DOE/RL-97-59
Revision 0

2.0 FACTS AND ANALYSES

2.1 ACCIDENT DESCRIPTION AND CHRONOLOGY

2.1.1 Background and Accident Description

On May 14, 1997, an autocatalytic chemical reaction caused a chemical explosion in Tank A-109, a ventilated 400-gallon stainless steel tank that was used to prepare a HN and HNO₃ solution. The HN and HNO₃ solution in Tank A-109 had evaporated for nearly four years. The evaporation process, which concentrated the HN and HNO₃, and the potential effect of a catalyst (such as iron) created the conditions that led to an autocatalytic chemical reaction. The autocatalytic chemical reaction resulted in a rapid generation of gas inside Tank A-109.

The gas buildup in Tank A-109 tore the lid from the tank and propelled it, and its attachments, upward with enough force to sever a 1.5-inch fire-suppression water line and to severely damage the ceiling and roof. At some point, the agitator motor broke loose from the tank lid and landed on the floor (see Exhibit 3 ), while the agitator shaft became embedded in the ceiling (see Exhibit 4 ). Tank A-109 was displaced from the scale on which it was set and came to rest at an angle against Tank A-102 (see Exhibit 5 and Exhibit 6). The scale was destroyed (see Exhibit 7 ). The force of Tank A-109 displaced Tank A-102 six inches, but did not appear to have damaged the empty tank. The lid of Tank A-109 was significantly deformed and came to rest on Tank A-109 (see Exhibit 6 and Exhibit 8), and is partially suspended by cables and piping. Additionally, Tank A-109A (the empty and inactive hydrazine tank) was destroyed in the explosion.

The force of the explosion and the impact of the lid against the ceiling created a 2-foot bulge in the roof above Room 40 (see Exhibit 9), an approximately 6-foot-long separation at the roof-wall interface, and a single tear near the bulge. A small crack was observed in the insulation material of a ventilation supply duct on the Facility roof. There was no apparent damage to the exterior walls of the Facility, and no damage to the roof above or the walls adjacent to Room 41.

The explosion also damaged the fire protection system in Room 40, causing the fire-suppression water supply line to spray water throughout the room and to release an estimated 22,400 gallons of fire-suppression water. Until the damaged fire-suppression water line had been isolated, water flowed from Room 40 through halls and stairwells, and some of the water flowed outside the building through exterior doors. Low pressure in the failed fire-suppression supply line activated a fire alarm to the Hanford Fire Department, and emergency response actions were initiated. Water that did not flow outside the building primarily was captured by the building drains, the remaining water either was cleaned up or allowed to evaporate. The water caused damage to systems in Room 40 of the Facility but there was no evidence that the water damaged systems elsewhere in the Facility.

A pressure wave from the explosion caused an over-pressurization of Room 40 of the Facility that resulted in damage to the interior doors leading into Room 40 (see Exhibit 10 ). Corridor 47, directly outside Room 40, also became pressurized, resulting in damage to the non-loadbearing wall between Corridor 47 and Room 41. A surveillance operator, who was preparing to enter the Facility at the time of the explosion, reported that the door he was about to enter at the first-floor stairwell was blown open by the pressure wave. The operator did not notice any unusual odor or fumes. The door was automatically closed soon after when the Facility emergency alarm was activated. The surveillance operator was surveyed twice and no contamination was found. A patrol officer who was stationed at a patrol post on the roof of the PFP also was surveyed and no contamination was found.

When Room 40 was over-pressurized, there was a temporary flow imbalance in the Facility ventilation system, resulting in a positive pressure in Room 40 with respect to the pressure outside the building. This was rapidly corrected as the excess gases were exhausted via the Facility ventilation system. Facility vent and balance staff estimated that a negative pressure was re-established within seconds. Analysis results of samples taken from the ventilation system are found in DOE/RL-97-62.

No one was in, or near, Room 40 at the time of the accident. During the initial stages of the emergency response to this accident, eight construction workers, who were on a break in a trailer outside the Facility, unknowingly passed under the plume path when directed to report to the on-scene Facility emergency center. All eight of the workers were evaluated and released from a local medical center. Later, several other employees who reported symptoms were evaluated. Ongoing occupational health evaluation is being provided as necessary. For further information, see DOE/RL-97-62.

Exhibit 3. Room 40 of the Facility After the May 14, 1997, Event.
Exhibit 4. Ceiling Damage Above Tank A-109.
Exhibit 5. Investigating the Damage in Facility Room 40.
Exhibit 6. Tank A-109 and Separated Lid.
Exhibit 7. Tank A-109 and Damaged Scale.
Exhibit 8. Tank A-109 Lid and Agitator Motor Base.
Exhibit 9. Bulge in Facility Roof Above Room 40.
Exhibit 10. Damage to Interior Doors That Lead to Room 40.

2.1.2 Environmental Considerations

After the lid was blown from the tank, gaseous reaction products were released into Room 40 and nearby corridors and eventually exited through the Facility exhaust system. The gasses were then emitted to the atmosphere through PFP Stack 291-Z-1, which has a high efficiency particulate air filter system and monitoring capability. Laboratory studies conducted after the accident revealed that the airborne releases would likely have consisted of a mixture of gases including nitric acid, nitrous oxide (laughing gas), various oxides of nitrogen, and water vapor. Of these, only the nitric acid and oxides of nitrogen are recognized to pose a potential health hazard. Real-time measurement for concentrations of chemicals released was not possible. Therefore, dispersion modeling was performed to estimate maximum chemical concentrations at ground level. The modeling results indicated that releases from the damaged roof would have generated the highest concentrations of chemicals; these levels were below applicable occupational exposure limits. The investigation concluded that no other chemicals that were in Room 40 at the time of the accident or any other components were involved in the environmental releases.

Based on extensive sampling, surveys, and stack monitoring data, no radioactivity was released from the Facility stack or the damaged area of the roof.

Water from the cut water line flooded the building, and some of it flowed out through various Facility exit doors. Extensive surveys conducted inside and outside of the building revealed radioactive contamination on the first floor of the Facility, and a small area of slightly above background levels of radioactive contamination outside that was that was isolated and immobilized. This contamination was likely the result of water flowing across walls and floors of contaminated areas of the Facility, carrying radioactive material outside. Additional information regarding the evaluation of radiological and chemical releases from the accident may be found in a separate report (DOE/RL-97-62).

Employees who were at PFP at the time of the explosion reported seeing a yellow-brown colored plume streaming from Stack 291-Z-1. A patrol shift lieutenant, who was outside the facility at the time of the explosion, observed a dark yellow to orange plume being released from Stack 291-Z-1 about 10 seconds after the explosion. He stated that it was identical in appearance to emissions he observed from past Plutonium Uranium Extraction (PUREX) facility operations except that this plume had a much thinner ribbon that did not encompass the full width of the stack. The lieutenant observed that the plume was about 50 feet long when he last saw it. It was reported that, about 10 minutes later, the plume was no longer visible.

2.1.3 Chronology of Events

Significant events related to the May 14, 1997, Facility event include the following:

• On September 19, 1968, a makeup procedure violation resulted in the introduction of strong HNO₃ into Tank A-119 in Facility Room 40. Tank A-119, which is similar to Tank A-109, experienced a rapid rise in pressure and blew solution through a dry chemical addition port.
• A 1987 engineering change request describes an early 1970s event in which the 6-inch chemical addition port cover for Tank A-109 was blown off and hit the ceiling. The cause of that event was attributed to a procedure violation where an employee added strong HNO₃ to Tank A-109 to make up a high acid flush instead of using a separate tank as required by procedure.
• At the Savannah River Site in 1972, an autocatalytic chemical reaction resulted in a HN and HNO₃ solution being ejected from a concentrator during solution boiling.
• A second event at the Savannah River Site occurred in 1980 when a solution autocatalytically decomposed when a steam valve failed, concentrating the solution, and resulting in the failure of a piping elbow.
• On December 3, 1989, at the PUREX plant at Hanford, a similar chemical solution was isolated in a pipeline and concentrated over time, eventually resulting in an autocatalytic chemical reaction. The over-pressurization generated by the reaction caused a valve gasket to blow out.
• On December 30, 1996, an event at the Savannah River Site resulted in the ejection of 2,500 pounds of solution from a tank containing HN and HNO₃ because of an autocatalytic chemical reaction.

On September 18, 1970, PFP issued a hazards review for the manufacture of HN. The review identified hazards of an autocatalytic chemical reaction and provided engineering and administrative controls for the operation. Hydroxylamine nitrate was manufactured at PFP during the 1970s, the process was discontinued in the mid-1980s.

During 1992, an operational readiness review was initiated for the restart of the Facility. In August 1992, classroom training for Facility restart was completed and, in September 1992, the training run commenced. On June 17, 1993, as part of the training run, operators completed mixing a batch of HN and HNO₃ solution, which records show as the last batch of chemicals that were added to Tank A-109 before the May 14, 1997, event. The normal batch size was 3,000 pounds, but the initial makeup was completed outside of specification; therefore, more water and nitric acid were required to bring the solution within specification. The laboratory reported the final sample results as 0.2534 M HNO₃ and 0.3542 M HN, which was within specification. The resulting solution in Tank A-109 weighed approximately 3400 pounds (370 gallons). On Friday, June 18, 1993, the Facility was shutdown in accordance with PFP procedure Shutdown Solvent Extraction (WHC-ZO-181-004) under Task B - Weekend Shutdown. This procedure was intended for short-term process shutdown and limited storage of Facility Room 40 make-up chemicals to durations of usually less than two weeks.

An entry made in the Facility process engineers log, dated December 29, 1993, stated that 2,440 pounds of solution remained in Tank A-109. The weight loss indicated that approximately 1,000 pounds of the HN and HNO₃ solution had been used between June 18, 1993, and December 29, 1993; the Board did not find any monthly weight reading records to verify the amount of solution in Tank A-109 during that period. The Board found log entries indicating that the Facility was placed in weekend shutdown four times between June 18, 1993, and December 29, 1993. The log indicates that the Facility was last placed in weekend shutdown on December 10, 1993.

Because of the need for an Environmental Assessment (and eventually an Environmental Impact Statement) prior to restart, PFP line management recommended an interim action plan to RL that would suspend the training run (WHC 1993). The interim action plan was submitted to RL on November 30, 1993, and approved by RL on December 22, 1993. Also, on November 30, 1993, the Facility long-term shutdown procedure was revised. The Board interpreted the issuance of a revised long-term shutdown procedure, on the same date the interim action plan was submitted to RL for approval, as an indication that the long-term shutdown procedure would be implemented at some future point in time.

The earliest recording of tank weight that the Board could find to indicate the volume of solution in Tank A-109 was dated May 23, 1994, which showed 1,535 pounds (184 gallons) of solution remained in Tank A-109. Tank weight data were collected monthly through October 28, 1996. The last weight recording on October 28, 1996, showed that 295 pounds (< 30 gallons) of solution remained in the tank. Although incomplete for every month, the monthly weight recording data that was found by the Board showed a trend of a steady drop in weight (see Figure 3). The procedure that required the recording of monthly tank weight readings did not require trending, and did stipulate that these records were to be kept for only one year. Therefore, the lack of monthly data does not indicate that the recordings were not made, but rather that they were not kept.

Figure 3. Tank A-109 Weight Volume Trend from Available Recorded Weight Readings.

Interviews with Facility line management and operations staff indicate a consistent belief that the solution in Tank A-109 was being stored for future decontamination and decommissioning activities associated with Facility deactivation. The Facility hazardous material inventory coordinator indicated a belief that the solution was being used on a regular basis. Because the solution in Tank A-109 was believed to be used on a regular basis, the coordinator did not question the continuing decrease in the weight of the tank.

The 1994 DOE Chemical Safety and Vulnerability Assessment established a working group to review and identify chemical safety vulnerabilities within the DOE complex. The review focused primarily on evaluating those chemicals that exceeded 25 percent of the Threshold Quantities listed in Appendix A of 29 CFR 1910.119, which did not include solutions of HN and HNO₃. A chemical safety vulnerability self-evaluation checklist was completed by Hanford in March 1994, and a DOE Headquarters field verification team evaluated Hanford in May 1994 to assess the results of the self-evaluation and to identify site-specific vulnerabilities (DOE 1994).

On October 31, 1996, the requirement to collect solution weight readings for Tank A-109 was removed from the surveillance procedures (WHC-96-1296). These weight readings were recorded to support a DOE requirement that is associated with the Emergency Planning and Community Right-to-know Act. In April 1996, PFP Operations requested that PFP Environmental Engineering verify whether the surveillance was still required since only a small quantity of HN and HNO₃ solution remained in Tank A-109. Since stopping the recording of weight readings in Tank A-109 required a change in procedure, an unreviewed safety question screen was performed. The unreviewed safety question screen did not identify any safety concerns and PFP Environmental Engineering deleted the surveillance requirement from the operations surveillance procedure.

On December 30, 1996, the Savannah River Site reported, via the Occurrence Reporting and Processing System, an event that resulted in the ejection of 2,500 pounds of solution from a tank at F canyon. The event was caused by an autocatalytic chemical reaction between HN and HNO₃. The Occurrence Reporting and Processing System summary report was reviewed by the Hanford lessons learned coordinator, but the information did not indicate that an autocatalytic chemical reaction had occurred, and the event was categorized as a tank overflow with no significance to Hanford.

On March 20, 1997, the PFP RL Facility Representative expressed concerns to Facility line management regarding the adequacy of records of chemicals stored in Room 40. Preliminary findings were reported back to the PFP RL Facility Representative on April 14, 1997, by the PFP Solid Waste organization. The preliminary findings stated that in April 1997, 140 pounds of nitric acid were reported in Tank A-109 by the Facility cognizant engineer. Interviews revealed that the Facility cognizant engineer had conducted a walkthrough of Room 40 to follow up on the RL Facility Representatives concern. The Facility cognizant engineer reported the tank contents as nitric acid because he thought the hydroxylamine nitrate in the tank had decomposed into HNO₃.

At 7:53 p.m. on May 14, 1997, an autocatalytic chemical reaction occurred in Tank A-109 resulting in an explosion and damage to the Facility.

A summary events chart and accident chronology (see Figure 4) was developed to identify and understand the significant sequence of events and conditions that preceded the accident.

Figure 4. Summary Events Chart and Accident Chronology.

2.1.4 Emergency Response

For information regarding the emergency and occupational health response to this accident, see DOE/RL-97-62.

2.2 MANAGEMENT SYSTEMS

Safety management systems provide a formal, organized process to plan, perform, assess, and improve safe conduct of work. In the DOE complex, the safety management system is institutionalized through a system of directives and contracts. The integrated safety management system establishes a hierarchy of components to implement the system. The objective of the integrated safety management system states that the DOE and its contractors must systematically integrate safety into management and work practices at all levels so that missions are accomplished while protecting the worker, the public, and the environment.

2.2.1 Safety Authorization Basis

Several Occupational Safety and Health Administration (OSHA) regulations, DOE Orders and guidance, technical standards, and the 1994 DOE Chemical Safety Vulnerability Assessment required hazards analysis of chemicals in process systems and in storage. Although requirements exist for hazards analysis of chemicals in process and in storage, neither the OSHA Process Safety Management Standard (29 Code of Federal Regulations [CFR] 1910.119), applicable DOE Orders and guidance, nor the DOE Chemical Safety Vulnerability Assessment specifically required hazards analysis for HN and dilute HNO₃ solutions.

DOE Order 5480.23, Nuclear Safety Analysis Reports, requires the establishment of the safety authorization basis for facilities to ensure that facilities operate in a safe manner. Part of the process for developing the safety analysis report includes the identification of process hazards, analysis of controls to mitigate the hazards, and evaluation of the consequences of failure of these controls. In September 1995, the current PFP Final Safety Analysis Report (FSAR) was approved by RL, which did not address storage of HN and HNO₃ solution in Tank A-109. The original PFP FSAR was submitted to DOE in 1992; however, DOE Headquarters (DP-45) did not approve the PFP FSAR until January 1995. Because three years had passed since the FSAR was submitted, several changes had occurred at PFP, which required amendment of the FSAR. Under Authority from DOE Headquarters (EM-60), RL approved a revised PFP FSAR in September 1995 that reflected the then current facility operations. The FSAR was written in anticipation of normal Facility operations, which did not include long-term storage of HN and HNO₃ solution in Tank A-109. The potential reaction hazard associated with long-term storage was considered a non-credible event and was not evaluated in the FSAR. The PFP Engineering organization is responsible for developing and maintaining the PFP FSAR. In December 1993, PFP Facility Operations, with RL approval, developed an interim standby plan for PFP, but the plan did not address the cold chemicals in Room 40; these were to be addressed at a later unspecified time.

Because these chemicals were never addressed prior to the explosion, not including them in the interim standby plan became a decision to store the chemicals in Room 40, including the HN and HNO₃ solution in Tank A-109, on a long-term basis. This action was taken without conducting an unreviewed safety question determination. Neither the PFP Facility Operations nor PFP Engineering recognized the potential hazard of an autocatalytic reaction created by concentrating dilute HN and HNO₃ solution through evaporation. A draft revision to the FSAR was prepared and submitted to RL for approval in September 1996, to reflect the shutdown status. This draft revision discusses the storage and potential future use of the Tank A-109 chemicals, but fails to recognize the hazards. Therefore, facility management operated outside the safety authorization basis for the Facility for almost 4 years.

In March 1994, DOE Defense Programs (DP) issued a memorandum, Guidance for Evaluating Safety Concerns Related to Potential Nitrate-Organic Safety Hazards, (DOE-DP 1994), which expanded the Russian reactor Tomsk lessons learned program for facilities with operations involving organic nitrate chemicals, by requesting that each field office complete a self-evaluation of chemical inventories. Although the self-evaluation was focused on organic nitrate chemical hazards, it clearly indicated a need to evaluate other chemicals that react exothermically with nitric acid, including inorganic nitrates. PFP was included in the self-evaluation program and RL submitted information on PFP to DOE-DP on April 28, 1994. Hydroxylamine nitrate was not specifically included in the response to the assessment; however, the Board concluded that the hydroxylamine nitrate met the assessment criteria (as defined in the guidance provided to PFP in March 1994) and should have been included in the response PFP submitted to DOE-DP. The Board concluded that this was a missed opportunity to identify and control the hazards of long-term storage or to drain the tank.

The 1994 DOE Chemical Safety Vulnerability Assessment, identified concerns with the storage of chemicals throughout the DOE complex. PFP performed a self-evaluation and identified over 110,000 pounds of hazardous chemicals for disposition. The HN and dilute HNO₃ solution was not specifically evaluated by PFP. Because solutions of HN and dilute HNO₃ are not listed in Appendix A ( List of Highly Hazardous Chemicals, Toxics, and Reactives) to the OSHA Process Safety Management Standard (29 CFR 1910.119) or DOE Handbook 1100-96, ChemicalProcess Hazards Analysis, which addresses 29 CFR 1910.119 requirements, a hazards analysis was not specifically required. The PFP self-evaluation recognized that chemical make up tanks may contain residual chemicals and stated, All these tanks should be inspected and contents verified. The Board found no evidence that the tanks were ever inspected, or that the contents were ever verified by PFP line management in response to the Chemical Safety Vulnerability Assessment. The Board concluded that this was a missed opportunity to identify and control the hazards of long-term storage or to drain the tank.

The OSHA Hazard Communication Standard (29 CFR 1910.1200) requires chemical manufacturers to provide information to users about the hazards inherent in the use of chemicals they manufacture. This information is provided through material safety data sheets. The material safety data sheets for HN did not indicate a potential for autocatalytic reactions below 100degreesCentigrade in solution with HNO₃. The Board concluded that although the material safety data sheet did not address autocatalytic reactions, this lack of information was not a factor in this event.

During the September 1996 Project Hanford Management Contract Contractor Transition - Pre-Existing Condition survey inspections of PFP, the BWHC Environment, Safety and Health team leader conducted a walk-through inspection of the Facility, Building 236-Z, including Room 40. During the inspection of Room 40, the team leader asked a PFP Safety and Health staff member whether any chemicals remained in the tanks. The staff member stated that the tanks are empty. Interviews with PFP safety and health staff revealed that they were unaware of any chemicals remaining in the tanks in Room 40. The Board considered this to be a missed opportunity to identify and control the hazards of long-term storage or to drain the tank.

2.2.2 Line Management Responsibilities and Authorities

DOE Policy 450.4, Safety Management System Policy directs that line management is accountable for ensuring that facilities under their responsibility are operated in a manner that provides adequate protection to worker safety and health, the public, and the environment.

DOE programmatic management oversight for the Facility is provided by DOE Office of Environmental Management (EM). For RL, the line management oversight for the Facility is from the Manager to the Assistant Manager for Facility Transition, then to the RL Director, Transition Programs Division. The Director also has an RL Program Manager assigned to PFP that has line responsibility for oversight of daily activities of the Facility. Additionally, the RL transition Program Division Director has RL Facility Representatives to assist with daily contractor oversight, as discussed in Section 2.2.3.

Prior to October 1, 1996, the Westinghouse Hanford Company held line management responsibility for the Facility. On October 1, 1996, FDH assumed line management responsibility for the Facility; however, Facility management personnel did not change. BWHC manages and operates the Facility under subcontract to FDH. The PFP Project Director reports directly to the BWHC President and has line management responsibility for PFP, including the Facility.

FDH has responsibility for ensuring subcontractors are adequately preforming work in accordance with their subcontract, including compliance with safety and environmental requirements.

The Board concluded that the DOE and contractor roles were well defined and understood, and were not a factor in this event.

Previous concerns with safety management have been reported to RL line management by the DOE Office of Oversight, which conducted an independent safety management evaluation from January to March 1996. The report indicated that the safety authorization basis for PFP was not being maintained or implemented and deficiencies were not being tracked, trended, or followed up. The report also documented concerns about RL direction and assessment of Hanford contractors, procedure quality and adherence, and near-term safety authorization basis deficiencies.

The Boards analysis of the deficiencies that were identified in the DOE Office of Oversight report and the facts identified during the investigation indicate that several of the generic PFP findings listed above (from the Oversight report) were similar to the specific causal factors of the Facility accident; therefore, the corrective actions taken by line management were not adequate or timely enough to prevent the Facility accident.

2.2.3 Line Management Oversight

The RL Facility Representative program, established by RLID 1300.1.C, provides for DOE line management oversight for ensuring that the facilities are operated by the contractor in a manner that provides adequate protection for worker safety and health, the public and the environment. The RL Director, Site Operations Division (who reports to the Assistant Manager for Facility Transition) has oversight responsibility for the PFP Facility, including the PRF Facility. The RL Site Operations Division Director has assigned two PFP RL Facility Representatives that have responsibility for the oversight of the daily activities at the Facility, as part of the PFP. The PFP RL Facility Representatives are located at PFP and have a functional reporting relationship to RL line management. The RL Facility Representatives are the first line of safety oversight for RL line management , and as such, they are DOE line managements eyes and ears that identify deficiencies for DOE and contractor line management action.

RL line oversight managers were provided detailed information from PFP RL Facility Representatives regarding procedural non-compliance and other safety issues on numerous occasions prior to the Facility accident. Two examples of these identified concerns were included in a report compiled by the PFP RL Facility Representatives in response to a request from the RL line manager in August 1995, and a December 1995, RL Facility Assessment Report (A-95-SOD-PFP-029) on conduct of operations. Both reports identified significant concerns with regard to continuing procedure non-compliance problems that indicated Facility line management was not adequately addressing the root causes.

The Boards analysis of the facts from this investigation indicate deficiencies in resolving the PFP RL Facility Representatives safety concerns. The inability, by RL and the contractor, to correct procedural non-compliance has been an ongoing issue at PFP. As previously mentioned, the DOE Office of Oversight independent safety management evaluation report identified the same concerns with respect to the need for RL to improve accountability for environment, safety and health performance among DOE and contractor managers, staff, and organizations. The Board concluded that RL has not provided adequate oversight of contractor line management to ensure that actions to correct significant deficiencies, as reported to them by the PFP RL Facility Representatives and DOE Office of Oversight, were effectively implemented. This was a contributing cause to the accident.

2.2.4 Contractor Policies and Procedures

DOE Order 5480.19, Conduct of Operations Requirements for DOE Facilities, requires rigorous compliance with, and execution of, procedures. Under this Order, line management is required to develop and implement hazard controls such that applicable standards and requirements are identified and agreed on; controls to prevent/mitigate hazards are identified; the safety envelope is established; and controls are implemented.

Facility Shutdown Planning.

On December 22, 1993, RL issued direction to PFP line management to take the Facility from operational status to interim standby in anticipation of a year-long delay in restart. The Facility Shutdown, Standby, and Transfer procedure (WHC-CM-1-3), specified PFP management requirements for placing facilities in standby. The procedure defines several standby condition categories. The Facility Shutdown, Standby, and Transfer procedure would have designated the Facility as Condition II -- Long-term Standby, which required the following actions:

• Facility manager will prepare a safety evaluation
• PFP Engineering will coordinate technical support to ensure that the shutdown plan meets safety requirements
• Safety will provide written guidance for safe shutdown
• Operations manager will determine whether a readiness review is required to ensure safe shutdown
• Facility management will revise the safety analysis report for facility configuration or mode changes.

The Board investigated the circumstances of the Facility shutdown plan and found that none of these required actions were implemented. The Board concluded that had these requirements been accomplished, the long-term storage hazard should have been identified and controlled.

The Board found that the most important procedural requirements omitted in the Facility shutdown plan involved the Facility line managements failure to prepare a safety evaluation and to appropriately revise the safety authorization basis to reflect the facilitys planned change in status. The Board concluded that these omissions resulted in retaining the facility in an un-analyzed condition and outside the scope of the facilitys authorization basis, and was a root cause for the explosion.

Long-term Shutdown.

In November of 1993, PFP management anticipated the need to shutdown the Facility for a long-term period because of work on an Environmental Impact Statement. On November 30, 1993, PFP line management proposed an interim standby plan for the Facility to RL line management. During this same time, PFP updated the existing Facility Room 40 long-term shutdown procedure (WHC-ZO-120-126), and issued the revised version on November 30, 1993. The long-term shutdown procedure for Room 40 required that Tank A-109 be drained and its contents stored in plastic drums.

In December 1993, RL line management oversight directed PFP line management to shut down the Facility and to put activities on long-term standby. RL line management further cautioned the contractor that care should be taken to ensure that all safety and environmental requirements were met during this transition from operations to long-term standby. However, the PRF shutdown plan that the contractor submitted for RL line management approval did not include performing the long-term shutdown procedure for Room 40 and; therefore, did not specifically address the chemical make-up tanks in Room 40, including Tank A-109. As a result, Tank A-109 was not drained when the standby plan was implemented. The Board concluded that this was a root cause to the explosion.

Unreviewed Safety Questions.

DOE Order 5490.21, Unreviewed Safety Questions, and WHC-CM- 1-5, Identifying and Resolving Unreviewed Safety Questions, require that any time a significant or procedural change occurs in the operation of a facility, an unreviewed safety question evaluation is to be performed to ensure that the safety authorization basis is preserved. The Board found no documented evidence that an unreviewed safety question determination was performed when the decision was made to deviate from standard operating practices (e.g., allowing long-term storage of HN and HNO₃ solution in Tank A-109); and, therefore, the contractor did not maintain the facility within the safety authorization basis. The Board concluded that not performing an unreviewed safety question determination was a missed opportunity to prevent the explosion and was a contributing cause to the accident.

2.2.5 Lessons Learned - Management Feedback and Implementation

DOE Order 232.1, Occurrence Reporting and Processing of Operations Information, requires RL line management oversight and facility line management to implement a lessons learned program that identifies root causes and corrective actions for events to ensure that the underlying reasons for Environment, Safety and Health deficiencies are identified and addressed adequately, and to ensure that the event does not recur. These documents require that applicable lessons learned, from other DOE sites and external parties, are effectively disseminated to management and workers. Finally, inherent in the requirements is the responsibility for RL and contractor line management to ensure that corrective actions identified from lessons learned are effectively implemented.

Hanford Site PUREX 1989 Event.

One of the more significant Hanford events was the 1989 PUREX 2BX autocatalytic reaction of a concentrated HN and HNO₃ (along with hydrazine) solution that had evaporated in a chemical make-up tank during a one-year period when the facility was in a shutdown condition. The HN and HNO₃ solution spontaneously reacted to produce over pressurization of an isolated process line, causing a gasket to fail. In January 1990, the PUREX managing contractor, Westinghouse Hanford Company, issued a letter to Hanford line management and other DOE sites to provide lessons learned and corrective actions to mitigate or prevent the causal factors from being repeated.

Both RL and PFP line management reviewed the lessons learned from the 1989 PUREX 2BX event and the contractor was required to implement corrective actions. The PUREX lessons learned that are applicable to the PRF accident are as follows:

• Facilities should evaluate their processes and procedures to preclude scenarios where over-concentration of reactive chemicals can occur. Evaluations should include scenarios where chemical concentration occurs as a result of evaporation, boil off, chemical make up error, etc. The use of oxidants and reductants should be given special attention, particularly in areas where hydrazine and/or HN are used.
• Facilities should review operational and administrative procedures to require the sampling and evaluation of long-standing chemicals before use. Procedures should address documented technical justification for continued use of out-of-specification chemicals.

The Board found that Facility line management did not implement these corrective actions mentioned above, and as a result, an opportunity was missed to identify and control the hazard, and was determined to be a contributing cause to the accident.

Savannah River Site 1996 Event.

A more recent event occurred at the Savannah River Site on December 28, 1996, which also involved an autocatalytic reaction of an HN and HNO₃ solution. The Savannah River Site issued an occurrence report and, under the lessons learned section, concluded the following:

Combining Hydroxylamine nitrate and strong Nitric acid in high concentrations may result in auto-catalytic decomposition of the HAN [hydroxylamine nitrate], even at relatively low temperatures.

The Hanford lessons learned process for reviewing, selecting, and disseminating information from other events and from sources of information relies on the RL and FDH lessons learned coordinators. The coordinators evaluate various sources for information, including Occurrence Reports, DOE publications, and Listserver messages. Then, applicable lessons learned are issued to points of contact at each facility. The points of contact distribute the lessons learned information to line management and staff within their respective organizations.

After reviewing the December 28, 1996, Savannah River Site Occurrence Summary Report, the FDH coordinator determined that the event was not applicable to Hanford. This determination was based on a review of the first ten lines of the Description of Occurrence section of the report. This section did not contain key words such as autocatalytic chemical reaction or hydroxylamine nitrate and nitric acid solution. The Board concluded that information from the Savannah River Site event could have served to help identify and control the hazard if it had been provided to Facility line management.

U.S. Army Information on HN.

As a result of the PRF event, the Board consulted with several external agencies to analyze information on the potential autocatalytic reaction hazards of HN and HNO₃. A significant source of information was the U.S. Army because of its extensive research and experience with HN and HNO₃ solutions. The U.S. Army had concluded that any concentration of HN and HNO₃ solution in storage was dangerous, given enough time. Although aware of DOEs use of HN and HNO₃ solutions, the Army was unaware of any problems that the Hanford and Savannah River Sites were experiencing until after the May 14, 1997, accident. RL was unaware of the Armys knowledge of the reaction hazard of HN and HNO₃ solutions. The Board concluded that if RL or the contractor had accessed the Armys knowledge of HN and HNO₃ solution, it could have served to help identify and control the hazard.

In summary, the Board concluded that adequate hazard information on the autocatalytic reaction potential of HN and HNO₃ solution was available, some of which had been provided to both RL and the contractor; however, neither RL nor the contractor disseminated this information to the necessary points of contact. Several events that had precursors to the accident were identified, but did not result in the effective identification of hazards or implementation of corrective actions; therefore, lessons learned from previous events were not applied to Facility operations and were not used as a management tool to identify these hazards. Additionally, oversight provided by RL line management did not ensure that the lessons learned program was effectively implemented at PFP.

2.2.6 Training and Qualifications

The education and experience of engineering and management staff was reviewed, and the Board found that all critical positions are filled by personnel with chemical engineering or related scientific degrees, and that they have many years of relevant experience.

DOE Order 5480.20A Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Nuclear Facilities requires a formal training and qualification program for technical staff, and a continuing training program. Maintaining a properly qualified and trained staff is critical to effective work planning and hazard identification at all facilities within the DOE complex. These Orders and procedures establish comprehensive qualification and training requirements applicable to all contractor work at DOE facilities. Additionally, the OSHA Hazard Communication Standard (29 CFR 1910.1200) requires that employers provide information to their workers about the hazardous chemicals to which they may be exposed to through the use of material safety data sheets, labeling, and training.

On September 18, 1970, the Facility contractor issued Hazards Review - Manufacture of Hydroxylamine Nitrate (ARH 1746). The Hazards Review identified the reaction hazards associated with hydroxylamine nitrate and strong nitric acid. An analysis of the facts indicates that reaction hazard information from the Hazards Review neither was communicated to PFP personnel during the training they received in preparation for the 1993 Facility training run campaign, nor at any other time. Several PFP operators and process engineers were aware that the HN and HNO₃ solution in Tank A-109 was evaporating. However, the failure of PFP line management to effectively communicate hazard information to workers contributed to the failure to recognize the reaction hazard.

In February 1997, the RL Office of Training conducted an assessment of the PFP training program for technical staff, including the cognizant engineers training and qualification program. The assessment identified several deficiencies in the training and qualification of technical staff. The assessment found that PFP does not have a systematic, standard, formalized training program for cognizant engineers. Additionally, the assessment found that eight of the 35 cognizant engineers were not qualified per DOE Order 5480.20A requirements. The other significant finding indicated that the PFP cognizant engineers attended only about 20 percent of the continuing training.

The Board concluded the following:

• PFP line management had not given sufficient attention to facility safety awareness and to the establishment of a training system that promotes adequate hazard awareness and recognition.
• PFP Engineering had not maintained an appropriate level of technical competence and knowledge of hazards that relate to the systems under their cognizance.

The Board identified this as a contributing cause to the accident because the necessary competence to identify the hazard was not established in contractor training and qualification programs or other means.

2.2.7 Safety Management Systems Summary and Analysis

In December 1993, RL directed that the Facility be shutdown. Facility line management proposed interim actions to shutdown the Facility that did not include draining the solution that remained in the tank. It is the judgement of the Board that Facility line management inappropriately omitted from the shutdown plan, actions to drain the solution from the tank.

The long-term storage of chemicals in Room 40 was not included in the scope of the safety authorization documentation for operations when the Facility transitioned from operations to shutdown. Therefore, the hazard of storing the solution on a long-term basis was not identified or analyzed. The Board concluded that a properly conducted hazards analysis, performed by experienced engineering and operations personnel, likely would have identified the hazards associated with long-term storage of the solution.

Since the hazard was not identified, controls for mitigating the hazard were not developed or implemented, and long-term chemical storage was conducted without appropriate safety controls.

In the course of this accident investigation, the Board identified a DOE-wide lack of knowledge on chemical concentrations, conditions, catalysts, etc., to ensure safe, long-term storage of chemicals that have an autocatalytic reaction potential. Several previous events, similar to this accident, have occurred at DOE sites and were evaluated during this investigation. The depth of investigation and reporting in each case appears to have been adequate to prevent the exact specific event from recurring, but the overall understanding of the chemistry of these events (i.e., reactive chemicals and catalysts) was not always investigated and reported. The Board found that more detailed technical information is necessary to provide adequate feedback to management. Insufficient technical detail provided in lessons learned from previous events contributed to managements failure to identify the hazard prior to this accident.

Although the legacy for many of the weaknesses that were identified during the investigation belongs to the previous operating contractor, opportunities by the current contractor to correct the problems were also missed. The investigation also confirmed that work still remains to be done to ensure that the benefits of a robust integrated safety management system are reflected in safe work performance.

2.3 LABORATORY ANALYSIS

Analytical support for the Boards investigation was provided by the Plutonium Process Support Laboratory at PFP, and by Fauske and Associates, Inc. Both laboratories experimented with a HN and HNO₃ solution that was similar to the original dilute solution that was mixed in Tank A-109. Each laboratory allowed its test solution to concentrate to the point of becoming unstable. Both laboratories observed reactions at system temperatures that were greater than the ambient temperature in Room 40 of the Facility before the explosion. Tank A-109 had no temperature indication capability; therefore, the temperature of the tanks contents before the explosion is unknown. The laboratories also experimented with the addition of catalysts that were similar to what may have been in Tank A-109. The laboratories observed that the reaction temperature was significantly lower with catalysts.

The Plutonium Process Support Laboratory analysis concluded that: (1) evaporation of water from HN and HNO₃ mixtures resulted in explosive concentrations that yielded heat and gaseous products (e.g., nitrogen, nitrous oxide, oxides of nitrogen, and water vapor); and (2) initiation of the reaction is facilitated by high HNO₃ concentrations, the presence of iron in solution as a catalyst, and elevated temperature (BWHC 1997).

Fauske and Associates, Inc., concluded that: (1) the pressure generated in the tank by this chemical reaction was between 200 to 300 pounds per square inch (psi); (2) concentrated HN (> 8 molar [M]) solutions will decompose at temperatures in excess of 100 degrees Centigrade; (3) highly diluted solutions of HN in the presence of HNO₃ can experience decomposition; and (4) an increase in the ratio of moles of HNO₃ to moles HN will decrease the temperature of decomposition (Fauske 1997).

Support for the mechanical effects of the explosion was provided by the Babcock and Wilcox Alliance Research Center (BWARC 1997). The separation of the lid from Tank A-109 was caused by a build-up of pressure inside Tank A-109 causing 23 stainless steel bolts to fail, and the remaining 5 bolts with nuts to be pulled through the tank lid. The Babcock and Wilcox Alliance Research Center estimated that a pressure build-up of between 150 and 250 psi would be sufficient to cause the type of failure that had occurred in Tank A-109 (BWARC 1997). Also, it was concluded that a pressure wave of between 2 to 3 psi is consistent with the extent of the damage to the interior doors leading into Room 40 (see Appendix D).

2.4 BARRIER ANALYSES

Barriers are used to control, prevent, or impede process or physical energy flows and which are intended to protect against hazards. The barrier analysis conducted by the Board addressed three types of barriers associated with the accident: administrative, management, and physical. These barriers either failed or were missing. Successful performance by any of these barriers would have prevented or mitigated the accident. The barriers that failed are summarized in Figure 5. Appendix B provides further details of the analysis of the performance of barriers. Energy from the autocatalytic reaction caused Tank A-109 to explode. Conventional logic indicates that the tank, ventilation system, and building structure would be physical containment barriers for the HN and HNO₃ solution. However, in this case, the tank and the other barriers could not have prevented the reaction that resulted in the explosion, and they were not intended to serve this purpose. Furthermore, the design of the tank, ventilation system, and building were never intended for long-term storage of the chemicals. These barriers were designed for solution makeup and to provide the solvent for the extraction process. Upon completion of processing, the tanks were to be emptied by draining any remaining solution into plastic drums for future uses or disposal.

Figure 5. Barrier Analysis Summary

The physical barrier that failed was the control of the HN and HNO₃ solution concentration in accordance with the original dilute product specification. The autocatalytic reaction occurred because the ventilation system evaporated the water from the HN and HNO₃ solution during the four-year period, which increased the concentration of the HN and HNO₃, and degraded the performance of this barrier. Degradation of the barrier was further enhanced by the presence of metals such as iron, nickel, and chromium (all of which were present in the stainless steel tank). These metals may have acted as catalysts to lower the initiation temperature for the chemical reaction. The ambient room air temperature increased slightly a few days before the accident, but the temperature of the contents of the tank at the time of the accident is unknown. It is possible that the temperature of the tank contents was higher than room temperature because of the chemical reaction.

Administrative barriers that failed, or were not implemented or used effectively, include procedures, training, hazards analysis, the facility standby plan, the facility safety authorization basis, and lessons learned from similar incidents.

The following three primary procedures were not followed, or implemented, and contributed to the accident:

• The procedure on how to place facilities into standby status was not followed. It required a safety evaluation of standby planning activities. Had this been done, the hazards might have been identified and controlled.
• The HN and HNO₃ solution in Tank A-109 was placed into short-term (weekend) shutdown by procedure; however, this procedure limited storage to usually less than two weeks. Tank A-109 was left in short-term shutdown for almost 4 years.
• The Facility had a long-term shutdown procedure for Tank A-109 that required draining the HN and HNO₃ solution into plastic drums whenever the process was shut down for an extended period. Facility line management shutdown planning did not include Room 40 chemical makeup tanks. Facility line management and RL line management oversight agreed to address these tanks later. This was contrary to standard operating practices for the Facility.

The vulnerability of an autocatalytic reaction hazard that is created when dilute HN and HNO₃ solution is concentrated through evaporation was not addressed in the safety authorization basis, because long-term storage of HN and HNO₃ solution was not anticipated during normal PRF operations. However, the FSAR did address the hazard that HN can autocatalytically react with concentrations of HNO₃ greater than 3.0 M, since this had been a problem in the past during chemical makeup. As discussed in Section 2.2.4, an unreviewed safety question determination should have been conducted before the long-term storage of HN and HNO₃ solution in Tank A-109 was initiated. During storage, Facility engineering should have been trending the concentration in Tank A-109 to ensure that the HNO₃ concentration did not approach 3.0 M. This also impacts the use of lessons learned, as applied to this accident. Lessons learned could result in controls and actions to ensure that hazardous conditions are identified and mitigated, but can only be considered when management adequately evaluates new activities that have not been previously reviewed for hazards.

Management barriers that failed, or were not used effectively, include Facility line managements control of operations (draining or maintaining the solution in Tank A-109); and RL line management oversights monitoring of contractor operations.

An additional management barrier that failed was the RL line management oversights and Facility line managements recognition of the subtle departure from the safety authorization basis, which, if reviewed, should have resulted in taking action to mitigate the hazards that led to the accident. Ultimately, PFP line management did not ensure the Facility was maintained within the safety authorization basis during transition from operations to shutdown/standby status or that the long-term shutdown procedure for Room 40, including Tank A-109 was implemented. RL line management oversight did not ensure that the Facility remained within the safety authorization basis during the transition.

The failed barriers do not meet DOEs expectations, as indicated in the Guiding Principles for Integrated Safety Management (DOE 450.4). Particularly, line management responsibility for safety, identification of safety standards and requirements, and maintenance of the safety authorization basis have not been implemented with sufficient rigor in daily operations at PFP. Procedures that could have mitigated the hazards were not implemented, hazards were not identified and controlled, and activities were not adequately monitored. The Board concluded that PFP line management failed to implement an effective safety management system that ensured hazards were identified, analyzed, and communicated to workers, and that corrective actions from prior events were implemented; this was a contributing cause to the accident.

2.5 CHANGE ANALYSIS

A change analysis was performed to determine changes that are needed to correct deficiencies in the safety management system, and to identify changes and differences that may have had an effect on the accident. The results of the change analysis may be found in Appendix C.

Two changes that directly contributed to the accident were: (1) failure to remove HN and HNO₃ solution from Tank A-109 in accordance with the long-term storage procedure, and (2) failure to maintain the HN and HNO₃ solution in Tank A-109 in its original, dilute concentration during the storage period. An unreviewed safety question screening was not performed before the HN and HNO₃ solution was allowed to be stored in Tank A-109 on a long-term basis; therefore, the hazard of long-term storage was not discovered.

2.6 CAUSAL FACTORS

A detailed events chart and accident chronology (see Figure 6 ) was developed to identify, analyze, and understand the significance of events and conditions that preceded the accident. The chart identified the events and conditions that are described in Section 2.1.3, Chronology of Events, and the causal factors that are discussed in this section.

The direct cause of the accident was the concentration by evaporation of a dilute solution of HN and HNO₃ in Tank A-109 to the point where an autocatalytic reaction occurred, creating a rapid gas evolution that over-pressurized the tank beyond its physical design limitations.

The three root causes of the accident (the fundamental causes that if eliminated or modified, would prevent recurrence of this and similar accidents) were the primary reason that the chemical reaction occurred. Because protective barriers were not in place or failed to be implemented, the HN and HNO₃ solution became unstable and the explosion occurred. It is the judgment of the Board that elimination of the root causes would not only prevent a possible recurrence of this accident, but would also have prevented this accident. The root causes are identified in Table 1 with a brief discussion of the significance of each.

The Board also identified six contributing causes (causes that increased the likelihood of the accident without individually causing the accident, but that are important enough to require corrective action). The contributing causes also are identified in Table 1 with a brief discussion of the significance of each.

Analysis of the root and contributing causes indicates that the accidents origins began with events that originated in September 1992 and, through a series of oversights and missed opportunities, continued to the date of the accident. Some of the historical problems that precipitated and contributed to the accident persist and have not been corrected by the Facility management systems of the previous or current contractors, or by RL. The potentially hazardous condition was overlooked and the relevance of precursors and other similar events was not recognized. Thus, the lessons learned from other events and precursors were never fully applied.

Missed opportunities include: omission of chemical tanks from the Facility interim standby plan developed in late 1993; not performing an unreviewed safety question evaluation of the shutdown plan as required by procedure; inadequate follow-up to the corrective actions proposed in the RL response to the 1994 DOE Chemical Safety Vulnerability Assessment; failure to list chemicals in the tank on the checklist for the March 1994 DOE Headquarters request for chemicals that react with nitric acid; and the inspections that were conducted during the Project Hanford Management Contract transition in September 1996.

Table 1. Causal Factors.

Figure 6. Detailed Events Chart and Accident Chronology.

Continue to Section 3