**\[DNFSB LETTERHEAD\]**

October 8, 2004

The Honorable Linton Brooks

Administrator

National Nuclear Security Administration

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

Dear Ambassador Brooks:

Earlier this year, the Defense Nuclear Facilities Safety Board (Board)
investigated a series of activities that preceded a skin contamination
incident at Sandia National Laboratories, New Mexico (SNL-NM). As
documented in the enclosed report, the Board's investigation revealed
multiple failures of the hazard analysis and work control processes. The
general weaknesses suggested by these failures had been previously
identified by independent Department of Energy Integrated Safety
Management reviews at SNL-NM in 1997 and 2003. Their persistence
suggests that past corrective actions may not have been as effective as
desired. Discussions with SNL-NM personnel suggest that the full
implications of the weaknesses observed, particularly the need for
strict formality of operations and adherence to procedures, may need to
be reinforced.

In its report on the skin contamination incident, SNL-NM committed to
develop a corrective action plan by January 2005 that will address the
associated weaknesses. The Board would like to receive a copy of this
plan, and to be briefed on the schedule and actions that will be taken
to ensure that Integrated Safety Management is fully implemented at
SNL-NM.

Sincerely,

***John T. Conway***

***Chairman***

c: Mr. Richard Black

Mr. Richard Englehart

Dr. C. Paul Robinson

Mr. Mark B. Whitaker, Jr.

Enclosure

**DEFENSE NUCLEAR FACILITIES SAFETY BOARD**

**Staff Issue Report**

August 26, 2004

**MEMORANDUM FOR:** J. K. Fortenberry, Technical Director

**COPIES:** Board Members

**FROM:** D. Nichols

**SUBJECT:** Integrated Safety Management at Sandia National
Laboratories

On April 19, 2004, a radiological control technician became contaminated
with fission and activation products at Sandia National Laboratories,
New Mexico (SNL-NM). An initial survey of his right arm showed 850,000
disintegrations per minute (dpm) per 100 cm^2^. SNL-NM personnel
provided a report on this incident to the staff of the Defense Nuclear
Facilities Safety Board (Board) on August 10, 2004. A review of the
events surrounding this incident revealed significant anomalies with
respect to the hazard analysis, approval, and conduct of the activities
that led to the contamination. The weaknesses suggested by these
observations are similar to those previously identified by external
reviews conducted by the Department of Energy (DOE) in 1997 and 2003.
The persistent nature of these weaknesses indicates the need for
additional management attention to the rigor with which operations are
being planned, conducted, and evaluated in SNL-NM's nuclear facilities.

**Background.** The technician became contaminated while working on an
activity designed to produce an initial batch of radioactive reference
samples for the New Brunswick Laboratory (NBL) in support of the
Domestic Nuclear Event Attribution Program. The radioactive component of
these samples was produced by irradiation in the Annular Core Research
Reactor (ACRR) of a 25 milliliter solution supplied by NBL. The NBL
solution contained up to 8.5 milligrams of uranium-235 (U^235^) as an
oxide dissolved in 1 molar nitric acid, together with additional
constituents designed to represent dissolved concrete. These materials
were contained in a glass vial that was designed to permit the release
of any gasses generated during the irradiation.

The production of the reference samples had been preceded by a series of
experiments conducted to establish appropriate parameters for
irradiating the NBL solution. During these preliminary tests, aluminum
wires containing small amounts of U^235^ were immersed in a pure water
bath, as surrogate for the NBL solution, and irradiated in the ACRR.
Parameters were varied to obtain the proper rates of heating and
activation.

Once the appropriate reactor parameters had been determined from these
experiments, a trial run was conducted using a diluted NBL solution to
prove the overall process of irradiation and subsequent processing of
the irradiated solution to form the NBL reference samples. The
Experiment Plans used for this and subsequent irradiations were
apparently developed by revising the initial plan created for the
experiment that had used water instead of the NBL solution. Although the
revisions increased the amount of U^235^ being irradiated and altered
some other aspects of the experimental apparatus, they did not address
the use of nitric acid or the other constituents included in the NBL
sample. Section 8.0, "TOXIC or CORROSIVE MATERIAL DESCRIPTION," of the
Experiment Plan retained the words "None Allowed" that had been used in
the original plan. Similarly, the Unreviewed Safety Question (USQ)
evaluation of the initial experiment was revised to address the increase
in U^235^; however, the revision to the USQ evaluation referenced the
Experiment Plans and did not address the substitution of acid for water
or the other constituents of the NBL sample. As a result, the actual
experiments conducted were not in accord with either their Experiment
Plans or the USQ evaluation used to approve them, at least with respect
to the material being irradiated.

The trial run apparently led to substantial revisions of the
radiological work permit for the process, including an upgrade of the
area classification from a Contamination and Radiation Area to a High
Contamination and High Radiation area. However, the activity hazard
analysis was not revised. The hazard analysis had grossly
mischaracterized the irradiated NBL solution as having only a "very low
activity," so that if it were spilled, it could simply be wiped up. Once
the solution had been irradiated, the actual radiation field at the
surface of the vial was measured at 4 Roentgen/hour.

Following the completion of test runs, the actual NBL solution was
irradiated on April 14, 2004. The solution was irradiated inside a
covered, but not sealed, glass vial. The irradiated vial and its test
stand were removed from the ACRR on April 16, 2004, placed inside a
plastic bag, and left in a shielded cell for the weekend. On Monday,
April 19, 2004, the vial was removed from the irradiation fixture and
placed into a zip-lock bag inside a lead-filled shielding container
(pig). The combination of pig, zip-lock bag, and glass vial did not
provide confinement for any gaseous fission products produced in the
irradiation or for the irradiated material in the event of a drop. The
radiation field at the surface of the pig was 60 milliRoentgen/hour. The
pig was hand-carried through hallways and up a set of open metal stairs
to the radiological laboratory, where it was placed in a fume hood.
There appears to have been no analysis of the hazards associated with
retrieving the sample from the reactor, or with hand-carrying this
unconfined sample through the facility and to the laboratory. There
appear to be no packaging requirements for transporting samples within
the facility.

The contamination event apparently occurred during the handling of the
material in the laboratory, although the exact mechanism by which the
contamination occurred was never conclusively determined.

Technical Area V personnel prepared a report on the incident. The report
addresses, to varying degrees, issues raised by this incident. Its
treatment of personal protective equipment (PPE) and the actions
associated specifically with the skin contamination event appears to be
adequate. The report identifies a number of issues associated with
activities leading up to the contamination, including the following:

-   Weaknesses in the hazard analysis process, including lack of a
    single integrated hazard analysis for the activity, inaccuracies in
    the hazard analysis, and inadequate communication of hazards among
    personnel responsible for various aspects of the operation.

-   Inconsistencies between the content of the Experiment Plans and the
    experiments that were fielded (although the report describes this
    issue as one of errors in documentation, not as a failure to follow
    the approved Experiment Plan).

-   Poor understanding of the contamination potential of the irradiated
    solution by those personnel involved in the work.

-   Inadequate packaging of the irradiated sample.

-   Inadequate guidance to workers on PPE.

The report identifies 16 specific corrective actions that have been
completed to address these issues. These include (but are not limited
to) performing critiques, revising PPE requirements, disseminating
lessons learned regarding PPE, and issuing guidance regarding
radiological controls. Personnel directly involved with the activity
were counseled "on the need to have a questioning attitude when working
in nuclear facilities and on the need for accuracy and completeness in
experiment planning and hazard analysis". A one-page interim direction
was issued that advised personnel on the importance of grading the need
for secondary containment when transporting radioactive material through
the facility. This interim direction did not establish a requirement for
specific considerations as part of a job hazard analysis, however.

The completed corrective actions also included the production of a new
Quality Management Procedure, a copy of which is included with the
report. The new procedure is two pages long. It is general in nature and
limited in content, making it difficult to see how the new procedure
addresses issues raised by the events that led up to the skin
contamination.

The report includes three outstanding actions. One, due by mid-October,
is to submit a formal recommendation to improve policies and procedures
for the safe movement of radioactive materials. A second, due by the end
of October, is to train personnel on the new Quality Management
Procedure. The third, due by the end of January 2005, is to develop and
implement a plan to improve work planning and activity-level hazard
analysis. In general, this plan is to address in a broader fashion the
specific weaknesses identified in the activities that led up to the skin
contamination event.

**Discussion.** In 1997, DOE's Office of Oversight evaluated the
implementation of Integrated Safety Management (ISM) at SNL-NM. The
evaluation report noted that SNL-NM and DOE line managers had "been
strong advocates for and aggressive in the implementation of integrated
safety management systems at \[SNL-NM\]". However, the report also noted
that "DOE and \[SNL-NM\] management have not adequately ensured that the
policies and goals have filtered down to the operational level and have
been verified to be effective". Specific weaknesses identified included
that "\[SNL-NM\] processes for identifying and analyzing hazards and for
planning and controlling work are not institutionalized and are often
ineffective in controlling hazards". In spite of the observed
weaknesses, the authors of the report were optimistic, stating that DOE
and SNL-NM "are well positioned to build on existing initiatives by
applying the broad array of technical resources and \[SNL-NM's\]
extensive systems engineering expertise to improving the effectiveness
of integrated safety management systems".

That optimism may have been misplaced. The report of a more recent
evaluation, conducted by DOE's Office of Independent Oversight and
Performance Assurance (January--February 2003) described the
implementation of ISM at SNL-NM using phrases very similar to those used
in the 1997 report. Although the authors of the 2003 report stated that
the SNL-NM ISM program "had improved, and most work is performed
safely," they also noted that "work was not always performed in
accordance with established requirements and procedures, and some unsafe
work practices were observed. Increased \[Sandia Site Office (SSO)\] and
\[SNL-NM\] senior management attention is needed to address weaknesses
in several important areas, including processes for analyzing hazards
and identifying controls, feedback and improvement programs, and
implementation of \[Environment, Safety, and Health (ES&H)\] controls".
With respect to ES&H controls, the report stated that SNL-NM "line
management systems for communicating ES&H expectations and monitoring
performance are not effectively implemented and are not providing
sufficient assurance that ES&H expectations are consistently met and
that work activities are performed safely". The report also stated that
"incorrect assumptions in the \[SNL-NM\] primary hazard screening
process have resulted in non-conservative facility/activity hazard
classifications; consequently, the appropriate level of hazards
analysis, review, and approval is not always performed".

Based on the documentation of activities that led up to the skin
contamination event and discussions with site personnel, the safety
issues identified in both of these reviews apparently continue to exist.
The overall process for planning; analyzing hazards; documenting,
approving, and conducting activities; and providing feedback at ACRR
still appears to be inappropriately informal. The Experiment Plans for
the irradiation of the NBL solution did not include the presence of
nitric acid and the other constituents of the sample; in fact,
corrosives were explicitly forbidden by the plans. Instead of
recognizing that the experiments had not been conducted in accordance
with the approved Experiment Plans, however, the report that SNL-NM
provided to the Board treats the omission of these materials from the
plans as documentation errors.

This treatment of deficiencies in the Experiment Plans as documentation
errors suggests that problems exist in the practical understanding of
ISM principles. Adequate conduct of operations, particularly for a
facility having the potential for significant radiological injuries to
workers, requires strict formality of compliance with procedures,
whether the procedures be technical drawings, Experiment Plans, or other
media that prescribe how work is to be performed. A rigorous program of
formal compliance with procedures is a prerequisite for effective and
acceptable administrative hazard controls.

Formal compliance with procedures remains a requirement even when the
nature of the work involves tests and experimentation. A test or
experiment may be notional at its conception but must be evaluated for
hazards, and hazard controls must be established and captured as
appropriate in a procedure. The procedure must then be evaluated under
the USQ program to determine the appropriate approval authority. To
permit adequate USQ review, the procedure and associated documentation
must be sufficiently complete to ensure that the activity is well
bounded and that its impact on the safety basis can be determined.

Once a procedure has been approved, it is essential that it be followed
as written to ensure that the activity remains within the approved
bounds of its operation and within the scope of the hazard analysis. If
changes are made to the activity that affects the procedure followed to
accomplish it, the procedure must be revised accordingly before the
activity is performed. If it is found that the procedure will not
accomplish the objectives of the experiment, the activity should be
stopped until the procedure can be rewritten. Revised procedures must be
reviewed again for new hazards and for the existence of a USQ.

Discussions with site personnel at SNL-NM suggest that the discrepancies
between the experiment plan and the actual activity performed, while
undesirable, are not viewed as significant safety issues or procedural
violations because everyone involved, including the person who reviewed
and approved the USQ paperwork, knew the actual content of the
experiments. Discussions with senior management personnel indicated that
small deviations from the Experiment Plans were considered to be routine
and acceptable.

Such thinking is inconsistent with the strict formality of operations
that are necessary for the safe operation of nuclear facilities.

**Conclusion.** The events associated with this occurrence suggest that
problems previously noted with the implementation of ISM at SNL-NM have
not been completely eliminated. The plan to be prepared by January 2005
may adequately address these problems. However, aggressive oversight by
both SNL-NM and SSO personnel who are fully aware of and committed to
the principles and practical application of ISM will be needed to
adequately achieve the degree of hazard analysis and compliance with
controls that is required for defense nuclear facilities.