July 2000
Prepared by
Office of Oversight
Office of Environment, Safety and Health
U.S. Department of Energy

TABLE OF CONTENTS

• Executive Summary

• 1.0 Introduction
  • 1.1 Background
  • 1.2 Facility Description
  • 1.3 Scope, Purpose, and Methodology

• 2.0 The Accident
  • 2.1 Background and Accident Description
    • 2.1.1 Accident Overview
    • 2.1.2 Background
    • 2.1.3 Accident Description
  • 2.2 Emergency Response and Medical Treatment
    • 2.2.1 Emergency Response
    • 2.2.2 Medical Treatment
    • 2.2.3 Reentry and Recovery Activities
  • 2.3 Radiological Impact
    • 2.3.1 Pu-238 Contamination of Facility
    • 2.3.2 Dose to Affected Workers
  • 2.4 Accident Reconstruction

• 3.0 Accident Facts and Analysis
  • 3.1 Physical Hazards, Controls, and Related Factors
    • 3.1.1 Work Planning
    • 3.1.2 Hazard Analysis
    • 3.1.3 Develop and Implement Controls
    • 3.1.4 Perform Work Within Controls
    • 3.1.5 Feedback and Improvement
    • 3.1.6 System Design
    • 3.1.7 Radiation Protection and Control
    • 3.1.8 Emergency Response
    • 3.1.9 Management Systems
  • 3.2 Barrier Analysis
  • 3.3 Change Analysis
  • 3.4 Causal Factors Analysis

• 4.0 Judgments of Need
• 5.0 Board Signatures
• 6.0 Board Members, Advisors, and Staff

• Appendix A - Board Appointment Memorandum
• Appendix B - Events and Causal Factors Chart
• Appendix C - Barrier Analysis

Executive Summary

Overview

On March 16, 2000, at approximately 2 p.m., a radiological release of plutonium-238 occurred near a glovebox in the Plutonium Processing and Handling Facility (TA-55) of the Los Alamos National Laboratory. At least seven of the eight workers who were in the room at the time received confirmed intakes of plutonium-238. The estimated lifetime effective dose to the most affected worker may be as high as 300 Rem, and three other workers will probably exceed their annual exposure limit of 5 Rem. Biological samples from the remaining workers show significantly lower exposures. The four workers with the highest radiological intake began chelation therapy immediately after the accident to facilitate removal of plutonium-238 from their bodies. Biological sampling will continue during the coming months to allow the workers' actual doses to be determined.

On the day after the accident, the Secretary of Energy ordered a Type A accident investigation to identify the cause of the accident and to identify lessons learned to prevent such accidents in the future.

Based on the potential radiological doses and the number of workers involved, this is one of the more serious accidents involving radiological intakes in the history of the Department of Energy and its predecessor agencies. The accident investigation board estimates that, on this basis, it ranks in the top ten worst radiological intake accidents in the 41 years for which this data is available.

The Accident

On March 16, 2000, a supervisor, performing his morning walkdown of glovebox lines in TA-55, noted that one glovebox had no argon flow through its oil bubbler. This inert glovebox has an argon atmosphere, maintained by a system that provides argon to the glovebox when its pressure falls below a specific setpoint and by an oil bubbler that regulates the negative pressure in the glovebox.

The supervisor tasked an electrical/mechanical technician to determine why there was no bubbler flow. Unknown to both the supervisor and the technician, an electrical circuit providing power to the automatic argon control system had tripped, closing the argon solenoid supply valve.

At approximately 1:30 p.m., the technician began his maintenance evaluation to determine why the argon flow to the bubbler had ceased. Seven other workers were in the room. While the technician was examining the piping under the west side of the glovebox, alpha radiation hand monitors in the vicinity alarmed. Shortly after the hand monitors alarmed, the continuous air monitors (CAMs) in the four corners of the room also alarmed. Upon hearing the first CAM alarm, all eight personnel immediately left the room.

The accident investigation board determined that the direct cause of the accident was a release of airborne contamination from a leaking compression fitting in an inadvertently pressurized dry vacuum line. The vacuum line serves an airlock between the glovebox and an adjacent dropbox.

Results and Analysis

Los Alamos National Laboratory placed the electrical/mechanical technician involved in this accident in a situation where he could not successfully carry out the assigned task. Deficiencies in operator aids such as valve labels, combined with the technician's lack of knowledge of the system piping, led the technician to evaluate the wrong pipe. A lack of communication between two work groups prevented the technician from knowing that an electrical breaker had tripped isolating argon flow. Weaknesses in the technician's training had not prepared him for the consequences of his actions, i.e., shaking the pipe and/or possibly operating valves. Incomplete and untested work that took place years earlier had left a pipe mechanical joint only finger-tight, unable to hold pressure. Installation and use of a ball valve with seals susceptible to degradation in a radiation environment eliminated a second physical barrier to the release. A lack of formality or definition in operations in TA-55 led to confusion as to what actions workers were allowed to perform on glovebox auxiliary systems. The hazard analysis underestimated the potential consequences of breaches of contaminated systems, so few design requirements were specified for glovebox auxiliary systems. The work control process allowed excessive dependence on worker skills so other knowledgeable persons, such as supervisors and other work centers, had no opportunity to review the planned actions. Finally, Los Alamos National Laboratory had not learned from the numerous prior contamination release events in TA-55, including one almost identical to the accident under investigation and involving the same glovebox and same personnel.

Several days before the accident, two chemical technicians decontaminating the glovebox experienced problems with a 120-volt AC power supply circuit. This circuit serves most 120-volt electrical outlets and services on the subject glovebox, including power for the argon supply solenoid valve and associated circuitry. With this circuit de-energized, the solenoid valve in the argon line fails in the shut position, cutting off argon flow to the glovebox. The fact that this circuit was experiencing problems was not effectively communicated to other work groups working in the room. Further, TA-55 does not document system status via logbooks or other means, so no reviewable record of this problem was available. As a result, the electrical/mechanical technician did not know that the electric circuit had tripped and had cut off the argon flow. If he had known, he might have limited his evaluation to electrical circuits and avoided the accident. Lack of communications between work groups and lack of records of plant conditions (such as logbooks) indicate poor conduct of operations or formality of operations—one of the three root causes of this accident.

The source of the leak was a compression fitting in the dry vacuum line used for purging the airlock between the glovebox and an adjacent dropbox. Post-accident inspection of the ferrule and tubing revealed that the fitting was only finger-tight. There was no apparent record of when and how this joint was installed or tested after installation; TA-55 does not maintain system configuration and maintenance history for these auxiliary systems. The manifold, which contained two valves and a pressure-vacuum gauge, is fabricated entirely of compression fittings. The facility's safety design basis does not address design specifications for this system because of deficiencies in the facility hazard analysis. However, use of compression fittings in this situation does not conform to the American Glovebox Society standard, which recommends the use of non-mechanical joints (i.e., soldered, brazed, welded) for these types of services. The accident would not have occurred if a mechanical joint had not been installed, or if a post-installation test or quality check had been performed. Failures in configuration control and proper use and installation of mechanical compression fittings are therefore the other two root causes of this accident.

Three factors must be present to release contamination from this piping system: source term (plutonium-238), containment failure (leaky fitting), and motive force (pressure). The accident investigation board was able to clearly establish the source term and containment boundary failure. With respect to motive force, there is strong evidence that the tubing was pressurized by operation of the argon manifold valve. TA-55 has no procedures for operating valves in glovebox auxiliary systems, and there are no standard valve lineups; in fact, of four vacuum/argon manifolds inspected in TA-55, no two had valves in the same position. In short, operation of these valves is generally not controlled except through reliance on workers' knowledge. Los Alamos National Laboratory has not established an adequate balance between control of operations, workers' operational freedom and the adequacy of workers' knowledge in making operational decisions, and barriers designed to prevent adverse events. As previously noted, poor formality of operations and failures in configuration control are root causes of this accident.

Los Alamos National Laboratory's treatment of the contaminated workers after the accident is notable. The senior radiological control technician in the room at the time of the release promptly ordered all personnel to leave the room when the first CAM alarmed. The Operations Center promptly announced the alarm and location, bringing assistance from personnel elsewhere in the facility. The eight contaminated workers were decontaminated within about 30 minutes of the accident. There was good communication from TA-55 to Los Alamos National Laboratory support organizations concerning caring for the workers and estimating their dose. Lastly, medical care included in-depth explanations to the eight workers on potential impacts and treatment options, as well as an offer for obtaining independent medical advice.

Conclusion

The accident investigation board concludes that this accident was preventable.   Weaknesses in work planning and control, formality of operations, hazard analysis, design of auxiliary systems, and configuration control significantly degraded the barriers between the worker and the hazard.  Los Alamos National Laboratory missed opportunities to correct contributing causes and possibly to prevent this accident when they failed to adequately analyze and learn from previous related events. Contributing to the accident was the lack of balance between control of operations, workers' operational freedom, reliance on workers' knowledge in making operational decisions, communications between work groups, and barriers designed to prevent adverse events.

The failure to effectively apply the core functions of integrated safety management to potentially hazardous work activity within TA-55 resulted in significant radiological doses to four workers. Most of the accidents investigated within the Department over the past year have involved a failure to apply integrated safety management to work considered "routine" or within the "skill of the craft," and all have involved injuries and/or exposures. Two of these accidents have involved maintenance evaluation or troubleshooting activities that were not adequately controlled or were not conducted within the framework of integrated safety management.

As we approach the Secretary of Energy's September 2000 deadline for full implementation of the Department's integrated safety management policy, Los Alamos National Laboratory, as well as the rest of the Department of Energy complex, needs to seriously consider the implication of these recent accidents. All potentially hazardous work, including work considered to be routine, within the "skill of the craft," or system maintenance evaluation/troubleshooting, needs to be conducted in accordance with the core functions of integrated safety management.

Causal Factors and Judgments of Need

Table ES-1 presents the causal factors and judgments of need determined by the Board. The causal factors are the events or condictions that produced or contributed to the accident and consist of root and contributing causes. Judgments of need are managerial controls and safety measures believed by the Board to be necessary to prevent or minimize the probability of a recurrence of this type of accident. Judgments of need are derived from the causal factors and are intended to assist managers in developing follow-up actions.

Table ES-1. Causal Factors and Judgments of Need 

Introduction

1.1 Background

On March 16, 2000, at 1:57 p.m., continuous air monitor (CAM) alarms actuated in a room in the Plutonium Processing and Handling Facility, Technical Area-55 (TA-55), at Los Alamos National Laboratory (LANL). Eight LANL workers in the room at the time of the alarm immediately evacuated to an adjacent corridor. All eight had levels of external contamination and five of the workers had nasal smear results indicating potentially high intakes of plutonium-238 (Pu-238). Medical treatment (chelation) for four workers was initiated within three hours by LANL.

On March 17, 2000, Bill Richardson, Secretary, U.S. Department of Energy (DOE), ordered a Type A accident investigation of this accident in accordance with DOE Order 225.1A, Accident Investigations (see Appendix A for the appointment memorandum).

1.2 Facility Description

LANL occupies approximately 43 square miles of DOE land situated on the Pajarito plateau in the Jemez Mountains of northern New Mexico. The closest population centers are the communities of Los Alamos, White Rock, and San Ildefonso Pueblo. The closest metropolitan center is Santa Fe, population approximately 70,000, located 35 miles away.

LANL's mission is to apply science and engineering capabilities to problems of national security. As technologies, U.S. priorities, and the world community have changed, LANL's original mission has evolved from the primary task of designing nuclear weapons to the following five areas: (1) stockpile stewardship, (2) stockpile management, (3) nuclear materials management, (4) non-proliferation and counter-proliferation, and (5) environmental stewardship.

Exhibit 1-1. Aerial Photo of Plutonium Facility

LANL currently consists of 49 active Technical Areas (TAs). TA-55 houses chemical and metallurgical processes for recovering, purifying, and converting plutonium and other actinides into many compounds and forms. Most of TA-55 is situated inside a protected area surrounded by a double security fence (see Exhibit 1-1). The Plutonium Processing and Handling Facility (PF- 4), the scene of this accident, is one of five connected buildings located on 40 acres about one mile southeast of the central technical area. PF-4 maintains extensive capability for plutonium fabrication and processing.

The regents of the University of California (UC) manage LANL under a management and operating contract with DOE. UC has managed the Laboratory since its inception in 1943. The DOE Los Alamos Area Office (LAAO), a part of the Albuquerque Operations Office (AL), administers the contract with UC and oversees contractor operations at the site. The Deputy Administrator for Defense Programs (DP), National Nuclear Security Administration, is the responsible program secretarial officer for LANL.

1.3 Scope, Purpose, and Methodology

The Type A accident investigation board (Board) began its investigation on March 20, 2000, and completed the onsite phase of its investigation on April 29, 2000. The scope of the Board's investigation was to review and analyze the circumstances of the accident to determine its causes. This investigation, performed in accordance with DOE Order 225.1A, Accident Investigations, included an evaluation of the adequacy of the safety management systems of TA-55, LANL, and DOE, as they relate to the accident.

The purposes of this investigation were to determine the causes of the accident, to identify lessons learned, and to reduce the potential for similar accidents at TA-55 and across the DOE complex.

The Board conducted its investigation using the following methodology:

• Inspecting and photographing the accident scene and individual items of evidence related to the accident
  

• Gathering facts through interviews, document and evidence reviews, and walkdowns of the area
  

• Reviewing emergency and medical response
  

• Analyzing facts and identifying causal factors through events and causal factors charting and analysis, barrier analysis, and change analysis to correlate and analyze facts and identify the accident's causes (see box)
  

• Developing judgments of need for corrective actions to prevent recurrence, based on analysis of the information gathered.

  The Accident

2.1 Background and Accident Description

2.1.1 Accident Overview

On March 16, 2000, a release of material containing Pu-238 occurred in one room of Building PF-4 in TA-55. Present in the room at the time were (refer to Figure 2-1):

• An Electrical Mechanical Technician (ET) who was evaluating the argon purge system for a glovebox, based on a report earlier that day of a no-flow condition for the argon system
  

• Two Radiological Control Technicians (RCT-1 and RCT-2) at their normal workstation along the south wall, east of the main door, who were replacing some glovebox-mounted, alpha radiation hand monitors (Ludlum Model 214)
  

• Two Chemical Process Technicians (CPT-1 and CPT-2) who were in the northeast corner, waiting for a meeting to discuss the new gloveboxes in an adjacent room

• One Chemical Process Technician (CPT-3) who was waiting for a furnace in a nearby glovebox to heat up and was talking on the phone at the RCT workstation
  

• Two Chemical Technicians (CT-1 and CT-2) associated with the electrolytic decontamination of the glovebox being examined by ET; CT-1 was on the east side of the glovebox, and CT-2 was at the desk in the southwest corner.

Figure 2-1. Locations and Exit Paths of Workers

Exhibit 2-1. Affected Line of Gloveboxes

The first indication of a release was when the hand monitor on the northwest side of the glovebox being examined by ET alarmed. At that time, ET was located at the northwest corner of the glovebox. RCT-1 and RCT-2 responded to investigate. A second hand monitor on the southwest side of the associated dropbox alarmed. CPT-1 also reacted to the alarms by walking along the north wall toward the corridor west of the glovebox to determine the cause of the alarm. Believing the alarms to be spurious, RCT-1 and RCT-2 retrieved stepladders from other locations in the room in order to reach and reset the hand monitors, which were mounted above the gloveboxes. The hand monitors could not be reset, and shortly thereafter, a third hand monitor alarmed on a nearby glovebox. Almost simultaneously, at 1:57 p.m., the CAM in the southwest corner of the room alarmed and all personnel evacuated from the room to the hallway, where decontamination activities began.

Figure 2-1 illustrates the room orientation with the location and paths taken by the eight workers, from just before the first hand monitor alarm until exiting to the corridor.

2.1.2 Background

The Nuclear Materials Technology Division (NMT) at LANL uses gloveboxes (see Exhibit 2-1) for various processes involving highly hazardous materials such as Pu-238 and Pu-239. The gloveboxes are uniquely designed for specific applications and processes. They are essentially self-contained processing areas with a controlled atmosphere and containment to ensure the safety of the worker, the facility, and the public.

Support systems are designed around the gloveboxes, based on the intended application of the glovebox. These systems include helium, argon, and nitrogen supply lines; vacuum services; and positive pressure chilled-water supply and return systems. Each glovebox is typically connected via an airlock (i.e., spool piece) to a dropbox or another glovebox to allow the transfer of material or equipment in and out of the glovebox under controlled conditions. Depending on radiation levels within the glovebox, there may be water-filled shield doors at the base of the glovebox and transparent plastic shielding over the glovebox windows. Electrical power, normally 120 Volt AC, is provided for instrumentation, monitoring, control and other glovebox needs. Power is available internally and externally to the gloveboxes.

Exhibit 2-2. Glovebox Bubbler

ET was examining the argon purge line for an inert glovebox that is purged with argon and maintained at a negative pressure with respect to the room. To maintain an inert, dry, and specific negative pressure in this glovebox, argon is supplied through a solenoid valve that is actuated by a photohelic pressure sensor. When pressure in the glovebox decreases below the desired negative differential pressure, the photohelic sensor energizes the solenoid valve to admit argon to the glovebox. This argon supply system is on the east side under the glovebox. Argon flow is controlled by a rotometer with an integrated throttle valve. The argon is exhausted from the glovebox to the appropriate facility ventilation header through a high efficiency particulate air (HEPA) filter and an oil bubbler (see Exhibit 2-2). The oil bubbler maintains the glovebox at a negative differential pressure based on the height of oil and the pressure in the ventilation header.

This glovebox has a second argon supply line on the west side for purging the airlock. This argon line is routed to a small manifold that includes a dry vacuum line and a common pressure gauge. The manifold is provided for purging the airlock and equalizing pressure between the airlock and glovebox, and is located under the northwest side of the glovebox. The argon line contains two valves between the header and the manifold. The dry vacuum line is connected to the manifold via two valves. All pipe and valve joints in the manifold are mechanical joints with compression fittings (see Figure 2-2).

The glovebox in question was installed sometime between 1978 and 1983. Initially the glovebox was used for radioactive material particle size analysis studies. These studies involved the use of small quantities (from one tenth of a gram up to one gram) of radioactive material. The glovebox was also used as a spare box to store radioactive material until 1993. In late 1993, the glovebox was put into service in support of preparing heat sources for the space program. This work continued until the late 1990s.

On November 19, 1998, this particular glovebox was involved in a release of radioactivity. That release occurred while workers were adjusting the negative differential pressure in the glovebox. The source of this leak was traced to a leaking airlock gasket. As a result, a requirement was established that all workers using or working on this glovebox must wear respirators.

This glovebox has not been used for the past few years and was scheduled for removal in 2000 based on its age and changes in Laboratory needs. This glovebox had been empty since the last accountable nuclear material was removed on December 9, 1998. To reduce the cost associated with transuranic waste disposal, NMT planned to decontaminate the glovebox using an electrolytic decontamination process that had been used successfully on 14 Pu-239 gloveboxes. The electrolytic decontamination process, developed at LANL by the Pit Disassembly and Nuclear Fuels Technologies Group (NMT-15) as a means to remove actinide contamination from the internal surfaces of gloveboxes, removes a thin layer of material from the glovebox surface using an alkaline electrolyte and a small direct current. The electrolyte is heated by the operation, significantly increasing the amount of humidity in the glovebox.

In preparation for the electrolytic decontamination of this glovebox, steps were taken to allow work in the glovebox without respiratory protection. A plastic "tent" with a portable air monitoring port was fabricated and installed over the suspected leaking airlock gasket. Portable CAMs were installed near the airlock and glovebox, and were required to be operating while work was performed in the glovebox. The airlock was monitored over a period of time, with the tent installed, and no increase in airborne radioactivity was observed. Based on these monitoring results, the requirement for respiratory protection for the electrolytic decontamination effort was waived. However, the portable CAMs were still required to be operating while work was performed in the glovebox.

On February 17, 2000, electrolytic decontamination equipment was transferred into the glovebox, and decontamination work began on February 28, 2000, following a pre-job briefing. For several days prior to the March 16 accident, electrical circuit #10 was noted to have tripped several times. Loss of power to this circuit stopped decontamination work because circuit #10 provides power to the required hand monitors on the glovebox. Circuit #10 also powers the photohelic system that actuates the solenoid to allow argon to flow into the glovebox.

Figure 2-2. Airlock Manifold Piping Diagram

2.1.3 Accident Description

On March 15, 2000, during the morning walkthrough of the room in question, a radiation control technician (RCT-1) noticed that one of the hand monitors for the glovebox had no power. To re-energize the hand monitor, its electrical plug was moved from the 120 volt AC circuit #10 to circuit #9. RCT-1 then notified the Area Work Supervisor (AWS) that circuit #10 was tripped. The AWS reset the circuit breaker and asked RCT-1 to plug the affected hand monitor back into circuit #10 to check it. RCT-1 moved the plug back to circuit #10 and verified that it was operational. Decontamination work was then allowed to continue in the glovebox.

On the following day, March 16, at 7:30 a.m., RCT-1 noticed that the same hand monitor was again without power. He notified the AWS of the problem and was told that the circuit could not be reset again. However, circuit #10 was not tagged out. The AWS stated that he would contact an electrician to troubleshoot the problem. In the meantime, the AWS directed RCT-1 to plug the hand monitor into circuit #9.

At approximately 8:30 a.m., the Room Work Supervisor (RWS) noticed that there was no argon gas flow indicated through the bubbler on the glovebox. The RWS tasked ET to conduct a maintenance evaluation of the flow problem. ET indicated that he could take a look at it but would not be able to thoroughly inspect the argon line until later in the day. That morning, ET verified that there was no flow through the bubbler. After lunch, ET reentered the room to determine the reason for the lack of argon flow to the glovebox.

Two Chemical Technicians (CT-1 and CT-2) entered the room shortly after ET, intending to continue the electrolytic decontamination of the glovebox. ET's maintenance evaluation of the argon flow was blocking their access to the glovebox, so they waited in the room to start their work. Two Chemical Process Technicians (CPT-1 and CPT-2) were also in the room waiting for a meeting to begin on an unrelated activity. Two Radiological Control Technicians (RCT-1 and RCT-2) were in the room, replacing hand monitors for re-calibration. A third Chemical Process Technician (CPT-3) was in the room to start up a furnace for a calcining operation in another glovebox and was talking on the phone at the RCT workstation.

ET began maintenance evaluation on the east side of the glovebox. On this side of the glovebox, behind a set of water-filled shield doors, are the argon supply line, solenoid-operated isolation valve, and rotometer that would indicate flow to the glovebox. ET again confirmed that there was no flow in the rotometer.

Moving to the west side, by the dropbox north of the glovebox, ET continued to trace the argon supply lines starting at the floor penetration and moving south toward the glovebox. When he reached the glovebox, he opened the northwest water-filled shield doors and continued his evaluation.

The first hand monitor alarmed while ET was conducting his evaluation under the glovebox. As it was alarming, ET stood up and was joined by RCT-1 and RCT-2 on the west side of the glovebox. When the hand monitor alarmed, ET and the RCTs believed it to be a false alarm, possibly caused by an electrical transient. As ET stood up to see which hand monitor was in alarm, he squeezed (or pumped) a glove on the glovebox, attempting to cause a sufficient pressure transient in the glovebox to cycle the photohelic around its setpoint, thus actuating the solenoid valve and allowing argon to flow into the glovebox. At about this time, a second hand monitor alarmed. As the RCTs attempted to reset the hand monitors, a third hand monitor alarmed, followed shortly thereafter by the first CAM alarm. When the CAM alarmed, RCT-2 ordered all personnel to immediately leave the room. The eight workers in the room exited to the corridor, where personnel decontamination efforts commenced.

The contamination spread quickly throughout the room as the workers exited. All four CAMs went into alarm within 37 seconds after the first CAM alarmed. The release spread to two adjacent rooms through interconnecting doors, activating the CAMs covering these rooms. The spread of the contamination was limited to these three rooms by the ventilation system, which maintained the rooms at a negative pressure with respect to the building corridors. Although the source of the contamination was unknown at the time, a later reentry determined that airborne contamination levels within the rooms had decreased. There was no release of contamination from the building.

2.2 Emergency Response and Medical Treatment

2.2.1 Emergency Response

Following the CAM alarm, RCT-2 ordered the immediate evacuation of all personnel working in the room. All eight personnel immediately exited the room and waited in the adjacent corridor for radiological evaluation and direction in accordance with facility spill/release response procedures.

Upon receiving CAM alarms from the two rooms, operation technicians in the Operations Center immediately announced the multiple CAM alarms over the PF-4 public address system in accordance with CAM alarm response procedures. They then notified the on-duty supervisor and the Facility Manager, while continually monitoring conditions within the facility. NMT division office personnel notified the Environment, Safety and Health Deputy Group Leader (ESH-1).

The Facility Manager was already present in PF-4 and responded to the corridor outside the room. The Facility Manager's deputy reported immediately to the Operations Center to monitor the situation with the ESH-1 Deputy Group Leader.

Upon hearing the Operations Center public address announcement of multiple CAM alarms in the room and an adjacent room, several RCTs and RCT supervisors from other areas of the building responded to the corridor area outside the room to assist with personnel monitoring and to limit general access to the area. The corridor floor area outside the two rooms was covered with a protective covering and the doorways to the rooms were sealed with tape to limit the spread of any contamination from the release.

On-scene surveys of the eight affected workers revealed anti-contamination clothing (anti-C) contamination up to 140,000 dpm¹ and skin contamination up to 20,000 dpm. RCTs from other areas changed the eight affected workers into clean anti-Cs and, by 2:10 p.m., had escorted them to the PF-4 decontamination room, where nasal smears were obtained and forwarded to the Health Physics Analytical Laboratory (HPAL) for analysis. Decontamination was completed within about 30 minutes and the workers released from PF-4 to await the results of nasal smear analysis.

¹ All contamination readings are in units of dpm per probe area, which is 76 cm².

At approximately 2:30 p.m., the Deputy Facility Manager, with the concurrence of the ESH-1 Deputy Group Leader, determined that the release did not have offsite consequences and, therefore, did not meet the criteria for establishing a Facility Incident Command as specified in the TA-55 Emergency Plan. They then left the Operations Center to meet in the ESH-1 Deputy Group Leader's Office.

Between 2:30 p.m. and 3:00 p.m., the ESH-1 Deputy Group Leader notified several LANL organizations of the event and requested the following support actions:

• Immediate analysis of nasal swipes from TA-55 by HPAL (ESH-4)
  

• Initial dose assessment activities to determine the relative impact on affected workers by the Dose Assessment organization (ESH-12)

• Determination of the medical implications of Pu-238 intake and coordination of transport, evaluation, and treatment of the eight affected workers by Occupational Medicine (ESH-2).

At about 3:00 p.m., the eight affected workers began to report to the ESH-1 Deputy Group Leader's Office to await the results of their nasal smears. At approximately 3:20 p.m., ESH-4 communicated the results of nasal smear analysis to the ESH-1 Deputy Group Leader as follows:

*NDA: No detectable activity

The ESH-1 Deputy Group Leader immediately notified TA-55 management and the affected workers of the nasal smear results. Based on these results, LANL management determined that all eight affected workers should report to the LANL Occupational Medicine Clinic (ESH-2) for medical follow-up and possible treatment.

The NMT Division Director was attending a meeting elsewhere in the Laboratory when the event occurred. He was kept apprised of the accident and left the meeting to rendezvous with his staff and the affected workers at the LANL clinic.

2.2.2 Medical Treatment

Following the initial notification of potential Pu-238 intakes, ESH-2 staff implemented procedures for treating contaminated injuries and established contamination controls at the clinic in anticipation of receiving the eight contaminated workers from TA-55.

The worker with the highest nasal smear results (ET) was transported by his supervisor and arrived at the clinic at 4:00 p.m. He was admitted through the clinic's decontamination facility and was independently surveyed by ESH-2 staff. Before the other seven affected workers arrived, ESH-2 staff were informed that all arriving TA-55 workers had been fully decontaminated. As a result, re-survey at the clinic was determined to be unnecessary and the contaminated-injury procedures were terminated. The other seven affected workers transported themselves to the clinic in a Government van and arrived at the clinic at 4:15 p.m.

After admission to the clinic, the workers received an initial physical examination and were counseled by the attending physician regarding the intake of Pu-238. The four workers with the lowest nasal smear results required no further treatment and were released. The four workers with the highest nasal smear results were counseled and given the option to undergo chelation therapy using calcium diethylenetriaminepentaacetate (DTPA) to accelerate the removal of plutonium from their bodies. Each agreed to chelation therapy, signed applicable consent forms, and immediately began chelation treatment via intravenous push. Administration of the first treatment was completed and all workers were released from ESH-2 to go home by 5:20 p.m.

Daily chelation treatment of the four workers continued through Thursday, March 24, 2000. On that date, the worker with the lowest estimated dose elected to terminate treatment, and the worker with the second lowest estimated dose elected to decrease treatment frequency to every other day. At the completion of the onsite phase of this investigation (April 29, 2000), three of the four workers with the highest estimated doses were still undergoing treatment.

2.2.3 Reentry and Recovery Activities

At approximately 3:00 p.m., the ESH-1 team leader was dispatched to the scene to plan and oversee reentry and recovery operations. The room was reentered three times during the afternoon of March 16, 2000, as described in Table 2-1.

During the first reentry, three RCTs entered the room wearing double anti-Cs and self-contained breathing apparatus (SCBA). They shut down a furnace that CPT-3 had left in operation during the room evacuation. The RCTs also performed direct reading surveys of gloveboxes, fixed-head air samplers, and roughing filters on the corner return registers in the room. During this entry, the CAM filters were changed; however, the CAMs were found to be internally contaminated and could not be returned to service. To provide some CAM coverage of the room, two portable CAMs that were not operating at the time of the accident were placed into service. The entry was terminated after approximately 25 minutes in the room, the limit of the SCBAs. Upon departure, an RCT reported hearing an unusual hissing sound in the room.

During the second reentry, two of the three RCTs re-entered the room wearing double anti-Cs and SCBAs. They successfully decontaminated the CAMs in an adjoining room and returned them to service, but found the CAMs in the accident room to have too much internal contamination to be decontaminated. Subsequently, a third portable CAM was set up in that room, and all portable CAMs were oriented to be visible from the PF-4 hallway windows. Finally, most hand monitors in the room were turned off to minimize ambient noise as most were in a continuous alarm state, and the second reentry was terminated after approximately 30 minutes.

The third and final reentry was performed by workers knowledgeable of processes performed in the room. The workers wore double anti-Cs and air purifying respirators. The entry was limited to five minutes to confirm shutdown of the furnace and to determine the source of the unusual hissing sound heard by an RCT during the first reentry. They found the furnace to be behind in the earlier reentries. This section describes the extent and characteristics of the release within the room, as found during the Board's initial reentry.

Table 2-1. Time and Objectives of Each Reentry to the Room

* All times are estimates based on personnel interviews. Reentry logs were not maintained.

The initial release was an airborne dispersal of Pu-238 of unknown chemical form, although the historical usage of the glovebox line would indicate that the material is most likely an oxide. (At the time of this report, LANL was still evaluating the chemical form of the release.) The results of analysis of the fixed-head air sampler filters are shown in Figure 2-3. These results clearly indicate that the initial release was located on the northwest side of the glovebox, where ET was working when the first glovebox hand monitor alarmed.

LANL and Lovelace Respiratory Research Institute (LRRI) estimate the particle size distribution of the release to be in the range of 1 to 5 micrometers activity medium aerodynamic diameter. The contamination evidence suggested that there was a significant amount of locally deposited material that may have caused the shut down but could not detect any unusual hissing noise coming from the room.

Based upon the results of the reentries and ongoing monitoring of the conditions in the room, the reentry team determined that the release had terminated. All personnel exited PF-4, and the facility was shut down for the evening at approximately 6:45 p.m.

2.3 Radiological Impact

2.3.1 Pu-238 Contamination of Facility

After the final reentry on March 16, 2000, the room was not entered until the Board arrived on site and took possession of the accident scene. One of the first actions of the Board was to conduct a comprehensive survey of the contamination in the room and collect the remaining fixed-head air samplers that had been left behind in the earlier reentries.  This section describes the extent and characteristics of the release within the room, as found during the Board's initial reentry.

The initial release was an airborne dispersal of Pu-238 of unknown chemical form, although the historical usage of the glovebox line would indicate that the material is most likely an oxide.  (At the time of this report, LANL was still evaluating the chemical form of the release.)  The results of analysis of the fixed-head air sampler filters are shown in Figure 2-3.  These results clearly indicate that the initial release was located on the northwest side of the glovebox, where ET was working when the first glovebox hand monitor alarmed.

LANL and Lovelace Respiratory Research Institute (LRRI) estimate the particle size distribution of the release to be in the range of 1 to 5 micrometers activity medium aerodynamic diameter.  The contamination evidence suggested that there was a significant amount of locally deposited material that may have caused the hand monitors to alarm. To assess this possibility, the Board had the probes of the hand monitors in the area surrounding the glovebox surveyed. It was found that the probe directly above the apparent release location was reading 17,000 dpm, and the probe on the dropbox north of the glovebox was reading 6000 dpm. The probe on the glovebox across the aisle and directly behind ET's task location was reading 11,000 dpm. All other probes were less than 1000 dpm (the hand monitors are set to alarm at 1000 dpm). The order in which the monitors alarmed can be inferred from the distances between the monitors and the location of the release. This inference suggests that the monitor directly above the release point alarmed first, followed by the monitor on the dropbox to the north, and finally by the monitor on the glovebox across the aisle to the west of the release point.

Figure 2-3. Fixed-head Air Sampler Results in Room

The Board requested smear and direct survey measurements of the open floor areas to determine the spread of contamination in the room. The results of the contamination survey were very similar to the distribution of the airborne material shown in Figure 2-3. Contamination to the west side of the glovebox ranged from 60,000 dpm to 300,000 dpm, with the maximum value at the northwest shield door where ET was conducting the maintenance evaluation when the first monitors alarmed. The general area around the west side of the glovebox was contaminated in the range of 10,000 to 40,000 dpm. The east side of the glovebox was measured to be between 6,000 and 18,000 dpm. In the rest of the room, levels ranged from about 1,000 to 10,000 dpm.

After the general conditions of the room were evaluated, the glovebox and ET's immediate task area were surveyed in detail. The gloves on the northwest side of the glovebox had contamination levels between 14,000 and 20,000 dpm. Some localized areas of contamination on the top of the glovebox and the top of the airlock were found to be as high as 200,000 dpm, but most areas were around 2,000 dpm. Measurements under the airlock indicated about 12,000 dpm.

At the time of the first hand monitor alarm, ET was tracing the piping and valve alignment underneath the northwest corner of this glovebox, and stated that he had "shaken" the pipes to test joint integrity. Therefore, the Board directed significant attention toward measuring the contamination levels at this location. The floor under the glovebox was found to be measuring about 1,000,000 dpm. The service pipelines were found to be reading levels ranging from 20,000 dpm to 200,000 dpm, with several locations as high as 1,000,000 dpm. The manifold for the airlock argon purge system is also at this location (see Exhibit 2-3 and Figure 2-4). On the line from the dry vacuum supply line to the manifold, near the vacuum manifold valve, there was also a reducer coupling for changing the size of the pipe. The argon manifold valve was not contaminated, and the piping to the airlock read about 10,000 dpm. The vacuum manifold valve read 100,000 dpm, but the reducer was contaminated to a level exceeding the range of the instrument at 2,000,000 dpm. This last measurement was taken at a distance of about two inches from the coupling, indicating that the contamination level was actually much higher than the recorded reading.

Exhibit 2-3. Alignment of Valves in the Manifold Line after the Accident

Figure 2-4. Northwest Corner of the Glovebox, Including the Argon and Dry Vacuum Lines

2.3.2 Dose to Affected Workers

With respect to the affected workers, the primary follow-up action to this accident will be the continuing process of estimating their committed effective dose equivalent (CEDE) (see text box below). The internal dosimetry of plutonium intakes is a slow process and could take up to a year of periodic bioassay results and evaluations before a final dose estimate can be made.

A key parameter in this dose assessment is determining the solubility of the plutonium-bearing material in human fluids. The solubility of the material determines how quickly the plutonium is transported through the body. The plutonium is either absorbed in various tissues, especially bone surfaces, or is eliminated from the body by excretion. Both LANL and LRRI are studying this solubility issue and the particle size distribution of the release.

Table 2-2 contains the range of potential doses for the affected workers as a function of the solubility of the material, and LANL's preliminary estimate based on early bioassay results from combining multiple analytical techniques, at the time of this report. Although the solubility of the material is not known at this time, a review of the history of the glovebox and the processes that were undertaken within it would suggest that the plutonium is most likely insoluble.

The Federal annual radiation dose limit for workers is 5 Rem TEDE. These limits are specified in 10 CFR Part 835, Occupational Radiation Protection. Table 2-2 indicates that at least one, and most likely four, individuals have estimated doses exceeding the annual limit. If the material is determined to be insoluble, the estimated 300 Rem CEDE dose would be the highest overexposure at a DOE facility since 1991.

Due to the long-term nature of these doses, they do not represent an immediate threat to the health of the workers. However, the long-term risks are indeterminate and may represent an increased risk of developing cancer later in life.

Table 2-2. Preliminary Dose Estimate (CEDE) to Affected Workers

2.4 Accident Reconstruction

The exact sequence of events that led to the release could not be confirmed by the Board. However, for this release to occur, the Board postulated that three basic conditions must have been present:

• Source Term - there must be radioactive material of the proper form and quantity that can be dispersed into the atmosphere
• Motive Force - there must be some form of energy that is available to cause the suspension of the material in the atmosphere
• Failure of Containment Boundary - there must be a pathway for the material to escape the containment for dispersal into the atmosphere.

Taking into account all physical evidence, personal testimony, and previous facility experiences, the Board identified four possible scenarios to explore:

• Leakage from a failed gasket on the airlock on the north side of the glovebox
• Leakage from a failed glove in the glovebox
• Leakage from a failed vacuum line fitting when the pipes were shaken
• Leakage from a failed vacuum line fitting during valve manipulation on the manifold.

The gasket and glove failures were considered since they have been associated with previous contamination events at this and similar facilities. However, these scenarios did not provide adequate explanations of the contamination patterns observed. The presence of a sufficient motive force could not be identified, and in the case of the glove failure, the moisture content of the glovebox would have greatly reduced the dispersion of any source material present. Therefore, the Board did not consider these two scenarios to be credible.

The Board focused primary attention on the manifold under the northwest corner of the glovebox where the maximum contamination was found. This manifold is used for purging the airlock between the glovebox and the dropbox to its north. For the general layout of this location refer to Exhibit 2-3.

Exhibit 2-4. Components of the Finger-Tight Fitting

After an initial set of in-place diagnostic tests ordered by the Board proved inconclusive, the manifold was removed as a unit and taken to another glovebox for further testing. During this relocation the vacuum line separated from the manifold at the upstream connection of the vacuum manifold valve. It was found that the compression fitting between the line and the valve was only "finger-tight" and had never been compressed (see Exhibit 2-4).

Furthermore, the vacuum manifold valve was found to have a significant seat leakage and could not maintain a static pressure in the line. The cause of this leakage was found to be significant degradation of the Teflon(r) seats in the ball valve. The cause of this degradation will require further analysis, but it probably results from a combination of thermal, abrasion, and radiation damage from prolonged exposure to Pu-238. The Board concluded that further analysis of this Teflon(r) degradation mechanism is warranted, and that DOE should evaluate the impact of this degradation at all similar plutonium facilities within the complex.

The shaking of the pipes under the glovebox could feasibly have released some contamination from the vacuum line.  However, the Board could not identify a motive force that would have led to the large and rapid dispersal of material observed in this accident.  Since the failed compression fitting had never been fitted properly, it was incapable of storing residual pressure.  Furthermore, the leaky valve would have ensured that the line was at the same pressure as the airlock.   Also, the argon manifold and valve were found to be functioning normally, so that shaking the line would not cause a surge of argon into the manifold.  Finally, the manifold is mounted with rigid pipe hangers that preclude significant movement.   Therefore, the Board concluded that this scenario was not a likely explanation of the accident sequence.

In the fourth scenario, the Board postulated that ET attempted to introduce argon flow into the glovebox by opening the argon manifold valve (believing it to be the glovebox supply valve) under the northwest side of the glovebox while kneeling in front of the open shield door and watching the photohelic gauge above the west side of the glovebox. Since the vacuum manifold valve was leaking and the vacuum header isolation valve was closed, this action would have sufficiently pressurized the vacuum line with argon to provide the motive force. The pressure vented through the finger-tight compression fitting and spread existing contamination into the room. When no change was observed on the photohelic gauge above the glovebox, ET closed the valve. At about this time the hand monitor alarmed, and ET stood up to investigate, pumping the glove at the same time.

While considering this scenario, the Board also evaluated the possibility that ET had inadvertently bumped the argon manifold valve while reaching under the glovebox. However, this was considered to be unlikely, as there was not a continuous release and the argon manifold valve was found to be fully closed after the event.

This fourth scenario was consistent with all of the physical evidence collected at the accident site. It explained the contamination pattern in the area and provided a good source for both the released material and the motive force.

Valve operation was within the management-approved authority of ET. Based on these considerations, the Board concluded that this scenario provided the most probable explanation of the physical evidence observed at the facility.

Accident Facts and Analysis

3.1 Physical Hazards, Controls, and Related Factors

3.1.1 Work Planning

Effective work planning begins with the preparation of a well-defined scope of work. To fulfill its responsibilities, line management must determine the work to be performed and must be accountable for understanding it as completely as possible through every phase of the work cycle.

Scope of Work

On the morning of the accident, RWS tasked ET to look at the glovebox to evaluate why there was no argon flow. ET entered the room and performed a cursory review of the argon system. Confirming that there was no argon flow, ET called RWS to inform him that he would return later to conduct a further evaluation. ET returned to the room after lunch and began a maintenance evaluation of the argon system in the glovebox. No formal scope of work was defined for this task.

Under LANL's integrated safety management (ISM) program, all aspects of work performed must follow the five core functions of ISM, beginning with defining the scope of work. Thus, every activity at LANL should be subjected to some level of work planning. Although the activity that ET was to perform was not defined as work requiring a radiological work permit (RWP) or special work permit (SWP), the location of the activity in a radiological area should have demanded the rigorous planning normally associated with either ISM or formality² of operations.

Laboratory Implementing Requirement (LIR) 402-720-01.1, Work Planning, and TA-55 Safety Manual, LA-12177-M, Rev. 2, define the work process documents to be used, based on the complexity and importance of the work and the potential for worker exposure to radiological hazards. RWPs are required for jobs involving radiological hazards, unless satisfactory radiological controls are found in an applicable safe operating procedure (SOP). However, RWPs cover radiological hazards only. SWPs cover hazardous operations that are done only once and for a limited time (usually less than 90 days).

Even though the task to be performed by ET was undefined, he assumed that it did not involve hazards beyond those covered by TA55-SOP-555.R4, Radiation Protection Requirements, which identifies the requirements for most routine work. Since ET's task was considered by TA-55 to be "maintenance evaluation" and not "work," it was not subject to normal work planning and controls. As a result, neither an RWP nor an SWP was developed or required. The process used by LANL in determining whether this activity should be classified as work or not, is not well defined.

The Board concluded that line management's failure to identify ET's task as work obviated the normal work planning process and contributed to the accident.

² "Formality of operations" is used in this report in lieu of the more common term "conduct of operations," consistent with LANL terminology. The LANL contract does not invoke DOE Order 5480.19, Conduct of Operations Requirements for DOE Facilities.

Maintenance Skill of the Craft

According to the work planning LIR, work process documents include research plans, SOPs, task instructions, and RWPs. This document states that:

"The type of work process document to be used shall be based on the complexity and importance of the work and the potential for worker exposure to radiological hazards. Work process documents shall be readily accessible to the worker and should be based on the level of skill of the worker using them."

The Board also examined LIR 230-03-02.1, Maintenance Skill of the Craft, to determine whether ET's maintenance evaluation task could have been covered under the umbrella of this LIR. LIR 230-03-02.1 requires review and approval of a Maintenance Skill of the Craft Task List. The approval of a task as maintenance skill of the craft requires concurrence by all reviewers. The Board was provided with a Maintenance Skill of the Craft Task List from the Los Alamos Facility Manager Council Binder. The task being performed on the glovebox does not appear on this list. The Board was informed that LIR 230-03-02.1 and the approved Skill of the Craft Task List apply only to contracted craft workers. The Board concluded that the task being performed at the time of the accident was not an approved skill-of-the-craft activity and, thus, should have been formally planned and controlled.

History of Work Planning Deficiencies

The Board reviewed prior TA-55 occurrences, as reported to the DOE Occurrence Reporting and Processing System (ORPS), and found the following similar deficiencies involving ineffective work planning:

• ALO-LA-LANL-TA55-2000-0002 - Inadequate work planning contributes to a failure to adequately isolate a system prior to initiating work on January 12, 2000.

• ALO-LA-LANL-TA55-1999-0022 - Inadequate work planning contributes to inadvertent disabling of fire detection equipment in a glovebox on April 22, 1999.

• ALO-LA-LANL-TA55-1998-0052 - Inadequate work planning contributes to airborne contamination in the room in question and an adjacent room on November 19, 1998.

Based on a continuing history of occurrences attributed to inefficient work planning, the Board concluded that LANL's existing work planning procedures are inadequate.

3.1.2 Hazard Analysis

The objective of hazard analysis is to develop an understanding of the potential for a hazard to affect the worker, the public, and the environment. Each level of hazard analysis is the foundation for more detailed analysis; that is, a site-level hazard analysis is used as the basis for the facility-level analysis, which in turn is used as the basis for the activity- or task-level analysis. Hazard identification and analysis may occur at any phase of the work cycle, including maintenance. Since the task being performed at the time of the accident was not defined as work and, hence, not subjected to formal work planning, no task-specific hazard analysis was conducted. However, after reviewing existing, higher-level hazard analyses at TA-55, the Board identified a number of deficiencies that are relevant to this accident.

Hazard Analyses for Glovebox Support Systems

The LANL Plutonium Facility (PF-4) is a Category 2 nuclear facility with an approved safety analysis report (SAR) and the accompanying DOE safety evaluation report and authorization agreement. Potential hazards from the mission-related activities conducted in the gloveboxes in PF-4 are described in the SAR. The philosophy of the design is to provide a controlled confinement system within which the mission of the facility can be conducted. The main safety-class and safety-significant systems, structures, and components are the building, its various ventilation systems, the gloveboxes, the fire suppression systems, and the criticality alarm system. Other systems and components within PF-4, such as service utilities and gloves, are not extensively described or analyzed within the SAR. Worker safety associated with these systems depends on the facility's administrative programs and procedures for maintenance and configuration management. The SAR mainly concentrates on experiments and other mission-related work in the gloveboxes, not routine maintenance or replacement of the gloveboxes, gloves, or other supporting systems. It does not address the use of mechanical fittings on contaminated auxiliary systems to gloveboxes, although the American Glovebox Society recommends using non-mechanical joints for these types of services. The SAR does not address events such as the one that led to this accident, causing such situations to be uncharacterized safety hazards for workers.

The TA-55 Hazard Analysis dated July 31, 1996, also describes potential hazards from operations in PF-4, but it does not evaluate the failure of potentially internally-contaminated piping systems that are tied into a glovebox. No modes of failure (e.g., coincidental, overpressurization, solder joint or mechanical joint failure) were analyzed, and no protective features were identified. In evaluating the hazard analysis it was found that worker consequences from breaches of gloveboxes and related systems were assigned a lower risk rating based on previous facility experience rather than on potential consequences. Since these previous experiences had never included an event of this magnitude, the potential for such an event was unrecognized. Therefore, this low risk rating placed these scenarios into an "acceptable risk" category and, by incorporating that conclusion into the SAR, they were eliminated from further analysis or from additional controls beyond normal administrative processes. As a result, the SAR does not adequately address worker-related safety for gloveboxes and related systems.

The Board concluded that this deficiency in the hazard analysis resulted in an inadequate evaluation of the safety implications of auxiliary systems. The Board believed that this could also contribute to inadequate attention to the design and control of auxiliary systems.

Existing Hazard Analyses

The Board reviewed several existing hazard analysis scenarios and concluded that they were not comprehensive. For example, these scenarios did not analyze the possibility of pressurizing the airlock during routine or special activities. Inadvertent airlock pressurization had occurred previously and should have been considered to be a credible hazard. Some previous overpressurizations were attributed to personnel not using the pressurization valves properly, resulting in releases of airborne radioactivity and activation of CAMs. In fact, a memorandum prohibiting the use of air evacuation/air backfill into airlock devices was issued on May 15, 1996, applying only to gloveboxes in the room next to the one where the March 16 accident took place. There was no evaluation of the continued use of airlock purge systems in other rooms. The AWS was unaware of the memorandum and informed the Board that the airlock purge system could be used on any glovebox with an inert atmosphere. Furthermore, the airlock purge valves on the manifold involved in the accident were not tagged or locked to prevent workers from manipulating the equipment.

An ESH-1 review of radiological work procedures is required as a part of the evaluation of radiological hazards. The TA-55 radiation protection SOP and work planning LIR require ESH-1 to concur with procedures covering radiological work. However, the NMT electrolytic decontamination SOPs did not have ESH-1 concurrence. In addition, there was no evaluation of the potential effect of electrolytic decontamination of Pu-238 on the performance of the glovebox HEPA filter or of the increased humidity associated with this operation on electronic circuits in the glovebox. The glovebox involved in the accident was the first one to be decontaminated that had the photohelic and internal power on the same circuit. An integrated approach to safety management would have ensured that a hazard analysis, involving all essential organizations, was performed and documented.

Contamination Survey Frequency

Radiological contamination surveys are conducted to identify areas with either fixed or removable contamination. These surveys should be frequent enough to identify areas of contamination promptly to ensure the safety of personnel in those areas. ESH-1/TA55, Radiological Monitoring Instructions, requires ESH personnel to perform radiological monitoring within TA-55, including PF-4. ESH-1 reviews the appropriateness of survey frequency annually. The Board compared the frequencies for alpha contamination surveys of the room where the accident took place (i.e., for Pu-238 operations) with those in rooms using Pu-239. Overall, the survey frequency for the room where the accident took place was no greater than the survey frequency for many of the rooms using Pu-239.

In response to numerous glove failures over the past few years (see Section 3.1.5), LANL has incorporated some changes, such as developing procurement specifications for new gloves and inspecting them upon receipt. However, glove failure information is not used to identify other necessary changes, such as increasing contamination survey frequencies in higher-risk (i.e., Pu-238) areas. Other than the periodic reissuing of Radiological Monitoring Instructions, there is no documented basis for any evaluation that ESH-1 has performed on the adequacy of the survey frequencies in TA-55.

The Board concluded that the process for analyzing hazards in the workplace did not ensure that hazard analyses were performed when required, and did not always adequately document the results of hazard analyses.  The lack of a hazard analysis for maintenance evaluation activities, which would have addressed the potential failure of internally-contaminated piping systems that are tied to gloveboxes, resulted in inadequate controls being implemented.  The lack of a hazard analysis for continued use of the airlock purge system (given the historical problems of using the system in an adjacent room) resulted in the system under the glovebox in question remaining in service and contributed to the inadequate identification of hazards associated with troubleshooting the system.

3.1.3 Develop and Implement Controls

On the day of the accident, ET notified RCT-2 that he was going to be performing a maintenance evaluation task around and under the glovebox. Notification was consistent with the TA-55 radiation protection SOP, which states "consult ESH-1 before accessing areas that are not normally accessed." The RCT acknowledged the notification and allowed ET to proceed without surveying the area or providing radiation protection coverage, because the hazards associated with the task were not recognized. The most recent contamination surveys of the areas ET would be accessing were conducted more than two months earlier, prior to the start of glovebox decontamination.

Adequacy of Procedures

The Board identified several deficiencies in developing and implementing controls for this maintenance evaluation task:

• The task was not routine radiological work but was allowed to be performed under an SOP for routine radiological work.
  

• There were no procedural requirements for identifying necessary controls to be implemented prior to shaking potentially-contaminated pipes.
  

• There were no procedural requirements, or other policy, precluding the operation of valves to the airlock purge system.
  

• The radiation protection controls recommended in the SOP were not implemented, in that ad hoc surveys were not performed to characterize potentially changing radiological conditions and RCT coverage was not provided for work that had the potential to create airborne radioactivity.

The RCT believed that physically shaking installed piping on the glovebox and manipulating valves were within the scope of ET's task. However, the RCT's supervisor stated that an additional radiological evaluation should have been conducted.

The Board concluded that the radiation protection SOP—the only SOP controlling the task—did not provide adequate controls for the task being performed at the time of the accident. Although this SOP provided greater detail than the upper-tier LANL documents, it did not require job-specific RWPs, RCT coverage, or other controls, thus lacking sufficient guidance to ensure that the radiological task performed on March 16 was adequately controlled.

Human Factors and System Configuration Controls

The Board identified several deficiencies in the human factors design of the glovebox and configuration controls that contributed to the severity of this accident:

• The photohelic sensor mounted on the east side of the glovebox actually read the differential pressure of the adjacent dropbox.
  

• There is no standard valve lineup configuration for glovebox auxiliary systems.
  

• Piping under the glovebox criss-crosses, making it difficult to trace piping systems and ensure operation of the proper valves.
  

• No operator aids, such as valve and instrument labeling, are provided to help determine how the system is configured.
  

• Specific design specifications and as-built drawings have not been prepared for the glovebox auxiliary systems.
  

• No records, logs, or postings were available that could have been reviewed to show the operational status of the glovebox and its auxiliary systems.

The Board concluded that human factors design and system configuration were not adequate to control the hazards associated with this task.

A field design change for glovebox auxiliary systems had been approved, but not incorporated. The approved field design change included the use of needle valves on the airlock purge system. This would have mitigated a rapid pressurization of the dry vacuum line, which could be achieved by manipulation of the existing argon manifold ball valve. The basis for not implementing this design change was not documented on the existing installation drawings. The Board concluded that by failing to incorporate the approved field design change, a control that might have prevented the accident was not implemented.

Training

The Board reviewed worker training records and qualification reports for the affected workers and determined that they had the procedurally-required training for the task being performed at the time of the accident. However, during interviews with the Board, these workers displayed a general lack of knowledge of the configuration of the glovebox support systems and the hazards associated with the task. The Board was especially concerned that:

• Training did not address the potential hazards associated with physically shaking internally-contaminated piping or piping containing hazardous chemicals.
  

• RCTs had not been trained on the function of the support systems associated with the gloveboxes and, therefore, were unaware of the potential radiological hazards associated with them.

The Board concluded that worker training had not provided adequate awareness of the hazards associated with the task being performed in the room and the training on glovebox support systems was not commensurate with the worker's assigned duties.

In summary, the Board concluded that LANL had not developed and implemented adequate controls for this task. The SOP was inadequate to control the task, insufficient operator aids were available to support the task, and the workers associated with the task were not adequately trained.

3.1.4 Perform Work within Controls

Safety controls must be identified and implemented before starting work. This was not the case for the maintenance evaluation task being performed at the time of the accident. The first three ISM core functions (define work, analyze the hazards, and develop/implement controls) were not addressed for this task and explain why the work was not performed within appropriate controls:

• Absence of facility-tenant agreements, which communicate facility-specific expectations for conduct of work and the development of safe work practices

• Failure to fully implement the hazard analysis LIR, which went into effect in December 1997, that establishes the hazard analysis and controls development process for conducting work
  

• General ambiguity in the definition of "work" by division managers.

A recent example of less-than-adequate implementation of safety management principles for performing work involves the decommissioning of the glovebox in question. The decommissioning SOP for the PF-4 glovebox requires every glovebox identified for decontamination and removal to first undergo a site characterization identifying the potential hazards, specifying the required personal protective equipment, and documenting a thorough radiological survey. However, the following hazards associated with the decontamination of the glovebox were not fully identified and documented in the associated NMT-15 work instruction:

• The potential hazards associated with high humidity and a wet decontamination process being performed in a glovebox designed for a high purity, low-dewpoint environment
  

• The functionality of the glovebox HEPA filter in wet conditions
  

• Permanently-installed electrical receptacles in the glovebox not designed to withstand such conditions.
  

A second example during the same electrolytic decontamination process concerns the specific glovebox decontamination procedure that required workers to change all cabinet gloves before initiating the electrolytic decontamination activity on February 28, 2000. This requirement was not met in accordance with procedural requirements, since only three of twelve gloves were changed.

A third example was revealed during the testimonies of workers involved in the decontamination of the glovebox in question. They stated that the electrical circuit supply power tripped several times and was reset each time during the two weeks of decontamination activity preceding this accident. LANL relies on LIRs, Laboratory Implementing Guidelines (LIGs), and SOPs for electrical safety. However, none of these documents discuss the resetting of circuits that have tripped. An October 19, 1995, memorandum entitled "Interpretation No.10," from the Electrical Authority Having Jurisdiction, provides some direction.

This interpretation was to be implemented immediately by all LANL personnel and all associated contractors. However, with the exception of breakers that fail twice within one hour, this memorandum does not address how often breakers must trip before a work request is generated and an electrician is contacted.

The Board concluded that multiple resetting of circuit #10 was not consistent with the institutional interpretation for addressing the recurrent breaker trips. With respect to performing work within established controls, the Board concluded that work documents, when they exist, are not always complied with.

One of the key elements in performing work safely is the worker's ability to recognize that when the work activity has exceeded the originally defined scope of work, the hazards identified, or the controls developed, the work activity must be stopped. NMT conducted a self-assessment of work safety in February 2000 to determine whether LANL's ISM system effectively supported management of worker health and safety. The assessment determined that although several workers had actually exercised the stop-work policy, 27 percent of those interviewed were unaware of this policy. The Board concluded that the workers involved in this maintenance evaluation task did not recognize that they were working beyond the scope of the task and, subsequently, did not invoke their stop-work authority.

3.1.5 Feedback and Improvement

LANL

The Board reviewed recent ORPS occurrence reports from LANL to determine whether this information had been used to formulate and disseminate effective lessons learned. One 1998 occurrence involved the release of Pu-238 in the room where the accident occurred; this release may be a precursor to the March 16 accident.

On November 19, 1998, the CAMs in that room alarmed while two personnel were adjusting the negative pressure in the glovebox involved in the accident—a situation similar to that of March 16, 2000. Direct measurements of the fixed-head filters in the room indicated widespread airborne contamination with levels ranging up to 40,000 dpm. Based on an interpretation of the survey results, LANL determined that the leak was due to a faulty gasket on an airlock between the dropbox and the glovebox. The corrective actions for this occurrence were limited to painting the suspect gasket with paint formulated to keep releases as low as reasonably achievable (ALARA) and increasing the frequency of surveys of suspect gaskets. The suspect gasket was not replaced, and the subsequent analysis of this event did not clearly identify the source of the release of Pu-238.

Limited corrective actions in response to this event were not timely, with implementation seven months after the occurrence. Furthermore, as a result of analyses conducted during its investigation, the Board concluded that the scenario providing the best explanation for the current accident is also a better explanation of the November 1998 occurrence with this same glovebox. The Board's conclusion is based on the following facts:

• Since the November 1998 event, no further leakage from the gasket had been observed.
  
• The contamination patterns were similar (to the extent that data from the previous event is available).
  
• During the November 1998 event, the same technician was attempting to adjust the negative pressure in the glovebox.
  
• This airlock has not been pressurized since that event.
  
• The compression fitting was most likely defective in November 1998.

On June 11, 1997, in another room of PF-4 a worker disassembled an argon manifold valve on a similar airlock system without following procedures (ALO-LA-LANL-TA55-1997-0027). This occurrence involved several situations that had similar themes to the current accident. It was recognized that there was no procedure for using the manifold to purge an airlock; the pressure gauge was found to be inadequate for the application; and the corrective actions included a commitment to evaluate all similar airlocks in PF-4 and to address this practice in NMT's policies and procedures. However, the Board did not find evidence that current policies and procedures had incorporated these concerns.

For a number of other recent radiological occurrences at TA-55, the direct cause of contamination has not been identified and corrective actions have not been sufficient. During 1999, TA-55 reported 47 occurrences, 26 of them related to personnel contamination or radiological activities. The reports for 14 of these events have no indication of the source of the contamination, and nine reports have no required corrective actions.

A further review of LANL's occurrence reports from 1990 to the present reveals that:

• The ORPS category of Personnel Contamination contains the most occurrences reported, followed by Violation/Inadequate Procedures.
  

• The number of Personnel Radiological Protection occurrences has remained relatively constant over this time period, even though the total number for all reported occurrences has decreased.
  

• In 71 reported personnel internal contamination radiological occurrences, individuals experienced conditions outside of engineering and administrative controls.
  

• Thirteen occurrences resulted in workers receiving internal doses.

The Board concluded that analyses of previous occurrences have not been comprehensive enough to support a lessons-learned program that would prevent recurrence of events.

Four other events showing weaknesses in the lessons-learned program were also identified:

• There is a lack of a systematic approach for trending, analyzing, formulating, and disseminating lessons learned from the large number of glove failures resulting in personnel contamination (48 documented events in 1998, 17 in 1999, and 11 through March 16, 2000). The Board concluded that LANL has not taken aggressive measures to trend and analyze glove failures and to predict end-of-service life in various processing lines. The Board also concluded that LANL does not have a configuration control system for changing out glovebox consumables (e.g., gloves and gaskets).
  

• On May 15, 1996 NMT-9 issued a memorandum prohibiting the use of the airlock purge systems in a room adjacent to where the accident occurred, to preclude potential glovebox airlock overpressurization. However, no prohibitions or warning tags were placed on the glovebox in question, even though it has a similar configuration and potential for overpressurization. Moreover, there is no evidence that a corrective action with respect to the airlock pressurization event of June 11, 1997 (i.e., to identify all locations where this may occur and address the issue in "appropriate Safe Operating Procedure" by April 14, 1998) was completed.

• Opportunities were missed for improving the awareness of RCTs through timely communications. ESH-1 holds monthly TA-55 team safety meetings. All RCTs in TA-55 participate in these meetings. Topics range from general, to compliance-related, to other information pertinent to RCTs' routine responsibilities. The Board reviewed the most recent meeting minutes (October 1999 - March 2000) and found no evidence of any discussion covering lessons learned from radiological incident reports or occurrence reports from TA-55. This meeting would have provided an ideal setting for discussing lessons learned from problems faced and actions taken during the events.
  

• TA-55 might have missed an opportunity to prevent the March 16 accident during the installation of Design Change Package (DCP) 96-088 to seismically upgrade Pu-238 gloveboxes in the room in question and two nearby rooms. As part of this upgrade, Field Change Request-09 (FCR-09) required installation of a needle valve, a check valve, and a filter in the argon line of the argon/dry vacuum manifold to the airlock - the Pu-238 release point during this accident. The purpose of this FCR was to resolve identified design deficiencies in the manifold and reduce the possibility of airlock overpressurization transients and manifold backflow contamination. A post-accident inspection of the manifold revealed that the requirements of FCR-09 had not been met on the glovebox in question. Installation of the needle valve in accordance with FCR-09 would have reduced the impact of adverse pressure transients on the airlock, the manifold piping, and its components. The Board concluded that failure to implement this modification on this glovebox was a missed opportunity to prevent this accident.

The Performance Assurance Working Group within NMT was assigned the responsibility to:

• Screen all appropriate information, including NMT radiological incident reports, occurrence reports, and accident/injury reports
  

• Select operating experience information for distribution to NMT organizations
  

• Prepare bulletins and monthly summaries
  

• Disseminate this information to NMT organizations and staff.

To determine the quality of information disseminated by the Performance Assurance Working Group, the Board reviewed the most recent bulletin published by the group (Bulletin NMT-DO:(U)00-040). This bulletin, developed in response to a glovebox event in the Chemistry and Metallurgy Research Facility in June 1999, has two shortcomings:

1) Timeliness - the bulletin was published nine months after the event that prompted its development

2) Usefulness at the activity level - the cursory summary description of the cause of this event focused mostly on technical factors and did not adequately emphasize the ISM-related factors that had been identified as weaknesses contributing to these occurrences.

Furthermore, the information collected and organized was mostly disseminated only to the group leaders within NMT, with no formal requirements for further dissemination. Based on the results of interviews, the Board concluded that the information passed on to the group leaders was not uniformly and effectively communicated for use at the activity level.

The Board also reviewed the status of self-assessment activities within the Laboratory, as they relate to NMT. LANL's Assessment and Audit organization has conducted a number of assessments during the last two years. The results of these assessments are rolled up at the institutional level, and individual divisions are not required to develop and implement corrective actions for deficiencies in their areas. Divisions are encouraged to develop their own self-assessment process. Within NMT, the Performance Assessment Team has recently been assigned the responsibility for developing a self-assessment process and for conducting self-assessments. To date this team has only conducted one self-assessment, exploring NMT employees' understanding of broad ISM concepts and stop-work policy. The Board concluded that the self-assessment program was not effective in identifying precursors that could have a bearing on this accident.

DOE Oversight - LAAO

The Assistant Area Manager for Facility Operations (AAMFO) for LAAO is responsible for providing oversight of LANL to ensure that health and safety programs are consistent with applicable Federal regulations, DOE orders, and state laws. To accomplish this, an annual appraisal plan is developed in accordance with LAAO procedures. The appraisal plan consists of an integrated assessment approach that is intended to ensure a broad-based and systematic review of all aspects of safety and facility operations is conducted within a calendar year.

Facility Operations personnel conduct both site-level and facility-level assessments. Site-level assessments are divided into several functional areas, including radiation protection, industrial hygiene, occupational safety, emergency management, and fire protection disciplines, and are typically assigned to the Safety and Health Team. Facility-level assessments are assigned to Facility Representatives. The AAMFO has assigned two senior-level, fully qualified Facility Representatives to TA-55 with offices in the facility. The AAMFO's organization includes technical representatives from the Safety and Health Team, which provides safety expertise to the Facility Representatives, and has access to additional technical assistance through the Authorization Basis Manager. The Safety and Health Team has had personnel shortages in critical technical disciplines and presently relies on highly qualified technical support subcontractors to accomplish site-level and programmatic reviews. It is well recognized that LAAO is not staffed for all areas of safety and health programs. The AAMFO has requested assistance for specific safety disciplines through support from AL; these requests have been honored based on the availability of AL resources.

Facility-specific and sitewide programmatic quarterly reports are the appraisal products generated by the Facility Representatives and technical representatives, respectively. The Board reviewed quarterly facility assessment reports completed since September 1998 and determined that relevant assessments of TA-55 were conducted. Several findings and observations were identified, including the failure to have an approved procedure for performing glovebox airflow and bubbler adjustment, inappropriate use of skill-of-the-craft work when work package initiation was required, and failure to follow the requirements stated in SOPs and RWPs. During the last 18 months, few documented facility-level (i.e., TA-55) assessments were conducted by the Safety and Health Team or the specific safety disciplines from AL, due to the limited technical representative resources.

Findings and observations that are transmitted to TA-55 management personnel are slowly accepted and corrected.  Additionally, the resultant corrective actions are not always adequate.  For example, in October 1998, the Facility Representatives issued a finding on the lack of detail in the Operations Center's logbooks. In response, the facility issued a memorandum instructing Operations Center personnel to enhance the content of the logbooks by September 1999. The Facility Representatives reviewed the proposed corrective action and closed the finding in January 2000. However, after reviewing the Operations Center's logbooks, the Board noted that there are still significant deficiencies in their content. More pointed examples of failing to develop meaningful corrective actions to findings and observations identified by the Facility Representatives include those items mentioned in the preceding paragraph, but particularly the failure to proceduralize the glovebox and bubbler adjustment process, which might have prevented the March 16 accident.

In accordance with the AL Facility Representative Program Manual, Facility Representatives should spend 60 to 80 percent of their time observing and assessing facility operations or performing other directly related duties. The Board determined that the Facility Representatives are unable to meet this requirement due to an expansion of duties beyond those traditionally considered within a Facility Representative's purview. Furthermore, LAAO managers have assigned administrative and programmatic duties to the Facility Representatives that interfere with their primary responsibilities for conducting oversight and assessment activities. While some reduction in administrative and programmatic duties has occurred, the overall LAAO Facility Representative staffing deficit appears to contribute to this additional burden.

Given the evidence presented, coupled with a lack of Facility Representative field presence and the reduced frequency of facility-level specialty technical assessments, it is conceivable that significant operational and work control deficiencies remain undetected by the area office. Further, the Board concluded that many of the scheduled assessments cited in the Annual Appraisal Plan are not conducted and that the assessment program lacks formality and structure. For example, no specific lines of inquiry or performance objectives are documented. Thus, it is not clear to the Board how the program can assure that Facility Representatives conduct a reasonable fraction of cross-sectional assessments in operations, maintenance, surveillance requirements, and safety systems.

DOE Oversight - Headquarters

DOE Policy 450.5, Line Environment, Safety and Health Oversight, defines the Headquarters line management functions for ES&H oversight as:

• Monitor field element and contractor performance through the review of information provided by field elements; contractors; the Headquarters Office of Environment, Safety and Health (EH); and external organizations, such as the Defense Nuclear Facilities Safety Board (DNFSB)
  

• When appropriate, participate in field element appraisals, assessments, surveillances, and walkthroughs of contractor facilities and activities
  

• Conduct onsite reviews of field element performance, including verification of their appraisals of the contractor, as necessary
  

• Conduct for-cause reviews, as necessary.

The Defense Programs' Office of Operations and Readiness assumes the primary role in providing Headquarters oversight of environment, safety, and health (ES&H) at TA-55. In accordance with a December 1999 memorandum, the plan for oversight activities provided by this office is to consist of the following:

• Review of daily AL operations reports
  

• Review of TA-55 occurrence reports
  

• Review of internal and external assessments (e.g., assessments by EH, a Facility Representative, the DNFSB, and the DOE Inspector General)
  

• Once per quarter, site walkdown and attendance, observation, and/or assistance with a Facility Representative assessment or critique.

The Office of Operations and Readiness periodically discusses ongoing issues with the TA-55 Facility Representatives. The site walkdowns and attendance, observation, and/or assistance with a Facility Representative assessment or critique have not always occured due to other commitments. Review of TA-55 Facility Representative findings and discussion with the Facility Representatives are the primary component of the Office of Operations and Readiness's oversight of TA-55.

The Office of Facilities Management and ES&H Support also provides some oversight of TA-55, in accordance with DOE Policy 450.5. This office's oversight function consists primarily of reviewing TA-55 occurrence reports and reviewing internal and external assessments. Like the Office of Operations and Readiness, the Office of Facilities Management and ES&H Support relies heavily on both the review of TA-55 Facility Representative findings and discussions with the Facility Representatives as a major component of their oversight of TA-55.

The Board concluded that the DOE Headquarters oversight function consisted mainly of reviewing other organizations' assessments and reviewing occurrence reports. The Facility Representative assessments and feedback to DOE Headquarters are major components of DOE oversight activities. In light of the previous discussion on weaknesses in the TA-55 Facility Representative oversight program, the Board concluded that DOE Headquarters does not have an effective program to provide ES&H oversight of TA-55.

3.1.6 System Design

The safety basis for system design in PF-4 primarily focuses on public safety and mission-related activities. The risk ranking of PF-4 support systems does not adequately account for hazards such as the impact of breaching contaminated vacuum lines on workers. As a result, the airlock argon/vacuum support systems were not thoroughly evaluated in the TA-55 hazard analyses. Most design features of support systems are identified only on generic "repeatable" drawings that show the general orientation of these systems, but allow considerable latitude in the actual installation of components. As-built design drawings were never prepared for many of the glovebox support systems.

The Board concluded that deficiencies in the design and installation of the argon and dry vacuum services to the glovebox airlock contributed to this accident. The dry vacuum system was the source of the contamination and contained the leaking compression fitting that allowed the contamination to be released to the room. The argon system provided the motive force for the accident. A review of the interface between these systems would have revealed a combined hazard that was greater than the sum of the risks represented by each individual system. This combined hazard should have been considered in the following elements of the manifold design.

Use of Ball Valves for Manifold Isolation

Ball valves do not effectively throttle pressure. The use of ball valves to isolate the argon system did not allow gradual introduction of argon to the airlock. Only a slight actuation of the ball valves exposes the airlock to full argon system pressure (23 psig). Although the risk of overpressurizing the airlock was recognized in airlocks in an adjacent room and the purge procedure prohibited, the corrective action was not implemented throughout the facility.

A field change was designed to preclude this problem by changing ball valves to needle valves, adding filters, and installing check valves in the argon/dry vacuum manifold system. This field change was not installed on all airlock manifolds, but only on manifolds removed during the seismic upgrades. The seismic upgrades to the glovebox involved in the accident on March 16, 2000 were accomplished without affecting the existing manifold. Pressure surges from the argon system in the original design also affected the dry vacuum manifold valves. The contaminated dry vacuum system is connected to the argon system via the manifold. The Board concluded that this design does nothing to mitigate the hazards of pressure surges in the contaminated airlock and dry vacuum system (see Figure 2-2).

Teflon(r) Seating Materials

The dry vacuum system employs ball valves with Teflon^(r) seats for isolation. The Pu-238 particles retained in the dry vacuum system cause significant degradation of these seats (see Exhibit 3-1). The seats in the vacuum manifold valve were degraded so badly that the valve no longer held pressure at the time of the accident. Any pressure in the airlock or in the manifold would have leaked through this isolation valve, contributing to the accident.

Teflon^(r) experiences significant degradation of many mechanical properties, including tensile strength, shear strength, elastic modulus, impact strength, and elongation at lower radiation exposure levels than most plastics. The following table extracted from the Materials Research Society's April 1997 Bulletin shows the impacts of radiation exposure on Teflon^(r) relative to other common plastics. This information is corroborated by the Nuclear Engineering Manual, edited by Harold Etherington and published by McGraw-Hill in 1958. These references are also corroborated by the DOE Handbook on Design Considerations, the DOE Standard for Good Practices in Radiological Protection, and the Electric Power Research Institute's compilation of Radiation Data for Design and Qualification of Nuclear Plant Equipment. ^3,4,5

³ DOE-HDBK-1132-99, Design Considerations, Section 5.4

⁴ DOE-STD-1128-98, Guide of Good Practices for Occupational Radiological Protection in Plutonium Facilities, Section C.4.3.1

⁵ EPRI NP-41728P, Project 1707-7 Radiation Data for Design and Qualification of Nuclear Plant Equipment

In addition to the use of Teflon^(r) as the seat material in this valve, Teflon^(r) tape is used to connect mechanical joints with pipe threads in this manifold. The Board concluded that Teflon^(r) was an inappropriate design choice as a sealing material in an environment containing Pu-238.

Exhibit 3-1. Teflon^(r) Seat Degradation

Use and Installation of Compression Fittings

The argon/dry vacuum manifold makes extensive use of compression fittings. Twelve compression fittings were used in less than two feet of piping for this installation. The American Glovebox Society's Guideline for Gloveboxes recommends piping and tubing outside of the glovebox be continuous (i.e., fabricated from a single length of pipe or an assembly with welded connections). The Board determined that even if compression fittings were necessary, the number of fittings could be significantly reduced with a more appropriate selection of fittings and components. The use of valves with integral compression fittings would eliminate two joints used for pipe thread to compression fitting adapters and the associated Teflon^(r) tape seals for each valve. The use of tube bends could have eliminated compression fitting elbows, another two joints. The Board concluded that the design and installation of this manifold with excessive compression fittings increased the risk of leaks and contributed to the accident.

The field installation of compression fittings throughout TA-55 also indicated a general lack of familiarity with the manufacturer's installation guidelines. The Board identified several instances of mixing materials in compression fittings. For example, both the combination of brass nuts with stainless steel compression fitting bodies and the use of compression nuts that are made of softer materials than the tube were observed. Such configurations are not recommended by the manufacturer. The excessive use of mechanical joints is also contrary to good design and installation practice. The Board concluded that TA-55 lacks familiarity with and training on the use and installation of compression fittings.

Human Factors

Human factors are also an integral component of good support system design. In the argon/dry vacuum manifold installations in several rooms in TA-55, each installation was different. The components used, the orientation of these components, and the routing of tubes and pipes varies from glovebox to glovebox. Non-standardized installation configurations and the lack of as-built drawings, together with inadequate labeling of components, contributed to confusion when tracing these systems for maintenance evaluations. The Board concluded that these deficiencies were factors in ET's inspection of pipes and valves unrelated to the loss of argon flow to the glovebox and contributed directly to the accident.

3.1.7 Radiation Protection and Control

By formal agreement, ESH-1 is the organization responsible for providing the following radiation protection and control support to TA-55:

• Providing radiological emergency response
• Helping NMT ensure compliance with applicable regulations, including implementation of the Laboratory's radiation protection program
• Providing facility support, including helping to maintain the facilities' authorization bases
• Implementing the Target Zero project at the facility - a LANL project in PF-4 to reduce radiological incidents to as close to zero as possible
• Providing health physics expertise and operational field RCT support to NMT programmatic work.

Specific weaknesses in radiation protection and control that were identified by the Board and that pertain to to this accident are discussed below.

RCT Training

ESH-1 has established a training and qualification program to provide knowledgeable RCTs who can support TA-55. The formal training and qualification program addresses generic radiation protection skills and topics. Once qualified, RCTs are assigned specific duties within the facility. Newly qualified RCTs are assigned less-hazardous tasks (e.g., changing air filters and performing routine surveys) to gain experience. As RCTs become more experienced, they are assigned to work with a Lead RCT in a certain room, acquiring additional working knowledge of the different systems in the facility while on the job.

RCTs do not receive formal training on topics specific to the SAR, the technical safety requirements (TSRs), or the physical systems and programmatic work in the rooms of the facility where they are assigned. The Board concluded that formal training of the RCTs in these areas would have improved their ability to perform their job function and to recognize and understand the hazards associated with the activities being conducted at the time of the accident.

ALARA Considerations

At the time of the accident, there were eight workers in the room. Of those eight workers, four had been in the room from 30 minutes up to one hour waiting for another evolution to occur before they could go to work. The Board is concerned that workers were loitering in Radiological Buffer Areas while not actively involved in ongoing work. The Board concluded that if the ALARA concept had been fully implemented, there would have been fewer workers in the room at the time of the event. This would have reduced the number of workers with an intake.

Radiological Control Instrumentation

LANL typically installs Ludlum Model 214 glovebox hand monitors near each set of gloves in a glovebox. When workers remove their hands from a glovebox, they use these monitors to check their arms and hands for alpha contamination. If a hand monitor alarms, an RCT responds by checking the worker for contamination and also confirming that the instrument is functioning correctly. Several of the occupants of the room stated that the hand monitors have had many spurious alarms. It was not until the third hand monitor alarmed that the workers thought something might be wrong.

This accident is similar to prior occurrence #ALO-LA-LANL-TA55-1998-0039. In both events, the first indication of a problem was when the hand monitor alarmed, and the RCTs responded to the alarms in accordance with their training. However, workers may have become desensitized to this alarm due to frequent false alarms in the past. The failure of RCTs and workers in the room to recognize what was happening with the hand monitors may have delayed the response to both events.

CAM Placement and Upgrade

In 1992, DP initiated an appraisal of the performance of the CAMs used in the Plutonium Facility and other facilities throughout the DOE weapons complex. As a result of this appraisal, LANL felt that it was important to improve their understanding of the variables that can affect CAM alarm sensitivity and in 1993 conducted a study of the "Continuous Air Monitor Correlation to Fixed Air Sample Data at Los Alamos National Laboratory." LANL's study focused mainly on the CAM's ability to detect airborne radiological releases and the increased risk to workers when the CAMs were unavailable. Based on the results of this study, LANL undertook the following CAM placement strategy to ensure more reliable and timely detection of radiological releases:

• If the probable location of a radiological release can be determined from process knowledge and historical data, place the CAMs nearby.
• If the probable location of a radiological release cannot be predetermined, place the CAMs at the exhaust registers within the laboratories.
  

In 1996, LANL conducted a follow-up study, "Evaluation of Continuous Air Monitor Placement in a Plutonium Facility." The purpose of this study was to compare the response times of CAMs placed at the exhaust registers with CAMs placed at alternative locations. The results showed that, for all release scenarios, the fastest response times to airborne contamination were usually achieved by placing the CAMs toward the interior of the room, not at the exhaust registers, where they are installed in the room where the accident took place.

These results suggest that workers could be better protected from inadvertent radiological releases by placing CAMs in the interior of rooms, even if the probable release locations are unpredictable. The question that still remained was whether the CAMs could be utilized in a way that could reduce the exposures to the workers. LANL convened a CAM-placement working group to answer this question. Their early recommendation was to relocate the CAMs toward the interior of the room, but questions still remained with respect to the optimal number of CAMs and how to compensate for changes in the room configuration.

LANL has continued to study these questions over the past two years. Their recommendations, which are yet to be published, are to move the CAMs from the corners of the room and remove the transport tubing on the CAM suction. LANL is also planning to upgrade the diagnostics used in the CAMs and network these new instruments together. LANL prepared a proposal to acquire prototypes from the instrument manufacturers and then have the prototypes tested and calibrated by LRRI. The total cost of this project was estimated to be $7 million for FY 2000. Because of budget concerns, the scope of the project has been reduced to only requesting prototypes from the instrument manufacturers this fiscal year.

After the accident on March 16, 2000, LANL removed the fixed-head filters from the first affected room and, based on the radiation readings from each filter and the times when each CAM alarmed, estimated the airflow pattern in the room at the time of the accident. They then estimated that it would have taken at least one but not more than five minutes for the radiological release to reach and activate the first CAM; the most likely delay time was estimated to be two minutes.

The Board concluded that if LANL had moved the CAMs to the interior of the rooms prior to the accident, their own studies show that the response time to the CAM alarm would have been less. Although this probably would have had little effect on the amount of intake that ET received, the Board concluded that it would have lowered the intakes of the other affected workers. The Board concluded that LANL should have relocated their CAMs in the various rooms in light of the studies they have completed over the past seven years.

3.1.8 Emergency Response

The emergency response actions taken after the accident were sufficient to limit additional exposures of facility personnel and to ensure that the internally contaminated personnel received prompt medical treatment. Facility personnel responded in a manner that indicated they were well-trained and familiar with emergency response procedures. Operations personnel made notifications and announcements in accordance with the appropriate CAM response procedures. Personnel working within the room reacted correctly and promptly to CAM alarms and followed the appropriate room evacuation protocols. Responding RCTs and supervisors provided prompt aid to affected workers and established contamination controls in accordance with approved procedures. Personnel exposure and dose assessments were completed in a timely manner, and workers requiring chelation therapy were promptly identified and counseled to assure that treatments were initiated in time to have the greatest impact on dose reduction.

The day before the accident, the TA-55 Emergency Management Coordinator had conducted a tabletop drill exercising facility incident command that had similarities to the subsequent release. This drill exercised the TA-55 Operations Center, the TA-55 emergency response team, the TA-55 facility incident command, the resident ESH-1 representative, the LANL emergency management and response organization, and the Los Alamos Fire Department. The drill participants included many of the personnel who actually responded to the accident. Emergency management and response training was a contributor to the successful response actions taken immediately after the release.

The Board concluded that overall, the emergency response of the facility was notable. Although specific deficiencies in responding to this accident were identified, the Board concluded that these deficiencies did not contribute to the severity of the accident or adversely impact the highest-priority emergency response objective, which is to provide timely medical treatment to internally contaminated personnel.

External Notifications

(EM&R) notification checklists as soon as possible. These notifications were not made, and EM&R first learned of the accident the following day when the AL emergency operations center personnel called to determine why AL had not been notified. Not requiring activation of the facility incident command structure weakened the facility's management of the accident and contributed to the failure to notify appropriate onsite and offsite organizations in a timely manner.

Post-accident Critique

The post-accident critique was not performed until Monday, March 20, 2000 —four days following the event — and written statements were not taken from affected and responding workers until several days following the event. The emergency response was not specifically reviewed to identify potential response problems and deficiencies. As a result, time-critical issues and decision-making information were not available to ensure that the event had been adequately analyzed and mitigated until days later.

Transportation of Exposed Workers

The ESH-1 Deputy Group Leader promptly contacted Occupational Medicine (ESH-2) to consult on the medical implications of Pu-238 intakes and to coordinate the transport, evaluation, and treatment of the eight affected workers. Following initial notification, the ESH-1 Deputy Group Leader followed up with ESH-2 staff and informed them that the affected workers had been decontaminated at the facility and would be arriving at ESH-2 shortly. The highest exposed worker was driven to ESH-2 by his supervisor; the other seven workers obtained a government vehicle and drove themselves to ESH-2. ESH-1 and NMT-8 management followed. Upon arrival, the TA-55 staff found that ESH-2 had established contaminated-injury receipt procedures and protocols, although the affected workers were not externally contaminated.

3.1.9 Management Systems

During the past three years, LANL has devoted considerable effort to the implementation of ISM and the establishment of facility management units (FMUs). Inclusion of ISM milestones in the DOE-UC contract has established the necessary institutional accountability and has led to a strong commitment by the senior management of the Laboratory. LANL senior managers are knowledgeable about the ISM concept and structure, have received appropriate training, and are closely following the progress of ISM as it permeates down through the Laboratory's infrastructure. The deployment of ES&H and engineering staff to project work, which is intended to both improve the efficiency of operations and provide easy access to required systems expertise, is a positive step toward integrating safety into the work being performed.

Although progress has been made in this area, the Board concluded that the events leading to the contamination of the workers demonstrate a lack of consistent application of the guiding principles and core functions of ISM, as they apply to the conduct of work in a potentially hazardous environment. Specific deficiencies identified by the Board are discussed below.

Roles and Responsibilities

The implementation of ISM has created considerable organizational complexities within the Laboratory and has challenged LANL's management in a number of areas, including the clear definition and communication of roles and responsibilities, and the specification of authorities and accountability measures for managers, technical staff, and workers. At the higher organizational levels, the ISM Plan and several LIRs and LIGs deal effectively with this issue through definition of safety- and environmentally responsible, line-management chains. Roles and responsibilities at lower organizational levels within NMT, however, are not well defined.

At the time of the accident, there were no facility/tenant agreements between the facility management organization (NMT-8), the owner of the glovebox (NMT-9), and the organization responsible for decontaminating the glovebox (NMT-15). Only one of these organizations had an interface working agreement. The Board found this document to be a poor substitute for the facility/tenant agreements that are designed to define organizational interfaces in enough detail to support operational activities. The Board considers this weakness to be a major deficiency.

The Board concluded that roles and responsibilities were not appropriately clarified and communicated between the group leaders and the facility managers, and for and among levels below group leaders and the facility managers. The events on March 16, 2000, demonstrate that a lack of clear definitions of roles and responsibilities was a contributing factor in:

• The failure to define the task to be performed more rigorously with the participation of Facility Management staff, using ISM standards and protocols

• The failure to establish a clear communication channel between the RWS, the AWS, the RCTs, and the other technicians and workers present
  

• The failure to provide proper supervision of the worker, in that the supervisor did not adequately define the scope of work, identify the hazards, ensure adequate training and knowledge, and provide direct supervision.

As a result of these deficiencies, ET was unaware of important information concerning the status of electrical circuit #10 providing power to the photohelic sensor in the glovebox and unaware of the hazards associated with his actions.

Competence Commensurate with the Requirements of the Work

One indication of weaknesses in this area is that the piping under the glovebox was shaken without specific knowledge of (1) what function the pipe serves, (2) whether the pipe may be contaminated, and (3) the possible consequences of a leak in the pipe. Management systems should preclude the performance of informal tasks based solely on the skill or prior experience of workers without a careful examination of potential hazards associated with the activities and the environment.

The Board concluded that management systems associated with activities being conducted in the room at the time of the accident did not fully address the potential hazards associated with the glovebox environment, nor did they appropriately scope the necessary protective measures. ET's lack of familiarity with potential hazards associated with the task and how to perform this task was indicative of a lack of competence commensurate with the requirements of the work.

Core Functions

Management system weaknesses identified throughout this report demonstrate inadequate implementation of ISM at the facility and activity level. Table 3-1 summarizes specific deficiencies identified in the application of the five core functions as they relate to the accident. The Board concluded that the events leading to the accident demonstrated a lack of consistent application of the ISM guiding principles and core functions.

Table 3-1. Deficiencies in the Application of the Core Functions of Integrated Safety
Management Related to the TA-55 PF-4 Accident

3.2 Barrier Analysis

Barrier analysis is based on the premise that hazards are associated with all tasks. A barrier is any management or physical means used to control, prevent, or impede the hazard from reaching the target (i.e., persons or objects that a hazard may damage, injure, or harm). The results of the barrier analysis are integrated into the events and causal factors chart to support the development of causal factors. Table 3-2 contains the Board's summary of physical and management barriers that failed to perform as intended, thereby contributing to the accident. Appendix C contains the complete barrier analysis.

Table 3-2. Barrier Analysis Summary

3.3 Change Analysis

Change analysis examines planned or unplanned changes that caused undesirable results related to the accident. This process analyzes the difference between what is normal, or expected, and what actually occurred prior to the accident. The results of the change analysis are integrated into the events and causal factors chart to support the development of causal factors. The change analysis is presented in Table 3-3.

Table 3-3. Change Analysis

3.4 Causal Factors Analysis

A causal factors analysis was performed in accordance with the DOE Workbook Conducting Accident Investigations, Rev 2. Causal factors are the events or conditions that produced or contributed to the occurrence of the accident and consist of direct, root and contributing causes.

The direct cause is the immediate event or condition that caused the accident. The Board determined the direct cause of the accident was the release of airborne contamination from a leaking compression fitting in an inadvertently pressurized glovebox-airlock dry vacuum line.

Root causes are events or conditions that, if corrected, would prevent recurrence of this and similar accidents.

The Board also identified contributing causes. Contributing causes are events or conditions that collectively with other causes increase the likelihood of the accident but that individually did not cause the accident.

A summary of the Board's causal factors analysis is presented in Table 3-4.

Table 3-4. Causal Factors Analysis Summary

Table 3-4. Causal Factors Analysis Summary (Continued)

Judgments of Need

Judgments of need are managerial controls and safety measures believed necessary to prevent or minimize the probability of a recurrence. They flow from the causal factors and are directed at guiding managers in developing corrective actions. Table 4-1 summarizes the Board's causal factors and judgments of need.

Table 4-1. Causal Factors and Judgments of Need

  Board Signatures

  Board Members, Advisors, and Staff

APPENDIX A

BOARD APPOINTMENT MEMORANDUM

APPENDIX B

EVENTS AND CAUSAL FACTORS CHART

APPENDIX C

BARRIER ANALYSIS