[DNFSB
LETTERHEAD]
September 8, 2004
Mr.
Paul M. Golan
Acting Assistant Secretary for
Environmental Management
U.S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0113
Dear Mr. Golan:
During the last year, the
Defense Nuclear Facilities Safety Board (Board) has become increasingly
concerned that the Integrated Safety Management (ISM) System for the Hanford tank farms is failing to control work activities adequately. This concern has been engendered by a series
of occurrences, incidents, near misses, and other operational events indicating
serious weaknesses in work planning, conduct of operations, and responses to
abnormal events or unexpected conditions. A prime
example is the recent event where controls on worker exposure failed and a
worker received an excessive and unexpected extremity exposure. Recent events that exemplify weaknesses in the
ISM System are discussed in the enclosure to this letter. While industrial hygiene issues are also of
concern at the tank farms, these issues have been well documented by other
agencies and are not reiterated here.
It would be an
oversimplification to assign a single cause (e.g., accelerated cleanup) to these
occurrences in light of their variety. However, the number of serious events at the tank farms is not to be expected at a project
with a mature and effective ISM System. While
compensatory and corrective actions taken by the Department of Energy (DOE) and
its contractor have yielded temporary successes or addressed specific issues,
lasting success in implementing an effective ISM System at the tank farms has not been apparent. DOE noted similar concerns in a recent letter
from the Office of River Protection to the Hanford tank farms operating contractor. That letter highlighted performance problems
at the contractor management level that allowed poor work planning, hazard
identification, and conduct of operations. DOE Guide 450.4-1B, Integrated Safety Management Guide (Volume I),
addresses situations
in which a decrease in the effectiveness of the existing ISM System is
observed, and notes that corrective actions by DOE and the contractor should focus on improving performance.
While senior managers from the
Office of River Protection and CH2M Hill Hanford, Inc. have briefed the Board
on some of the specific issues associated with the latest extremity exposure
event, the Board would like to understand in greater detail the deficiencies of
the Hanford tank farm ISM System at the activity
level, and what actions must be taken to correct them. Therefore, pursuant to 42
U.S.C. § 2286b(d), the Board requests
that DOE submit to the Board within 60 days of receipt
of this letter a report that identifies weaknesses in the ISM System for the
tank farms, with particular focus on work planning, conduct of operations, and feedback and improvement
programs at the activity level. For each
weakness identified, the report should describe corrective actions, a schedule for carrying
out these actions, and a plan to ensure that all corrective actions have been
effective. The report should also
discuss the roles
and responsibilities of line managers in implementing and upgrading ISM at the
activity level.
While the Waste Treatment Plant
(WTP) is currently a construction site and hence does not pose radiological
hazards, incidents threatening worker safety have been on the rise in 2004. These incidents are often characterized by a failure
to follow mandatory controls and procedures or by carelessness and inattention
to detail. The Office of River Protection has also noted this trend and has required the WTP contractor to develop a
corrective action plan to ensure worker safety. The Board would like to be kept informed of DOE’s plans to improve safety performance at WTP.
Sincerely,
John T. Conway
Chairman
c: Mr. Roy J. Schepens
Mr. Mark
B. Whitaker,
Jr.
Enclosure
ENCLOSURE
Recent
Operational Events at Hanford Tank Farm and Waste Treatment Plant
Hanford Tank Farms
The following paragraphs
highlight the Defense Nuclear Facilities Safety Board’s (Board) concerns
regarding the current state of implementation of Integrated Safety Management (ISM)
at the Hanford tank farms.
ISM Core Function 1: Define the Scope of Work
The tank farms have experienced
significant problems with configuration
management, a key safety management program for ensuring that the scope of work
is well defined. After tank
farm workers
modified the wrong clean-out box near
the 242-A Evaporator,
three waste transfers were completed
without proper leak detection. Furthermore, operators conducted an entire evaporator
campaign using n transfer line that had a tap installed on the primary line and a hole cut into the encasement line. As a result, high-level waste (HLW) leaked and contaminated
the nearby area. Nearly 4 months later,
the contractor is still trying to verify
the configuration of the transfer line. While attempting to recover from this problem,
tank farm workers exceeded their approved work scope by cleaning up
the spilled HLW
solutions without authorization from the shift manager or the necessary
controls for handling these liquids.
ISM Core Functions 2 and 3: Analyze the Hazards and Develop and
Implement
Controls
These functions are particularly
important in cleanup work, where
conditions are often poorly characterized and/or changing. At the
tank farms, these ISM steps are accomplished at the activity level by using job
hazard analyses and enhanced work planning sessions. The Board’s staff has observed a number of
enhanced work planning sessions at the
tank farms. These sessions often are little
more than informal discussions among the planner, supervisor, and work crew
about how the work steps are to be worded and organized. During these sessions, an actual
hazard analysis is
seldom performed, and the words “what if’ are rarely spoken. As a
result, the controls tend to focus on anticipated safety events. For several of the events cited in the
following table, the hazards had not been adequately analyzed. In one case, workers in street clothes moved a highly contaminated pump,
wrapped only in a single layer of plastic, with a crane. During this activity, two workers had their
shoes and/or pants contaminated when waste leaked out of the bag. Other events in the tank farms resulted from the failure to establish conservative
controls when work was
to be performed in an area that was poorly
characterized. A
worker exceeded
Hanford’s administrative control level for extremity exposure as a result of encountering high beta
dose rates while
removing contaminated equipment from a tank for which little characterization
data existed.
ISM Core Function 4: Perform Work within Controls
In the above extremity exposure
incident, the field work supervisor decided to continue removing the highly
contaminated equipment even though the limits of the radiological work permit
had been exceeded, contact dose rates were higher
than the range of the radiation instrument
being used, and other controls for working in a high-radiation area with high
beta dose rates were not in place. In a
number of the tank farm incidents, the shift
manager was not
informed when unexpected conditions were encountered.
ISM Core Function 5: Provide Feedback and
Continuous Improvement
When ISM was first implemented at Hanford, feedback and improvement was
an immature process, and there
appears to have been little real progress made toward instituting effective
feedback and improvement at the activity level. Assessments and independent reviews have
repeatedly identified that feedback is not routinely provided for completed
activities, that the input provided is difficult to access, and that lessons
learned often are not incorporated into subsequent work packages. A user-friendly
system that is used by the workforce would significantly improve the
development and application of lessons learned.
ISM System
The Board has observed further
indications of weaknesses in the implementation of the ISM System at the tank
farms. Pre-job briefings do not address
contingency plans beyond routine alarms and putting work in a “safe condition,”
which usually is not defined in advance. Furthermore, drills generally involve simple
and obvious scenarios (e.g., alarm goes off), for which the response is usually
to evacuate the area or push an emergency stop button. Such drills do not require that supervisors
and other operations personnel analyze operational data to determine what is
happening, develop an appropriate response, and identify the “safe condition”. As a result, workers and supervisors may not be adequately
prepared when an abnormal event occurs or when they encounter an unexpected
condition.
Waste Treatment Plant
The following paragraphs
highlight the Board’s concerns regarding the current state of ISM System
implementation at the
Waste Treatment Plant (WTP) construction site.
Recent near misses at WTP have
involved dropping heavy loads
(e.g., a structural steel beam, a rebar curtain, and a 100-pound concrete embed) and simultaneously cutting tbrough an energized 480-volt cord and partially through a water hose. In another accident, a flatbed trailer carrying
it 50,000-pound
crane overturned and spilled five counterweights weighing more than 16,000
pounds, which tumbled up to
30 feet away. Such events have the
potential to seriously injure or kill workers.
A
key component of
the ISM System for WTP construction activities is the use of a checklist to
identify hazards and controls.
A generic vulnerability of
checklists is the tendency to quickly check off the blocks on the checklist, with little analysis of the hazards or controls involved. Furthermore, checklists that rarely change can
lead to complacency among workers over time. Considering the constantly changing conditions
typical of construction work, both of these situations need to be avoided. It would be appropriate for the
Department of
Energy to review the effectiveness of safety
checklists at the construction site, how their use is complemented by pre-job
briefings, and how this impacts conduct of operations and line management
oversight.
Event Data Summary
|
Date |
Occurrence No. |
Description |
|
June 25, 2003 |
RP-CHG-TANKFARM-2003-0030 |
Jumper removal
in 241-AW-101 01A pit results in multiple personnel contaminations. During jumper removal in 01A pit,
a powder
substance fell from the jumper to the pit floor, causing airborne contamination in the
immediate area. The contamination control
practices defined for the pit work did not contain all
contamination at the source. |
|
August 28, 2003 |
RP-CHG-TANKFARM-2003-0043 |
Electrical near miss
at 271-AP results in power loss
to tank ventilation system. Subtier workers were pulling wire in
a subgrade cable trench. When they were done, a worker attempted to replace
one of two steel cover plates. As
the worker moved the
plate into position, it slipped off the recessed edge and from his hands and
fell into the cable trench. The plate struck
a cable bundle containing 480-volt conductors, penetrated cable insulation,
and caused a short-circuit resulting in an
arc flash. Work instructions contained no
information regarding how to remove these plates. No eye-bolts were used in the removal or
installation of the plates―a practice of CH2M Hill Hanford Group
electricians in the past. This
practice was not communicated to the subcontractor electricians. |
|
September 11, 2003 |
RP-CHG-TANKFARM-2003-0046 |
High radiation readings on uncovered transfer line during transfer from AP-108 to AN-101. A
pretransfer survey
of an uncovered transfer line in AN Farm showed radiation readings
of 10 milliroentgen/hr at contact. Another survey
taken after the transfer
had begun showed readings of
2 roentgen/hr
at contact
and 700 milliroentgen/hr at 30 cm. A
high radiation
area was created. The lack of an interface between requirements for establishing access controls for potential high radiation areas involving excavations near pipelines was identified as a direct cause of this event. The work document did not address or provide instructions for establishment of access control during the time the trench would not be occupied by workers. Additionally, the transfer and excavation procedures did not address or provide instructions for controlling areas where transfer lines were exposed as a result of excavations. |
|
November 18, 2003 |
RP-CHG-TANKFARM-2003-0056 |
Inoperable equipment alarm during waste transfer results in Technical Safety The high-pressure alarm for the 241-AP flush pit was found to be active during an ongoing transfer. The transfer had been restarted the day before following a flush in 241-AP. The alarm had not been properly cleared prior to resuming the transfer. Performing the transfer without the alarm having been cleared renders the equipment inoperable (new alarm conditions would be undetected). Personnel performed the waste transfer based on acceptable equipment/alarm conditions of initial prerequisite checks, incorrectly assuming that the alarm condition had not changed upon restart. |
|
December 4, 2003 |
RP-BNRP-RPPWTP-2003 -006 |
Electrical shock from portable heater. After
an electrician miswired a 480-volt portable heater, an iron worker
attempted to move the heater and received an electric shock. |
|
December 9, 2003 |
RP-CHG-TANKFARM-2003-0058 |
Operating experience demonstrated
insufficient training of operating staff prior to initial operation of
S-112
retrieval
system. Because of a lack of
familiarity with the configuration of the S-112 saltcake dissolution system,
operators did not change the position of a manual valve when they attempted to
switch from transfer mode to recirculation mode. Operators then dismissed numerous alarms
as nuisance alarms
while waste continued to be transferred inadvertently
from tank S-112, and the pump started to run dry. The transfer was halted
only upon the intervention of an engineer and facility representative. |
|
January 4, 2004 |
RP-BNRP-RPPWTP-2004-0001 |
Truck contacts
aerial communication lines. A dump truck configured as a
snowplow caught
the leading edge of its raised bed against four insulated communication lines.
The result was
two power
poles being
snapped and a
third being partially uprooted. The
power poles held six uninsulated power lines (three 2,400-volt,
one 240-volt, and the rest deenergized). The impact snapped one of the deenergized
power lines, which fell across two
2,400-volt lines,
blowing two fuses at the 13.8-kilovolt/2,400-volt
transformer. |
|
January 12,
2004 |
|
Near-miss steel
drop. A
1,112-lb steel
beam was dropped
20-25 ft at the Waste Treatment Plant (WTP) Low-Activity Waste Facility. |
|
January 13, 2004 |
|
Near-miss steel drop. A
stainless steel
plate was dropped 8 ft and a section of telescoping
brace was dropped 12 ft at WTP. |
|
March
30, 2004 |
RP-BNRP-RPPWTP-2004-0005 |
Fall from trailer results in two broken ribs. While
working on the bed of a truck trailer, a carpenter stepped back off the trailer
and fell 5 feet to the ground. He was
transported to the hospital and diagnosed with two broken ribs and a bruised
hip. |
|
May
20, 2004 |
RP-CHG-TANKFARM-2004-0027 |
Contamination
discovered on clean-out box (COB) COB-AW-2 components. During 242-A Evaporator
campaign 04-01, waste leaked from a piping assembly installed by the
construction contractor in support of modification
efforts. The modification area was
draped in plastic with lead shielding, rubber matting, and absorbent pads
between the soil and the modified piping. A spray shield was also in place around the clean-out box. Release to the environment was prevented
only by the absorbent pads, rubber matting, and plastic. The timeline was as follows: January 2004―High-level waste transfer is
conducted without proper leak detection because wrong clean-out box was modified. March–April―Entire
evaporator campaign
is conducted without proper leak detection because wrong clean-out box was
modified. In addition, waste is
transferred though a clean-out box with its encasement cut open and hot taps installed
on mining legs,
which are connected to the primary slurry transfer line. High-level waste leaks during transfer and
contaminates nearby area. In mid-May, workers
investigating possible waste leak at clean-out box AW-2
terminate work after the sleeve of one of the worker’s anticontamination
clothing became contaminated (20 mrad/hr) and
exceeded allowable limits. During a field investigation
of clean-out box AW-2 in the latter part of the third week of May, workers discover
~500 ml of
high-level waste inside a plastic cover and
clean up the
waste. However, their work package
scope includes only taking radiation surveys and contamination swipes, and
shift manager is not notified of unexpected condition as required by procedure. Health physics technician leaves farm although riggers are in a high radiation area and continuous
coverage by a health
physics technician is required. |
|
May 24,2004 |
RP-CHG-TANKFARM-2004-0028 |
Construction personnel
alarm personnel contamination monitor when exiting radiological
buffer area. On May 20, 2004, the transfer pump
was removed from AN-01A
pit using the flex
receiver and
cradle trailer. The pump
was left in the trailer, and
a high radiation area was posted
around it. The pump was
surveyed in the
trailer, and no detectable contamination was found. On May 24, 2004, the pump
was lifted from
the trailer to the ground, and a high radiation area was
reestablished
around the pump. While the highly
internally contaminated pump (up to 9 roentgen/hr at contact) was
being moved,
waste leaked out of a hole in the single plastic bag wrapped
around the pump
and contaminated the shoes and/or pants (up to 180,000 disintegrations per minute/100 cm2
beta-gamma) of two workers, who were not wearing anticontamination clothing. |
|
June 15,2004 |
RP-BNRP-RPPWTP-2004-0008 |
Amputation of fingertip. At WTP, a carpenter using B drill press caught his leather
glove on the drill bit and
had part of his
finger amputated. |
|
June 17,2004 |
RP-BNRP-RPPWTP-2004-0009 |
Rebar curtain
collapses. While a rebar curtain splice
was being installed on a
wall at WTP, the lower curtain portion collapsed, causing rebar to fall to
the ground. |
|
June
22,2004 |
RP-BNRP-RPPW'TP-2004-0010 |
Near miss
from falling embed.
A
concrete embed
weighing approximately 100 lb fell approximately 40 to 45
ft
from a
scissor lift at
WTP. |
|
June
22, 2004 |
|
Failure to wear required personal
protective equipment. Hanford Fire Department personnel entered 244-TX
Farm without
wearing required self-contained breathing air equipment. |
|
June
24, 2004 |
RP-BNRP-RPPW'TP-2004-0011 |
Ankle fracture. A WTP employee fractured his
ankle when he stepped out of his truck and tripped over a taut string
line. |
|
June 30, 2004 |
RP-CHG-TANKFARM-2004-0033 |
A 4,500-lb
flex receiver platform abruptly A
crane lifted and
positioned the flex receiver platform assembly over riser six in preparation
for removing the temperature probe from Tank AN-101. During positioning of the flex receiver platform, a
support pin was removed on one of the four hydraulic jacks. This caused the platform to shift because of
uneven weight distribution, which in turn resulted in the thermocouple probe
becoming tilted in the riser. |
|
July
8, 2004 |
RP-BNW-RPPWTP-2004-0012 |
Manlift cuts
480-volt cable. While workers were lowering a manlift, the lift contacted a wooden stand holding
electrical cords and a water hose. The
lift cut through a 480-volt cord, causing it to short out and
trip the breaker.
A water hose on the stand was
also partially cut. |
|
July
13, 2004 |
RP-BNRP-RPPWTP-2004-0013 |
Truck/trailer rolls
over. At
WTP, a tractor
and flatbed trailer transporting an approximately 50,000-lb pedestal crane
overturned. Five counterweights weighing
a total of 16,000 lb landed up to 30 ft away. |
|
July
22, 2004 |
RP-CHG-TANKFARM-2004-0037 |
Extremity
administrative control level During removal of a 244-CR
thermocouple, beta radiation dose rates increased rapidly, and the radiation detection meter
pegged high in the beta-gamma mode (e.g., beta window open). Workers took a brief pause in the work to establish the path forward for
placing the job in a safe configuration. It was decided
to complete removal of the thermocouple. The thermocouple was removed and placed on a
flatbed truck. Subsequently, it was discovered that
a nuclear
chemical operator had exceeded the extremity/skin administrative control
level of 15 rem during the
removal of the 244-CR thermocouple. |
|
July
28, 2004 |
RP-BNRP- RPPWTP-2004-0014 |
Nitrogen bottle pack falls off truck. While workers were preparing to offload a
12-pack of pressurized
nitrogen cylinders from a flatbed truck, the 12-pack
rolled off the truck and fell to the ground. All
cylinders
remained intact. |