ensured that the policies and goals have filtered down to the operational level and have been verified to be effective”.  Specific weaknesses identified included that “[SNL-NM] processes for identifying and analyzing hazards and for planning and controlling work are not institutionalized and are often ineffective in controlling hazards”.  In spite of the observed weaknesses, the authors of the report were optimistic, stating that DOE and SNL-NM “are well positioned to build on existing initiatives by applying the broad array of technical resources and [SNL-NM’s] extensive systems engineering expertise to improving the effectiveness of integrated safety management systems”.

 

That optimism may have been misplaced.  The report of a more recent evaluation, conducted by DOE’s Office of Independent Oversight and Performance Assurance (January–February 2003) described the implementation of ISM at SNL-NM using phrases very similar to those used in the 1997 report.  Although the authors of the 2003 report stated that the SNL-NM ISM program “had improved, and most work is performed safely,” they also noted that “work was not always performed in accordance with established requirements and procedures, and some unsafe work practices were observed.  Increased [Sandia Site Office (SSO)] and [SNL-NM] senior management attention is needed to address weaknesses in several important areas, including processes for analyzing hazards and identifying controls, feedback and improvement programs, and implementation of [Environment, Safety, and Health (ES&H)] controls”.  With respect to ES&H controls, the report stated that SNL-NM “line management systems for communicating ES&H expectations and monitoring performance are not effectively implemented and are not providing sufficient assurance that ES&H expectations are consistently met and that work activities are performed safely”.  The report also stated that “incorrect assumptions in the [SNL-NM] primary hazard screening process have resulted in non-conservative facility/activity hazard classifications; consequently, the appropriate level of hazards analysis, review, and approval is not always performed”.

 

Based on the documentation of activities that led up to the skin contamination event and discussions with site personnel, the safety issues identified in both of these reviews apparently continue to exist.  The overall process for planning; analyzing hazards; documenting, approving, and conducting activities; and providing feedback at ACRR still appears to be inappropriately informal.  The Experiment Plans for the irradiation of the NBL solution did not include the presence of nitric acid and the other constituents of the sample; in fact, corrosives were explicitly forbidden by the plans.  Instead of recognizing that the experiments had not been conducted in accordance with the approved Experiment Plans, however, the report that SNL-NM provided to the Board treats the omission of these materials from the plans as documentation errors.

 

This treatment of deficiencies in the Experiment Plans as documentation errors suggests that problems exist in the practical understanding of ISM principles.  Adequate conduct of operations, particularly for a facility having the potential for significant radiological injuries to workers, requires strict formality of compliance with procedures, whether the procedures be technical drawings, Experiment Plans, or other media that prescribe how work is to be performed.  A rigorous program of formal compliance with procedures is a prerequisite for effective and acceptable administrative hazard controls.

 

Formal compliance with procedures remains a requirement even when the nature of the work involves tests and experimentation.  A test or experiment may be notional at its conception but must be evaluated for hazards, and hazard controls must be established and captured as appropriate in a procedure.  The procedure must then be evaluated under the USQ program to determine the appropriate approval authority.  To permit adequate USQ review, the procedure and associated documentation must be sufficiently complete to ensure that the activity is well bounded and that its impact on the safety basis can be determined.

 

Once a procedure has been approved, it is essential that it be followed as written to ensure that the activity remains within the approved bounds of its operation and within the scope of the hazard analysis.  If changes are made to the activity that affects the procedure followed to accomplish it, the procedure must be revised accordingly before the activity is performed.  If it is found that the procedure will not accomplish the objectives of the experiment, the activity should be stopped until the procedure can be rewritten.  Revised procedures must be reviewed again for new hazards and for the existence of a USQ.

 

Discussions with site personnel at SNL-NM suggest that the discrepancies between the experiment plan and the actual activity performed, while undesirable, are not viewed as significant safety issues or procedural violations because everyone involved, including the person who reviewed and approved the USQ paperwork, knew the actual content of the experiments.  Discussions with senior management personnel indicated that small deviations from the Experiment Plans were considered to be routine and acceptable. 

Such thinking is inconsistent with the strict formality of operations that are necessary for the safe operation of nuclear facilities.

 

Conclusion.  The events associated with this occurrence suggest that problems previously noted with the implementation of ISM at SNL-NM have not been completely eliminated.  The plan to be prepared by January 2005 may adequately address these problems.  However, aggressive oversight by both SNL-NM and SSO personnel who are fully aware of and committed to the principles and practical application of ISM will be needed to adequately achieve the degree of hazard analysis and compliance with controls that is required for defense nuclear facilities.