On December 8, 1999, at 9:35 a.m., a chemical explosion occurred within the skull caster furnace section of the Building 9201-5 at the Y-12 Plant in Oak Ridge, Tennessee. The explosion injured 11 workers, three of whom required hospitalization. One worker had third-degree burns on 17 percent of his body and was flown to the Erlanger Burn Center in Chattanooga, Tennessee. The worker was initially considered to be in critical condition and received a number of skin grafts before leaving the hospital on December 21, 1999.

On December 1, 1999, Depleted Uranium Operations (DUO) workers in Building 9201-5 were changing out the crucible in the skull caster furnace. This crucible is cooled by a sodium-potassium liquid metal alloy (NaK). The crucible was last changed out in 1993, and the workers were using a new procedure for the activity. When workers removed a flexible argon purge hose from the crucible, several gallons of NaK sprayed out through an open isolation valve into the furnace.

Over the next several days, the workers monitored conditions in Building 9201-5 and intermittently purged the furnace with argon in an attempt to minimize further oxidation. Facility management developed a recovery plan outlining the process for cleaning up the NaK spill. On Friday, December 3, the workers observed unusual and unexpected conditions in the furnace, including a yellow color and abnormal configuration of the material. Mineral oil was sprayed on the deposits to minimize oxidation.

Some aspects of the emergency response to this accident were effective. For example, the workers promptly assisted the most severely injured workers to the safety showers. In addition, the fire department and radiation control personnel responded promptly and effectively to transport the injured personnel and prevent the spread of contamination. However, the accident highlighted deficiencies in numerous aspects of safety management at the Y-12 Plant.

The December 1 NaK spill resulted from numerous deficiencies in the new procedure for crucible changeout. During this work activity, the workers made pen and ink changes without stopping to obtain proper review and approval of the changes. A key step requiring opening of the dump valve to drain the crucible NaK piping had been inadvertently deleted from the procedure, resulting in a failure to open the valve and trapping the remaining NaK under argon pressure. When workers observed an unexpected NaK level in the sump, they did not stop to analyze the system configuration or seek assistance before repeating parts of the procedure. A worker climbed into the furnace to disconnect the argon purge hose. When the hose was disconnected, the trapped NaK sprayed out under pressure into the furnace through an open isolation valve that was also incorrectly aligned because of procedural deficiencies.

After the spill, facility management stopped work to develop a recovery plan for cleaning it up. The plan was developed in one week using a team approach, including personnel from safety engineering and the industrial safety/hygiene organization. However, the personnel who developed the recovery plan did not adequately understand the hazards associated with superoxide explosions and the use of mineral oil. Further, the recovery plan did not conform to authorized Y-12 Plant mechanisms for controlling hazardous activities. The process did not include a hazard screen or job hazard analysis, and the plan was not subjected to any management or technical review or approval beyond the core group that developed it. The plan failed to address the necessary personal protective equipment (PPE) for the workers engaged in the hazardous NaK recovery; such equipment could have mitigated or prevented the injuries that were incurred.

The crucible changeout procedure and recovery plan did not identify or control the explosion hazard associated with potassium superoxide in the presence of organic materials, such as mineral oil. The explosion hazard is clearly identified in the NaK Material Safety Data Sheets required by the Occupational Safety and Health Administration and in many other documents and publications available on site, including the safety analysis for another Y-12 Plant facility. The recovery plan directed workers to spray the NaK spill with mineral oil and to mechanically break up NaK that could not be vacuumed out. These very actions and conditions caused the explosion and worker injuries.

Management at all levels and safety professionals, such as industrial hygienists, did not maintain an adequate level of knowledge on the well-documented hazards associated with NaK. Because previous NaK spills and events had not caused serious injuries, management and work planners apparently developed a level of confidence in their familiarity with NaK and did not seek outside expertise. Inadequate understanding of the hazard, as well as failure to follow the contractor’s ISM work control processes, resulted in a hazard analysis and hazard controls that were ineffective in preventing or mitigating the accident.

This accident highlighted weaknesses in programs and processes essential to safety, such as procedure quality, use, and change control; system configuration control; unreviewed safety question determinations; and training. These weaknesses persist, in part, because of a lack of management involvement in safety and weaknesses in the contractor’s independent quality assurance function, line management self-assessment programs, and DOE oversight. Further, the December 1 spill was not reported to contractor senior management, safety engineering, the DOE Facility Representative, or the DOE Occurrence Reporting and Processing System as required.

The Board determined that the contractor, Lockheed Martin Energy Systems (LMES), has not effectively incorporated the lessons learned from previous events and accidents, thereby missing a number of opportunities to prevent this accident. In 1992, an NaK release at this same facility prompted corrective actions that involved specific PPE requirements for workers who could come in contact with NaK—requirements not incorporated in the NaK spill cleanup plan. In 1994, LMES generated a lessons-learned document based on a sodium explosion in France that killed one worker and injured four. The facility’s response to that document was inadequate, and neither workers nor management questioned its adequacy. In 1997, when an NaK drum and a small reactor containing NaK were discovered in another Y-12 facility, management recognized that the facility safety analysis report did not address these hazards. As a result, the facility filed an unusual occurrence report and performed a hazard screening evaluation that clearly identified the explosion hazard and the chemical reaction that would cause an accident like the one that later occurred in Building 9201-5. However, this hazard information was not effectively communicated to or utilized by workers or planners in Building 9201-5.

The Y-12 Plant, located in Oak Ridge, Tennessee, encompasses 600 acres within the fenced complex, with an additional 3,000 acres of buffer zone. The primary mission of the Y-12 Plant is nuclear weapons stockpile maintenance. Secondary missions include research and development, as well as management of facilities that are no longer needed for defense missions while they undergo or await decontamination and decommissioning.

Building 9201-5, also referred to as Alpha-5, was constructed in the early 1940s. It is a large (about 530,500 square foot of floor space) clay block and concrete block structure that has a high bay. The activities in Building 9201-5 are part of the Y-12 Plant depleted uranium operations (DUO) program, which encompasses processing of depleted uranium for use in stockpile maintenance. Within the DUO program, the Y-12 Arc Melt Operations Division operates various process equipment in Building 9201-5.

The Board began its investigation on December 10, 1999, completed the onsite phase of its investigation on January 14, 2000, and submitted its report to the Assistant Secretary for Environment, Safety and Health on February 10, 2000. The scope of the Board’s investigation was to review and analyze the circumstances of the accident to determine its causes. The Board also evaluated the adequacy of safety management systems and work control practices of OR and the Y-12 Plant, as they relate to the accident.

The mixture of sodium and potassium metals, commonly called NaK, is a highly reactive material that has been used in industry for decades because of its excellent high-temperature thermal and hydraulic properties. NaK is an extremely reactive and pyrophoric alloy, composed of 78 percent potassium and 22 percent sodium, that is a liquid at room temperature. Because it is extremely reactive with water, moist air, and oxygen, NaK must be used and stored in an inert atmosphere (e.g., dry argon or nitrogen).

The primary hazards associated with NaK are fires, explosions, and release of caustic fumes. When exposed to water, NaK reacts violently, producing fire, small explosions, release of caustic fumes, and spattering of hot, reactive particles of NaK and combustion compounds. NaK reacts to a lesser degree with air, causing fires and caustic fumes of potassium oxide and sodium oxide. Hydrogen can also be produced by NaK reactions with the water vapor in air. An NaK fire produces caustic white smoke (consisting of oxides and hydroxides of potassium and sodium). The smoke made up of these combustion products can attack the skin and mucous membranes and can cause irritation and chemical burns. According to the Material Safety Data Sheet (MSDS), the long-term health effects of exposure to NaK fumes have not been fully investigated and are not well known.

In early 1999, Y-12 Plant management began planning to replace the steel crucible of the skull caster furnace (Figure 2).

These crucibles experience heat stress during the arc melting process and need to be replaced (typically after about 70 melting cycles) to reduce the likelihood of a crucible failure during operations. The last crucible change occurred in 1993.

The crucible changeout procedure was finalized and issued in June 1999. In October 1999, an informal meeting was held to discuss the job and the potential hazards. Also in October 1999, a radiological work permit (RWP) was issued for surveillances in the area that established personal protective equipment (PPE) requirements. The job package instructions were issued and a job hazard analysis was completed in November 1999.

Figure 2. Skull Caster Furnace

The crucible changeout work began on December 1, 1999, at about 7:30 a.m. with a pre-job briefing. A simplified schematic of the NaK system is shown in Figure 3. The first portions of the procedure involved heating the NaK system to about 200 F to improve flow characteristics and then draining the expansion tank through the dump valve.

Figure 3. Simplified NaK System Schematic

After the tank was drained, the dump valve was closed in accordance with the procedure. An engineer was marking up a copy of the procedure as it was being performed. Next, the crucible annulus was pressurized with argon to force NaK from the crucible annulus to the sump tank. The sump level was then measured and a four-inch discrepancy was noted, indicating to the operators that the crucible had not been fully drained. At this point, the supervisor, along with others present, decided to repeat the procedure steps involving heating the NaK. The supervisor then directed the pipefitter to close the argon isolation valve and remove the argon purge hose. The pipefitter removed the hose without closing the valve.

The spill generated a large amount of hazardous smoke. The pipefitter, who was not wearing appropriate PPE, saw the leak and exited the furnace immediately. All personnel left the area. Fire Protection Engineering was notified to open the roof-mounted smoke dampers in the facility to permit clearing of the smoke.

Later that day, a management review was held to review the spill incident. The main corrective action from the management review was to develop a recovery plan for the NaK spill. After that meeting, two Y-12 Plant staff reentered the area to observe conditions. They opened the furnace cover and saw “a white flaky powder.”

The recovery team met at about 7:15 a.m., proceeded to the process area, and held a pre-work briefing, which ended about 7:50 a.m. The team entered the skull caster furnace area at about 8:00 a.m., at which time questions arose about where operators could don respirators. Three individuals were sent back to don respirators. The team re-signed the RWP and assembled at the platform about 9:00 a.m. Three of the workers, two of whom were on the platform, wore standard anti-contamination coveralls, booties, gloves, cloth hoods, and respirators, while the other workers wore only lab coats or coveralls, booties, and gloves. None of the workers wore NaK suits or flame-retardant coveralls.

The industrial hygiene representative (IH-1) and the process engineer (PE-1) report having a short conversation among themselves at about 9:25 a.m., in which they discussed the importance of "not letting their guard down" because NaK was a hazardous material with a potential for explosions involving superoxides and/or hydrogen.

The layout of Building 9201-5 is shown in Figure 4.

Figure 4. Skull Caster Furnace Area, Showing Position of Safety Showers

At the time of the explosion, the ten workers were positioned as marked on Figure 5.

Figure 5. Skull Caster Furnace Area, Showing Positions of Workers at the Time of the Explosion

The workers on the platform left as rapidly as possible. The operations manager (OM-1) helped the most severely injured worker (CO-1) off the platform and held him in an effort to smother his burning coveralls as they proceeded to the safety shower. Other workers discarded burning clothing as they left the area. The workers assisted the injured personnel and extinguished small fires. One worker (IH-1) exited the area and called 911, which connects to the Y-12 fire department dispatcher.

As of the conclusion of the onsite phase of the accident investigation (January 14, 2000), the Y-12 Plant was in the process of developing an approach to stabilize and remove the remaining hazardous material. Y-12 Plant management indicated that their plan is to discontinue the use of NaK systems across the plant. They plan to collect and dispose of all NaK in the Y-12 Plant, including the material in Building 9201-5 and other areas at the Y-12 Plant.

In the interim, NaK remains in the furnace, in the sump, and in the buckets of oil at the accident scene. The Y-12 Plant is controlling access to the area and prohibiting disturbing the remaining NaK. Y-12 Plant management is evaluating a proposal by an outside contractor to perform the needed remediation and disposal activities.

Fire alarm functions had been removed from the skull caster furnace high bay in about 1969, leaving the high bay without a fire alarm function (discussed further in Section 3.6). Because of the lack of adequate fire detection alarms and the presence of a hazard (NaK cooling system, spill and potential superoxides), DUO management established a compensatory fire watch for the skull caster furnace area in response to the accident investigation board’s concern. The fire watch will wear appropriate anti-contamination clothing and inspect the high bay area from the third floor mezzanine once every four hours until the hazard is abated. DUO management, in conjunction with fire protection engineering and the fire department, plans to evaluate the removal of fire alarm protection from that section of the building.

Until the hazard is stabilized and/or remediated, several conditions require further evaluation by Y-12 and compensatory or permanent corrective action:

• Potential unknown explosion damage to the NaK cooling system and piping inside the skull caster furnace

• The lack of fire alarm detection for the skull caster furnace high-bay area

• The lack of skull caster furnace integrity due to missing gaskets

• The presence of superoxide in the remaining material (confirmed by chemical testing)

• The presence of mineral oil in contact with superoxides inside the furnace

• Operability of the roof vents.

The Plant Shift Superintendent’s (PSS) office and the Y-12 fire department received the first call about the accident at 9:36 a.m. The Y-12 fire department was immediately dispatched and arrived at Building 9201-5 at 9:38 a.m. The fire department established an on-scene incident command post and secured the area around the building. Personnel in the accident area started to proceed to the Boundary Control Station where emergency response personnel assisted and prepared injured individuals for ambulance transport.

At 9:42 a.m., reports that the area was full of smoke prompted the PSS to direct an evacuation. Personnel evacuated to the assembly area on the west side of the building. The PSS declared an operational emergency and activated the Technical Support Center (TSC) at 9:43 a.m. DOE was notified of the accident at 9:49 a.m.

A Y-12 Plant radiological control technician (RCT) accompanied CO-1 to the ORMMC and remained there to provide assistance with the other two workers when they arrived. The Radiation Emergency Assistance Center/Training Site (REAC/TS) was activated while the first ambulance was transporting the first individuals to the ORMMC. REAC/TS personnel met the ambulances when they arrived at the ORMMC, where they surveyed and decontaminated the victims.

The minimal external radiological contamination on the three victims transported offsite would not result in a radiological health hazard. (The highest level of contamination in the surveys at the ORMMC was about 1500 counts per minute.) The contamination was generally found in the hair or along the hairline. Most of the contamination-control PPE (lab coats, gloves, booties) worn by the three transported victims was removed immediately after the explosion (e.g., because of burn damage) or before transport to the hospital. Decontamination efforts (washing and shampooing of hair) were successful in reducing the contamination. The survey of CO-1 indicated some small areas of low-level contamination (50 to 100 counts per minute), which was removed from the individual at the burn center.

The Y-12 RCTs set up contamination control areas at the ORMMC and assisted the REAC/TS. Contaminated clothing was collected and returned to the site. A nurse’s shoe was found to be contaminated and was returned to the site. Subsequent surveys of the accident responders, ambulances, gurneys, and ORMMC facilities showed no radioactive contamination resulting from treating the accident victims.

Bioassay samples (urine and fecal) were collected from the workers on the spill recovery team, another DUO worker in the building who entered the area after the explosion to provide assistance, and emergency responders (fire department/ambulance). Bioassay samples were not yet available for the three individuals who were sent to the ORMMC.

The available bioassay results indicate that several of the workers received intakes of radioactive material resulting from the accident. Y-12 Plant personnel estimated the committed effective dose equivalent (CEDE), which is the expected dose that will occur over a 50-year period as a result of the intake, using the conservative assumption that the material was all Class Y uranium-234.

Five employees experienced respiratory irritation following the explosion. Two of these five had not been in the vicinity of the skull caster at the time of the explosion, but entered the vicinity immediately after the explosion to provide assistance. Three employees developed bronchitis in the days following the explosion. Of these three, two had a prior history of asthma. In addition to burns and smoke inhalation, the explosion and/or physical trauma (e.g., falls) resulted in other injuries (eye injuries, ringing in ears, hearing degradation, contusions, and muscle strains) to varying degrees.

Several of the employees involved in the incident, or acquainted with those involved in the incident, suffered emotional upset and post-traumatic stress reactions. In addition to medical treatment, the Y-12 medical facility’s psychologist and the Y-12 employee assistance program (EAP) director offered psychological support and education regarding the potential for trauma-induced stress reactions. Those involved in and responding to the accident, the family members of those injured, and co-workers in the building were contacted and invited to use these services.

Employees experiencing more serious burns (CO-1, CO-2, CO-3, and OM-1) may develop visible scars. Due to the severity of their neck burns, there is some concern that the two most seriously burned employees (CO-1 and CO-2) could develop neck scars that somewhat limit head movement. The most seriously burned worker (CO-1) may also develop a scar in the left armpit that could limit shoulder range of motion. It will be several months before it is known whether these complications have developed.

Y-12 Plant chemical safety hazards analysis processes are intended to identify and control hazardous materials by means of the facility authorization basis, hazard identification, job hazard analysis, hazard screening, and hazard evaluations. These processes did not identify and communicate the hazards associated with a mixture of potassium superoxide and mineral oil and did not establish effective controls (e.g., prohibiting the use of mineral oil on NaK) to address the hazards. These processes failed even though the potential for superoxide explosions is documented and communicated in numerous technical and safety documents, including the MSDS for NaK, the Fire Protection Guide for Hazardous Materials, and the Sodium-NaK Handbook, all of which are readily available. In addition, the NaK MSDS and other technical documents clearly warn against the storage of metal under hydrocarbons (e.g., oil) or the addition of organics where superoxide is suspected. The MSDS, which can be accessed from any computer terminal within Y-12, also recommends that spills be cleaned up promptly using Met-L-X (which is a fire-fighting agent for liquid metal fires) or dry soda ash. Table 1 provides a sample of the technical information related to NaK and the superoxide/organic explosion hazards.

Table 1. Information About NaK and Superoxide Explosion Hazards

The Y-12 Plant has used mineral oil to isolate NaK from contact with air since the system was installed in 1969. Y-12 Plant personnel refer back to an undocumented analysis by a Y-12 Plant materials science specialist as a basis for this practice. Although mineral oil was commonly used during this era to cover NaK in storage, numerous publications as early as the 1950s warned of the hazards associated with organics (including oil) where potassium superoxides may have formed.

A 1997 hazard screening evaluation for reactive metals stored in a different Y-12 Plant facility (Building 9720-27) clearly identifies the hazards associated with superoxide/oil explosions. It states: “The potassium present in the NaK can react with atmospheric oxygen to form oxides, peroxides, and superoxides that form a crust over the NaK surface. These oxides can be shock sensitive and can react violently (even explosively) upon contact with acids, halogens, organics, and metallic potassium in NaK.” This hazard screening evaluation was developed by the same department that is responsible for engineering/safety documents in Building 9201-5, where the explosion occurred.

The existing safety documents Building 9201-5 focus exclusively on NaK reactions with water and do not address other important reactions. For example, the NaK/water reaction was believed to be the dominant hazard, and it was the only hazard analyzed and discussed in the Building 9201-5 authorization basis. However, the sequence of events, beginning with the spraying of NaK into the furnace, created conditions favorable for the formation of potassium superoxide, and the subsequent addition of mineral oil created a shock-sensitive explosive mixture. Because this hazard was not recognized by the facility work planners, the subsequent disturbance of the mixture through prodding and poking led to an explosion and multiple injuries.

Chemical Analysis of the Spill/Spray and Explosion

The initial spill on December 1, 1999, involved a failure to close a valve, resulting in NaK spraying into the crucible while under pressure and at elevated temperatures. These conditions—forced exposure to air at elevated temperature—were favorable for the formation of potassium superoxide. Spraying NaK into the air in this manner is similar to the process used for commercial production of potassium superoxide, although commercial processes would use a higher temperature and a controlled fine spray (see Figure 6).

Figure 6. Commercial Production of Potassium Superoxide

Industrial unit for KO2 production (1) Container with molten metallic potassium; (2) pipe for supplying molten potassium to the sprayer; (3) sprayer; (4) pipe for supplying air to the nozzle; (5) needle for controlling the supply of air and molten potassium mixture to the nozzle; (6) cylindrical KO2 container; (7) KO2 outlet.

In a potassium fire, the dense white smoke formed is the potassium oxide (K2O). Because of the limited quantity of water vapor present in the air at the time of the spill, a relatively small amount of the NaK would react with water vapor to produce hydroxides. As shown in the box, the reactions of potassium and oxygen in the air can produce three different oxides, depending on the conditions.

If potassium oxide is subjected to an oxygen environment at an elevated temperature, the oxide will form potassium superoxide. At the time of the spill, the NaK had been heated to about 80 C. After the NaK spill, the material that sprayed into the furnace would be at a higher temperature because of the heat of the reaction. The residue noted after the spill was a combination of NaK, the oxides of potassium and sodium, potassium superoxide, and a small amount of sodium and potassium hydroxides.

The operators closed the furnace and purged it with argon to minimize further oxidation. However, the argon purge may not have been complete because the furnace is not airtight; between December 1 and 7, argon might have leaked away, and air might have diffused in. During this period, the mixture of NaK, the oxides and hydroxides of potassium and sodium, and potassium superoxide continued to react with any oxygen or water vapor in the furnace. Any oxygen present would be available to convert additional potassium oxide to superoxide.

The addition of oil to the potassium produced a shock-sensitive explosive mixture. Without the mineral oil, an explosion would not have occurred. The technical literature indicates that for an explosion to occur, a boundary layer with an organic or other material (halogen, acid) is needed.

When the operators sprayed mineral oil into the furnace on December 3, 1999, they noted "flashes and pops." These could have resulted from the reaction between moist air and NaK, and from subsequent ignition of the hydrogen and mineral oil from the heat of the reaction. Also, the oil spray flushed the oxides and superoxides off the wall of the furnace, thereby concentrating the superoxides at the bottom of the furnace where the operator was probing at the time of the explosion.

The Board believes that there is still a potential for explosive mixtures in the furnace and in surrounding areas (see Exhibit #7). Analysis of one of the residue samples taken from the floor on December 17, 1999, showed that 25 percent of the potassium was in the form of a superoxide. The furnace seals were damaged in the explosion, so an argon purge might not be effective in precluding oxygen from reacting with residual NaK (see Exhibit #8). The small amount of uncharacterized material that remains immersed in mineral oil on the platform will have to be handled with extreme care. Since the superoxide hazard is not currently addressed by the authorization basis for this facility, an unreviewed safety question determination is needed.

Exhibit #7. Residual NaK from Explosion Near Furnace	Exhibit #8. Furnace Showing Explosion Damage

Hazard Identification

The major contributor to the accident was the fundamental failure to identify the hazards associated with the use of mineral oil on NaK. Although this hazard is well recognized in the technical and safety literature, including the NaK MSDS, the personnel involved in planning for crucible changeout and NaK recovery did not have a full understanding of NaK hazards.Specifically, these personnel, including operations personnel, industrial hygiene specialists, and engineers, did not recognize the hazards associated with using mineral oil on NaK and developed a recovery plan that created an impact-sensitive explosive mixture of potassium superoxide and mineral oil.

The Y-12 Plant had 30 years of NaK experience without a serious injury, which may have resulted in complacency and a false sense of security. However, some of the events involving NaK should have prompted DUO and safety personnel to recognize the hazards associated with NaK, including its explosive characteristics. For example, when referring to the 85-gallon NaK spill in the 1980s, one interviewee stated that “there were a couple of fireballs you could have sold tickets to – real bangs.” In this event, the NaK came out as a spray and a large fraction of it was immediately oxidized, with some probably becoming superoxide immediately. The potential for superoxide and the presence of yellow material that looked like superoxide were recognized. Despite the fact that different circumstances were apparent, none of the facility personnel, work planners, or managers in the DUO organization took the initiative to fully understand and analyze the conditions. Even if the hazard was recognized after superoxide was suspected and oil had been applied, the potential for explosions could have been considered and controls (e.g., engineering controls such as blast shields, or other chemical treatments for the material) could have been developed.

DUO line management, DUO facility management, and work planners believed that they had sufficient knowledge and expertise, and did not challenge the technical basis for the use of mineral oil. Given the long history of the use of mineral oil and the level of confidence in its use, it is not clear what would have prompted the DUO workers to stop work and obtain additional technical guidance, or whether additional guidance would have resulted in different actions.

Authorization Basis

Consistent with DOE Order 5480.23, Nuclear Safety Analysis Reports, and DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Building 9201-5 is a Category 3 (low hazard) nuclear facility requiring a formal authorization basis. The authorization basis is the safety envelope established by the facility operator and accepted by DOE as providing reasonable assurance of a safe level of operation. The authorization basis document for the Arc Melter Area in 9201-5 is the “Phase I Hazard Screening Analysis for the 9201-5 Arc Melt Operations,” (HS/12/F/5/Jan. 25, 1991).

A draft basis for interim operation (BIO) for Building 9201-5 is in review. The development, DOE comments, and revisions of the BIO have taken over four years and have resulted in four submissions of Revision 0 of the BIO to DOE. Since the BIO was drafted in 1995, essentially all the procedures for developing authorization basis and job hazard analysis documents have undergone significant revision in an effort to develop them into the LMES integrated safety management program. Many of these revisions impose new requirements on how hazard assessment documents are developed. The BIO would need extensive revision to incorporate the new requirements.

Neither the hazard screening nor the draft BIO addresses the superoxide/oil hazard. These documents were not effective in establishing controls that would have prevented this accident. However, the superoxide/oil hazard was addressed by Y-12 Plant site safety engineering in a 1997 hazard screening evaluation for reactive metal storage in Building 9720-27 and in a 1999 revision to this document. The Building 9201-5 hazard screening was referenced in performing the Building 9720-27 analysis for NaK. The relevant hazard information was not, however, incorporated into the draft BIO for Building 9201-5.

Unreviewed Safety Question Determination (USQD) Process

The USQ screen for the spill event was not conducted. NaK was viewed as an existing hazard, and it was informally concluded that there was no reduction in the safety margin. Because the screen was not conducted, opportunities were missed to review the MSDS, USQDs, and reference material that was available regarding the hazard.

In summary, the fundamental failure to identify the hazard was the major factor in the accident. Since the hazard was not identified, it was not analyzed and controls were not in place to prevent the accident or protect the workers. The actions that were taken after the spill as directed by the recovery plan (adding oil and then impacting with a steel probe) escalated a manageable spill event into an accident with multiple injuries. Opportunities to identify the hazard were missed, including the authorization basis and USQD processes and the hazard identification and job hazard analysis (see Section 3.3).

 3.2    Conduct of Operations 

Deficiencies in conduct of operations contributed to this accident. Failures in procedure development and use, as well as aspects of communications, notifications, and investigation of abnormal events, led directly to the NaK spill and subsequent explosion. Table 2 identifies various failures in conduct of operations evident in this accident.

The December 1 spill and December 8 cleaning operation with subsequent explosion demonstrated deficiencies in implementation of DOE conduct of operations requirements. The numerous deficiencies across many chapters of DOE Order 5480.19 indicate a programmatic breakdown in conduct of operations requiring prompt senior management attention to prevent future injury or loss.

Procedure Development, Verification, and Validation 

Y-12 Plant personnel prepared a detailed procedure for the skull caster crucible changeout activity, which had previously been addressed in the furnace operation procedure. The skull caster changeout procedure was incorrectly designated as a Category 3 procedure, which does not require in-hand use or verbatim compliance with the steps and sequence. The Y-12 Technical Procedure Process Control procedure and the Y-12 Conduct of Operations Manual require a procedure to be designated as Category 1 if failure to comply in a step-by-step manner could result in a significant health, safety, or environmental risk to the employee or the public. According to these requirements, a Category 1 procedure must be near at hand to the operation, open to the page for the step being performed, performed in a step-by-step manner, and signed off for designated steps. The skull caster crucible changeout procedure contains more than 400 steps and significant hazard to workers, and the activity had not been performed for over six years.

The skull caster furnace operating procedure and the crucible changeout procedure did not contain adequate provisions for abnormal conditions. The documents did not define the response required for an NaK spill in the furnace, even though this guidance is available in the NaK Training Manual. The emergency response to a rupture of NaK piping is to shut down the pump and open the NaK sump dump valve to drain the NaK in the system to the sump tank. The training manual states that Met-L-X should be used to cover the NaK completely, with special care being taken to add the powder carefully to prevent splashing or splattering the NaK. As soon as possible, the residual NaK should be shoveled into a steel container equipped with a lid and containing some Met-L-X powder. The NaK spill section of the crucible changeout procedure does not address the operation of the dump valve or the use of Met-L-X, but rather permits the placement of spilled NaK into stainless steel drums of mineral oil. If the emergency response for the NaK spill on December 1, 1999, had included opening the dump valve, less NaK would have spilled. The lack of an adequate spill procedure resulted in delays in the recovery, hardening of the crust, and possible additional oxidation, and the need to develop a "plan" to clean up the spill. The use of Met-L-X rather than mineral oil would have eliminated the potential for explosion.

Since the plan development did not follow the formal process for a procedure, the plan was not subjected to the technical procedure development and approval process or the work package process required for maintenance work activities. There was no formal hazard identification planning or job hazard analysis, subject matter expert and discipline review was limited to informal reviews within the recovery team, and there was no formal verification and validation of the plan. In order to deviate from the procedure development requirements, the Procedure Configuration Control Board (PCCB) would have to approve a waiver/exemption. The PCCB did not approve any exemptions to site requirements and in fact were unaware of the plan. While the plan was reviewed and approved by individuals involved in its development, it was not subjected to an independent management or technical review and did not receive the required independent verification for a hazardous technical maintenance operation.

Procedure Use and Compliance

While workers were draining NaK from the skull caster furnace crucible on December 1, 1999, errors in procedure use led directly to the spill in the furnace. Since the procedure was designated Category 3 (not requiring step-by-step completion), the operating crew believed that it was not necessary to stop the process when they encountered errors in the procedure. Instead, they marked up a copy of the procedure for future reference, improvised the next activity, and continued performing the evolution. This is in direct conflict with 10 CFR 830.120, Quality Assurance Requirements, and the Y-12 Conduct of Operations Manual chapter on procedural use. 10 CFR 830.120(c)(i) states: “work shall be performed to established standards and administrative controls using approved instructions, procedures, or other appropriate means.” The Y-12 Plant Conduct of Operations Manual states: “During use, procedures shall not be altered, changed, or revised without a proper review and approval.” In addition, the 1988 final safety analysis report (which was never formally approved by DOE) for the 9201-5 skull caster furnace assumed rigorous procedure compliance as part of the analysis, stating: “Operating procedures shall be current and shall be followed by operating personnel.” Although the workers discovered many procedural errors from the start of the evolution, they did not stop working until the NaK spilled in the furnace. Exhibit #9 shows a page from the procedure that was being used at the time of the crucible changeout, including markups. As shown in that exhibit, significant changes in important steps (such as step 29, which requires measurement of the sump level) were made during the work activity. Table 3 identifies errors in the crucible changeout procedure.

Exhibit #9. Crucible Changeout Procedure Page Showing Markups

Table 3. Crucible Changeout Procedure Errors

Other Conduct of Operations Deficiencies

Other deficiencies in conduct of operations also contributed to the accident. For example, the operation that directly caused the spill was the removal of the argon hose without closing drain valve NAK/S-HV-0120 at the crucible. The verbal instructions from the operations supervisor were miscommunicated to the pipefitter responsible for removing the argon hose. DOE Order 5480.19 states: “Instructions involving the operation of equipment should be repeated by the receiver to the extent necessary for the sender to ensure the instructions are correctly understood.” In accordance with the Y-12 Site Verbal Communication procedure (Y10-145), this process of repeating back instructions should be used for important operational steps to ensure that the message is understood. During crucible draining, this process was not used effectively. Consequently, verbal directions to close the isolation valve before removing the argon hose were not effectively communicated.

• Miscommunication between the operations manager and the maintenance pipefitter was an important factor in the argon hose being removed before the isolation valve was closed, which led to the spill.

• Maintenance supervision was minimal because management assumed that the maintenance personnel were under the direction of operations.

• The maintenance department prepared a work package for crucible changeout that duplicated and paralleled the crucible changeout procedure, including the serious omissions and errors in the procedure.

• Maintenance personnel stated in interviews that they were following parts of the operational procedure, not the prepared work package.

• Maintenance supervision did not ensure that the maintenance work package prepared for the activity was “in hand” and being used effectively.

• Additionally, the step-by-step maintenance work package with a sign-off for each step was not appropriately used during the work. Though numerous steps had been completed before the accident, no steps were signed off on the job-site copy.

• The planning for the maintenance work package did not include adequate walkdowns to identify errors in the work package.

If maintenance workers had followed the work package as required, they might have stopped work when the steps could not be implemented as written.

Overall, in the area of conduct of operations, the Y-12 Plant has not successfully transitioned from an expert-based approach to an institutionalized and rigorous process for identifying, analyzing, and controlling hazards. Unless the process focuses the participant to base decisions on technical basis documents rather than solely on individual expertise, the current approach will continue to impede implementation of integrated safety management, limit management control, and contribute to events and accidents.

3.3    Worker Safety and Health

Deficiencies in worker safety and health programs either contributed to the NaK spill on December 1, 1999, and the subsequent accident on December 8, 1999, or exacerbated the consequences of these events. Areas of concern are hazard communication, job hazard analysis, safety and health procedures and permits, and PPE.

Hazard Communication

Hazard communication training on NaK was not provided for some workers in accordance with the requirements of 29 CFR 1910.1200 (h) and LMES Procedure Y73-208INS. For example, at a minimum, the OSHA Standard requires employee training on hazardous chemicals in the work area to include methods for chemical detection, physical and health hazards, and measures to be taken to protect workers from these hazards. Due to the NaK hazards, work activities on or near the skull caster furnace require both Hazard Communication Level I training and the appropriate work area (job-specific) hazard communication training for employees who could be exposed. Some of the safety staff (RCTs and Industrial Safety) involved with the December 1 crucible changeout or the December 8 recovery plan had not received Hazard Communication Level I training.

The pre-job briefing for the recovery activities was conducted informally before the work began and consisted primarily of assigning tasks to the operators. Because the recovery team met several times before then, the workers thought they understood the hazards and believed that a detailed pre-job briefing was not necessary. Many of the participants might therefore not have fully understand the hazards associated with NaK, including the basic information from the NaK Training Manual and the NaK MSDS.

Job Hazard Analysis

An initial job screening and a JHA were conducted in preparation for the crucible changeout on December 1, 1999. However, the JHA did not provide enough detail to adequately correlate job steps with hazards and controls. For example, many steps and a variety of hazards and controls are involved in "performing work inside skull caster furnace chamber," although the JHA addresses these activities in one job step. LMES Procedure Y73-043 cautions JHA preparers to avoid such generalities. Some stated job steps, such as "exposure to NaK," are not job steps; they are hazards associated with specific, but undefined, work steps. Since the job steps are not clearly delineated in the JHA, the hazards and controls for those steps are not defined. Some hazards that are identified in other technical references are not identified in the JHA, such as the potential for fire, explosions, and formation of NaK superoxides. Further, the JHA process did not include fire protection engineering, even though the dominant hazard was a pyrophoric material. The Board believes that including Y-12 Plant fire protection engineering in the planning process could have alerted the JHA team to the fire and explosion hazards of NaK, and the need for flame-retardant clothing and other controls.

For the recovery plan on December 8, 1999, the facility work planners did not perform an initial job screening and hazard identification screening as required by LMES Procedure Y15-012, nor did they perform a JHA as required by LMES Procedures Y15-012 and Y73-043.

Safety and Health Procedures and Permits

Several safety permits were identified for the December 1 and 8 work activities to address radiological hazards, asbestos, and energized equipment. However, no permits were issued for the dominant hazard, which was the NaK. LMES Procedure 70-525 requires an Operations Safety Work Permit (OSWP) if the work presents “a condition of extraordinary or unusual liability to accident occurrence, which could result in serious injury, illness or property damage.” According to the procedure, “work with toxic or corrosive materials” is an example of when an OSWP should be used. In fact, since working with NaK should require a Type I OSWP, an additional, formal health and safety evaluation would have been required for both crucible changeout and NaK recovery. This type of formal recognition and review of the NaK hazards might have alerted work planners to the full range of hazards.

Personal Protective Equipment

Exhibit #10. Comparison of Personal Protective Equipment

Some PPE requirements in the RWPs were also in conflict with the PPE requirements in the recovery plan. For example, the recovery plan requires personnel on the platform to wear a cloth hood, while the RWP for this task indicated “cloth with no hood.” Some PPE was not sufficient for the application. As an example, long-sleeved chrome leather gloves were required only for two of the steps in the recovery plan; most steps required standard work gloves. Burned gloves with the seams blown out found at the accident scene were standard-issue, short gloves made of leather, cloth, and latex. The failure to prescribe flame-retardant clothing or ensure the use of chrome leather work gloves for all work activities contributed to the magnitude of the injuries incurred (see Exhibit #11).

Exhibit #11. Comparison of Recommended Chrome Gloves to Regular Gloves Worn During the Accident

PPE selection was based on a hazard analysis that was incomplete (for the crucible changeout) or not documented (for the recovery plan). Both 29 CFR 1910.132 and SH 116PD, “Personal Protective Equipment Program,” require a documented and certified hazard assessment, such as a JHA or an operating procedure that identifies the hazards and incorporates the applicable PPE. The recovery plan was not accompanied by a written hazard assessment and does not fully satisfy these requirements. The JHA for crucible changeout does not address either a fire or explosion hazard for work activities inside the skull caster furnace chamber. Therefore, hazard controls, such as PPE, were not identified or evaluated for these events.

The potential interaction of NaK with water, and resultant formation of a sodium hydroxide and potassium hydroxide smoke cloud, was evaluated for PPE considerations. However, the evaluation is incomplete because it did not estimate the sodium hydroxide and potassium hydroxide concentrations and did not provide a technical basis for the use of either a full-face respirator with a P-100 cartridge or an NaK hood with supplied air.

The respiratory protection requirements for operators were inadequate for the concentrations of sodium and/or potassium hydroxides that could have been expected in an accident. Similarly, the failure to define respiratory protection requirements for observers in the vicinity of the furnace was inconsistent with concentrations that could be expected. Information in the facility authorization basis documents could have been used to estimate concentrations in the event of a spill and thus to define PPE requirements for workers and observers. However, the facility authorization basis document was not adequately used in the preparation of the JHA or in the specification of PPE. For example, the authorization basis document for the Arc Melt Facility, the “Phase I Hazard Screening Analysis for the 9201-5 Arc Melt Operations,” estimates concentrations of sodium hydroxide resulting from a spill of 30 gallons of NaK. An extrapolation from this analysis indicates that a spill of three gallons (comparable to the spill on December 1) would have resulted in sodium hydroxide concentrations in excess of Immediately Dangerous to Life or Health (IDLH) values, and in excess of American Conference of Governmental Industrial Hygienists (ACGIH) ceiling concentrations for sodium hydroxide within 15 feet of the furnace. If the airborne release fraction of sodium or potassium was greater than one percent, as assumed in the hazard screening analysis, then the sodium hydroxide and potassium hydroxide concentrations would have been greater. The Sodium-NaK Engineering Handbook indicates that the release fractions could be as high as 20 to 60 percent.

The respirator protection in use at the time of the spill and the explosion did not comply with site procedures or MSDS recommendations. Procedure Y73-050PD states that an air-purifying respirator cannot be used if IDLH conditions are likely to exist. Further, the NaK MSDS recommends a National Institute for Occupational Safety and Health (NIOSH)-approved self-contained breathing apparatus (SCBA), and not an air purifying respirator "when inhalation of fumes or smoke is possible."

    Exhibit #12. NaK Locker Showing the Lack of NaK Suits

NaK suits were not staged at the furnace for the spill recovery on December 8 for either planned work evolutions or response to abnormal events (see Table 4 and Exhibit #12). Section 9 of the recovery plan requires an NaK suit for cleaning the furnace walls and floor. For abnormal response actions, Section 2 of the recovery plan refers to the abnormal response action of the crucible changeout procedure (Section 4.8), which requires the use of an NaK suit for both NaK spills and external NaK oxidation events, either of which could have occurred in removing the spilled NaK from the furnace.

Table 4. NaK Suits Unavailable for the Recovery Plan on December 8th

Radiological Control personnel informed the team that on November 12, 1999, they had performed radiological contamination surveys on the NaK suits located in the skull caster area safety equipment locker. Fixed contamination was identified on the interior of the NaK suits but no removable contamination was found, as documented on the survey. Radiological Control personnel moved the suits to the Boundary Control Station where they were at the time of the accident.

Workplace Radiological Controls

A much more structured and effective process is needed to ensure that the appropriate PPE for all potential hazards related to work activities is identified, provided, and properly used to protect worker safety and health.

3.4     Training 

The OSHA Hazard Communications Standard, 29 CFR 1910.1200, requires employers to train workers on chemical hazards in the workplace. LMES has established sitewide requirements specifying that training related to hazardous materials be provided to the workforce. For example, LMES General Employee Training (Module 50018507,Section II. E. Safety and Health) establishes training requirements related to potentially hazardous chemicals in the workplace.

Weaknesses exist in many of the important Y-12 Plant training documents as they relate to the use of NaK. Some training documents do not specifically address NaK. Where NaK is addressed, information about superoxides is absent or inadequate to ensure that personnel can recognize the presence of superoxides or how to control their hazards. The following training documents do not provide adequate information to ensure that Y-12 Plant personnel fully understand the potential hazards associated with NaK:

• The NaK Training Manual for Personnel Operating the NaK System for the 9201-5 Skull Caster (1988) does not discuss the formation of superoxides, the characteristics/appearance of superoxides, the potential for unstable conditions associated with shock-sensitive superoxides, or the hazards associated with chemical incompatibilities with acids, halogens, and hydrocarbons (including mineral oil). The manual does not provide information to aid operating personnel in recognizing superoxides.

• Section IV. C., First Aid, of the NaK Training Manual indicates that if NaK contacts skin, “All visible NaK should be brushed from the skin with a dry cloth and the skin should be washed thoroughly with water, followed by a sponging with 3% acetic acid to neutralize any residual caustic.” Current first-aid standards no longer recommend acid washes for treatment of caustic exposures, and the 3% acetic acid has been removed from the safety equipment lockers.

• The lesson plan for pyrophoric metals and pyrophoric non-metallic solids (approved 7/15/97), which is used to train fire fighters, discusses the fire hazards associated with NaK alloys and specifically recognizes that “potassium in NaK will react with atmospheric oxygen to form three different oxides. These oxides form a crust over the NaK surface. If the crust is permeated and the superoxide is allowed to mix with the potassium in the NaK then a very high temperature thermite reaction can occur.” Although this document specifically mentions superoxides, it does not address explosion hazards associated with superoxides in contact with acids, halogens, or organics, such as mineral oil.

• Work area (job-specific) hazard communication training has not been developed or provided to DUO workers.

The Y-12 Plant relies on on-the-job training (OJT) for some aspects of training, in accordance with Y-12 procedures (Y90-027, Conduct of Training procedure). Training records confirm that OJT is provided to chemical operators on some subjects, but none of the recent OJT addressed NaK. Some Y-12 Plant personnel indicated that DUO supervisors use the NaK Training Manual to conduct OJT for chemical operators and other facility personnel. However, personnel involved with the accident and a review of training records did not indicate that training was provided on this manual. Several of the personnel involved in the accident stated that they never were given a copy of the manual. Even if provided, OJT based on this manual would not adequately address the superoxide/oil hazards, since the manual has not been updated for more than ten years and does not adequately address these hazards.

Overall, the formal training and OJT provided to the facility personnel are not adequate to ensure that personnel who operate NaK systems are aware of safe handling practices and NaK hazards. DUO facility personnel are given little or no specific training on the hazards associated with the combination of superoxides and mineral oil. In the absence of training, facility personnel have relied on information passed on from other workers or supervisors without an adequate basis. For example, the personnel who were interviewed stated that it was common knowledge that mineral oil was the first thing to put on NaK to stabilize it or to make it safe, including extinguishing NaK fires. This erroneous information has been passed down from operator to operator since the installation of the NaK systems and has never been corrected by training or lessons-learned programs.

To be effective in protecting worker safety and health, information related to significant hazards and their controls must be institutionalized into training materials, including tests and lesson plans. Y-12 Plant processes have not been effective in ensuring that readily available information on the superoxide hazard was captured, incorporated, or taught in a timely manner. Effective training could have helped to identify the hazard and prevent the accident.

3.5    Emergency Response

Although the individual response actions were commendable, deficiencies in emergency planning and facility design could have aggravated conditions and increased the severity of the accident and injuries. For example:

• Workers did not have recent fire fighting or refresher training with special training on liquid metal reactions and fires.

• An operator stated that because they could not find temporary berming for the safety shower, one operator was diverted from responding to the accident, and the lack of berming created a slip hazard for other workers involved (see Exhibit #13). Preplanning for emergencies should utilize engineered controls such as permanent berming rather than administrative controls. Pooling of water caused a worker to slip and fall twice while carrying the most seriously injured person.

• Emergency equipment, such as NaK suits, had been moved from a normal storage location prior to the work.

• Fire detection alarms for the high bay had been deactivated; therefore, no alarms were received during the explosion, although significant smoke was generated. The 911 call was the only notification of the accident. Although the 911 call was timely in this accident, the lack of fire alarms could have delayed the response and treatment in other circumstances (e.g., if all personnel were incapacitated by the blast or fumes).

    Exhibit #13. Safety Shower Showing Lack of Berms and Burned Clothing

The emergency management critique conducted by facility personnel solicited and collected feedback from field responders, participants, fire department, TSC staff, and other critique attendees. Logs and documentation were also reviewed as part of the Y-12 Plant critique. The critique identified the following concerns for further review and evaluation:

• Three initial emergency responders did not use SCBAs during the initial entry into Building 9201-5 based on a report of no fire and information that building personnel were seriously injured, requiring time-urgent response. The expected response is to initially respond in SCBAs, and there was concern about using the protocol for this and other emergencies.

• Access controls were not adequate to prevent unauthorized personnel from re-entering 9201-5 West, an area designated as part of the accident scene that had been evacuated.

• Although the Emergency Operations Center (EOC) was not required to be activated for this emergency, activating the EOC would have facilitated interface with state and local governments and DOE. Systems and staffing in theY-12 TSC were not available to accomplish all required offsite interfaces.

• Incident command strategic goals and tactical objectives were not clear, given the lack of use of procedures, checklists, drawings, and other resources at the command post.

• The Y-12 TSC was overstaffed, creating a crowded work environment, because most of the TSC staff did not interact properly with the automated paging system.

• Although the automated paging system had no failures, the Y-12 Site Office indicated that several of their staff should have been paged. However, the emergency response duty roster provided by the Oak Ridge Operations Center did not identify these additional notifications.

• Internal and external organization relationships for emergency public information were not clearly understood.

• There were minor telephone problems in the Y-12 TSC.

• Logistical problems were encountered with video camera support of reentry operations.

• Not all TSC staff used the TSC checklists.

• Internal communications within Y-12 were not timely.

The Radiological Control department conducted an additional critique specifically for its personnel on December 14, 1999, to determine how to improve emergency response. The critique, attended by about 25 personnel, included all key responders to the accident. It was detailed, introspective, and focused on identifying areas for improvement. While radiological response to the accident was timely and appropriate, the critique identified needed improvements in several areas, including pre-staging of equipment, transport of equipment to the hospital, availability of equipment at the assembly areas, radio discipline, support to the incident commander, and shift turnover. Because of the number of personnel involved in the emergency, responding RCTs had to gather equipment from a variety of sources. The critique noted that pre-staging equipment in a few central locations would further facilitate emergency response.

3.6    Facility Design and Configuration

Other facility design deficiencies could have increased the severity of the accident. Because of the significant reaction of NaK with water, postings on the skull melt furnace required the exclusion of water from the furnace area. For some equipment, such as the cooling water system adjacent to the furnace, raised berms prevented water migration toward the furnace area. However, other potential entry points for water were not considered:

• The safety shower near the furnace does not have permanent berming. Consequently, during the accident, water from the shower pooled and ran under the furnace, where it interacted with NaK from the explosion. Pooling of water on the floor also caused the person carrying the most severely injured person to fall twice while assisting him. An operator stated that at one time there were temporary berms for the safety shower; however, they could not be located and were not put in place during the accident.

• Part of the room adjacent to the high bay containing the furnace has fire protection sprinklers, and there are no berms to prevent water from the sprinklers from migrating south toward the furnace.

• Roof vents located directly above the furnace could activate, allowing rainwater to fall directly on the furnace. These vents activated during the accident (see Exhibit #14). Rainwater could therefore have entered the furnace during the time it took to close the furnace.

    Exhibit #14. Open Roof Vents

The roof vents did not open during the spill, which produced a significant amount of smoke. Therefore, Operations contacted the fire department to investigate the vents. The investigation revealed that the smoke detectors were about 10 feet over the floor by the saw and oven, and were too low to detect smoke from or over the skull caster furnace. Operations personnel stated that during the accident, a large amount of smoke was in the area of the industrial saw, yet the detectors did not cause an alarm. Fire protection engineering indicated that the detector for the saw was not installed with a collector (an umbrella-type plate) above the detector to concentrate the smoke to improve detection capability. The fire alarm operated satisfactorily during testing after the accident. Fire protection engineering and the fire department have implemented compensatory measures in the form of a fire watch at four-hour intervals, and they are evaluating options for permanent action.

3.7 Integrated Safety Management Systems

To ensure that management systems were examined as potential contributing and root causes of the accident, the Board reviewed the role of LMES management in promoting and implementing integrated safety management (ISM). The Board also reviewed management's role in the Y-12 Plant ISM program in selected areas, including the role of the DUO Operational Safety Board (OSB) in preparing for the work activities, quality assurance, lessons learned, communication of hazards, and management involvement in safety.

The ISM system provides a formal, organized process for planning, performing, assessing, and improving the safe conduct of work. Properly implemented, ISM is a "standards-based approach to safety" requiring rigor and formality in the identification, analysis, and control of hazards. Safety management requirements are institutionalized through DOE directives and contracts to establish a safe work environment. The system establishes a hierarchy of components to facilitate the orderly development and implementation of safety management throughout the DOE complex. The guiding principles and core functions of ISM are the primary focus for contractors in conducting work efficiently and in a manner that ensures the protection of workers, the public, and the environment. The accident investigation program requires that accidents be evaluated in terms of ISM to foster continued improvement in safety and to prevent additional accidents.

The ISM program at the Y-12 Plant has been contractually required since 1998. LMES's ISM system requirements were established through procedures in 1997 and 1998. The procedures establish a protocol for implementing ISM at the facility and activity level. At the facility level, implementation of ISM is intended to provide the operations line managers with the technical resources and processes necessary to fulfill their ISM responsibilities for managing their safety envelope. The facility relies on establishing OSBs and assigning key technical resources to these boards for ensuring that work is safely planned. Work planning is conducted using a multi-disciplined team that forms the OSB so that potential hazards are identified and analyzed and controls are integrated and put in place to protect the worker, the public, and the environment.

To determine where improvements were needed, LMES management conducted a self-assessment in 1997 to evaluate the programs that implement ISM functions at each level. The self-assessment incorporated the results of the 1997 Type A accident investigation of a welder fatality at K-25; Defense Nuclear Facilities Safety Board technical reports; and other information related to ISM. Opportunities for improvement from this LMES self-assessment included:

• The need to formalize requirements for job walk-downs to ensure appropriate line, technical, and environment, safety, and health (ES&H) support involvement in hazard identification

• The need to consistently apply one job hazard analysis process across the site

• The need to formally include non-nuclear hazard identification and analysis in planning for operational work

• The need to improve the control of routine work and the processes for determining the grade of the task being evaluated

• The need to provide line managers with the tools and ES&H support resources to execute their safety responsibilities.

DUO is attempting to implement ISM. The charter for the DUO OSB defines the roles and responsibilities of OSB members, and the use of multi-disciplinary teams is encouraged. An OSB was used for developing both the changeout procedure and the NaK recovery plan. Time was taken to plan for recovery of the spilled NaK using multi-disciplined teams. At the request of DUO management, an experienced industrial hygienist and a safety specialist participated on these teams.

Notwithstanding these DUO efforts, this accident highlighted deficiencies in work planning and control that contributed to both the NaK spill and the subsequent explosion. The deficiencies were evident in work definition, planning, hazard identification, hazard analysis, developing adequate controls, and work performance—both leading up to the NaK spill on December 1, 1999, and in the work activities associated with NaK recovery that resulted in the accident. A number of controls for ensuring safe work conduct were bypassed, and numerous procedure violations occurred at all levels of the Y-12 organization. The weaknesses spanned multiple organizations and demonstrated inadequate management commitment and implementation of ISM. Table 5 summarizes deficiencies in the application of the five core functions of ISM as they relate to this accident.

Table 5. Deficiencies in the Application of the Core Functions of Integrated Safety Management

Workers, supervisors, and managers at the facility level abandoned the ISM approach and reverted to an "expert-based approach," relying on individual expertise and informal practices in implementing the changeout procedure on December 1. Further, there was a tendency to assume that the group had adequate knowledge of NaK and not to seek outside information or expertise (e.g., from MSDSs, NaK manuals, and vendors), even when unusual and unexpected conditions were encountered. This complacency about the adequacy of knowledge within the group led to a false sense of security regarding the hazards. The facility personnel then proceeded to develop the recovery plan without due consideration of the Y-12 Plant requirements for rigorous planning, thorough hazard identification, documented hazard analysis, and formal procedural controls for hazardous work. The reliance on an expert-based approach indicates that the work planning processes envisioned by ISM are not yet fully understood and accepted by the workforce and are not being promoted and enforced by senior management.

Although some positive steps have been taken, LMES management has not effectively implemented ISM or effectively carried out its guiding principles. Table 6 presents significant weaknesses and failures in the implementation of each of the seven guiding principles of ISM. In addition, the accident investigation board determined that the improvement areas identified in the LMES self-assessment have not been adequately addressed, as evidenced by the fact that the weaknesses highlighted in this accident are similar to those that LMES identified in 1997.

Table 6. Weaknesses in Implementing the Guiding Principles of Integrated Safety Management

LMES had opportunities to apply the principles of ISM in every phase of the activity, from crucible changeout through spill cleanup. These opportunities, presented in Table 7, further demonstrate how this accident could have been prevented if ISM had been properly applied.

Table 7. Opportunities Existed to Apply ISM Principles

DUO Operational Safety Board

The DUO organization convened the OSB for the crucible changeout procedure. The roles and responsibilities of OSB members for this activity are defined in "Operational Safety Board Charter, Depleted Uranium Operations," dated March 1998. Members are responsible for ensuring that work and safety planning are integral functions and activities are properly scoped; hazards are identified and analyzed; hazard controls are properly developed, integrated, and implemented; and work is performed as required by controls.

More specific member responsibilities are detailed in the Charter for the DUO Organization Manager and Operations Manager, as well as for technical support members. These responsibilities include authorizing activities based on screenings and reviews; ensuring that personnel are trained to perform their assigned work; ensuring that hazards are identified and adequate controls are in place during the execution of work; verifying and validating technical procedures for operational activities; and incorporating controls into the work steps of these procedures. However, there were significant deficiencies in implementing these roles and responsibilities for the crucible changeout procedure and the NaK recovery plan. For example:

• The OSB did not effectively implement the roles and responsibilities defined by their organizational charter.

• Members of the OSB did not seek additional technical advice or information on these hazards from readily available sources or lessons learned from other NaK-related accidents, but relied on past practice and group knowledge.

• The OSB failed to ensure that operating personnel who perform work at the arc melter were adequately trained on NaK safety procedures; the hazards of NaK, superoxides, and mineral oil; MSDSs; and NaK fire fighting methods.

• Effective hazard controls were not established for the work involved. Personnel were not provided the proper PPE. Proper safe distances from the NaK recovery operation were not determined, and proper fire extinguishing material (Met-L-X) was not used.

• The OSB permitted hazardous work (NaK spill recovery) to be conducted utilizing a plan, which was an unauthorized mechanism. The plan was deficient and directed workers to perform operations (i.e., spraying mineral oil) that were unsafe and contrary to MSDS provisions.

The OSB was not effective in implementing many of its roles and responsibilities for crucible changeout and spill recovery, and therefore failed to implement many of the elements of ISM. The OSB did not recognize or take action to correct serious flaws in work planning, hazard identification and control, and work authorization. Overreliance on past practices; failure to seek a technical understanding of the hazards associated with NaK, superoxides, and mineral oil; and lack of rigor by the OSB in discharging its responsibilities resulted in ISM not being adequately applied to the work activities involved in this accident.

Quality Assurance

10 CFR 830.120, "Quality Assurance Requirements," establishes the basic quality assurance requirements for a DOE nuclear facility. DOE Order 414.1A, Quality Assurance, further delineates and invokes those requirements for implementation by DOE contractors. Included in those requirements are training and qualification of personnel to ensure that they can perform their assigned work; performing work in accordance with established technical standards and administrative controls, using approved instructions and procedures; designing items and processes on the basis of sound engineering/scientific principles and standards; managers' assessing their management processes and identifying and correcting problems; and planning and conducting independent assessments to measure the adequacy of work performance and promote improvement. Deficiencies in each of these areas were found during the course of this Type A accident investigation.

The Y-12 Plant Quality Assurance (QA) organization does not perform activities within DUO on a regular basis, and there are few criteria that would trigger involvement by the QA organization. The QA program relies on each line organization to integrate quality into its activities and processes. The Y-12 QA organization provides services to other Y-12 organizations "as requested," and QA services must be funded by the requesting line organization. This approach to funding can be a disincentive to using the quality organization for an independent review, particularly when funding is limited or reduced.

The level of QA involvement within DUO was limited over the past few years and did not identify numerous weaknesses in the areas that QA is required to address:

• In the area of personnel training and qualification, numerous deficiencies were found with respect to NaK and hazard communication training, including lack of training on NaK safety procedures and fire fighting methods (see Sections 3.3 and 3.4).

• The Y-12 QA organization and the DUO QA point of contact were not asked to review or be involved in the development of the crucible changeout procedure or the NaK recovery plan, nor were they involved in any of the related planning or walkdown activities.

• Neither the QA organization nor any other independent review organization identified the design and configuration control deficiencies (e.g., fire protection, points of water entry) or questioned the technical basis for operations in the absence of the OCI system.

• DUO line management self-assessments did not effectively identify and correct conduct of operations deficiencies in the Arc Melt organization, as evidenced by the large number of weaknesses identified in conduct of operations (see Section 3.2).

• In the past year, the only independent assessments of the DUO organization by the Y-12 QA organization examined conduct of operations. The QA assessment did not ensure that weaknesses were identified and corrected.

• Although the Facility Evaluation Board's annual independent assessments of ISM include DUO, the QA organization is not used effectively to accomplish the objectives in the QA rule, including the conduct of independent assessments to ensure the effectiveness of work and hazard control processes and to achieve continuous improvement in processes and the infrastructure essential to ES&H and ISM.

• At the Y-12 Plant, the line organization has primary responsibility for QA, with assistance as requested and occasional independent assessments by the QA organization. Although institutional procedures are in place, there has not been sufficient internal or independent QA involvement in Building 9201-5, as evidenced by deficiencies in design, training and qualification, and conduct of operations.

Lessons Learned, Communication of Hazards, and Corrective Actions

There have been opportunities for LMES and the Y-12 Site Office (YSO) to investigate, communicate, and apply information on the hazards associated with NaK. The failure to follow up and apply such information indicates the lack of effective communication mechanisms and the ineffective application of lessons learned to ensure that important hazards information, such as the potential for a NaK superoxide explosion, is effectively communicated and followed up by LMES management.

LMES has an established lessons-learned program at Y-12. An August 1999 ISM independent assessment noted that the lessons-learned program was not effectively capturing lessons learned from all sources and transmitting them down to the working level. An LMES corrective action plan, OR-Y12-SME-98-7, identified corrective actions that were implemented and validated. An assessment, IA-Y-89-LL-0014, conducted in October 1999, concluded that the lessons-learned program was adequate.

An effective lessons-learned program is an essential management tool for identifying and communicating important safety information that can be used to prevent accidents and protect workers, the public, and the environment. However, if line management does not review and apply the lessons learned, as necessary, opportunities for improving safety and preventing accidents are lost. Table 8 provides examples in which the Y-12 Plant has not effectively incorporated lessons learned from previous events and accidents. Of particular concern is the failure to apply information from two 1997 events involving the discovery of NaK containers and the subsequent identification, though a hazard screening, of the hazards associated with NaK, superoxides, and organics (e.g., mineral oil). As a result of this screening, the facility safety engineering organization had definitive knowledge of the potential explosion hazard involving superoxides and mineral oil. Although the information was known within the facility safety engineering organization (which also performed the safety analysis for Building 9201-5) since at least 1997, it did not get communicated and applied at Building 9201-5.

Table 8. Lessons Learned

Y-12 Plant management failed to effectively implement corrective actions for previous incidents, events, and accidents that involved selection and use of PPE. The occurrence report an a 1992 incident involving removal of residual NaK from a skull melt crucible and exposure of workers to a vapor cloud noted the need to revise procedures to reflect proper PPE requirements. The applicable operating procedure was revised, yet problems with use of PPE were evident during this accident. Several accidents at other LMES sites in the past few years, including the welder fatality in 1997, involved improper selection and use of PPE. As evidenced by the weaknesses detailed in Section 3.3, there continue to be significant problems in the use of PPE at Building 9201-5.

DUO personnel did not report the December 1, 1999, spill to the PSS as required and did not inform YSO, thereby missing additional opportunities for higher-level management involvement as part of a formal critique. Thresholds for reporting occurrences have not been carried out within DUO in accordance with the LMES Conduct of Operations Manual, Y14-001-INS. Facility personnel indicated that they did not believe the spill to be reportable. However, notification in this case would be required by Y14-192, "Occurrence Notification and Reporting," under four possible categorization criteria: Violation/Inadequate Procedures, 1F-ON(2); Operations, 1H-ON(1); Near Miss Occurrences, 10B-ON(2); and Potential Concerns/Issues, 10C-ON(2). YSO only became aware of the spill as a result of the December 8, 1999, accident even though the YSO Facility Representative had met with the DUO Manager on December 3, 1999, two days after the spill. In addition, the Facility Representative's review of the PSS daily log indicated that the PSS had not been notified of the spill.

The Y-12 Plant has not adequately addressed many of the deficiencies identified during the 1998 Office of Oversight integrated safety management evaluation of the Y-12 Plant. This evaluation did not address Building 9201-5 but reviewed selected non-nuclear facilities. Deficiencies in the DUO organization are similar to those identified by the Office of Oversight, indicating that LMES management's corrective actions to date have not been effective. The 1998 Oversight evaluation concluded that:

• There was no structured process for hazard identification, analysis, and development of controls for non-routine work activities within non-nuclear facilities.

• Training for supervisors and ES&H staff, including industrial hygiene, had not been kept current.

• OSBs had not been effectively implemented, and management needed to apply sufficient attention to ensure that the technical competence needed to safely manage and operate the Y-12 plant is maintained.

• Corrective actions were not consistently identified and implemented, and ES&H reviews identified repeat findings that line organizations had not adequately corrected.

Management Involvement

The involvement of senior LMES management, DUO management, and YSO in safety at Building 9201-5 has been limited. Thus management missed opportunities to prevent the accident by participating in safety-related decisions and questioning the technical basis for lower-tier management decisions. Examples include:

• In accordance with the "Operational Safety Board Charter, Depleted Uranium Operations," the DUO Organization Manager can serve as the OSB Chairman and conduct "expanded/more extensive OSB reviews as required." However, the DUO Manager was not involved with the OSB for the crucible changeout procedure or the NaK recovery plan. Even after the spill, DUO management did not take a more active role. This lack of DUO upper management involvement in the OSB process resulted in a missed opportunity to challenge the conclusions and approach being taken by the OSB.

• On the day of the spill, the DUO assessment coordinator conducted a management review, rather than a formal critique (which would have been required if the spill was reported to DOE), of the NaK spill. One of the actions agreed upon at the review was to develop a plan rather than a Category 1 procedure for the recovery operation. This decision represents another missed opportunity for upper management to challenge the OSB's underlying assumptions: the use of a plan for the spill recovery operation; a more fundamental technical understanding of the behavior of NaK, superoxide formation, and mineral oil; and the continuing reliance on past practices. In agreeing to produce a plan, the OSB violated numerous site requirements associated with the development of technical procedures.

• The DUO organization used an informal USQD process that was not carried out in accordance with Y74-809, "Unreviewed Safety Question Determinations." The decision that a USQD was not required for the NaK spill was made without reference to the USQD Screening Worksheet, which requires approval by the Operations Manager and the USQD Manager. Instead, the decision was made informally and communicated to the individual heading up the NaK recovery team via e-mail. This is yet another missed opportunity for the management review and approval required when the Worksheet is used.

The YSO Facility Representative (FR) conducts walk-throughs and assessments in DUO areas. However, the number of assessments and walk-throughs has been limited due to the large number of facilities covered by the FR, who only spends a few hours a month in Building 9201-5. As a result, the FR relies on informal agreements with the Arc Melt Unit Manager to keep informed of important ongoing activities. The FR was aware of the plans to change out the crucible and knew that a procedure was being developed for that purpose; the Arc Melt Unit Manager was to tell the FR when crucible changeout was to take place. However, the FR was not informed, and yet another opportunity was missed for review of the procedure, this time by the FR.

An alternative arc melt process that does not require the use of NaK has been under way at Y-12 since 1992. This initiative was driven by the Y-12 Site objective to reduce the weapons program footprint and associated costs rather than the elimination of hazards associated with the use of NaK. In the 1992 occurrence report, the lessons learned/corrective actions noted that DUO intended to replace the NaK system with the alternative process, referred to as Vacuum Induction Melt/Vacuum Arc Melt (VIM/VAR). This system was acquired and installed but required significant development effort before it could be used. During the mid-1990s, DUO experienced budget cuts, and the development activity received low priority and made limited progress. The recent restart of a weapons program that required the use of the arc melter made it necessary to use one of the systems. DOE and LMES management decided that the alternative system would take too long to bring to full operation and therefore decided to use the skull caster furnace with the NaK system to meet production requirements. If sufficient funding had been sustained immediately after 1992 incident, the new process could have replaced the process that uses NaK and thus could have served as an organizational control to prevent the accident.

Overall, the results of this accident investigation indicate that management at OR and YSO, senior LMES management, and DUO management above the operation management level did not maintain an adequate awareness of the activities and safety-related incidents under their areas of responsibility. In addition, management at these organizations did not take sufficient action to ensure that effective QA programs were in place, that lessons learned were adequately addressed, and that ISM was effectively implemented at the facility level.

    Conclusions and Judgments of Need

The accident investigation board determined that the direct cause of the explosion and resulting injuries was a disturbance (impact with a steel probe) of an unrecognized and unanalyzed shock-sensitive explosive compound (consisting of potassium superoxide and mineral oil) that was formed when mineral oil was inappropriately sprayed on a previous NaK spill.

As discussed throughout this report, there were 14 causal factors that contributed to the accident. The accident investigation board assessed the circumstances of the accident and the contributing causal factors and identified six root causes, which are included in Table 9. The Board's determination of the root causes used formal analytical techniques, including change analysis, barrier analysis, and events and causal factors analysis. The results of these analytical techniques are summarized in Appendix B.

The overall conclusion of the accident investigation board is that the explosion and subsequent injuries could have been prevented. Although some progress has been made in implementing ISM within the DUO organization, there were failures in management systems and ISM processes within OR and within every level of the LMES management chain. Because of these failures in the management system and ISM processes, there were numerous missed opportunities to prevent the December 1, 1999, spraying of NaK into the furnace and the December 8, 1999, explosion.

The accident investigation board also concluded that significant and prompt senior DOE and LMES management attention is needed to enhance worker protection by improving implementation of ISM and management systems. The Board has identified a set of judgments of need, which are included in Table 9.

Table 9. Root Causes and Judgments of Need

    Board Signatures

    Board Members, Advisors, and Staff

Appendix A
Board Appointment Memorandum

Appendix B
Application of Analysis Methods and Tools

B-1. Causal Factors Analysis

A complete causal factors analysis was performed to evaluate the causal factors of the accident, including the direct cause, root causes, and contributing causes. The analytical techniques that were used were events and causal factors charting and analysis, barrier analysis, and change analysis. The direct cause of the incident is the immediate events or conditions that caused the accident. Root causes are the causal factors that, if corrected, would prevent recurrence of this and similar incidents. Contributing causes are other events and conditions that collectively with other causes increased the likelihood of an accident but individually did not cause the accident.

The direct cause of the explosion and resulting injuries was the disturbance (impact with a steel probe) of an unrecognized and unanalyzed shock-sensitive explosive compound (consisting of potassium superoxide and mineral oil) that was formed when mineral oil was inappropriately sprayed on a previous NaK spill.

Section 3 of the report presents the analysis of the various safety-related processes and systems and identifies the contributing causes of the accident. Root cause analysis of these contributing causes rolls them up to higher-level root causes, which are listed, along with a short discussion of each, in Table B-1. Figure B-1 shows the contributing causes and most-directly-related root causes. Figure B-2 shows an events and causal factors chart for this accident.

B-2. Barrier Analysis

Barrier analysis identifies three types of barriers associated with the accident: (a) administrative barriers, (b) management barriers, and (c) physical barriers. A barrier is defined as anything that is used to control, prevent, or impede process or physical energy flows and that is intended to protect a person or object from hazards. Barriers that either failed or were missing led to the accident. Successful performance by any of these barriers would have prevented or mitigated the severity of the accident. The barriers that failed are summarized in Table B-2.

B-3. Change Analysis

Change analysis identifies changes or differences that might have affected the accident. These were analyzed to determine whether the change or difference might have contributed to the accident. The results of this analysis are shown in Table B-3.

Table B-1. Root Cause Analysis

Figure B-1.  Root and Contributing Causes

Figure B-2.  Events and Causal Factors Chart

Figure B-2.  Events and Causal Factors Chart (Continued)

Figure B-2.  Events and Causal Factors Chart (Continued)

Figure B-2.  Events and Causal Factors Chart (Continued)

Table B-2. Barrier Analysis Summary

Table B-3. Change Analysis