[DNFSB LETTERHEAD]

 

September 8, 2004

 

Mr. Paul M. Golan

Acting Assistant Secretary for

Environmental Management

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0113

 

Dear Mr. Golan:

 

During the last year, the Defense Nuclear Facilities Safety Board (Board) has become increasingly concerned that the Integrated Safety Management (ISM) System for the Hanford tank farms is failing to control work activities adequately.  This concern has been engendered by a series of occurrences, incidents, near misses, and other operational events indicating serious weaknesses in work planning, conduct of operations, and responses to abnormal events or unexpected conditions.  A prime example is the recent event where controls on worker exposure failed and a worker received an excessive and unexpected extremity exposure.  Recent events that exemplify weaknesses in the ISM System are discussed in the enclosure to this letter.  While industrial hygiene issues are also of concern at the tank farms, these issues have been well documented by other agencies and are not reiterated here.

 

It would be an oversimplification to assign a single cause (e.g., accelerated cleanup) to these occurrences in light of their variety.  However, the number of serious events at the tank farms is not to be expected at a project with a mature and effective ISM System.  While compensatory and corrective actions taken by the Department of Energy (DOE) and its contractor have yielded temporary successes or addressed specific issues, lasting success in implementing an effective ISM System at the tank farms has not been apparent.  DOE noted similar concerns in a recent letter from the Office of River Protection to the Hanford tank farms operating contractor.  That letter highlighted performance problems at the contractor management level that allowed poor work planning, hazard identification, and conduct of operations.  DOE Guide 450.4-1B, Integrated Safety Management Guide (Volume I), addresses situations in which a decrease in the effectiveness of the existing ISM System is observed, and notes that corrective actions by DOE and the contractor should focus on improving performance.

 

While senior managers from the Office of River Protection and CH2M Hill Hanford, Inc. have briefed the Board on some of the specific issues associated with the latest extremity exposure event, the Board would like to understand in greater detail the deficiencies of the Hanford tank farm ISM System at the activity level, and what actions must be taken to correct them.  Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests that DOE submit to the Board within 60 days of receipt of this letter a report that identifies weaknesses in the ISM System for the tank farms, with particular focus on work planning, conduct of operations, and feedback and improvement programs at the activity level.  For each weakness identified, the report should describe corrective actions, a schedule for carrying out these actions, and a plan to ensure that all corrective actions have been effective.  The report should also discuss the roles and responsibilities of line managers in implementing and upgrading ISM at the activity level.

 

While the Waste Treatment Plant (WTP) is currently a construction site and hence does not pose radiological hazards, incidents threatening worker safety have been on the rise in 2004.  These incidents are often characterized by a failure to follow mandatory controls and procedures or by carelessness and inattention to detail.  The Office of River Protection has also noted this trend and has required the WTP contractor to develop a corrective action plan to ensure worker safety.  The Board would like to be kept informed of DOE’s plans to improve safety performance at WTP.

 

Sincerely,

 

John T. Conway

Chairman

 

c:   Mr. Roy J. Schepens

Mr. Mark B. Whitaker, Jr.

 

Enclosure



 

ENCLOSURE

 

Recent Operational Events at Hanford Tank Farm and Waste Treatment Plant

 

Hanford Tank Farms

 

The following paragraphs highlight the Defense Nuclear Facilities Safety Board’s (Board) concerns regarding the current state of implementation of Integrated Safety Management (ISM) at the Hanford tank farms.

 

ISM Core Function 1:  Define the Scope of Work

 

The tank farms have experienced significant problems with configuration management, a key safety management program for ensuring that the scope of work is well defined.  After tank farm workers modified the wrong clean-out box near the 242-A Evaporator, three waste transfers were completed without proper leak detection.  Furthermore, operators conducted an entire evaporator campaign using n transfer line that had a tap installed on the primary line and a hole cut into the encasement line.  As a result, high-level waste (HLW) leaked and contaminated the nearby area.  Nearly 4 months later, the contractor is still trying to verify the configuration of the transfer line.  While attempting to recover from this problem, tank farm workers exceeded their approved work scope by cleaning up the spilled HLW solutions without authorization from the shift manager or the necessary controls for handling these liquids.

 

ISM Core Functions 2 and 3:  Analyze the Hazards and Develop and Implement Controls

 

These functions are particularly important in cleanup work, where conditions are often poorly characterized and/or changing.  At the tank farms, these ISM steps are accomplished at the activity level by using job hazard analyses and enhanced work planning sessions.  The Board’s staff has observed a number of enhanced work planning sessions at the tank farms.  These sessions often are little more than informal discussions among the planner, supervisor, and work crew about how the work steps are to be worded and organized.  During these sessions, an actual hazard analysis is seldom performed, and the words “what if’ are rarely spoken.  As a result, the controls tend to focus on anticipated safety events.  For several of the events cited in the following table, the hazards had not been adequately analyzed.  In one case, workers in street clothes moved a highly contaminated pump, wrapped only in a single layer of plastic, with a crane.  During this activity, two workers had their shoes and/or pants contaminated when waste leaked out of the bag.  Other events in the tank farms resulted from the failure to establish conservative controls when work was to be performed in an area that was poorly characterized.  A worker exceeded Hanford’s administrative control level for extremity exposure as a result of encountering high beta dose rates while removing contaminated equipment from a tank for which little characterization data existed.

 


ISM Core Function 4:  Perform Work within Controls

 

In the above extremity exposure incident, the field work supervisor decided to continue removing the highly contaminated equipment even though the limits of the radiological work permit had been exceeded, contact dose rates were higher than the range of the radiation instrument being used, and other controls for working in a high-radiation area with high beta dose rates were not in place.  In a number of the tank farm incidents, the shift manager was not informed when unexpected conditions were encountered.

 

ISM Core Function 5:  Provide Feedback and Continuous Improvement

 

When ISM was first implemented at Hanford, feedback and improvement was an immature process, and there appears to have been little real progress made toward instituting effective feedback and improvement at the activity level.  Assessments and independent reviews have repeatedly identified that feedback is not routinely provided for completed activities, that the input provided is difficult to access, and that lessons learned often are not incorporated into subsequent work packages.  A user-friendly system that is used by the workforce would significantly improve the development and application of lessons learned.

 

ISM System

 

The Board has observed further indications of weaknesses in the implementation of the ISM System at the tank farms.  Pre-job briefings do not address contingency plans beyond routine alarms and putting work in a “safe condition,” which usually is not defined in advance.   Furthermore, drills generally involve simple and obvious scenarios (e.g., alarm goes off), for which the response is usually to evacuate the area or push an emergency stop button.  Such drills do not require that supervisors and other operations personnel analyze operational data to determine what is happening, develop an appropriate response, and identify the “safe condition”.  As a result, workers and supervisors may not be adequately prepared when an abnormal event occurs or when they encounter an unexpected condition.

 

Waste Treatment Plant

 

The following paragraphs highlight the Board’s concerns regarding the current state of ISM System implementation at the Waste Treatment Plant (WTP) construction site.

 

Recent near misses at WTP have involved dropping heavy loads (e.g., a structural steel beam, a rebar curtain, and a 100-pound concrete embed) and simultaneously cutting tbrough an energized 480-volt cord and partially through a water hose.  In another accident, a flatbed trailer carrying it 50,000-pound crane overturned and spilled five counterweights weighing more than 16,000 pounds, which tumbled up to 30 feet away.  Such events have the potential to seriously injure or kill workers.

 

A key component of the ISM System for WTP construction activities is the use of a checklist to identify hazards and controls.  A generic vulnerability of checklists is the tendency to quickly check off the blocks on the checklist, with little analysis of the hazards or controls involved.  Furthermore, checklists that rarely change can lead to complacency among workers over time.  Considering the constantly changing conditions typical of construction work, both of these situations need to be avoided.  It would be appropriate for the Department of Energy to review the effectiveness of safety checklists at the construction site, how their use is complemented by pre-job briefings, and how this impacts conduct of operations and line management oversight.

 

 

Event Data Summary

 

Date

 

Occurrence No.

 

Description

June 25, 2003

 

RP-CHG-TANKFARM-2003-0030

Jumper removal in 241-AW-101 01A pit results in multiple personnel contaminations.

During jumper removal in 01A pit, a powder substance fell from the jumper to the pit floor, causing airborne contamination in the immediate area.

The contamination control practices defined for the pit work did not contain all contamination at the source.

August 28, 2003

RP-CHG-TANKFARM-2003-0043

Electrical near miss at 271-AP results in power loss to tank ventilation system.

Subtier workers were pulling wire in a subgrade cable trench.  When they were done, a worker attempted to replace one of two steel cover plates.  As the worker moved the plate into position, it slipped off the recessed edge and from his hands and fell into the cable trench.  The plate struck a cable bundle containing 480-volt conductors, penetrated cable insulation, and caused a short-circuit resulting in an arc flash.

Work instructions contained no information regarding how to remove these plates.  No eye-bolts were used in the removal or installation of the platesa practice of CH2M Hill Hanford Group electricians in the past.  This practice was not communicated to the subcontractor electricians.

September 11, 2003

RP-CHG-TANKFARM-2003-0046

High radiation readings on uncovered transfer line during transfer from AP-108 to AN-101.

A pretransfer survey of an uncovered transfer line in AN Farm showed radiation readings of 10 milliroentgen/hr at contact.  Another survey taken after the transfer had begun showed readings of 2 roentgen/hr at contact and 700 milliroentgen/hr at 30 cm.  A high radiation area was created.

The lack of an interface between requirements for establishing access controls for potential high radiation areas involving excavations near pipelines was identified as a direct cause of this event.  The work document did not address or provide instructions for establishment of access control during the time the trench would not be occupied by workers.  Additionally, the transfer and excavation procedures did not address or provide instructions for controlling areas where transfer lines were exposed as a result of excavations.

November 18, 2003

RP-CHG-TANKFARM-2003-0056

Inoperable equipment alarm during waste transfer results in Technical Safety
Requirement violation.

The high-pressure alarm for the 241-AP flush pit was found to be active during an ongoing transfer. The transfer had been restarted the day before following a flush in 241-AP. The alarm had not been properly cleared prior to resuming the transfer. Performing the transfer without the alarm having been cleared renders the equipment inoperable (new alarm conditions would be undetected).

Personnel performed the waste transfer based on acceptable equipment/alarm conditions of initial prerequisite checks, incorrectly assuming that the alarm condition had not changed upon restart.

December 4, 2003

 

RP-BNRP-RPPWTP-2003 -006

 

Electrical shock from portable heater.

After an electrician miswired a 480-volt portable heater, an iron worker attempted to move the heater and received an electric shock.

December 9, 2003

RP-CHG-TANKFARM-2003-0058

Operating experience demonstrated insufficient training of operating staff prior to initial operation of S-112 retrieval system.

Because of a lack of familiarity with the configuration of the S-112 saltcake dissolution system, operators did not change the position of a manual valve when they attempted to switch from transfer mode to recirculation mode.  Operators then dismissed numerous alarms as nuisance alarms while waste continued to be transferred inadvertently from tank S-112, and the pump started to run dry.  The transfer was halted only upon the intervention of an engineer and facility representative.

January 4, 2004

RP-BNRP-RPPWTP-2004-0001

Truck contacts aerial communication lines.

A dump truck configured as a snowplow caught the leading edge of its raised bed against four insulated communication lines.  The result was two power poles being snapped and a third being partially uprooted.  The power poles held six uninsulated power lines (three 2,400-volt, one 240-volt, and the rest deenergized).  The impact snapped one of the deenergized power lines, which fell across two 2,400-volt lines, blowing two fuses at the 13.8-kilovolt/2,400-volt transformer.

January 12, 2004

 

Near-miss steel drop.

A 1,112-lb steel beam was dropped 20-25 ft at the Waste Treatment Plant (WTP) Low-Activity Waste Facility.

January 13, 2004

 

 

Near-miss steel drop.

A stainless steel plate was dropped 8 ft and a section of telescoping brace was dropped 12 ft at WTP.

March 30, 2004

RP-BNRP-RPPWTP-2004-0005

Fall from trailer results in two broken ribs.

While working on the bed of a truck trailer, a carpenter stepped back off the trailer and fell 5 feet to the ground.  He was transported to the hospital and diagnosed with two broken ribs and a bruised hip.

May 20, 2004

RP-CHG-TANKFARM-2004-0027

Contamination discovered on clean-out box (COB) COB-AW-2 components.

During 242-A Evaporator campaign 04-01, waste leaked from a piping assembly installed by the construction contractor in support of modification efforts.  The modification area was draped in plastic with lead shielding, rubber matting, and absorbent pads between the soil and the modified piping.  A spray shield was also in place around the clean-out box.  Release to the environment was prevented only by the absorbent pads, rubber matting, and plastic.  The timeline was as follows:

January 2004High-level waste transfer is conducted without proper leak detection because wrong clean-out box was modified.

MarchAprilEntire evaporator campaign is conducted without proper leak detection because wrong clean-out box was modified.  In addition, waste is transferred though a clean-out box with its encasement cut open and hot taps installed on mining legs, which are connected to the primary slurry transfer line.  High-level waste leaks during transfer and contaminates nearby area.

In mid-May, workers investigating possible waste leak at clean-out box AW-2 terminate work after the sleeve of one of the worker’s anticontamination clothing became contaminated (20 mrad/hr) and exceeded allowable limits.

During a field investigation of clean-out box AW-2 in the latter part of the third week of May, workers discover ~500 ml of high-level waste inside a plastic cover and clean up the waste.  However, their work package scope includes only taking radiation surveys and contamination swipes, and shift manager is not notified of unexpected condition as required by procedure.  Health physics technician leaves farm although riggers are in a high radiation area and continuous coverage by a health physics technician is required.

May 24,2004

RP-CHG-TANKFARM-2004-0028

 

Construction personnel alarm personnel contamination monitor when exiting radiological buffer area.

On May 20, 2004, the transfer pump was removed from AN-01A pit using the flex receiver and cradle trailer.  The pump was left in the trailer, and a high radiation area was posted around it.  The pump was surveyed in the trailer, and no detectable contamination was found.  On May 24, 2004, the pump was lifted from the trailer to the ground, and a high radiation area was reestablished around the pump.  While the highly internally contaminated pump (up to 9 roentgen/hr at contact) was being moved, waste leaked out of a hole in the single plastic bag wrapped around the pump and contaminated the shoes and/or pants (up to 180,000 disintegrations per minute/100 cm2 beta-gamma) of two workers, who were not wearing anticontamination clothing.

June 15,2004

 

RP-BNRP-RPPWTP-2004-0008

Amputation of fingertip.

 At WTP, a carpenter using B drill press caught his leather glove on the drill bit and had part of his finger amputated.

June 17,2004

 

RP-BNRP-RPPWTP-2004-0009

Rebar curtain collapses.

While a rebar curtain splice was being installed on a wall at WTP, the lower curtain portion collapsed, causing rebar to fall to the ground.

June 22,2004

RP-BNRP-RPPW'TP-2004-0010

 

Near miss from falling embed.

A concrete embed weighing approximately 100 lb fell approximately 40 to 45 ft from a scissor lift at WTP.

June 22, 2004

 

Failure to wear required personal protective equipment.

Hanford Fire Department personnel entered 244-TX Farm without wearing required self-contained breathing air equipment.

June 24, 2004

RP-BNRP-RPPW'TP-2004-0011

 

Ankle fracture.

A WTP employee fractured his ankle when he stepped out of his truck and tripped over a taut string line.

June 30, 2004

 

RP-CHG-TANKFARM-2004-0033

A 4,500-lb flex receiver platform abruptly
drops when set pin from supporting leg
lifting opposing leg.

A crane lifted and positioned the flex receiver platform assembly over riser six in preparation for removing the temperature probe from Tank AN-101.  During positioning

of the flex receiver platform, a support pin was removed on one of the four hydraulic jacks.  This caused the platform to shift because of uneven weight distribution, which in turn resulted in the thermocouple probe becoming tilted in the riser.

July 8, 2004

RP-BNW-RPPWTP-2004-0012

Manlift cuts 480-volt cable.

While workers were lowering a manlift, the lift contacted a wooden stand holding electrical cords and a water hose.  The lift cut through a 480-volt cord, causing it to short out and trip the breaker.  A water hose on the stand was also partially cut.

July 13, 2004

RP-BNRP-RPPWTP-2004-0013

 

Truck/trailer rolls over.

At WTP, a tractor and flatbed trailer transporting an approximately 50,000-lb pedestal crane overturned.  Five counterweights weighing a total of 16,000 lb landed up to 30 ft away.

July 22, 2004

RP-CHG-TANKFARM-2004-0037

 

Extremity administrative control level
exceeded for nuclear chemical operator.

During removal of a 244-CR thermocouple, beta radiation dose rates increased rapidly, and the radiation detection meter pegged high in the beta-gamma mode (e.g., beta window open).  Workers took a brief pause in the work to establish the path forward for placing the job in a safe configuration.  It was decided to complete removal of the thermocouple.  The thermocouple was removed and placed on a flatbed truck.

Subsequently, it was discovered that a nuclear chemical operator had exceeded the extremity/skin administrative control level of 15 rem during the removal of the 244-CR thermocouple.

July 28, 2004

RP-BNRP- RPPWTP-2004-0014

Nitrogen bottle pack falls off truck.

While workers were preparing to offload a 12-pack of pressurized nitrogen cylinders from a flatbed truck, the 12-pack rolled off the truck and fell to the ground.  All cylinders remained intact.