Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 17
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities 2 Causal Factors in Events at Chemical Demilitarization Facilities Early in its deliberations, the committee recognized that different stakeholders have different perceptions of what constitutes a chemical event. It further became apparent that the sheer number of incidents recorded for JACADS and TOCDF made a detailed review of each event beyond the committee’s resources and time. To focus its efforts, the committee identified from the full list of incidents compiled by a variety of groups (see Appendixes B, C, and D) a comparatively small number of serious events that could be evaluated in some detail. The committee’s goal was to select representative occurrences so that this report’s findings and recommendations would be generally applicable. This chapter describes the committee’s process for defining a chemical event, its rationale for selecting which of the large number of chemical events it would analyze in depth, and what its analysis of operational events inside each facility determined. DEFINITIONS One of the first issues addressed by the committee was what constitutes a chemical event. The Army’s definition of chemical events encompasses all chemical accidents, incidents, and politically and publicly sensitive occurrences (U.S. Army, 1995), whether or not chemical agent was actually present. The committee determined that the seven examples provided in Army Regulation 50-6 (U.S. Army, 1995; see Chapter 1) were too broad for the tasks assigned to it. Consequently, it elected to establish its own criteria to determine which of the reported incidents qualified as chemical events.1 The following definition was developed by the committee and used for the selection process: Chemical event: Any incident associated with chemical demilitarization operations that resulted in an actual or potential release of chemical agent. As used in this report, the term “release” refers to agent detected and confirmed in an area where agent is not normally present or expected to be present. Further, as described in this report, an “environmental release” refers to agent detected and confirmed in the environment outside the chemical demilitarization facility. Additionally, the committee had an interest in whether there was “worker exposure” involved in the chemical event. SOURCES OF INPUT AND SELECTION OF EVENTS FOR IN-DEPTH ANALYSIS Any analysis of events must recognize a continuum of potential events, ranging from expected and safe variations of processes to serious events that harm people or damage equipment. If too narrow a set of events is chosen for analysis (for example, only those with severe consequences), patterns of contributing factors may be difficult to identify. Conversely, too broad a set of incidents includes much “normal” variation that merely confirms that process controls are functioning as planned. The amount of effort devoted to the investigation of events tends to be a function of the severity of the outcomes, with the result that much more detailed data are available on the (rare) major events. The committee received written or verbal communication from stakeholders and/or their representatives describing a large number of potential chemical events. The Army Program Manager for Chemical Demilitarization (PMCD) provided a written list of 81 events (Appendix B) that occurred after operations began at Johnston Atoll Chemical Agent Disposal System (JACADS) and at Tooele Chemical Agent 1 The committee’s purpose in reclassifying chemical events was solely to assist in selecting the events that it would review, and not to “second-guess” the Army’s classification system.
OCR for page 18
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities Disposal Facility (TOCDF), as well as detailed investigation reports on several of the incidents. The Calhoun County (Alabama) Commissioners provided a letter detailing concerns and questions for the committee and including a list of six chemical events and a number of areas of concern (Appendix D). The committee met with Congressman Bob Riley (R-Ala.) at his request, and with representatives from Calhoun and Talladega counties, plus concerned citizens and governmental officials from Alabama, at a Capitol Hill meeting arranged by Congressman Riley to provide the committee with a local perspective. The Chemical Weapons Working Group (CWWG) provided the committee with a list of 118 items (Appendix C). Several committee members discussed some CWWG concerns with Craig Williams, the executive director of the CWWG, at the Capitol Hill meeting. A verbal presentation was made and submitted in writing by Gary Harris, a former employee and whistle-blower at the Chemical Agent Munitions Disposal System (CAMDS) facility and at TOCDF, at the committee’s meeting of October 18, 2001. A verbal presentation was made by Suzanne Winters, chair, Utah Citizens Advisory Commission (formerly science advisor to the governor of Utah), at the committee’s meeting of October 18, 2001. A set of 69 Notices of Violation at TOCDF issued by the State of Utah’s Department of Environmental Quality, Division of Solid and Hazardous Waste, on February 13, 2001, was reviewed. A subgroup of the committee visited Anniston, Alabama, and received comments from local officials and citizens. Of these submissions, the three formal lists of events supplied to the committee (by PMCD, the Calhoun County Commissioners, and the CWWG) had some events in common that are discussed further below. The written submission by Gary Harris focused principally on his experiences at the CAMDS facility, which was not part of this study. The PMCD Incident List The PMCD provided to the committee a list of 81 incidents, 42 at TOCDF and 39 at JACADS (U.S. Army, 2001c; see Appendix B). The Army had classified 24 (17 at TOCDF and 7 at JACADS) of these as “chemical events.” Of the 81 incidents, some were significant enough to warrant investigation by agencies external to the incineration facility. The committee obtained investigation reports for 14 of the incidents and supplemented the information in them by interviewing managerial, operating, and laboratory personnel during site visits to JACADS and TOCDF. The committee also obtained data from process logs and other operational documents to assist with detailed analysis of specific incidents. Using its agreed-to definition of a chemical event and drawing on the extensive reports, the committee reevaluated this extensive material and designated 40 events (19 at TOCDF and 21 at JACADS) as chemical events. To focus its analysis, the committee decided to examine events with the following characteristics: (1) sufficient investigation had already been done to provide a basis for analysis and (2) the event could have had potentially serious outcomes, was complex in nature, was well documented, and provided a rich source of potential causal factors. With this as a rationale, the committee examined five dissimilar incidents in significant detail (Table 2-1). The committee then analyzed two relatively recent events, both of which resulted in the release of agent into the environment and triggered detailed investigations (Table 2-2; see Boxes 2-1 and 2-2 for details on the two events). The Calhoun County Commissioners’ List The Calhoun County (Alabama) Commissioners submitted a letter (see Appendix D) that listed six areas of concern about operations at TOCDF. Those concerns included six chemical events the commissioners wished the committee to evaluate. They also requested that the committee evaluate events described or concerns raised by groups of concerned citizens. The only citizen group that provided such a listing was the CWWG. Five of the incidents identified by the commissioners were included in the PMCD incident list (Appendix B) and were reviewed either in the committee’s overall examination or in its detailed analyses; the remaining incident could not be confirmed as having happened. Many of the other concerns expressed by the commissioners were deemed to be outside the scope of the committee’s statement of task, although some, such as the operation of the chemical agent monitoring systems and the potential impact of changes in demilitarization technology and/or operational procedures, are examined in this report. To ensure that a full range of possible incidents was considered, members of the committee met in person with the Calhoun County Commissioners at their offices on December 3, 2001, to discuss their concerns within the constraints imposed by NRC committee guidelines. The Chemical Weapons Working Group Incident List The Chemical Weapons Working Group provided a list of 118 items to the committee (see Appendix C), 55 of which were notations of operational shutdowns and unconfirmed automatic continuous air monitoring system (ACAMS) alarms, for example: “Site masking alarm and/or stack alarm. Potential case of chemical warfare agent release or release of other related toxic chemicals (unidentified to date).” It is probable that most, if not all, of the “site masking” alarms
OCR for page 19
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities TABLE 2-1 Events on the PMCD List That Were Examined by the Committee Date Demilitarization Site and Army Classification Process Component Incident / Event Description by PMCD 21-Jan-92 JACADS (Unusual Occurrence)a Deactivation furnace system (DFS) Processing VX-filled M55 rockets when a detonation occurred within the DFS, causing the kiln to stop rotating. 2-Jan-93 JACADS (Unusual Occurrence) Explosive containment room (ECR)-A During M60 105-mm projectile processing within the ECR a fire occurred along the miscellaneous parts conveyor. Fire was contained within the ECR. Changes made to the equipment and increased frequency of ECR cleanup of residual explosives. 17-Mar-93 JACADS (Chemical Event) Munitions demilitarization building (MDB) Ratheon Engineering and Constructors worker potentially exposed to mustard agent (HD). Worker developed blister(s) on leg after handling HD-contaminated waste materials. 23-Mar-94 JACADS (Chemical Event) Common stack Liquid incinerator (LIC) was being ramped down (controlled cooling operation) for slag removal. Minute amount of GB released via common stack. Technical investigation completed and operation procedures changed. 19-Nov-94 JACADS (Unusual Occurrence) ECR Detonation of rocket on fuze shear caused agent migration to observation corridor. All agent vapor contained under engineering controls and exhausted through the MDB charcoal filter units. aThe committee’s definition of a chemical event requires that the event result in actual or potential release of agent in an area where agent is not normally present or expected to be present. The committee categorized the January 1992, January 1993, and November 1994 incidents as unusual occurrences because no agent was released or migrated to areas where it was not supposed to be, and further, the potential of this happening was considered slight. Conversely, the March 1993 and March 1994 incidents were categorized as chemical events because both resulted in the release of agent into the environment. SOURCE: Excerpted from U.S. Army (2001c); see Appendix B. TABLE 2-2 Events on the PMCD List That Were Chosen by the Committee for Detailed Analysis Date Demilitarization Site and Army Classification Process Component Incident / Event Description by PMCD 8-May-00 TOCDF (Chemical Event) Deactivation furnace system (DFS) During processing of GB rockets the DFS interlock shut off all burners due to pollution abatement system air flow meter failure. ACAMS alarmed in the furnace stack during re-light of the furnace. No agent or munitions were being processed at time of the alarms. The perimeter monitors’ readings were all negative for agent. Investigation teams from CDC (Centers for Disease Control and Prevention), Department of Army Safety, and Utah DSHW (Division of Solid and Hazardous Waste) conducted the investigation of stack release. Technical investigation completed with recommended procedural and design changes. 3-Dec-00 JACADS (Chemical Event) DFS waste bin Chemical agent (VX) was detected and confirmed in the ash from the heated discharge bin at the DFS. The agent was detected during routine monthly sampling for metals as required by the RCRA (Resource Conservation and Recovery Act) permit. The bin was isolated and placed under engineering control, and subsequently the bin was fully enclosed under engineering control. SOURCE: Excerpted from U.S. Army (2001c); see Appendix B.
OCR for page 20
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities BOX 2-1 December 3-5, 2000, Johnston Atoll Chemical Agent Disposal System (JACADS) Event The destruction of the last agent-containing munitions on Johnston Island, M23 VX land mines, was completed on November 29, 2000. This marked the end of the operational phase of JACADS and the beginning of the closure phase. One of the first steps of closure was to process bulk solid waste (items such as spill pillows, rags contaminated with explosive or agent, metal hardware, rubber hoses, etc.) from the explosive containment room (ECR) through the deactivation furnace system (DFS). The material was processed using the standard 5X procedure (1000°F for 15 minutes) and the ash and unburned material produced placed in disposal bins. A bin was sampled monthly for agent analysis. Between 7:47 PM on Dec 2, 2000 and 12:56 AM on Dec 3, 2000, three spill-pillows (each containing approximately 20 pounds of liquid waste) were processed. How much of that was chemical agent VX is unknown. The spill-pillows contained talcum powder and an amorphous silicate absorbent. The 5X treated remains of the pillows, cardboard mines, fuses, and kicker chutes passed through the DFS and the non-combustible ash exited the heated discharge conveyor (HDC) to bin 135. At 8:06 AM on Dec 3, 2000 bin 135 was placed in the staging area (outside primary engineering control) with the lid open to cool. At 10:30 AM on Dec 3, 2000, a routine sample of the solid waste from bin 135 was taken for waste control limit (WCL) analysis and the bin lid closed. The analysis (12:30 AM Dec 4, 2000) indicated a suspected interference. An extraction analysis on the same sample confirmed the presence of VX at 3000 WCL at 1:56 AM Dec 5, 2000. A second sample was taken at 3:00 AM Dec 5, 2000 and analysis indicated 5045 WCL. At 4:30 AM Dec 5, 2000, bin 135 and two others were moved to the unpacking area for further monitoring. At 10:10 AM Dec 5, 2000, an automatic continuous air monitoring system (ACAMS) reading of 1476 time weighted average (TWA) was measured in air drawn from the bottom of bin 135. After another positive ACAMS reading, the site alarm sounded at 10:20 AM and all personnel were masked and sent to checkpoint “Charlie” for possible evacuation. Depot area air monitoring system (DAAMS) confirmation of VX in bin 135 was obtained at 3:00 PM Dec 5, 2000. The hazardous materials (HAZMAT) team began a series of checks of all other bins at 12:13 PM Dec 5, 2000 and found all readings less than TWA. The DFS kiln was restarted at 9:19 PM Dec 5, 2000 to maintain a negative pressure in the HDC waste bin enclosure. An all-clear was sounded at 9:39 PM. No agent was measured at the perimeter DAAMS tubes throughout the incident. The Chemical Event Report was submitted within 3 hours of the event and the JACADS field office and U.S. Army Chemical Activity Pacific made notifications to their respective field offices. The Program Manager for Chemical Demilitarization (PMCD) made telephone notifications to the Assistant Secretary of the Army for Installations, Logistics, and the Environment, the Department of the Army Safety Office and the Department of Health and Human Services, however no notification was given to Region IX, Environmental Protection Agency. PMCD initiated an investigation to protect evidence and gather information and assembled an investigation team on Johnston Island on Dec 13, 2000. The conclusions of the investigation team as summarized in the report were: “The process of sending VX contaminated liquid and saturated spill pillows to the DFS in excess of the decontamination capability of the furnace system appears to be the major cause of the chemical event. There are no other scenarios consistent with the physical evidence observed in bin 135 that could have resulted in the agent levels that were recorded during this chemical event. A faster response from the lab and a procedure that includes an action level for the exceedance of waste control limits would have reduced the amount of time bin 135 was outside of engineering controls. A detailed review of standard operating procedures for bulk solid waste fed to the DFS should be conducted. In addition, a narrower definition of what constitutes bulk solid waste should be developed.” SOURCE: Reprinted from U.S. Army (2001f). noted were false positive ACAMS alarms, which are discussed in some detail in Chapter 1. Thirty items were simple statements of fact that bore no relationship to the committee’s task, for example: “August 1, 1997—Former Chief Safety Officer, Steve Jones is ruled for in his Dept. of Labor Wrongful Termination Action. Judge awards Jones his job back and $500,000 or no rehiring and $1 million. Judge calls EG&G managers liars.” Four items appeared to be related to stockpile storage, and not to chemical demilitarization operations. Seventeen of the items on the CWWG list were identifiable as being related to incidents or events included on the PMCD list and were considered by the committee. For most of the items on the CWWG list, no specific documentation or details were included beyond one to a few sentences. The committee concluded that the majority of the items were not germane to its statement of task. Those that were relevant were typical of the ones from the PMCD list that the committee studied intensively. In conclusion, the committee determined that evaluation of additional items on the CWWG list would not materially influence the findings and recommendations of this report.
OCR for page 21
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities BOX 2-2 May 8-9, 2000, Tooele Chemical Agent Disposal Facility (TOCDF) Event During processing of rockets containing the chemical agent GB, at approximately 4:20 PM on May 8, 2000, a jam occurred in the lower feed gate of the deactivation furnace system (DFS) feed chute from the explosives containment room (ECR). Operators sprayed water into the chute in an attempt to clear the feed gate jam. The last of the material in the furnace had cleared the DFS and the heated discharge conveyor (HDC) by 5:30 PM. At approximately 6:10 PM the pressure was lowered in accordance with non-normal operating plans. An alarm indicating high air flow rates through the DFS and pollution abatement system went off at 8:20 PM and by 8:42 PM pressure fluctuations were affecting the operation of the DFS induced draft fans. Meanwhile, at approximately 8:30 PM, personnel entered the area to inspect the feed chute and found enough debris to fill a coffee can. The decision was made to wash down the chute. With several openings and closing of the feed gates and spraying with water, the pressure controlling equipment was unable to stabilize the pressure in the kiln. The DFS operator took manual control in attempting to stabilize the pressure. The wash down of the chutes was completed by about 9:30 PM. The maintenance personnel then changed the strainers in ECR - B and placed approximately one pound of agent contaminated waste on the upper feed gate (this was the source of the agent that eventually was monitored in the stack, but the operators were unaware of its presence). The DFS operators continued to have difficulty stabilizing the furnace system. About 10:00 PM the DFS burners were automatically shut down and operators locked out by a malfunction signal sent by the DFS exhaust flow meter. While seeking approval to by-pass the lock out of the burners and restart the afterburner, the common stack automatic continuous air monitoring system (ACAMS) alarmed at 11:26 PM. The site was immediately masked. A depot area air monitoring system (DAAMS) tube was taken for analysis at 11:38 PM and another put in its place. ACAMS readings as high as 3.63 allowable stack concentration (ASC) were obtained. The furnace was “bottled up” (dampers closed to slow airflow) at 11:44 PM. By 12:18 AM on May 9, 2000 the ACAMS had cleared and the order to unmask given. Restarting of the DFS afterburner was attempted again at 12:23 AM, but the furnace went to a negative pressure and fluctuated once again. Another burner lockout occurred this time because the clean liquor pump was not running. At 12:28 AM, the DFS duct ACAMS alarmed and the site was masked again and the furnace was “bottled up” at 12:32 AM. The alarm cleared and the site was unmasked at 1:07 AM. DAAMS tubes from the perimeter were collected around 6:55 AM and subsequent analysis showed no detectable agent. The analysis of the stack DAAMS tubes indicated a stack release of 18-36 mg. The TOCDF control room notified Deseret Chemical Depot (DCD) emergency operations center (EOC) at 11:30 PM on May 8, 2000 following the stack ACAMS alarm and updated the report at 11:42 PM with the highest readings and the fact that the duct ACAMS had also alarmed. They further notified the DCD EOC at 12:25 AM on May 9, 2000 that all ACAMS had cleared and that DAAMS analysis was pending. At 12:32 AM the DCD EOC was informed that the stack ACAMS were back in alarm and at 1:17 AM that DAAMS tubes from the first set of alarms confirmed the presence of agent GB. At approximately 3:00 AM on May 9, 2000 notification was made by the DCD EOC to the Utah Department of Environmental Quality (DEQ) and at approximately 3:34 AM to the Tooele County dispatcher. The event was classified as a Limited Area Event (not likely to leave the site). No action was taken by the state or county until normal business hours on May 9. Investigations were conducted by the TOCDF contractor EG&G, the Army Safety Office, the Centers for Disease Control and Prevention (CDC), and the Utah DEQ. Suspension of agent burning was initiated and stayed in effect until corrective actions recommended by the reports were made and approved by the Utah DEQ. The CDC report concluded that there was neither an impact to the health of TOCDF workers nor the general public. Subsequent computer modeling indicated that no harm to humans would occur beyond 8 ft. past the top of the 200-ft. common stack. Resumption of operations in the two liquid incinerators and the metal parts furnaces (none of which were involved in the event) followed approval on July 28, 2000. Approval to resume operations in the DFS was given September 29, 2000. SOURCE: Compiled from Utah DEQ (2000a), U.S. Army (2000a,b), and CDC (2000). Notice of Violation Reports The Notice of Violation reports issued by the Utah Department of Environment Quality (DEQ) for TOCDF contained a total of 69 items. These often differ in nature from the events listed by PMCD and others, in that they were mainly failures to observe and follow prescribed procedures, and, in general, did not lead to chemical events. Table 2-3 shows the frequency of occurrence of each type of violation reported by DEQ. Although many of these violations were classified by the committee as minor, they are important as indicators of
OCR for page 22
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities TABLE 2-3 Committee’s Classification of 69 Items Cited in Notice of Violation Reports Violation Type Number Operational error (wrong feed, missed analysis, use of faulty equipment) 20 Failure to test/inspect on schedule 13 Failure to follow plans/procedures/specifications 11 Failure to keep correct records 7 Improper storage 5 Storage time limits exceeded 5 Incorrect labeling of waste 2 Failure to notify of changes 2 Other 4 systemic operating problems. Record-keeping errors or instances of exceeding time limits for testing or inspection, which tend to occur in all complex processes, may be indicative of insufficient resources devoted to the tasks to be performed, or lack of priority setting to prevent such “minor” infractions. The committee considered each of these as it developed its findings and recommendations. ANALYSIS OF SELECTED CHEMICAL EVENTS The committee’s analysis was conducted on several levels. First, members investigated the causal factors for each of the seven events listed in Tables 2-1 and 2-2. They then developed a notional causal tree for each of the two events in Table 2-2 that were analyzed in depth. For illustrative purposes, a causal tree developed by the committee for the December 3-5, 2000, incident at JACADS appears at Appendix F. The tree is a standard tool in reliability analysis and is particularly useful in human reliability analysis where operator actions contribute either positively or negatively to an incident. Lastly, the committee provides a series of general and specific observations about the events. Causal Factors The committee’s analysis of the seven chemical events listed in Tables 2-1 and 2-2 showed that there were multiple causal factors for all of the selected events. (Note: the committee could determine causal factors only for incidents for which sufficient investigation data were available.) Rather than being specified for each incident, the causal factors identified by the committee are grouped into the following generic categories: Standard operating procedure (SOP) deficiencies, including nonexistent SOP(s), inadequate SOP(s), and SOP(s) being circumvented or ignored as a routine operating practice. Such deficiencies contributed to 6 of the 7 incidents subjected to in-depth review (Table 2-4) and were noted as being involved in at least 14 of the incidents that received less thorough review by the committee. Note also that 11 of the 69 items in the Notice of Violation reports (see Table 2-3) involved similar failures to follow procedures. Several incidents involved multiple SOP deficiencies, and in one, the March 17, 1993, incident in which a worker was exposed to HD, at least six SOP deficiencies were noted, including: No procedures for loading/handling bags. Placing HD sludge in plastic bags. Tagging bags improperly. No pre-entry hazards briefing. Improper carrying of bags. Failure to wear proper personal protective equipment. Following existing SOPs could have prevented several of the incidents that occurred at both TOCDF and JACADS. However, the non-compliance with SOPs was not a question of operators being contrary. Most operators were in fact trying to smooth or simplify the process by using non-approved methods, and had presumably been reinforced in this approach by past experiences. SOPs are not always perfect, for example, in that they apply to conditions not quite met at the particular time they are required. If the safe alternative is to stop work whenever an SOP is not exactly appropriate, that may not always be apparent to the operator. Failures of communication, including failure to communicate essential information, failure to heed communicated information, and inadequate communication systems, contributed to four of the incidents reviewed in-depth by the committee, and to at least five others. The March 17, 1993, and May 8, 2000, incidents could have been prevented had communications failures not occurred. In the March 17, 1993, incident, the supervisor of the work group noted that a bag containing HD waste was leaking and communicated this information to the individual handling the bag. The warning was not heeded, and subsequently the contents leaked onto the individual who was carrying the bag. In the May 8, 2000, incident, the control room supervisor was not informed that the agent strainer was to be changed during a demilitarization protective ensemble entry to clear the lower feed gate, or that the agent-contaminated strainer was being placed on the gate. During the course of this event, at many points the operator performed actions that were later seen to have been unfortunate. This suggests that the design of the system displays was not adequate to obtain an integrated overview of what was happening. This fact was recognized after the incident and a new single-screen display was developed to assist operators. However,
OCR for page 23
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities TABLE 2-4 Frequency of Causal Factors in the Seven Incidents Analyzed by the Committee Causal Factors Date SOP Deficiencies Communication Failure Unexplained Human Error Equipment Malfunction Design Deficiency Improper Technique Mind-set 21-Jan-92 1 1 2-Jan-93 1 1 1 17-Mar-93 6 1 1 1 1 2 1 23-Mar-94 1 4 2 19-Nov-94 1 1 1 1 3 1 8-May-00 2 2 1 1 1 1 3-Dec-00 3 1 1 2 TOTAL 14 5 2 3 11 4 9 during the committee’s visit, the operator and supervisor took about 10 minutes to find this screen, suggesting that it is not often used. Also, when the screen was located, it was found to be an all-text display, rather than an analog or pictorial representation. All-text displays are good for obtaining detailed information but poor for obtaining an integrated view of changing situations or conditions. The implication is that the fix was not a great improvement over the existing system. Unexplained human error is a category that describes human actions that were wrong for no reason recorded in the investigation reports or for which there is no apparent explanation. One example is the operator who assembled a piece of equipment incorrectly. The committee suspected that a more complete investigation would reveal causes for such errors. Equipment malfunction refers to the failure of equipment to function as designed but does not include design deficiencies. Contributing to three of the seven incidents subjected to in-depth review, and to at least nine other incidents, these failures ranged from simple tearing of waste bags to breakdowns of critical instrumentation such as flow meters and sensors. The committee noted that in virtually every incident involving equipment malfunction, there was a precursor, for example, installation of a flow sensor on the wrong side of a water flow control solenoid (design deficiency). Design deficiency applies to equipment or facilities found to perform operating functions inadequately as a result of their poor design. In several incidents examined by the committee, entrainment of agent into nonagent areas by personnel leaving a demilitarization protective ensemble entry could have been avoided if a timed interlock had been designed into transitional airlocks to ensure sufficient purging of airlock. Design deficiencies were found to have contributed to six of the seven incidents reviewed by the committee and to at least five others. Although a higher frequency of design deficiencies might be expected in the early phases of an operation, this does not appear to have been the case for either TOCDF or JACADS—at least based on the information that was available to the committee. The committee notes, however, that one of the chemical events it examined was directly attributable to failure to capture and implement at TOCDF design changes made at JACADS. Improper technique refers to a manner of performing tasks that causes either a hazard or a malfunction. An example is using equipment for purposes other that those dictated by design, as occurred in the May 8, 2000, incident at TOCDF in which the water spray nozzles designed for cooling the deactivation furnace system (DFS) lower feed gate were used to clean the gate when jams occurred. Since the nozzles were operated at low pressure, operators used significant quantities of water in attempts to clean or clear the feed gate and the water vaporized, causing fluctuations in pressure and in the flow rate in the DFS. While these factors were not frequent, they contributed to several incidents. Mind-set refers to the mental attitude people have about the process of disposal and the state of the system during processing. In the incidents studied, people behaved at times as if they assumed that an ACAMS alarm was false, that contaminated waste was less hazardous than raw agent, or that parts coming through a furnace were automatically 5X material.2 During its review of incidents, the committee 2 5X refers to a level of decontamination at which solids may be released for general use or sold (e.g., as scrap metal) to the general public in accordance with applicable federal, state, and local regulations. There is a misconception that 5X means simply that the solid has been placed in a temperature zone of 1000°F or higher for 15 minutes. To achieve a 5X level of decontamination a solid must be heated to 1000°F and maintained at that temperature for 15 minutes.
OCR for page 24
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities invariably found itself engaged in discussions of the mind-set(s) prevalent at the time of the incident(s). Mind-set was involved in every incident the committee reviewed in depth, and it contributed significantly to several others. Perhaps the most troubling was what the committee referred to during its deliberations as the “false positive mind-set.” False positive ACAMS alarms have been frequent at both JACADS and TOCDF and have caused people at both sites to assume that any alarm without a readily apparent cause is false—an assumption that has, in turn, fostered other failures and delays in addressing and responding to events. Table 2-4 summarizes the results of the committee’s analyses, indicating the frequency with which the causal factors outlined above contributed to the severe incidents closely examined by the committee. Causal Tree Analysis of Two Events For the two events it examined that were sufficiently documented to allow a detailed analysis, the committee charted activities in the sequence of events leading to each incident, either as a time line or as a causal tree (see Appendix F). A standard tool in reliability analysis, the causal tree or event tree is particularly useful in analyzing incidents to which operator actions contribute either positively or negatively. Figure F-1 in Appendix F shows the causal tree for the December 3-5, 2000, event at JACADS. The committee recognizes that such trees are designed at the discretion of the analyst and should not be construed as reflecting scientific certainty. Figure F-1, as well as a similar analysis by the committee of the May 8-9, 2000, event at TOCDF, suggests that the incidents examined by the committee grew from normal activities into potentially dangerous events. The activities charted can be categorized as ranging from normal operations through system response. In addition, some can extend back in time before the occurrence of the incident, e.g., latent failures. Normal tasks—that the system was attempting to accomplish before the adverse event occurred. Examples are maintenance and operations. Latent failures—conditions present in the system for some time before the incident, but evident only when triggered by unusual states or events. Examples include equipment design deficiencies, unexpected configurations of munitions, or routine ignoring of standard operating procedures. Active failures—events before which there were no adverse consequences and after which there were. Active failures are usually the result of personnel decisions or actions. These same actions may have resulted in safe outcomes on previous occasions, but in the incidents examined by the committee, such actions combined with latent failures to cause some adverse consequences. Examples of active failures include use of the wrong procedure, incorrect performance of an appropriate procedure, or failure to correctly and rapidly diagnose a problem. Immediate outcome—the adverse state the system reached immediately after the active failure. Examples are release of agent, plant damage, or personal injury. Reporting and investigation flow charts supplied by the Army indicate that the severity of outcome often determines the incident’s prominence for managers, the workforce, or the community, which in turn drives subsequent responses. Incidents with more salient outcomes naturally receive more scrutiny, which may bias the data set used for analysis. System responses—actions taken to correct the effects and anticipate the aftereffects of an adverse outcome. Following each event, there is a system response that also needs to be analyzed. How did the system for incident response function? How did the management act to improve safety? Was an exposed worker properly treated? Were communities notified appropriately? How did the plant return to a normal state? How rapidly did it return? Finally, how was the system changed in light of the incident? This stage of analysis is considered in Chapter 4. General Observations Based on its review, the committee believes that the chemical events and other serious incidents examined at JACADS and TOCDF have been honestly investigated and reported. Even so, the investigation reports that were available to the committee did not always reflect the complete set of factors that caused or contributed to the cause of events. Likewise, the investigation team(s) may not have used the most appropriate methodologies for collecting, analyzing, and reporting the events. In particular, the committee saw little evidence of the use of formal methods, such as event tree analysis, and little involvement of human factors engineering even though most of the incidents reviewed by the committee had a component of human behavior as a causal factor (see Table 2-4). The committee found inconsistencies in the form and format of investigation reports within and between chemical demilitarization sites. Finally, the committee noted that complete documentation supporting incident investigations was not always retained with the reports or in a report file. For example, a videotape relevant to the December 3, 2000, incident at JACADS could not be located for the committee to view. During its in-depth review, the committee observed differences in the types and completeness of entries made in JACADS and TOCDF operating logs (deactivation furnace system, demilitarization protective ensemble, control room,
OCR for page 25
Evaluation of Chemical Events at Army Chemical Agent Disposal Facilities and so on). The variations were largely attributable to individuals who made the entries, which suggests that some training relative to the nature, content, and detail of entries into operating logs would be appropriate. Error-correction deficiencies were also noted in the operating logs. Specific Observations In conducting its detailed examination, the committee observed patterns of causal factors or categories of activities, such as latent and active failures, that appeared to recur over significant time periods. Deficiencies in standard operating procedures, which can be readily identified and corrected and should decline with time and operating experience, were the most notable. Based on the information available to the committee, it appears, however, that the frequency of SOP deficiencies in the incidents examined did not decline with time. This might suggest that any lessons learned from past experience are being interpreted too narrowly (Chapter 4) or that the need for improvement in this area is not being recognized. As noted earlier, following an SOP may not appear to be the correct choice to an operator. This is particularly true when the operator has a limited perspective on the task and so does not understand the reasons why a procedure that looks unnecessarily complex is indeed appropriate. This circumstance argues again for operator knowledge in addition to rule following. As in any complex system, there are likely still undetected design deficiencies at TOCDF, and, most certainly, systemization at new chemical demilitarization facilities will uncover other design deficiencies. Active communication between and among chemical demilitarization facilities via the programmatic lessons learned (PLL) program (Chapter 4) is key to ensuring that design deficiencies are detected and corrected. Equipment failure may be random, but it is certainly preventable. Excellent maintenance, equipment monitoring, and preventive maintenance practices can dramatically reduce equipment malfunctions at a lower overall cost than that incurred in an unanticipated shutdown. Many industries have found that investment in these practices can provide reductions in overall costs. Equally, human errors are preventable, even if they appear to be random. Better knowledge of human functioning in complex situations (human factors engineering) shows how equipment design, workforce knowledge, and management environment can contribute to human error, or to its reduction (Reason, 1997). Industry experience has shown that a well-trained and vigilant workforce, and vigorous and effective management and supervision, committed to creating an environment in which safety is always first, will help to minimize human errors and any ensuing events that might be caused or initiated by them. Similarly, the human component of failures in communication and improper tech- BOX 2-3 An Example of Negative Effects of Mind-set The committee highlights a sentence in an investigation report that begins the section titled “Air Monitoring of 5X Material”: “The waste located in BIN 135 was designated 5X by the process. Therefore, there was no requirement to monitor for an airborne agent hazard” (U.S. Army, 2001f). Although it agrees that the process had been demonstrated to be capable of producing 5X [decontaminated] material, the committee asserts that the waste bin enclosure should have been actively monitored to ensure that 5X destruction was being achieved on a continuous basis. To the committee, this case is not different from that of the liquid incinerator, where “6 nines” destruction efficiency has been demonstrated but does not obviate the need for monitoring to ensure that the operating requirements are achieved. It was known that certain materials could pass through the deactivation furnace system without complete combustion (e.g., rolled-up coveralls), and thus, the operating assumption regarding 5X decontamination was known to be erroneous in some cases. This assumption also led to employees being sent on two occasions to deal with the waste bin with an inappropriate level of personal protective equipment, and the “false positive” mind-set led to delays in reporting the results of monitoring. niques can be greatly reduced, if not eliminated, through the development of a strong safety culture in the chemical demilitarization work environment. The “crying wolf” phenomenon of a decreased willingness to respond after repeated false alarms is an expected, and sensible, human behavior, but one that must be discouraged in chemical demilitarization operations by appropriate training and a recognized reward structure. The committee also discussed “waste mind-set”—the attitude or belief among employees and management at both JACADS and TOCDF that waste processing and/or handling is less hazardous than agent processing. This mind-set has led to notable deficiencies in SOPs for waste handling and contributed significantly to several incidents. Even though mind-set cannot be considered to be the root cause of any of the incidents reviewed by the committee, it is a prevalent factor (see Table 2-4) and a significant issue, as the December 3, 2000, deactivation furnace system waste bin incident at JACADS illustrates (U.S. Army, 2001f) (see Box 2-3). The most difficult challenge facing those operating future demilitarization facilities will be overcoming, or preventing the development of, mind-sets that lead to an adverse chemical event or contribute to the severity, magnitude, and consequences of such an event. This challenge is also important to bear in mind as sites transition from agent disposal operations to decommissioning and closure.
Representative terms from entire chapter: