2
Causal Factors in Events at Chemical Demilitarization Facilities

Early in its deliberations, the committee recognized that different stakeholders have different perceptions of what constitutes a chemical event. It further became apparent that the sheer number of incidents recorded for JACADS and TOCDF made a detailed review of each event beyond the committee’s resources and time. To focus its efforts, the committee identified from the full list of incidents compiled by a variety of groups (see Appendixes B, C, and D) a comparatively small number of serious events that could be evaluated in some detail. The committee’s goal was to select representative occurrences so that this report’s findings and recommendations would be generally applicable.

This chapter describes the committee’s process for defining a chemical event, its rationale for selecting which of the large number of chemical events it would analyze in depth, and what its analysis of operational events inside each facility determined.

DEFINITIONS

One of the first issues addressed by the committee was what constitutes a chemical event. The Army’s definition of chemical events encompasses all chemical accidents, incidents, and politically and publicly sensitive occurrences (U.S. Army, 1995), whether or not chemical agent was actually present. The committee determined that the seven examples provided in Army Regulation 50-6 (U.S. Army, 1995; see Chapter 1) were too broad for the tasks assigned to it. Consequently, it elected to establish its own criteria to determine which of the reported incidents qualified as chemical events.1 The following definition was developed by the committee and used for the selection process:

Chemical event: Any incident associated with chemical demilitarization operations that resulted in an actual or potential release of chemical agent.

As used in this report, the term “release” refers to agent detected and confirmed in an area where agent is not normally present or expected to be present. Further, as described in this report, an “environmental release” refers to agent detected and confirmed in the environment outside the chemical demilitarization facility. Additionally, the committee had an interest in whether there was “worker exposure” involved in the chemical event.

SOURCES OF INPUT AND SELECTION OF EVENTS FOR IN-DEPTH ANALYSIS

Any analysis of events must recognize a continuum of potential events, ranging from expected and safe variations of processes to serious events that harm people or damage equipment. If too narrow a set of events is chosen for analysis (for example, only those with severe consequences), patterns of contributing factors may be difficult to identify. Conversely, too broad a set of incidents includes much “normal” variation that merely confirms that process controls are functioning as planned. The amount of effort devoted to the investigation of events tends to be a function of the severity of the outcomes, with the result that much more detailed data are available on the (rare) major events.

The committee received written or verbal communication from stakeholders and/or their representatives describing a large number of potential chemical events.

  • The Army Program Manager for Chemical Demilitarization (PMCD) provided a written list of 81 events (Appendix B) that occurred after operations began at Johnston Atoll Chemical Agent Disposal System (JACADS) and at Tooele Chemical Agent

1  

The committee’s purpose in reclassifying chemical events was solely to assist in selecting the events that it would review, and not to “second-guess” the Army’s classification system.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 17
2 Causal Factors in Events at Chemical Demilitarization Facilities Early in its deliberations, the committee recognized that Chemical event: Any incident associated with chemical different stakeholders have different perceptions of what demilitarization operations that resulted in an actual or po- constitutes a chemical event. It further became apparent that tential release of chemical agent. the sheer number of incidents recorded for JACADS and TOCDF made a detailed review of each event beyond the As used in this report, the term “release” refers to agent committee’s resources and time. To focus its efforts, the detected and confirmed in an area where agent is not nor- committee identified from the full list of incidents compiled mally present or expected to be present. Further, as described by a variety of groups (see Appendixes B, C, and D) a com- in this report, an “environmental release” refers to agent de- paratively small number of serious events that could be tected and confirmed in the environment outside the chemi- evaluated in some detail. The committee’s goal was to se- cal demilitarization facility. Additionally, the committee had lect representative occurrences so that this report’s findings an interest in whether there was “worker exposure” involved and recommendations would be generally applicable. in the chemical event. This chapter describes the committee’s process for de- fining a chemical event, its rationale for selecting which of SOURCES OF INPUT AND SELECTION OF EVENTS the large number of chemical events it would analyze in FOR IN-DEPTH ANALYSIS depth, and what its analysis of operational events inside each facility determined. Any analysis of events must recognize a continuum of potential events, ranging from expected and safe variations of processes to serious events that harm people or damage DEFINITIONS equipment. If too narrow a set of events is chosen for analy- One of the first issues addressed by the committee was sis (for example, only those with severe consequences), pat- what constitutes a chemical event. The Army’s definition of terns of contributing factors may be difficult to identify. chemical events encompasses all chemical accidents, inci- Conversely, too broad a set of incidents includes much “nor- dents, and politically and publicly sensitive occurrences mal” variation that merely confirms that process controls are (U.S. Army, 1995), whether or not chemical agent was actu- functioning as planned. The amount of effort devoted to the ally present. The committee determined that the seven ex- investigation of events tends to be a function of the severity amples provided in Army Regulation 50-6 (U.S. Army, of the outcomes, with the result that much more detailed data 1995; see Chapter 1) were too broad for the tasks assigned to are available on the (rare) major events. it. Consequently, it elected to establish its own criteria to The committee received written or verbal communica- determine which of the reported incidents qualified as chemi- tion from stakeholders and/or their representatives describ- cal events.1 The following definition was developed by the ing a large number of potential chemical events. committee and used for the selection process: • The Army Program Manager for Chemical Demili- tarization (PMCD) provided a written list of 81 events (Appendix B) that occurred after operations 1The committee’s purpose in reclassifying chemical events was solely to assist in selecting the events that it would review, and not to “second- began at Johnston Atoll Chemical Agent Disposal guess” the Army’s classification system. System (JACADS) and at Tooele Chemical Agent 17

OCR for page 17
18 EVALUATION OF CHEMICAL EVENTS AT ARMY CHEMICAL AGENT DISPOSAL FACILITIES Disposal Facility (TOCDF), as well as detailed in- documents to assist with detailed analysis of specific inci- vestigation reports on several of the incidents. dents. Using its agreed-to definition of a chemical event and • The Calhoun County (Alabama) Commissioners pro- drawing on the extensive reports, the committee reevaluated vided a letter detailing concerns and questions for the this extensive material and designated 40 events (19 at committee and including a list of six chemical events TOCDF and 21 at JACADS) as chemical events. and a number of areas of concern (Appendix D). To focus its analysis, the committee decided to examine • The committee met with Congressman Bob Riley (R- events with the following characteristics: (1) sufficient in- Ala.) at his request, and with representatives from vestigation had already been done to provide a basis for Calhoun and Talladega counties, plus concerned citi- analysis and (2) the event could have had potentially serious zens and governmental officials from Alabama, at a outcomes, was complex in nature, was well documented, and Capitol Hill meeting arranged by Congressman Riley provided a rich source of potential causal factors. With this to provide the committee with a local perspective. as a rationale, the committee examined five dissimilar inci- • The Chemical Weapons Working Group (CWWG) dents in significant detail (Table 2-1). provided the committee with a list of 118 items (Ap- The committee then analyzed two relatively recent pendix C). Several committee members discussed events, both of which resulted in the release of agent into some CWWG concerns with Craig Williams, the the environment and triggered detailed investigations (Table executive director of the CWWG, at the Capitol Hill 2-2; see Boxes 2-1 and 2-2 for details on the two events). meeting. • A verbal presentation was made and submitted in The Calhoun County Commissioners’ List writing by Gary Harris, a former employee and whistle-blower at the Chemical Agent Munitions The Calhoun County (Alabama) Commissioners sub- Disposal System (CAMDS) facility and at TOCDF, mitted a letter (see Appendix D) that listed six areas of con- at the committee’s meeting of October 18, 2001. cern about operations at TOCDF. Those concerns included • A verbal presentation was made by Suzanne Win- six chemical events the commissioners wished the commit- ters, chair, Utah Citizens Advisory Commission (for- tee to evaluate. They also requested that the committee evalu- merly science advisor to the governor of Utah), at ate events described or concerns raised by groups of con- the committee’s meeting of October 18, 2001. cerned citizens. The only citizen group that provided such a • A set of 69 Notices of Violation at TOCDF issued listing was the CWWG. by the State of Utah’s Department of Environmental Five of the incidents identified by the commissioners Quality, Division of Solid and Hazardous Waste, on were included in the PMCD incident list (Appendix B) and February 13, 2001, was reviewed. were reviewed either in the committee’s overall examina- • A subgroup of the committee visited Anniston, Ala- tion or in its detailed analyses; the remaining incident could bama, and received comments from local officials not be confirmed as having happened. Many of the other and citizens. concerns expressed by the commissioners were deemed to be outside the scope of the committee’s statement of task, Of these submissions, the three formal lists of events although some, such as the operation of the chemical agent supplied to the committee (by PMCD, the Calhoun County monitoring systems and the potential impact of changes in Commissioners, and the CWWG) had some events in com- demilitarization technology and/or operational procedures, mon that are discussed further below. The written submis- are examined in this report. To ensure that a full range of sion by Gary Harris focused principally on his experiences possible incidents was considered, members of the commit- at the CAMDS facility, which was not part of this study. tee met in person with the Calhoun County Commissioners at their offices on December 3, 2001, to discuss their con- cerns within the constraints imposed by NRC committee The PMCD Incident List guidelines. The PMCD provided to the committee a list of 81 inci- dents, 42 at TOCDF and 39 at JACADS (U.S. Army, 2001c; The Chemical Weapons Working Group Incident List see Appendix B). The Army had classified 24 (17 at TOCDF and 7 at JACADS) of these as “chemical events.” Of the 81 The Chemical Weapons Working Group provided a list incidents, some were significant enough to warrant investi- of 118 items to the committee (see Appendix C), 55 of which gation by agencies external to the incineration facility. The were notations of operational shutdowns and unconfirmed committee obtained investigation reports for 14 of the inci- automatic continuous air monitoring system (ACAMS) dents and supplemented the information in them by inter- alarms, for example: “Site masking alarm and/or stack alarm. viewing managerial, operating, and laboratory personnel Potential case of chemical warfare agent release or release of during site visits to JACADS and TOCDF. The committee other related toxic chemicals (unidentified to date).” It is also obtained data from process logs and other operational probable that most, if not all, of the “site masking” alarms

OCR for page 17
19 CAUSAL FACTORS IN CHEMICAL EVENTS AT DEMILITARIZATION FACILITIES TABLE 2-1 Events on the PMCD List That Were Examined by the Committee Demilitarization Site Date and Army Classification Process Component Incident / Event Description by PMCD 21-Jan-92 JACADS Deactivation furnace system Processing VX-filled M55 rockets when a detonation occurred within (Unusual Occurrence)a (DFS) the DFS, causing the kiln to stop rotating. 2-Jan-93 JACADS Explosive containment room During M60 105-mm projectile processing within the ECR a fire (Unusual Occurrence) (ECR)-A occurred along the miscellaneous parts conveyor. Fire was contained within the ECR. Changes made to the equipment and increased frequency of ECR cleanup of residual explosives. 17-Mar-93 JACADS Munitions demilitarization Ratheon Engineering and Constructors worker potentially exposed to (Chemical Event) building (MDB) mustard agent (HD). Worker developed blister(s) on leg after handling HD-contaminated waste materials. 23-Mar-94 JACADS Common stack Liquid incinerator (LIC) was being ramped down (controlled cooling (Chemical Event) operation) for slag removal. Minute amount of GB released via common stack. Technical investigation completed and operation procedures changed. 19-Nov-94 JACADS ECR Detonation of rocket on fuze shear caused agent migration to (Unusual Occurrence) observation corridor. All agent vapor contained under engineering controls and exhausted through the MDB charcoal filter units. aThe committee’s definition of a chemical event requires that the event result in actual or potential release of agent in an area where agent is not normally present or expected to be present. The committee categorized the January 1992, January 1993, and November 1994 incidents as unusual occurrences because no agent was released or migrated to areas where it was not supposed to be, and further, the potential of this happening was considered slight. Conversely, the March 1993 and March 1994 incidents were categorized as chemical events because both resulted in the release of agent into the environment. SOURCE: Excerpted from U.S. Army (2001c); see Appendix B. TABLE 2-2 Events on the PMCD List That Were Chosen by the Committee for Detailed Analysis Demilitarization Site Date and Army Classification Process Component Incident / Event Description by PMCD 8-May-00 TOCDF (Chemical Deactivation furnace system During processing of GB rockets the DFS interlock shut off all Event) (DFS) burners due to pollution abatement system air flow meter failure. ACAMS alarmed in the furnace stack during re-light of the furnace. No agent or munitions were being processed at time of the alarms. The perimeter monitors’ readings were all negative for agent. Investigation teams from CDC (Centers for Disease Control and Prevention), Department of Army Safety, and Utah DSHW (Division of Solid and Hazardous Waste) conducted the investigation of stack release. Technical investigation completed with recommended procedural and design changes. 3-Dec-00 JACADS DFS waste bin Chemical agent (VX) was detected and confirmed in the ash from the (Chemical Event) heated discharge bin at the DFS. The agent was detected during routine monthly sampling for metals as required by the RCRA (Resource Conservation and Recovery Act) permit. The bin was isolated and placed under engineering control, and subsequently the bin was fully enclosed under engineering control. SOURCE: Excerpted from U.S. Army (2001c); see Appendix B.

OCR for page 17
20 EVALUATION OF CHEMICAL EVENTS AT ARMY CHEMICAL AGENT DISPOSAL FACILITIES BOX 2-1 December 3-5, 2000, Johnston Atoll Chemical Agent Disposal System (JACADS) Event The destruction of the last agent-containing munitions on evacuation. Depot area air monitoring system (DAAMS) confirmation Johnston Island, M23 VX land mines, was completed on November of VX in bin 135 was obtained at 3:00 PM Dec 5, 2000. The hazardous 29, 2000. This marked the end of the operational phase of JACADS materials (HAZMAT) team began a series of checks of all other bins at and the beginning of the closure phase. One of the first steps of clo- 12:13 PM Dec 5, 2000 and found all readings less than TWA. The DFS sure was to process bulk solid waste (items such as spill pillows, rags kiln was restarted at 9:19 PM Dec 5, 2000 to maintain a negative contaminated with explosive or agent, metal hardware, rubber hoses, pressure in the HDC waste bin enclosure. An all-clear was sounded at etc.) from the explosive containment room (ECR) through the deacti- 9:39 PM. No agent was measured at the perimeter DAAMS tubes vation furnace system (DFS). The material was processed using the throughout the incident. standard 5X procedure (1000°F for 15 minutes) and the ash and un- The Chemical Event Report was submitted within 3 hours of the burned material produced placed in disposal bins. A bin was sampled event and the JACADS field office and U.S. Army Chemical Activity monthly for agent analysis. Pacific made notifications to their respective field offices. The Pro- Between 7:47 PM on Dec 2, 2000 and 12:56 AM on Dec 3, 2000, gram Manager for Chemical Demilitarization (PMCD) made telephone three spill-pillows (each containing approximately 20 pounds of liq- notifications to the Assistant Secretary of the Army for Installations, uid waste) were processed. How much of that was chemical agent VX Logistics, and the Environment, the Department of the Army Safety is unknown. The spill-pillows contained talcum powder and an amor- Office and the Department of Health and Human Services, however no phous silicate absorbent. The 5X treated remains of the pillows, card- notification was given to Region IX, Environmental Protection Agency. board mines, fuses, and kicker chutes passed through the DFS and PMCD initiated an investigation to protect evidence and gather infor- the non-combustible ash exited the heated discharge conveyor (HDC) mation and assembled an investigation team on Johnston Island on to bin 135. At 8:06 AM on Dec 3, 2000 bin 135 was placed in the Dec 13, 2000. staging area (outside primary engineering control) with the lid open to The conclusions of the investigation team as summarized in the cool. report were: “The process of sending VX contaminated liquid and satu- At 10:30 AM on Dec 3, 2000, a routine sample of the solid waste rated spill pillows to the DFS in excess of the decontamination capa- from bin 135 was taken for waste control limit (WCL) analysis and the bility of the furnace system appears to be the major cause of the chemi- bin lid closed. The analysis (12:30 AM Dec 4, 2000) indicated a sus- cal event. There are no other scenarios consistent with the physical pected interference. An extraction analysis on the same sample con- evidence observed in bin 135 that could have resulted in the agent firmed the presence of VX at 3000 WCL at 1:56 AM Dec 5, 2000. A levels that were recorded during this chemical event. A faster response second sample was taken at 3:00 AM Dec 5, 2000 and analysis indi- from the lab and a procedure that includes an action level for the cated 5045 WCL. At 4:30 AM Dec 5, 2000, bin 135 and two others exceedance of waste control limits would have reduced the amount of were moved to the unpacking area for further monitoring. time bin 135 was outside of engineering controls. A detailed review of At 10:10 AM Dec 5, 2000, an automatic continuous air monitor- standard operating procedures for bulk solid waste fed to the DFS ing system (ACAMS) reading of 1476 time weighted average (TWA) should be conducted. In addition, a narrower definition of what con- was measured in air drawn from the bottom of bin 135. After another stitutes bulk solid waste should be developed.” positive ACAMS reading, the site alarm sounded at 10:20 AM and all SOURCE: Reprinted from U.S. Army (2001f). personnel were masked and sent to checkpoint “Charlie” for possible noted were false positive ACAMS alarms, which are dis- dents or events included on the PMCD list and were con- cussed in some detail in Chapter 1. Thirty items were sidered by the committee. simple statements of fact that bore no relationship to the For most of the items on the CWWG list, no specific committee’s task, for example: “August 1, 1997—Former documentation or details were included beyond one to a few Chief Safety Officer, Steve Jones is ruled for in his Dept. sentences. The committee concluded that the majority of of Labor Wrongful Termination Action. Judge awards the items were not germane to its statement of task. Those Jones his job back and $500,000 or no rehiring and $1 mil- that were relevant were typical of the ones from the PMCD lion. Judge calls EG&G managers liars.” Four items ap- list that the committee studied intensively. In conclusion, peared to be related to stockpile storage, and not to chemi- the committee determined that evaluation of additional items cal demilitarization operations. Seventeen of the items on on the CWWG list would not materially influence the find- the CWWG list were identifiable as being related to inci- ings and recommendations of this report.

OCR for page 17
21 CAUSAL FACTORS IN CHEMICAL EVENTS AT DEMILITARIZATION FACILITIES BOX 2-2 May 8-9, 2000, Tooele Chemical Agent Disposal Facility (TOCDF) Event During processing of rockets containing the chemical 12:23 AM, but the furnace went to a negative pressure and fluctuated agent GB, at approximately 4:20 PM on May 8, 2000, a jam once again. Another burner lockout occurred this time because the occurred in the lower feed gate of the deactivation furnace sys- clean liquor pump was not running. At 12:28 AM, the DFS duct tem (DFS) feed chute from the explosives containment room ACAMS alarmed and the site was masked again and the furnace was (ECR). Operators sprayed water into the chute in an attempt to “bottled up” at 12:32 AM. The alarm cleared and the site was un- clear the feed gate jam. The last of the material in the furnace masked at 1:07 AM. DAAMS tubes from the perimeter were collected had cleared the DFS and the heated discharge conveyor (HDC) around 6:55 AM and subsequent analysis showed no detectable agent. by 5:30 PM. At approximately 6:10 PM the pressure was low- The analysis of the stack DAAMS tubes indicated a stack release of ered in accordance with non-normal operating plans. An alarm 18-36 mg. indicating high air flow rates through the DFS and pollution The TOCDF control room notified Deseret Chemical Depot abatement system went off at 8:20 PM and by 8:42 PM pressure (DCD) emergency operations center (EOC) at 11:30 PM on May 8, fluctuations were affecting the operation of the DFS induced 2000 following the stack ACAMS alarm and updated the report at draft fans. 11:42 PM with the highest readings and the fact that the duct ACAMS Meanwhile, at approximately 8:30 PM, personnel entered had also alarmed. They further notified the DCD EOC at 12:25 AM on the area to inspect the feed chute and found enough debris to fill May 9, 2000 that all ACAMS had cleared and that DAAMS analysis a coffee can. The decision was made to wash down the chute. was pending. At 12:32 AM the DCD EOC was informed that the stack With several openings and closing of the feed gates and spraying ACAMS were back in alarm and at 1:17 AM that DAAMS tubes from with water, the pressure controlling equipment was unable to sta- the first set of alarms confirmed the presence of agent GB. bilize the pressure in the kiln. The DFS operator took manual At approximately 3:00 AM on May 9, 2000 notification was made control in attempting to stabilize the pressure. The wash down of by the DCD EOC to the Utah Department of Environmental Quality the chutes was completed by about 9:30 PM. The maintenance (DEQ) and at approximately 3:34 AM to the Tooele County dispatcher. personnel then changed the strainers in ECR - B and placed ap- The event was classified as a Limited Area Event (not likely to leave the proximately one pound of agent contaminated waste on the upper site). No action was taken by the state or county until normal business feed gate (this was the source of the agent that eventually was hours on May 9. monitored in the stack, but the operators were unaware of its Investigations were conducted by the TOCDF contractor EG&G, presence). The DFS operators continued to have difficulty stabi- the Army Safety Office, the Centers for Disease Control and Preven- lizing the furnace system. About 10:00 PM the DFS burners were tion (CDC), and the Utah DEQ. Suspension of agent burning was ini- automatically shut down and operators locked out by a malfunc- tiated and stayed in effect until corrective actions recommended by the tion signal sent by the DFS exhaust flow meter. reports were made and approved by the Utah DEQ. The CDC report While seeking approval to by-pass the lock out of the concluded that there was neither an impact to the health of TOCDF burners and restart the afterburner, the common stack auto- workers nor the general public. Subsequent computer modeling indi- matic continuous air monitoring system (ACAMS) alarmed at cated that no harm to humans would occur beyond 8 ft. past the top of 11:26 PM. The site was immediately masked. A depot area air the 200-ft. common stack. monitoring system (DAAMS) tube was taken for analysis at Resumption of operations in the two liquid incinerators and the 11:38 PM and another put in its place. ACAMS readings as metal parts furnaces (none of which were involved in the event) fol- high as 3.63 allowable stack concentration (ASC) were ob- lowed approval on July 28, 2000. Approval to resume operations in tained. The furnace was “bottled up” (dampers closed to slow the DFS was given September 29, 2000. airflow) at 11:44 PM. By 12:18 AM on May 9, 2000 the ACAMS SOURCE: Compiled from Utah DEQ (2000a), U.S. Army (2000a,b), had cleared and the order to unmask given. and CDC (2000). Restarting of the DFS afterburner was attempted again at Notice of Violation Reports mainly failures to observe and follow prescribed procedures, and, in general, did not lead to chemical events. Table 2-3 The Notice of Violation reports issued by the Utah De- shows the frequency of occurrence of each type of violation partment of Environment Quality (DEQ) for TOCDF con- reported by DEQ. tained a total of 69 items. These often differ in nature from Although many of these violations were classified by the events listed by PMCD and others, in that they were the committee as minor, they are important as indicators of

OCR for page 17
22 EVALUATION OF CHEMICAL EVENTS AT ARMY CHEMICAL AGENT DISPOSAL FACILITIES TABLE 2-3 Committee’s Classification of 69 Items view (Table 2-4) and were noted as being involved Cited in Notice of Violation Reports in at least 14 of the incidents that received less thor- ough review by the committee. Note also that 11 of Violation Type Number the 69 items in the Notice of Violation reports (see Table 2-3) involved similar failures to follow proce- Operational error (wrong feed, missed analysis, use of dures. Several incidents involved multiple SOP de- faulty equipment) 20 ficiencies, and in one, the March 17, 1993, incident Failure to test/inspect on schedule 13 in which a worker was exposed to HD, at least six Failure to follow plans/procedures/specifications 11 SOP deficiencies were noted, including: Failure to keep correct records 7 Improper storage 5 —No procedures for loading/handling bags. Storage time limits exceeded 5 —Placing HD sludge in plastic bags. Incorrect labeling of waste 2 —Tagging bags improperly. Failure to notify of changes 2 —No pre-entry hazards briefing. Other 4 —Improper carrying of bags. —Failure to wear proper personal protective xxx equipment. systemic operating problems. Record-keeping errors or in- Following existing SOPs could have prevented sev- stances of exceeding time limits for testing or inspection, eral of the incidents that occurred at both TOCDF which tend to occur in all complex processes, may be indica- and JACADS. However, the non-compliance with tive of insufficient resources devoted to the tasks to be per- SOPs was not a question of operators being contrary. formed, or lack of priority setting to prevent such “minor” Most operators were in fact trying to smooth or sim- infractions. The committee considered each of these as it plify the process by using non-approved methods, developed its findings and recommendations. and had presumably been reinforced in this approach by past experiences. SOPs are not always perfect, for example, in that they apply to conditions not quite ANALYSIS OF SELECTED CHEMICAL EVENTS met at the particular time they are required. If the The committee’s analysis was conducted on several lev- safe alternative is to stop work whenever an SOP is els. First, members investigated the causal factors for each not exactly appropriate, that may not always be ap- of the seven events listed in Tables 2-1 and 2-2. They then parent to the operator. developed a notional causal tree for each of the two events in • Failures of communication, including failure to com- Table 2-2 that were analyzed in depth. For illustrative pur- municate essential information, failure to heed com- poses, a causal tree developed by the committee for the De- municated information, and inadequate communica- cember 3-5, 2000, incident at JACADS appears at Appendix tion systems, contributed to four of the incidents F. The tree is a standard tool in reliability analysis and is reviewed in-depth by the committee, and to at least particularly useful in human reliability analysis where op- five others. The March 17, 1993, and May 8, 2000, erator actions contribute either positively or negatively to an incidents could have been prevented had communi- incident. Lastly, the committee provides a series of general cations failures not occurred. In the March 17, 1993, and specific observations about the events. incident, the supervisor of the work group noted that a bag containing HD waste was leaking and commu- nicated this information to the individual handling Causal Factors the bag. The warning was not heeded, and subse- The committee’s analysis of the seven chemical events quently the contents leaked onto the individual who listed in Tables 2-1 and 2-2 showed that there were multiple was carrying the bag. In the May 8, 2000, incident, causal factors for all of the selected events. (Note: the com- the control room supervisor was not informed that mittee could determine causal factors only for incidents for the agent strainer was to be changed during a demili- which sufficient investigation data were available.) Rather tarization protective ensemble entry to clear the than being specified for each incident, the causal factors lower feed gate, or that the agent-contaminated identified by the committee are grouped into the following strainer was being placed on the gate. During the generic categories: course of this event, at many points the operator per- formed actions that were later seen to have been un- • Standard operating procedure (SOP) deficiencies, fortunate. This suggests that the design of the sys- including nonexistent SOP(s), inadequate SOP(s), tem displays was not adequate to obtain an integrated and SOP(s) being circumvented or ignored as a rou- overview of what was happening. This fact was rec- tine operating practice. Such deficiencies contrib- ognized after the incident and a new single-screen uted to 6 of the 7 incidents subjected to in-depth re- display was developed to assist operators. However,

OCR for page 17
23 CAUSAL FACTORS IN CHEMICAL EVENTS AT DEMILITARIZATION FACILITIES TABLE 2-4 Frequency of Causal Factors in the Seven Incidents Analyzed by the Committee Causal Factors SOP Communication Unexplained Equipment Design Improper Date Deficiencies Failure Human Error Malfunction Deficiency Technique Mind-set 21-Jan-92 01 1 2-Jan-93 01 1 1 17-Mar-93 06 1 1 1 01 2 1 23-Mar-94 01 04 2 19-Nov-94 01 1 1 1 03 1 8-May-00 02 2 1 01 1 1 3-Dec-00 03 1 01 2 TOTAL 14 5 2 3 11 4 9 xx during the committee’s visit, the operator and super- committee and to at least five others. Although a visor took about 10 minutes to find this screen, sug- higher frequency of design deficiencies might be gesting that it is not often used. Also, when the expected in the early phases of an operation, this screen was located, it was found to be an all-text does not appear to have been the case for either display, rather than an analog or pictorial represen- TOCDF or JACADS—at least based on the informa- tation. All-text displays are good for obtaining de- tion that was available to the committee. The com- tailed information but poor for obtaining an inte- mittee notes, however, that one of the chemical grated view of changing situations or conditions. events it examined was directly attributable to fail- The implication is that the fix was not a great im- ure to capture and implement at TOCDF design provement over the existing system. changes made at JACADS. • Unexplained human error is a category that describes • Improper technique refers to a manner of perform- human actions that were wrong for no reason recorded ing tasks that causes either a hazard or a malfunc- in the investigation reports or for which there is no tion. An example is using equipment for purposes apparent explanation. One example is the operator other that those dictated by design, as occurred in who assembled a piece of equipment incorrectly. The the May 8, 2000, incident at TOCDF in which the committee suspected that a more complete investiga- water spray nozzles designed for cooling the deacti- tion would reveal causes for such errors. vation furnace system (DFS) lower feed gate were • Equipment malfunction refers to the failure of equip- used to clean the gate when jams occurred. Since ment to function as designed but does not include the nozzles were operated at low pressure, operators design deficiencies. Contributing to three of the used significant quantities of water in attempts to seven incidents subjected to in-depth review, and to clean or clear the feed gate and the water vaporized, at least nine other incidents, these failures ranged causing fluctuations in pressure and in the flow rate from simple tearing of waste bags to breakdowns of in the DFS. While these factors were not frequent, critical instrumentation such as flow meters and sen- they contributed to several incidents. sors. The committee noted that in virtually every • Mind-set refers to the mental attitude people have incident involving equipment malfunction, there was about the process of disposal and the state of the a precursor, for example, installation of a flow sen- system during processing. In the incidents studied, sor on the wrong side of a water flow control sole- people behaved at times as if they assumed that an noid (design deficiency). ACAMS alarm was false, that contaminated waste • Design deficiency applies to equipment or facilities was less hazardous than raw agent, or that parts com- found to perform operating functions inadequately ing through a furnace were automatically 5X mate- rial.2 During its review of incidents, the committee as a result of their poor design. In several incidents examined by the committee, entrainment of agent into nonagent areas by personnel leaving a demilita- 25X refers to a level of decontamination at which solids may be released for general use or sold (e.g., as scrap metal) to the general public in accor- rization protective ensemble entry could have been dance with applicable federal, state, and local regulations. There is a mis- avoided if a timed interlock had been designed into conception that 5X means simply that the solid has been placed in a tem- transitional airlocks to ensure sufficient purging of perature zone of 1000°F or higher for 15 minutes. To achieve a 5X level of airlock. Design deficiencies were found to have con- decontamination a solid must be heated to 1000°F and maintained at that tributed to six of the seven incidents reviewed by the temperature for 15 minutes.

OCR for page 17
24 EVALUATION OF CHEMICAL EVENTS AT ARMY CHEMICAL AGENT DISPOSAL FACILITIES invariably found itself engaged in discussions of the in the incidents examined by the committee, such mind-set(s) prevalent at the time of the incident(s). actions combined with latent failures to cause some Mind-set was involved in every incident the com- adverse consequences. Examples of active failures mittee reviewed in depth, and it contributed signifi- include use of the wrong procedure, incorrect per- cantly to several others. Perhaps the most troubling formance of an appropriate procedure, or failure to was what the committee referred to during its delib- correctly and rapidly diagnose a problem. erations as the “false positive mind-set.” False posi- • Immediate outcome—the adverse state the system tive ACAMS alarms have been frequent at both reached immediately after the active failure. Ex- JACADS and TOCDF and have caused people at amples are release of agent, plant damage, or personal both sites to assume that any alarm without a readily injury. Reporting and investigation flow charts sup- apparent cause is false—an assumption that has, in plied by the Army indicate that the severity of out- turn, fostered other failures and delays in addressing come often determines the incident’s prominence for and responding to events. managers, the workforce, or the community, which in turn drives subsequent responses. Incidents with more Table 2-4 summarizes the results of the committee’s salient outcomes naturally receive more scrutiny, analyses, indicating the frequency with which the causal fac- which may bias the data set used for analysis. tors outlined above contributed to the severe incidents • System responses—actions taken to correct the ef- closely examined by the committee. fects and anticipate the aftereffects of an adverse outcome. Following each event, there is a system response that also needs to be analyzed. How did the Causal Tree Analysis of Two Events system for incident response function? How did the For the two events it examined that were sufficiently management act to improve safety? Was an exposed documented to allow a detailed analysis, the committee worker properly treated? Were communities noti- charted activities in the sequence of events leading to each fied appropriately? How did the plant return to a incident, either as a time line or as a causal tree (see Appen- normal state? How rapidly did it return? Finally, dix F). A standard tool in reliability analysis, the causal tree how was the system changed in light of the incident? or event tree is particularly useful in analyzing incidents to This stage of analysis is considered in Chapter 4. which operator actions contribute either positively or nega- tively. Figure F-1 in Appendix F shows the causal tree for General Observations the December 3-5, 2000, event at JACADS. The committee recognizes that such trees are designed at the discretion of Based on its review, the committee believes that the the analyst and should not be construed as reflecting scien- chemical events and other serious incidents examined at tific certainty. Figure F-1, as well as a similar analysis by the JACADS and TOCDF have been honestly investigated and committee of the May 8-9, 2000, event at TOCDF, suggests reported. Even so, the investigation reports that were avail- that the incidents examined by the committee grew from able to the committee did not always reflect the complete set normal activities into potentially dangerous events. of factors that caused or contributed to the cause of events. The activities charted can be categorized as ranging Likewise, the investigation team(s) may not have used the from normal operations through system response. In addi- most appropriate methodologies for collecting, analyzing, tion, some can extend back in time before the occurrence of and reporting the events. In particular, the committee saw the incident, e.g., latent failures. little evidence of the use of formal methods, such as event tree analysis, and little involvement of human factors engi- • Normal tasks—that the system was attempting to neering even though most of the incidents reviewed by the accomplish before the adverse event occurred. Ex- committee had a component of human behavior as a causal amples are maintenance and operations. factor (see Table 2-4). The committee found inconsistencies • Latent failures—conditions present in the system for in the form and format of investigation reports within and some time before the incident, but evident only when between chemical demilitarization sites. triggered by unusual states or events. Examples Finally, the committee noted that complete documenta- include equipment design deficiencies, unexpected tion supporting incident investigations was not always re- configurations of munitions, or routine ignoring of tained with the reports or in a report file. For example, a standard operating procedures. videotape relevant to the December 3, 2000, incident at • Active failures—events before which there were no JACADS could not be located for the committee to view. adverse consequences and after which there were. During its in-depth review, the committee observed dif- Active failures are usually the result of personnel ferences in the types and completeness of entries made in decisions or actions. These same actions may have JACADS and TOCDF operating logs (deactivation furnace resulted in safe outcomes on previous occasions, but system, demilitarization protective ensemble, control room,

OCR for page 17
25 CAUSAL FACTORS IN CHEMICAL EVENTS AT DEMILITARIZATION FACILITIES and so on). The variations were largely attributable to indi- BOX 2-3 An Example of Negative Effects viduals who made the entries, which suggests that some of Mind-set training relative to the nature, content, and detail of entries into operating logs would be appropriate. Error-correction deficiencies were also noted in the operating logs. The committee highlights a sentence in an investigation report that begins the section titled “Air Monitoring of 5X Material”: “The waste located in BIN 135 was designated 5X by the process. There- Specific Observations fore, there was no requirement to monitor for an airborne agent haz- In conducting its detailed examination, the committee ard” (U.S. Army, 2001f). observed patterns of causal factors or categories of activi- Although it agrees that the process had been demonstrated to ties, such as latent and active failures, that appeared to recur be capable of producing 5X [decontaminated] material, the commit- over significant time periods. Deficiencies in standard oper- tee asserts that the waste bin enclosure should have been actively ating procedures, which can be readily identified and cor- monitored to ensure that 5X destruction was being achieved on a rected and should decline with time and operating experi- continuous basis. To the committee, this case is not different from ence, were the most notable. Based on the information that of the liquid incinerator, where “6 nines” destruction efficiency available to the committee, it appears, however, that the fre- has been demonstrated but does not obviate the need for monitoring quency of SOP deficiencies in the incidents examined did to ensure that the operating requirements are achieved. It was known not decline with time. This might suggest that any lessons that certain materials could pass through the deactivation furnace learned from past experience are being interpreted too nar- system without complete combustion (e.g., rolled-up coveralls), and rowly (Chapter 4) or that the need for improvement in this thus, the operating assumption regarding 5X decontamination was area is not being recognized. As noted earlier, following an known to be erroneous in some cases. This assumption also led to SOP may not appear to be the correct choice to an operator. employees being sent on two occasions to deal with the waste bin This is particularly true when the operator has a limited per- with an inappropriate level of personal protective equipment, and the spective on the task and so does not understand the reasons “false positive” mind-set led to delays in reporting the results of why a procedure that looks unnecessarily complex is indeed monitoring. appropriate. This circumstance argues again for operator knowledge in addition to rule following. As in any complex system, there are likely still undetec- niques can be greatly reduced, if not eliminated, through the ted design deficiencies at TOCDF, and, most certainly, sys- development of a strong safety culture in the chemical de- temization at new chemical demilitarization facilities will militarization work environment. uncover other design deficiencies. Active communication The “crying wolf” phenomenon of a decreased willing- between and among chemical demilitarization facilities via ness to respond after repeated false alarms is an expected, the programmatic lessons learned (PLL) program (Chapter and sensible, human behavior, but one that must be discour- 4) is key to ensuring that design deficiencies are detected aged in chemical demilitarization operations by appropriate and corrected. training and a recognized reward structure. Equipment failure may be random, but it is certainly The committee also discussed “waste mind-set”—the preventable. Excellent maintenance, equipment monitoring, attitude or belief among employees and management at both and preventive maintenance practices can dramatically re- JACADS and TOCDF that waste processing and/or handling duce equipment malfunctions at a lower overall cost than is less hazardous than agent processing. This mind-set has that incurred in an unanticipated shutdown. Many industries led to notable deficiencies in SOPs for waste handling and have found that investment in these practices can provide contributed significantly to several incidents. Even though reductions in overall costs. mind-set cannot be considered to be the root cause of any of Equally, human errors are preventable, even if they ap- the incidents reviewed by the committee, it is a prevalent pear to be random. Better knowledge of human functioning factor (see Table 2-4) and a significant issue, as the Decem- in complex situations (human factors engineering) shows ber 3, 2000, deactivation furnace system waste bin incident how equipment design, workforce knowledge, and manage- at JACADS illustrates (U.S. Army, 2001f) (see Box 2-3). ment environment can contribute to human error, or to its The most difficult challenge facing those operating fu- reduction (Reason, 1997). Industry experience has shown ture demilitarization facilities will be overcoming, or pre- that a well-trained and vigilant workforce, and vigorous and venting the development of, mind-sets that lead to an ad- effective management and supervision, committed to creat- verse chemical event or contribute to the severity, magnitude, ing an environment in which safety is always first, will help and consequences of such an event. This challenge is also to minimize human errors and any ensuing events that might important to bear in mind as sites transition from agent dis- be caused or initiated by them. Similarly, the human com- posal operations to decommissioning and closure. ponent of failures in communication and improper tech-