Sled Track Type b Report Final

7/30/2019 Sled Track Type b Report Final

1/51

D

National Nuclear Security Administration

Sandia Site Office

Type B Accident Investigation

Employee Injured when Rocket MotorUnexpectedly Fired on October 9, 2008

at the Sandia National LaboratoriesTechnical Area III Sled Track

November 2008


2/51


3/51

TABLE OF CONTENTS

PageTABLES................................................................................................................ iiFIGURES.............................................................................................................. ii

ACRONYMS........................................................................................................ iii

EXECUTIVE SUMMARY......................................................................................11.0 BACKGROUND ......................................................................................1-1

1.1 NNSA/Sandia Site Office.....................................................................1-11.2 Sandia National Laboratories ..............................................................1-11.3 Sled Track Facility Description ............................................................1-11.4 Technical Management SolutionS, Inc. ...............................................1-21.5 Scope and Methodology......................................................................1-2

2.0 ACCIDENT DESCRIPTION AND CHRONOLOGY OF EVENTS............2-12.1 Accident Description............................................................................2-12.2 Emergency Response .........................................................................2-42.3 Description of Injuries ..........................................................................2-4

2.4 Emergency Preparedness ...................................................................2-42.5 Photographic Record of the Accident Scene .......................................2-5

3.0 ACCIDENT ANALYSIS ...........................................................................3-13.1 Measurements, Photos and Physical Evidence at Accident Scene .....3-13.2 Technical Assistance Team (TAT).......................................................3-13.3 Disassembly of Test Sled and Measurements.....................................3-13.4 TAT Assessment of Potential Causes of the Rocket Ignition...............3-23.5 TAT Determination of Potential Causes of the Rocket Ignition............3-2

4.0 MANAGEMENT SYSTEMS EVALUATION.............................................4-14.1 DOE Oversight ....................................................................................4-14.2 Explosives Safety Program Implementation ........................................4-1

4.2.1 Explosives Safety Analyses..........................................................4-14.2.2 Explosives Safety Compliance .....................................................4-2

4.3 Sandias Integrated Safety Management System................................4-44.3.1 Core Function 1, Define the Scope of Work .................................4-44.3.2 Core Function 2, Analyze the Hazards.........................................4-44.3.3 Core Function 3, Develop/Implement Controls...........................4-114.3.4 Core Function 4, Perform Work Safely.......................................4-114.3.5 Core Function 5, Feedback and Improvement ...........................4-12

5.0 CAUSAL FACTORS................................................................................5-15.1 Direct Cause........................................................................................5-15.2 Root Cause..........................................................................................5-1

5.3 Contributing Causes............................................................................5-16.0 CONCLUSIONS AND JUDGMENTS OF NEED .....................................6-17.0 BOARD SIGNATURES...........................................................................7-18.0 LIST OF BOARD MEMBERS, ADVISORS AND STAFF ........................8-1

Appendix A Appointment of Type B Accident Investigation Board................. A-1Appendix B Barrier Analysis .......................................................................... B-1Appendix C Change Analysis ........................................................................C-1

i


4/51

TABLES

Table ES-1 Conclusions and Judgments of Need........................................ES-2

Table 2-1 Event Chronology Table...............................................................2-1

Table 4-1 Consequence Guidelines .............................................................4-6

Table 4-2 Frequency Guidelines...................................................................4-6

Table 4-3 Risk Bins for Onsite Receptors.....................................................4-7

Table 4-4 Hazard Assessment for Area III Sled Track Complex...................4-8

Table 6-1 Conclusions and Judgments of Need...........................................6-1

Table B-1 Barrier Analysis Table ................................................................. B-3

Table C-1 Change Analysis Table................................................................ C-3

FIGURES

Figure 1-1 Accident Investigation Terminology..............................................1-3

Figure 2-1 Representative rocket motor and test package ............................2-5

Figure 2-2 Position of rocket and test package after accident .......................2-5

Figure 2-3 HiCapPen with LED module installed and illuminated..................2-6

Figure 2-4 Post accident MDM25 connector..................................................2-6

Figure 2-5 Post accident LED module with black electrical tape....................2-7

Figure 2-6 TAT Schematic Analysis...............................................................2-7

Figure 2-7 HiCapPen connection to sled track side box ................................2-8

Figure 2-8 Post accident sled track side box .................................................2-8

Figure 2-9 Post accident wiring to sled track .................................................2-9

Figure 2-10 Pre-accident grounding connections ............................................2-9

Figure 4-1 Validation and Qualification Sciences Experimental Complex,Quality Assurance Plan and Work Controls Program...................4-5

ii


5/51

ACRONYMS

ACLS Advanced Cardiac Life Support

AF Arming and Firing

CFR Code of Federal Regulation

CO Console OperatorCPR Corporate Process Requirement

DOE Department of Energy

EED Electroexplosive Devices

EMT Emergency Medical Technician

ERT Emergency Response Team

ESD Electrostatic Discharge

ES&H Environmental, Safety & Health

FR Facility Representative

GIF Gamma Irradiation Facility

HA Hazard Analysis

IN Instrumentation Technician

ISM Integrated Safety Management

ISMS Integrated Safety Management System

IWP Integrated Work Plan

JON Judgments of Need

KAFB Kirtland Air Force Base

LED Light Emitting DiodeMOR Management Operational Review

NNSA National Nuclear Security Administration

OP Operating Procedure

ORPS Occurrence Reporting and Processing System

PHS Primary Hazard Screening

PPE Personal Protective Equipment

RBO Risk-Based Oversight

RF Radio Frequency

SA Safety Assessment

SNL/NM Sandia National Laboratories/New Mexico

SSO Sandia Site Office

ST Mgr Rocket Sled Track Complex Manager

TA-III Technical Area III

TAT Technical Assistance Team

iii


6/51

TE Test Engineer

TMSP Test and Maintenance Support Personnel

TMSS Technical Management SolutionS, Inc.

TQP Technical Qualification Program

TSOP Test Specific Operating ProcedureUNMH University of New Mexico Hospital

VQSEC Validation and Qualification Sciences Experimental Complex

iv


7/51

EXECUTIVE SUMMARY

On the afternoon of October 9, 2008,a sled track test was to be performedinvolving a sled that consisted of a

test package connected to the frontof a Super Zuni rocket motor. Thepurpose of the test was to recordthermal battery output during theimpact with the target.

At approximately 4:45 pm, one of theArming and Firing Technicians(AF1), a TMSS employee, wasinstalling a Light Emitting Diode(LED) module into a MDM25connector on the top of the testpackage when the rocket motorunexpectedly fired. AF1 washospitalized with a broken leg andfirst and second degree burns mostlyto his hands and arms.

Analysis

The direct cause of the injury wasthe inadvertent ignition of the SuperZuni rocket motor. If therequirements of the DOE Explosives

Safety Manual had been properly

implemented, the rocket motor wouldnot have ignited. The severity of theburn injury could have been reduced

if the worker had been wearing along sleeved cotton shirt as requiredby the Operating Procedure. TheSandia Integrated SafetyManagement System was notadequately implemented for thisseries of tests. Analysis of thehazards associated with this seriesof tests did not result in operatingprocedures and practices thatprecluded ignition of the rocket

motor. Sufficient energy to fire therocket was provided by an internalbattery in the test package. Explicitcontrols were not provided to ensurethat the energy in the test packagecould not ignite the rocket motor.

The Board concludes that thisaccident was preventable. Sandiadid not provide sufficient oversight ofthe Sled Track Operations to ensurethat requirements were appropriatelyimplemented.

ES-1


8/51

Table ES-1. Conclusions and Judgments of Need

Conclusions Judgments of Need

The Board concludes that the safetyanalyses used to support the MC4152Thermal Battery Rocket Sled Testing were

not performed in sufficient detail toadequately address all scenarios associatedwith this accident.

The Board concludes the test series setupdid not provide for adequate grounding andbonding.

The Board concludes that based on the workpractices described in the OP and testimonyof the workers, management did notadequately educate and train employees inthe hazards and precautions required for

handling explosives and materials used inconjunction with explosives operation.

The Board concludes the OPs for this sledtrack test series were derived from the OPsfrom previous similar tests. Additionalhazards analysis specific to this test serieswere not documented and used during thedevelopment of the OPs for this specific testseries.

The Board concludes the cited probabilityreduction in the SA from Anticipated to

Extremely Unlikely was not supported bythe identification of specific design featuresor engineered barriers to minimize theprobability of the analyzed scenarios.

The Board concludes that because theaccident under review involves workers inclose proximity to the rocket, the reduction inseverity of the consequence would not beconsistent with the qualitative analyticalmethod described in the SA.

The Board concludes that, based on an

unmitigated scenario, the likelihood shouldbe substantially higher than BeyondExtremely Unlikely. According to the HA, ifthe frequency had been assessed asAnticipated or Unlikely, this activity wouldhave been within the Risk Rank of I or II andwould have been carried forward foradditional identification and discussion.

Sandia needs to develop and implementa plan to fulfill their responsibilities under10 CFR 851, Worker Protection and theDOE M 440.1-1A, Explosives SafetyManual to control explosives hazards.

ES-2


9/51


The Board concludes hazards specific to thistest series were not fully analyzed and wereinformally discussed with the workers.

The Board concludes that if implementation

of the hazard assessment processes hadmore thoroughly identified hazardsassociated with this test series, requiredhazard controls could have been moreclearly identified and followed by theworkers.

The Board concludes the controls werebased on historical operations and not adetailed analysis of the rocket sled testseries as required by ISM.

The Board concludes that the actions of the

workers involved with this test series did notdemonstrate an understanding of conduct ofoperations principles.

The Board concludes that identified practicesrepresent a normalization of deviation fromestablished explosives safety work practices.

Sandia management needs to ensure

violations of explosives safetyrequirements and deviations fromestablished practices are detected andcorrected.

The Board concludes that SSOs efforts toimprove Sandias safety and healthperformance is an ongoing challenge.

SSO needs to evaluate the effectivenessof its RBO of explosives operations andfacilities.

ES-3


10/51

1.0 BACKGROUND

The organizations related to thisaccident were the National NuclearSecurity Administration Sandia SiteOffice (NNSA/SSO), Sandia

Corporation (Sandia) and TechnicalManagement SolutionS, Inc.(TMSS). A brief description of eachorganization is provided in thissection.

1.1 NNSA/Sandia Site Office

The NNSA/SSO provides oversightof Sandias activities and implementsthe Department of Energy (DOE)contract with Sandia. In addition, the

DOE/NNSA Service Center isavailable to provide support to theNNSA/SSO.

1.2 Sandia NationalLaboratories

Sandia is a national securitylaboratory involved in a variety ofresearch and development programsto help secure a peaceful and freeworld through technology. Sandia

develops technologies to sustain,modernize, and protect the UnitedStates nuclear arsenal, prevent thespread of weapons of massdestruction, defend againstterrorism, protect nationalinfrastructures, ensure stable energyand water supplies, and provide newcapabilities to the United Statesarmed forces.

1.3 Sled Track Facility

Description

The Sled Track Test Site is afederally-funded basic research anddevelopment facility and operatesunder the programmatic direction ofthe DOE Headquarters. The SledTrack Test Site is one of numerous

federally-owned facilities situated onland owned by the DOE. The SledTrack Test Site is located on Kirtland

Air Force Base (KAFB),Albuquerque, NM.

The Sled Track Complex supportsthe verification of design integrity,performance, and fusing functions ofweapon systems through thesimulation of high-speed impacts ofweapon shapes, substructures, andcomponents. Sandia NationalLaboratories, New Mexico (SNL/NM)test facilities such as the Sled TrackComplex have been specificallydesigned for the validation of

analytical modeling and thefunctional certification of weaponssystems. The facility is also used tosubject weapon parachute systemsto aerodynamic loads to verifyparachute design integrity andperformance. In addition, SandiaEnergy & Environment Programsuse the Sled Track Complex to verifydesigns in transportation technology,reactor safety, and Defense

Programs transportation systems.

Technical Area III (TA-III) isapproximately 5 miles south ofTechnical Area I in the southwestportion of KAFB. Approximately 200people work in the area, which iscomposed of 20 test facilitiesdevoted to large-scale physicaltesting and simulation of a variety ofnatural and induced environments.Over 150 structures are located

within TA-III, most of which aregrouped in small units separated byextensive open spaces.

Operations at the Sled TrackComplex include a variety of testsand test article preparation such asconducting rocket sled and rocket

1-1


11/51

launcher tests, free-flight testing, andexplosives testing. Each rocket sledtest involves the acceleration of arocket down a sled track. A test mayinvolve impacting an object onto a

target, or launching a parachute froman ejector accelerated along thetrack. Each explosive detonation isused to subject test articles to shockwaves and propel missiles into testarticles. Rocket launches are used toaccelerate test objects along a beamon a carriage that is stopped at theend of the beam, releasing testobjects into free flight at specifictargets. In free-flight launches, test

objects are launched directly intofree flight from portable launch rails.

1.4 Technical ManagementSolutionS, Inc.

TMSS, Inc. has been working withvarious government agencies forover 20 years. They provide a widerange of support and serviceapplications, consisting of:

Project Management support

Engineering support

General Technologists

System Program Administrators

Maintenance Planners

Technical Support Specialists

Project Support Specialists

Test and Maintenance SupportPersonnel (TMSP)

Under their contract with Sandia,TMSS provides maintenance andsupport of testing operations invarious test facilities of SNL/NM toinclude the Rocket Sled TrackComplex.

1.5 Scope and Methodology

The Accident Investigation Board(Board) was appointed on October14, 2008 (See Appendix A) andbegan the investigation that day.

The scope of the Boardsinvestigation was to identify allrelevant facts; analyze the facts todetermine the direct, contributing,and root causes of the accident;develop conclusions; and determineJudgments of Need (JONs). (SeeFigure 1-4 below for an explanationof accident investigationterminology). The investigation wasperformed in accordance with DOE

Order 225.1A,AccidentInvestigation, using the followingmethodology:

The accident scene wasinspected, physical evidence wascollected, and photographs weretaken of the scene.

Facts relevant to the accidentwere gathered throughinterviews, reviews of

documentation, and examinationof the physical evidence.

The facts were analyzed toidentify the causal factors usingbarrier analysis, change analysis,event and causal factors analysisand root cause analysis.

Conclusions and JONs weredeveloped to guide thedevelopment of corrective actions

that, if implemented, shouldprevent recurrence of similaraccidents.

1-2


12/51

Accident Investigation Terminology

A causal factoris an event or condition in the accident sequence thatcontributes to the unwanted result. There are three types of causal factors:direct cause(s), which is the immediate event(s) or condition(s) that caused theaccident; root cause(s), which is the causal factor that, if corrected, wouldprevent recurrence of the accident; and the contributing causal factors, whichare the causal factors that collectively with the other causes increase thelikelihood of an accident but which did not cause the accident.

Event and causal factors analysis includes charting, which depicts the logicalsequence of events and conditions (causal factors that allowed the accident tooccur), and the use of deductive reasoning to determine the events or conditions

that contributed to the accident.

Barrier analysis reviews the hazards, the targets (people or objects) of thehazards, and the controls or barriers that management systems put in place toseparate the hazards from the targets. Barriers may be physical oradministrative.

Change analysis is a systematic approach that examines planned or unplannedchanges in a system that caused the undesirable results related to the accident.

Figure 1-1. Accident Investigation Terminology

1-3


13/51

2.0 ACCIDENT DESCRIPTIONAND CHRONOLOGY OFEVENTS

2.1 Accident Description

On the afternoon of October 9, 2008,a sled track test was to be performedinvolving a sled that consisted of atest package connected to the frontof a Super Zuni rocket motor (SeeFigure 2-1). The test packageconsisted of two thermal batteriesand a hardened data recorder knownas the HiCapPen. The test packageand the rocket motor were mounted

on the west rail of the 10,000 footsled track at Station 47 (a point4,700 feet from the south end of thesled track). The objective was tolaunch the sled from Station 47 andimpact a target located at Station 32(a point 3,200 feet from the southend of the sled track). The purposeof the test was to record thermalbattery output during the impact withthe target.

At approximately 4:45 pm, one of theArming and Firing Technicians(AF1), a TMSS employee, wasinstalling a Light Emitting Diode(LED) module into a MDM25connector on the top of the testpackage when the rocket motorunexpectedly fired and proceededdown the track (See Figures 2-3 and2-4). AF1 was bending over the testpackage when the rocket fired. He

was thrown onto the test track andwas lying across both the east andwest rails. There were 3 other sledtrack personnel in the vicinity. AF2was standing near AF1 and west ofthe rails. An InstrumentationTechnician (IN1) was standing eastof the rails a few feet away and had

turned away from the test track topick up his equipment. The TestEngineer (TE) was standing east ofthe rails several feet away. The

rocket sled hit the target and came toa stop in the vicinity of Station 31.

When the smoke from the rocketexhaust cleared, AF2 saw that AF1was injured, and instructed TE to call911. AF2 and the TMSS fire crewmoved AF1 from on top of the tracksonto the ground on the west side ofthe test track. TE called the ConsoleOperator (CO) in Building 6741 andrequested that the CO call 911.

AF2, IN1, and TE did not attemptfirst aid. They tried to make AF1 ascomfortable as possible. They put afoam cushion behind AF1s headand some clothing materialunderneath his arms so he could resthis elbows. Because his arms wereburned severely and AF1 could notlay them down or put them acrosshis chest. AF1 rested his elbows

and held his forearms up in the air.AF2 stated it was obvious that AF1sleg was broken and there wasn'tanything AF2 could do.

AF2 was concerned that AF1 wasgoing into shock. AF1s breathingaccelerated and he kept asking forwater to drink. AF2 gave AF1 sips ofwater to try to keep him calm.

AF1 was wearing TMSS's company

attire consisting of safety boots,denim blue jeans, a denim short-sleeved shirt and baseball cap. Afterthe accident AF2 stated that he sawblack smoke marks and soot on

AF1s clothing and the sleeves ofAF1s shirt were tattered and torn.

2-1


14/51

Table 2-1. Event Chronology Table

Date Time Event

October 9,2008 AM At 11:00 a successful iteration of this sled track testseries. The test crew included TE, CO, AF1, AF2, IN1and IN2. IN2 installed the LED module for this test.

October 9,2008

PM AF1, AF2 and IN1 made connections to the wiresleading to the thermal batteries and fire sets andperformed a systems check to ensure they wereworking properly. The firing cable was shorted andgrounded. AF2 took possession of the fire set key.The thermal battery fire set cable from the sled wasdisconnected.

October 9,

2008

PM AF1 & AF2 team completed their rocket motor

transport and pre-arming sequence, which involvesinstalling the rocket motor on the sled track,connecting to the test sled, and shorting andgrounding the coaxial cable that is connected to therocket motor igniter.

October 9,2008

PM AF1 and AF2 contacted CO and informed him thatthey completed their tasks.

October 9,2008

PM CO announced on the radio that essential personnelmay reenter the area to complete their tasks.

October 9,2008

PM TE and IN1 return to sled area. IN1 connected hisinstrumentation system and interface control box to the

top of the sled and set the HiCapPen to a 5 minutedelayed activation state.

October 9,2008

PM IN1 disconnected his equipment from the connector onthe sled.

October 9,2008

PM IN1 requested AF1 to insert LED module into theconnector mounted on the test unit. IN1 was notpositioned to do the task and IN2 was not available.

October 9,2008

PM IN1 gave AF1 the LED module and screwdriver totighten down the connector.

October 9,2008

4:45 PM AF1 bent over the rocket sled to insert the LEDmodule.

October 9,2008

PM LED module made contact with connector housing thepin 4. AF2 heard a click.

October 9,2008

Accidentoccurs

Rocket ignited and AF1 was injured.

October 9,2008

PM AF1 landed across the rails. TE, IN1 and AF2 heardloud sound and feel the heat from the rocket.

October 9,2008

PM AF2 instructed TE to call CO to call 911.

2-2


15/51

October 9,2008

PM CO called 911.

October 9,2008

PM AF2 and TMSS fire crew helped move AF1 out oftrough.

October 9,

2008

Accident+

15 min

KAFB and SNL/NM emergency responders arrived on

scene.October 9,2008

Accident+30 min

AF1 airlifted to the UNMH.

October 9,2008

PM IN1 and AF2 went to UNMH because of ringing in theirears. Waited three hours and left without treatment.

October 14,2008

AF1 was hospitalized more than 5 days triggering aType B investigation in accordance with DOE Order225.1A,Accident Investigation.

2-3


16/51

2.2 Emergency Response

Nine minutes after receiving the 911call, KAFB Fire Department and the

SNL/NM Emergency ResponseTeam (ERT) arrived at the accidentscene. The emergency responsecrew included three EmergencyMedical Technicians Paramedics(EMT-P). KAFB Fire Departmentreached the site first and treated AF1for first/second degree burns andcompound fracture of the right femur.Paramedics then started anintravenous saline and morphine andplaced AF1 on a back board inpreparation for airlift by helicopter.The ERT located a staging area andlanding zone for the emergencyhelicopter. About 15 minutes afterKAFB and SNL/NM ERT arrived, thehelicopter arrived. AF1 was loadedinto the helicopter and the helicopterleft the scene en route to theUniversity of New Mexico Hospital(UNMH). AF2 and IN1 weretransported to UNMH complaining ofringing in their ears. TE refusedtransport and signed a refusal formfor the paramedics.

The ERT began to clean uphazardous waste such as blood,remaining bandages, and blood-borne pathogen protectiveequipment. The accident scene wasthen isolated by a barrier ofCaution tape by SNL/NM protective

force personnel. The SNL/NMprotective force maintained control ofthe accident scene until the Boardtook custody.

2.3 Description of Injuries

AF1 received a compound fracture tothe right femur, first and second

degree burns to both hands andarms, his face, and a 10 inchlaceration on his right thigh. His rightpants leg was torn and his clothing

was charred. AF1 received twosurgeries on his leg: the first surgeryoccurred on the evening of October9, 2008 to repair his femur and thesecond surgery occurred on October12, 2008 to clean up the fracturewound. His burns were treated andhe was expected to recover fully.

IN1 and AF2 waited in theemergency room at UNMH for 3hours without being seen by amedical professional. They decidedto go home.

2.4 Emergency Preparedness

The SNL/NM Emergency MedicalServices Program includes fivephysicians in the Urgent Care Clinicand three paramedics in addition tosix registered nurses and twomedical assistants. The Urgent CareClinic is equipped with two

ambulances for immediate transportfor patients requiring further care.There is a current contract with

Albuquerque Ambulance for back-uptransport of patients. Theparamedics that responded to theincident were Advanced Cardiac LifeSupport (ACLS) certified and theircertifications were current.

The attending physician at UNM

Hospital indicated the patient carecontributed to the effective treatmentand made Emergency Roomresponsibilities considerably easier.

2-4


17/51

2.5 Photographic Record of the Accident Scene

This section depicts the conditions at the accident scene.

Figure 2-1. Representative rocket motor and test package

Figure 2-2. Position of rocket and test package after accident

2-5


18/51

Figure 2-3. HiCapPen with LED module installed and illuminated

Pin #4

Figure 2-4. Post accident MDM25 connector

2-6


19/51

Figure 2-5. Post accident LED module with black electrical tape

Connector

J2-Pin 4

Ungrounded Rocket Body

Connector

J2-Case

1.2 ohm

10.8 VBattery

1.2 ohm

0.403 ohm 0.445 ohm

0.050 ohm ShuntConnector J3

Pin 5

Detonator Current = 10.8 volts (.297) = 1.97 amps > 1.5 amp all-fire

2 (0.813) ohms

LED Module

Initiators

0.30 ohm

0.20 ohm

Connector

J2-Pin 4

Ungrounded Rocket Body

Connector

J2-Case

1.2 ohm

10.8 VBattery

1.2 ohm

0.403 ohm 0.445 ohm

0.050 ohm ShuntConnector J3

Pin 5

Detonator Current = 10.8 volts (.297) = 1.97 amps > 1.5 amp all-fire

2 (0.813) ohms

LED Module

Initiators

0.30 ohm

0.20 ohm

Figure 2-6. TAT Schematic Analysis

2-7


20/51

Figure 2-7. HiCapPen connection to sled track side box

Figure 2-8. Post accident sled track side box

2-8


21/51

Figure 2-9. Post accident wiring to sled track (note oxidation on track rails)

Batteries Rocket Motor

NN

Telemetry Power Panel

Based on Pre-Accident Position of the Article

Copper Braided GroundCable; Looped to the Control

Room

HiCapPen Recorder

Ground points used pre-

accident

Ground cable to

nozzle

Wrist strap used for

installing C-Cable

leads

No Continuity toOxidized Rail

C-Cable with 20

gauge wire ground

and hot leads

HiCapPen EnableCable Signal Ground

Reported short to ground in

the telemetry box by the TAT

Post accidentshowed that this

ground was open to

the panel ground onoxidized rails.

Smart FireSetGround cable contected the

fireset, C-Cable fireset, and

ground wire to panels.

East Rail

West Rail

No continuity

between rails

Continuity

Figure 2-10. Pre-accident grounding connections (Board reconstruction)

2-9


22/51

3.0 ACCIDENT ANALYSIS

3.1 Measurements, Photos andPhysical Evidence atAccident Scene

On October 9, 2008, the Sandiainvestigative readiness team tookphotographs of the accident scene.On October 10, 2008, Sandia tookadditional photographs and madeelectrical measurements at theaccident scene. Preliminarymeasurements included the sledtrack rails, at the sled side boxes,and at the stop location on the sled

track.Starting October 14, 2008, the Boardtook additional photographs andelectrical measurements at theaccident scene and collectedphysical evidence such as wires,electrical cable, wire strippers, and asmall screwdriver. All photographsand measurements were analyzedby the Board (See Section 2.5). Apiece of physical evidence that was

not found at the time was the LEDmodule that AF1 was installing whenthe rocket ignited.

A search for the LED module wasnot initiated until the Board wasassured that all other physicalevidence and measurements hadbeen taken. On October 30, 2008, asearch team found the LED module(See Figure 2-5) approximately 250

feet north of Station 47 andapproximately 60 feet east of therocket sled track. Black electricaltape had been wrapped around theLED module (See Figure 2-5). Thepurpose of the tape was to shield theLED from sunlight in order to moreeffectively see the status of the LED

through the camera located north ofStation 47. According to testimonyfrom AF1, the presence of theelectrical tape on the LED module

did not make it difficult for him toinstall. The LED module wasprovided to the TAT for additionaltesting and analysis.

3.2 Technical Assistance Team(TAT)

Sandia formed a TAT to support theBoard. The TAT members wereselected from across SNL/NM tosupport the Board with technical

advice and analysis. To minimizepotential conflicts of interest, thepersonnel selected were notmembers of the organization thatexperienced the accident.

3.3 Disassembly of Test Sledand Measurements

On October 21, 2008, the Board metwith TAT members to discuss a planto disassemble the test sled package

and to determine appropriatediagnostic tests. On October 21 and22, 2008, the TAT, accompanied byBoard members, took diagnostic andelectrical measurements of thecondition of the rocket at the stoplocation at Station 31 on the sledtrack. On October 21, the femaleMDM25 connector on top of the testpackage was examined and a blackmark was observed near pin 4 that is

connected to the HiCapPen battery.This is the connector where AF1 wasattempting to insert the LED module(See Figure 2-4).

The test sled was towed back to theStation 47 firing location on October22 and electrical measurementswere taken with the test sled at

3-1


23/51

Station 47. Photographs were takenof the measurements process in bothlocations. After all accident scenemeasurements were taken by theTAT on October 22, the test sled

was towed to the end of the sledtrack, removed from the track, andtransported to Building 6736 fordisassembly and further diagnosticmeasurements in a more controlledenvironment.

On October 23 and 24, disassemblyand diagnostic tests of the sled testpackage occurred in the presence ofa Board member and photographswere taken of these activities. First,

the spent rocket motor wasunscrewed from the test sled. Theexposed forward end of the rocketmotor revealed that the interiorelectromagnetic barrier had beenremoved in order to expose theigniter wire as part of the test set up.The igniter wire was present but notconnected to the igniter. AF2 saidthis is not uncommon after the rockethas been fired. Next, the test

package (HiCapPen and thermalbatteries) was removed from the sledand placed on a work table. Thethermal batteries were separatedfrom the HiCapPen and the wiringharness from the HiCapPen to thefemale MDM25 connector wasremoved and provided to the TAT foradditional testing and analysis.

On October 24, the HiCapPen wasconnected to a laptop computer and

an attempt was made to downloadthe data from the HiCapPenmemory. Because the HiCapPenhad not armed, no data had beenrecorded.

During the week of October 27, theTAT took further measurements at

the accident scene and found anunexpected earth ground in thetelemetry sled side box which lateranalysis showed contributed to theignition of the rocket (See Figure 2-

10).3.4 TAT Assessment of

Potential Causes of theRocket Ignition

Using the measurements gathered atthe accident scene and informationon the sled test package, fire setcable, and test sled side boxes, theTAT developed a circuit graphic forthe test setup at the time of theaccident (See Figure 2-6). The TATalso developed a schematic of thetest package circuitry. The TATanalyzed this schematic for potentialignition sources within the test setup.In addition to the development of thecircuit analysis, the TAT alsoanalyzed other scenarios that couldhave ignited the rocket:

rocket propellant self-initiation,

radio frequency and

electromagnetic energy inducedcurrent to the igniter circuitry(e.g., from radios, cell phones,electrical power lines, etc.),

thermal battery initiation of therocket motor,

firing set initiation of the rocketmotor, and

electrostatic discharge (ESD)initiation of the rocket motor.

3.5 TAT Determination ofPotential Causes of theRocket Ignition

On October 27, 2008, the TATbriefed the Board on the results oftheir measurements, data gathering,results of examination of the female

3-2


24/51

MDM25 connector, and theirdetermination of the cause as to whythe rocket motor ignited.Microscopic photography of thefemale MDM25 connector confirmed

a black mark at the base of the pinconnected to the HiCapPen battery(See Figure 2-4). Pin #4 on thefemale MDM25 connector, bydesign, was connected directly to theHiCapPen battery in order toenergize the LED (See Figure 2-3).The output of the HiCapPen batterywas 10.8 volts and the battery wasnot current limited. The TATconcluded that the energy source

that caused the rocket ignition was ashort at Pin #4 that occurred when

the male and female MDM25connectors came in contact. Fromthe TAT analysis of the circuitschematic (See Figure 2-6), theydiscovered a circuit configuration

that would have caused the energyfrom the short to flow from theMDM25 female connector, throughthe test sled body, and through therocket igniter.The TAT did provide the Board witha formal report that is maintained inthe official investigation files. Someof the topics discussed in the reportwere deemed Official Use Only andtherefore are not included as part of

this report.

3-3


25/51

4.0 MANAGEMENT SYSTEMSEVALUATION

4.1 DOE Oversight

Starting in 2005, SSO adopted anew safety basis approach for non-nuclear facilities. This approachinvolved Risk-Based Oversight(RBO). RBO focuses a significantamount of effort on oversight ofnuclear activities and less onindustrial activities. This approachfocuses on DOE's risk related to 1)exposure to the public; 2) releases tothe environment; and 3) risk to

DOE's mission. As a result, SNL/NMnuclear facilities receive extensivetransactional oversight, as doindustrial facilities that can releasetoxic gases and expose the public.Facilities such as the low hazardNeutron Generator Facility also havesignificant DOE oversight because oftheir ability to have a dramatic effecton DOEs mission on a routine basis.

For facilities/activities that do not fall

into one of the three categoriesabove, SSO relies on a systemsbased approach to driveperformance improvement andcompliance. Additional contractualmechanisms include SandiasContractor Assurance System (e.g.Performance Evaluation Plan, andfee determination, etc.). SSO andexternal audits from OA in 2005, andfrom HS-64 in 2008 continued to find

problems with work control andISMS implementation. Although theLab has put much effort intoimproving work control and ISMSimplementation, they have hadlimited success as indicated inSandias Performance EvaluationReport for the past three years.

The Board concludes that SSOsefforts to improve Sandias safetyand health performance is anongoing challenge.

4.2 Explosives Safety ProgramImplementation

Title 10 Code of Federal Regulation(CFR) 851.24 states that DOEcontractors must have a structuredapproach to their worker safety andhealth program which at a minimumincludes provisions for explosivessafety. Contractors must comply withthe applicable standards and

provisions in 10 CFR 851, AppendixA.3, that states compliance with theDOE Manual (M) 440.1-1A, DOEExplosives Safety Manual, January9, 2006, is mandatory. Sandiaincorporated the requirements ofDOE M 440.1-1A, Explosives SafetyManual, as well as additionalrequirements and practices forconducting explosives operations atSNL into the Corporate Process

Requirement (CPR) 400.1.1.31, SNLEnvironment, Safety, and Health(ES&H) Explosives Safety Manual,dated November 9, 2007.

4.2.1 Explosives Safety Analyses

DOE M 440.1-1A,Explosives SafetyManual, Chapter II, item 2.1grequires that Safety analyses ofexplosives facilities and operationsshall be performed.

CPR400.1.1.31 SNL ES&HExplosives Safety Manual, ChapterII, item 1.7S states The [Hazard

Assessment] HA can either be astandalone document that explicitlyfollows the process outlined in thisManual and referenced within the[Primary Hazards Screening]

4-1


26/51

PHS/HA, or it can be accomplishedwithin the PHS/HA software as longas it satisfies the requirementsoutlined in this Manual.

PHS 9632456779-013, The

Primary Hazard Screening for theArea III Sled Track Complex,dated April 14, 2008 and theIntegrated Work Plan (IWP) forthe MC4152 Thermal BatteryRocket Motor Sled Testing (IWP1737 dated August 15, 2008)identified the worst case scenarioof the rocket motor asinadvertently ignites whenpersonnel are nearby without a

specific breakdown of thehazards (reference section 4.3.2).

The Board concludes that the safetyanalyses used to support theMC4152 Thermal Battery RocketSled Testing were not performed insufficient detail to adequatelyaddress all scenarios associatedwith this accident.

4.2.2 Explosives Safety

ComplianceThe following explosives safetyrequirements were not fullyimplemented:

DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item13.3.5(4) requires Test unitscontaining low-firing-currentactuators or detonators shall beclearly marked.

The rocket motor test assembly wasnot marked as containing low-firing-current detonator (igniter).

DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item6.0b states that Stray energy,such as transients and other

forms of induced energy, can beimposed on circuits affecting[Electroexplosive Devices] EEDsfrom other subsystems by variousmethods. Examples are inductive

or capacitive coupling; sneakground circuits; defectivecomponents or wiring; errors indesign, modification, ormaintenance.

The igniter was connected to thesled track side panel ground with acoaxial cable and an unexpectedground connection was discoveredat the sled track side panel.

DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item13.8.4a1 states that for electricalinstruments used with non-initiating electrical circuits suchas the HiCapPen Each specificuse of the instrument shall beanalyzed to ensure no crediblescenario exists whereby thenormal test energy from theinstrument can ignite explosivescharges or initiators in the test.

The ST Mgr stated that he suspectedthat there was a potential hazard dueto the battery in the HiCapPen andhe instructed an electrical engineerto assess the hazard. Nodocumentation of this analysis wasprovided to the Board.

DOE M 440.1-1A, ExplosivesSafety Manual, Chapter II, 7.1states that Positive steps must

be taken to control or eliminatestatic electricity in areas wherematerials that are ignitable bystatic spark discharge areprocessed or handled. Thisincludes spark-sensitiveexplosives, propellants, andpyrotechnics as well as solvent

4-2


27/51

vapors, and flammable gases.Wires used as static groundconductors should be at least No.10 AWG or equivalent.

CPR400.1.1.31, SNL ES&H

Explosives Safety ManualChapter II, 7.1S states thatExplosive materials andexplosive devices require specialcare in handling and packagingbecause they can be set off bydischarges of static electricity atlevels commonly found in thework environment. In all cases,take special care to maintain theitem and all of its electrically

isolated parts in electrostaticequilibrium with their environmentand anyone who may touchthem.

A 20 AWG wire pigtail, a coaxialcable, and a shorting plug were usedto short the igniter. The shortingplug was grounded to the track sidepanel ground. The OPs did notspecify any bonding or groundinginstructions. The TE and techniciansdevised bonding and groundingmethods based on their experiencewith Super Zuni rocket motors. TheOPs did not specify when the INworkers were required to usewristbands.

Representatives of sled trackmanagement provided the TAT andthe Board with a bonding andgrounding graphic of how the test

series was most likely setup at thetime of the accident. The practice ofclamping bonding straps to oxidizedtrack rails did not provide anadequate common earthen ground.

The Board concludes the test seriessetup did not provide adequategrounding and bonding.

CPR400.1.1.31, SNL ES&HExplosives Safety ManualChapter II, 7.4Sa states Use ofwristbands during all operationsinvolving static-sensitive

explosive materials is mandatory.The functional check should bebetween the wearer contact pointand the wristband attachment toground. Functional checks shallbe noted in the facility log.

A wristband was not used by AF1and IN1 during the instrumentationprocedures for the HiCapPenpreparation for this test. Evidencesuggested that a wristband clamped

to the East track may have beenused during the shorting andgrounding of the rocket motor. Thiswristband was connected to theoxidized East rail and measurementsafter the accident demonstrated noconductivity with the rail. Functionalchecks of the wristband bondingconnections were not documented.

DOE M 440.1-1A, ExplosivesSafety Manual, Chapter II, item1.6 states Before beginningexplosives operations, managersshall educate and trainemployees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation. This training should bea part of the employee trainingand qualification programspecified in Chapter V.

The OP requires personnel to takeXPL-160, Explosives Safety Course.This course did not provide sufficientdetail to ensure that personnel couldeffectively implement establishedexplosives safety requirements andsafe work practices.

4-3


28/51

No records related to the Sled Trackgrounding system maintenance,inspection, or verification of systemintegrity were provided in responseto a request from the Board.

The Board concludes that based onthe work practices described in theOP and testimony of the workers,Sandia management did notadequately educate and train

employees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation.

The Board concludes that the aboveidentified practices represent anormalization of deviation fromestablished explosives safety workpractices.

CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter II, item 7.4Sc2 statesthat Wristbands without resistorsshould be visually inspected priorto each use and conductivity

verified to be less than 1,200,000ohms at least once per year.Verification shall be recorded.

4.3 Sandias Integrated SafetyManagement System

CPR400.1.2, Integrated SafetyManagement System (ISMS)Description, January 11, 2008,

documents the Sandia ISMS. TheBoard reviewed Sandiasimplementation of the five corefunctions. The Board foundweaknesses associated with four ofthe five core functions.

The wristband (W011) connected onthe east rail of the accident site wasidentified as being in fair physicalcondition during the last inspectionon February 13, 2007. Thegrounding strap (G009) used at theside panel was documented as goodphysical condition during the lastinspection on February 13, 2007.

4.3.1 Core Function 1, Define theScope of Work

No specific issues were identifiedwith respect to the definition of the

work to be performed in theexperimental series.

CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter II, item 7.1Sb3 requiresworkers to Use tools that arenon-sparking (nonferrous metal)and unpainted.

4.3.2 Core Function 2, Analyzethe Hazards

The complicated relationshipbetween the various qualitativehazard assessment methods usedby Sandia made it challenging forline management to ensure that thehazards and associated controls forthe MC4152 Sled Test Series wereclearly communicated to theworkers.

IN1 gave a ferrous screwdriver toAF1. AF1 accepted the ferrousscrewdriver to connect the LED

module to the MDM25 connector.

CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter I, item 8.4Sa6 states thatMaintain lightning protection andstatic grounding systems inaccordance with Chapter X.

The following diagram is an excerptfrom a diagram in the Validation andQualification Sciences ExperimentalComplex, Quality Assurance Planand Work Controls Program.

4-4


29/51

Figure 4-1. Validation and Qualification Sciences Experimental Complex, QualityAssurance Plan and Work Controls Program

The Primary Hazards Screening(PHS), Integrated Work Plan (IWP),

Hazards Analysis (HA), SafetyAssessment (SA), and ManagementOperational Review (MOR) identifiedinadvertent rocket firing as the worstcase accident scenario; however, theonly controls identified in thesedocuments were the OPs. The OPsdid not contain guidance to theworkers on specifics such asgrounding and bonding instructions,verifying continuity and resistivity of

bonding and grounding systems, andwhen using wriststraps was required.The referenced documents did notinclude an analysis of the rocket sledtest configuration. The need forelectrical isolation of all batteries inthe test package from the low energy

igniter in the rocket motor was notdocumented.

The Board concludes the OPs forthis sled track test series werederived from the OPs from previoussimilar tests. Additional hazardsanalysis specific to this test serieswere not documented and usedduring the development of the OPsfor this specific test series.

Sled Track management used theHA and SA to evaluate the risk of the

Sled Track operations. Risk iscategorized using qualitativemethods to estimate the probabilityof occurrence and the severity ofconsequences of postulatedaccidents. Tables 1 and 2 belowdefine parameters considered duringqualitative risk analysis.

4-5


30/51

Table 4-1 - Consequence Guidelines

Consequence Level Onsite (Workers)

High (H) Immediate worker fatality

Moderate (M) Life-threatening injuries

Low (L) Less than Life-threatening injuriesNegligible (N) Minor medical treatment (such as cuts, bruises,

contusions, and minor skin irritations)

Table 4-2 - Frequency Guidelines

Description Frequency (per year)

Anticipated (A) F 1.0E-02

Unlikely (U) 1.0E-02 > F 1.0E-04

Extremely Unlikely (EU) 1.0E-04 > F 1.0E-06

Beyond Extremely Unlikely (BEU) F < 1.0E-06

The Board compared two similaraccident scenarios in the hazardevaluation table of the SA-RSD-2006-0001, Rocket Sled TrackComplex Safety Assessment Safety

Assessment (SA). In scenario STT-4, an explosion occurs near the sledtrack in the vicinity of the testpackage or rocket during testpreparation and results in injury.

The test package in this scenariomay contain radioactive material andhigh explosives and the rocketmotors contain propellant. Inscenario STT-5, a normal test failswhich causes fire and/or explosion atthe sled track and result in injury.

The postulated causes of event STT-4 include an electrical short, leakingbatteries, battery overheats, staticelectricity, equipment/vehicle fire,

and equipment/vehicle collision. Thecauses of STT-5 include an electricalshort, static electricity, electricalcomponent failure, human errorduring preparation, sequenceproblem, design errors, hardwarefaults, etc. Both of these eventswere assessed to have an

unmitigated frequency level ofAnticipated, and the unmitigatedlocal physical consequence level forboth events was determined to beHigh.

Preventive features are identified inthe SA to reduce the probability ofoccurrence of the postulatedscenarios. The preventive featuresfor both accidents were Conduct ofOperations (Test Specific OperatingProcedure (TSOP), AccessControls), Fire ProtectionProgram, and Explosives SafetyProgram. Crediting these identifiedcontrols, STT-4 probability isreduced to Extremely Unlikely andSTT-5 is reduced to Unlikely. Thedifference in reduction in probabilityis not explained in the SA.

The Board concludes the citedprobability reduction in the SA fromAnticipated to Extremely Unlikelywas not supported by theidentification of specific designfeatures or engineered barriers tominimize the probability of theanalyzed scenarios.

4-7


31/51

Mitigative measures are identified inthe SA to reduce the severity of theconsequences associated with theSTT-4 and STT-5 scenarios. Bothscenarios list Conduct of Operations

(TSOP, Access Controls) andEmergency Preparedness Programas mitigative features. STT-5 alsocites a Design Feature (building6741 and 6742). No explanation ofthe attributes of the design feature isprovided for this in the SA.

The STT-4 consequence remainedHigh and the STT-5 consequencewas reduced to Negligible. Thedifference in the reduction of

consequence between STT-4 andSTT-5 is not explained in the SA.Because the hazard is anunanticipated explosion, the onlymitigation that would result in areduction from High to Negligiblewould be physical separation of theexplosive and the human receptors.

The Board concludes that becausethe accident under review involvesworkers in close proximity to the

rocket, the reduction in severity ofthe consequence would not beconsistent with the qualitativeanalytical method described in theSA.

PHS Number 9632456779-013,AreaIII Sled Track Complex, was writtento encompass all the operations atthe Sled Track. The PHScategorized the Sled Trackoperations as a Moderate hazardrequiring the development of a HA.Sled track management consideredthe HA to be a bounding analysisand elected not to develop anactivity-specific PHS for this test

series.

VQSEC Operating Procedure,OP473407, 10019 Issue B,Explosives Hazards Analysis, is theHA for TA-III. Table 3 providesguidance for identifying risk bins forhazards based on unmitigated risk.Table 4 Hazard Assessment forTA-III Sled Track Complex, containsthe hazard analysis results for thesled track operations.

Table 4-3 - Risk Bins for Onsite Receptors

Frequency Consequence

BeyondExtremelyUnlikely(BEU)

ExtremelyUnlikely (EU)

Unlikely (U) Anticipated(A)

High (H) III II I I

Moderate (M) IV III II I

Low (L) IV IV III IINegligible (N) IV IV IV III

Note: Events classified as Risk Rank I or II, based on unmitigated risk, arecarried forward for identification and discussion.

4-8


32/51

Table 4-4 Hazard Assessment for Area III Sled Track Complex

Operation Mode ofFailure

Effect Frequency ConsequenceLevel

RiskRank

MitigatingFeatures

Premature

detonation ofexplosiveswhilepersonnelare in thearea.

Human

error, suchasinadvertentcharging offireset

Injury or

death ofemployeesdue tooverpressureandfragmentation

BEU Moderate IV TWDs

EngineeringControls

Two-person rule

Grounding

Training

Range limits

Controlled Access

Proper storageand handling

Shielding

Risks are defined in terms of RiskRank I, II, III, or IV. According to theprocedure, hazards classified asRisk Rank I and II are those ofsignificant concern and hazardsclassified as Risk Rank III and IV areof less concern.

Table 4 of the HA defines the

operation being analyzed asPremature detonation of explosiveswhile personnel are in the area.The mode of failure is defined asHuman error, such as inadvertentcharging of fireset. The effect isInjury or death of employees due tooverpressure and fragmentation.The frequency level was determinedto be Beyond Extremely Unlikely(less than 1x10-6) with a

consequence level of Moderate.Potential initiators of the rocketmotor that were not included in thisanalysis include:

electrostatic discharge (ESD);

natural phenomena (e.g.,lightning);

use of ferrous tools (potentialsource of a spark);

energy from test packages (e.g.,HiCapPen); and

radio frequency (RF) sources.

Several inconsistencies were notedbetween the HA and SA for the Sled

Track Operations. The HAunmitigated frequency of BeyondExtremely Unlikely is not supportedby either example from the SA. Inthe SA, the unmitigated frequency isAnticipated and the lowestmitigated frequency is ExtremelyUnlikely. Based on the SA, theunmitigated frequency in the HAshould have been Anticipated. TheHA unmitigated consequence was

determined to be Medium. Bothexamples from the SA started withan unmitigated local physicalconsequence of High. Based onthe values in the SA, the HA shouldhave been an unmitigated Risk RankI. Proper Risk Ranking in the HAwould have resulted in the need for

4-9


33/51

additional analysis of this testconfiguration.

The Board concludes that, based onan unmitigated scenario, thelikelihood should be substantially

higher than Beyond ExtremelyUnlikely.According to the HA,if thefrequency had been assessed asAnticipated or Unlikely, thisactivity would have been within theRisk Rank of I or II and would havebeen carried forward for additionalidentification and discussion.

IWP 1737, MC4152 Thermal BatteryRocket Sled Testing, was developedto facilitate planning of this testseries. The IWP references the PHSfor the Sled Track, but does notreference the SA or HA. In the IWPInterview Questions and Answers, ano response was given for thefollowing questions:

IWP Question 31 ConcerningTSOP and OPs Haveexplosives safety issues beenreviewed?

IWP Question 32 ConcerningTSOP and OPs Have fireprotection requirements beendocumented?

IWP Question 33 ConcerningTSOP and OPs Have Lightningsafety and static electricity issuesbeen identified?

IWP Question 34 ConcerningTSOP and OPs - Have securityissues been addressed?

IWP Question 35 ConcerningTSOP and OPs Is anemergency plan in place?

IWP question 36 ConcerningTSOP and OPs Is thereadequate control of hazard area,including safety observers?

IWP question 37 ConcerningTSOP and OPs Is theredocumented engineering basis toestablish hazard area?

When asked, the IWP authors statedthat they believed the IWP questionsset was asking whether additionalreview of these areas was required.

Per the SA, prior to each testoperation, the Rocket Sled TrackComplex Manager (ST Mgr)performs a MOR to verify that ES&Hand programmatic requirements aremet. As part of this review, the STMgr, or his designee, determinesthat the requirements specified in theSA are properly implemented.

The MOR was part of the TSOPdevelopment process. Activity-specific OPs were intended tocapture the required controls for the

operation of the Sled Track and arediscussed in Section 4.3.3 of thisreport.

The HA and SA both focused on allsled track operations and were notspecific to the MC4152 Sled testseries. The primary hazardsassociated with this activity wereintroduced into the facility by eachindividual test series. AF1 statedthat he did not participate in the

MOR, but had read and signed theOP MC4152. Based on interviews, itwas determined that the hazardanalysis for this sled track test seriesby the TE and the MOR of the testconfiguration was informal, verbaland undocumented. The MORdiscussion of hazards associated

4-10


34/51

with the test series was notdocumented in the notes in the finalapproved MOR.

The Board concludes hazardsspecific to this test series were not

fully analyzed and were informallydiscussed with the workers.

The development and approval ofthe various hazards analysesassociated with this series of testsdid not demonstrate a level oftechnical inquisitiveness that couldhave increased the likelihood thatthe potential hazards associated withthe test configuration wereadequately identified and analyzed.

The Board concludes that ifimplementation of the hazardassessment processes had morethoroughly identified hazardsassociated with this test series,required hazard controls could havebeen more clearly identified andfollowed by the workers.

4.3.3 Core Function 3,Develop/Implement

Controls

ISM requires controls to bedeveloped and implemented basedon the analysis of the hazards for anoperation. The controls for this testseries were captured in theOP473407-12349, MC4152 ThermalBattery Rocket Sled Testing. TheOP was developed based on OPsfrom previous experiments; the

connection between the hazardanalysis methodologies and the OPswas not clearly demonstrated. Thispractice represents a normalizationof deviation. Those involved with thedevelopment of the OP did notquestion the adequacy of thehazards analysis.

The Board concludes the controlswere based on historical operationsand not a detailed analysis of therocket sled test series as required byIntegrated Safety Management.

4.3.4 Core Function 4, PerformWork Safely

Several OPs were used to performwork at the Sled Track. The OPsreviewed did not contain detailedinstructions (e.g., how to ground thetest configuration, when wrist strapswere required to be worn). The workwas performed by AF1, AF2, andIN1 based on the experience of theworkers and not necessarily thestated steps in the procedure.

A procedure was found in the controlroom and the CO had checked offmost of his operational steps. Acurrent OP was not found by the sledtrack and interviews confirmed thatthe sled side work was beingperformed based on each workerstraining and experience. Theprocedure checklist was not being

marked by AF and IN as required bythe OP.

The same procedure was to be usedby the CO and the workers that arephysically located by the Sled Track.Communication between the CO andworkers at the Sled Track waslimited due to the logistics of theoperation (e.g., physical separationand due to the restriction not to usethe radio within 50 feet of the rocket).

It was sled track managementsstated expectation that a coordinatedeffort would be made to sign offprocedure, but a process was not inplace to sign off the procedure atmultiple locations.

4-11


35/51

VQSEC Conduct of Operations,Chapter XVI Operations Procedures,Section 7 states that Operatorsshould have procedures with themand follow them in a step-by-step

manner when the procedurescontain sign-offs for the variousactivities.

OP473407-12349, MC4152 ThermalBattery Rocket Sled Testing statedthat long sleeved shirts wererequired PPE for this activity. AF1was wearing a short sleeved shirt atthe time of the accident.

The Board concludes that theactions of the workers involved withthis test series did not demonstratean understanding of conduct ofoperations principles.

4.3.5 Core Function 5, Feedbackand Improvement

Several SSO and Sandiaassessment reports of sled trackrelated activities were reviewed bythe Board. The assessments wereat a high level and concentrated on

documentation and did not documentobservation of actual sled trackoperations. None of the reviewedassessment reports identified thehazards analysis and controls thatfailed during this accident.Corrective actions associated withthe provided assessment reportswere not provided to the Board.

Occurrence Reporting and

Processing System (ORPS) reportDP-ALO-KO-SNL-200-1993-0004,Premature Rocket Sled Detonation,Resulting in Brush Fire, describes asituation similar to the subjectincident for this investigation. Theevent involved 25 Super Zuni rocketmotors. The direct cause identified

in the ORPS report was that the fireset was modified for the test in amanner that created an extremesensitivity to spurious noise inducedon the trigger circuit. This faulty

design was directly responsible forthe premature detonation of thepayload which occurred when thesecond-stage rocket motor ignited.

ORPS report DP-ALO-KO-SNL-2000-2000002, Employee Injuredby Detonation at ExplosiveComponents Facility, involved anunexpected detonation. The ORPSreport stated that the root cause wasthat the implementing procedure did

not include a specific requirement toconsider isolating all energy sources,including diagnostics, to thecomponent being tested.

Several of the corrective actionsfrom these two incidents could relateto this test sled incident, but thedetails of the corrective actionimplementation, closure and lessonslearned were requested by theBoard. The information was notprovided to the Board.

A 2008 SSO Self Assessmentidentified SSO and Sandia feedbackand improvement deficiencies.Weaknesses were noted associatedwith trending and analysis of data,issues management, and lessonslearned program implementation.

The Board concludes that linemanagement missed opportunities to

improve the effectiveness ofmanagement system implementationbecause of weaknesses in feedbackand improvement.

4-12


36/51

5.0 CAUSAL FACTORS

5.1 Direct Cause

The direct cause of the accident wasthe inadvertent ignition of the Super

Zuni rocket motor.5.2 Root Cause

Sandia did not fulfill theirresponsibilities under 10 CFR 851,Worker Protection and the DOE M440.1-1A, Explosives Safety Manualto control explosives hazards asevidenced by the following:

Hazards associated with thisrocket sled test series were not

accurately analyzed or fullycontrolled.

The design of this rocket sled testseries did not ensure that the testpackage was electrically isolatedfrom the Super Zuni rocket motor.

The test series set up did notprovide adequate grounding,shorting and bonding.

Sandia management did notadequately educate and train

employees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation.

The actions of the workersinvolved with this test series didnot demonstrate anunderstanding of explosivessafety requirements or conduct ofoperations principles.

5.3 Contributing Causes

Sandia management failed to detectviolations of explosives safetyrequirements and deviations fromestablished practices.

5-1


37/51

6.0 CONCLUSIONS ANDJUDGMENTS OF NEED

JONs are the managerial controls ansafety measures determined by the

Board to be necessary to prevent orminimize the probability or severity ofa recurrence. These JONs arelinked directly to the causal factors,

which are derived from facts andanalyses and form the basis forcorrective action plans and which arethe responsibility of line

management. The following table,Table 6-1, contains the Boardsconclusions and the JONs.

Table 6-1. Conclusions and Judgments of Need


The Board concludes that the safetyanalyses used to support the MC4152Thermal Battery Rocket Sled Testing were

not performed in sufficient detail toadequately address all scenarios associatedwith this accident.

The Board concludes the test series setupdid not provide for adequate grounding andbonding.

The Board concludes that based on the workpractices described in the OP and testimonyof the workers, management did notadequately educate and train employees inthe hazards and precautions required for

handling explosives and materials used inconjunction with explosives operation.

The Board concludes the OPs for this sledtrack test series were derived from the OPsfrom previous similar tests. Additionalhazards analysis specific to this test serieswere not documented and used during thedevelopment of the OPs for this specific testseries.

The Board concludes the cited probabilityreduction in the SA from Anticipated to

Extremely Unlikely was not supported bythe identification of specific design featuresor engineered barriers to minimize theprobability of the analyzed scenarios.

The Board concludes that because theaccident under review involves workers inclose proximity to the rocket, the reduction inseverity of the consequence would not be

Sandia needs to develop and implementa plan to fulfill their responsibilities under10 CFR 851, Worker Protection and theDOE M 440.1-1A, Explosives SafetyManual to control explosives hazards.

6-1


38/51


consistent with the qualitative analyticalmethod described in the SA.

The Board concludes that, based on anunmitigated scenario, the likelihood should

be substantially higher than BeyondExtremely Unlikely. According to the HA, ifthe frequency had been assessed asAnticipated or Unlikely, this activity wouldhave been within the Risk Rank of I or II andwould have been carried forward foradditional identification and discussion.

The Board concludes hazards specific to thistest series were not fully analyzed and wereinformally discussed with the workers.

The Board concludes that if implementation

of the hazard assessment processes hadmore thoroughly identified hazardsassociated with this test series, requiredhazard controls could have been moreclearly identified and followed by theworkers.

The Board concludes the controls werebased on historical operations and not adetailed analysis of the rocket sled testseries as required by ISM.

The Board concludes that the actions of the

workers involved with this test series did notdemonstrate an understanding of conduct ofoperations principles.

The Board concludes that identified practicesrepresent a normalization of deviation fromestablished explosives safety work practices.

Sandia management needs to ensure

violations of explosives safetyrequirements and deviations fromestablished practices are detected andcorrected.

The Board concludes that SSOs efforts toimprove Sandias safety and healthperformance is an ongoing challenge.

SSO needs to evaluate the effectivenessof its RBO of explosives operations andfacilities.

6-2


39/51


40/51

8.0 LIST OF BOARD MEMBERS, ADVISORS AND STAFF

Board Members

Chairperson Marcus Hayes, Occupational Safety and

Health Manager, National Nuclear SecurityAdministration Service Center

Analyst John E. Franchere, Safety Engineer,Environment, Safety and Health Office, SandiaSite Office

Member Kevin Carr, Explosives Safety Engineer,National Nuclear Security AdministrationService Center

Member Lynn Maestas, Physical Scientist, NationalNuclear Security Administration Service Center

Member Steve Muoz, Electrical Engineer, NationalNuclear Security Administration Service Center

Member Mario Murray, Safety Engineer, NationalNuclear Security Administration Service Center

Administrative Support Denise Regalado, Administrative Analyst

8-1


41/51

APPENDIX A APPOINTMENT OF TYPE BACCIDENT INVESTIGATION BOARD

A-1


42/51

A-3


43/51

A-4


44/51

A-5


45/51

A-6


46/51

APPENDIX B BARRIER ANALYSIS

B-1


47/51

Barrier AnalysisTable B-1. Barrier Analysis Table

Hazard: Rocket Motor Fires Target: AF1

What were thebarriers?

How did eachbarrier perform?

Why did the barrierfail?

How did the barrier affect theaccident?

Use of Non-ferrous Toolson a LowEnergy, ESDSensitiveArticle

No nonferroustools identifiedat accidentscene

AF1 was in positionof a ferrousscrewdriver andferrous wire stripperat the time of theincident.

The presence offerrous toolsprovided a secondpotential way to

initiate this incident.

The analysis of the incidentdetermined that the LEDmade contact with pin 4 andcaused this incident.

Ferrous tools are a secondpotential initiator for a lessthan adequately groundedrocket and should not havebeen in use at the time of theincident.

Compliancewith the DOEExplosiveSafety Manualand SNLEstablishedExplosiveSafetyProcedures

Weaknessesidentified inimplementation

EstablishedExplosives SafetyProcedures containexplicit requirementsfor working withexplosives. Severalof theserequirements werenot implemented ina manner that would

prevent thisaccident.

More thoroughimplementation of theExplosives SafetyProcedures would haveprevented this accident (e.g.,proper grounding, checkingcontinuity of bonding andgrounding systems, use ofwrist straps, isolation, andlimiting current from

HiCapPen battery).

Work planningto ensurehazards areidentified andcontrolled, anddifferent jobsarecoordinated

Thecomplicatedrelationshipbetween thevarious hazardassessmentmethodologiesmake it difficultfor linemanagement to

ensure that thehazards andassociatedcontrols areclearlycommunicatedto the worker.

The PHS, IWP, HA,and MOR identifiedinadvertent rocketfiring as the worstcase hazardscenario, however,the only controlsidentified in thesedocuments were theOPs and specific

hazards andcontrols of the testseries were notidentified.

If sled track managementsimplementation of the hazardassessment processes hadmore thoroughly identifiedhazards associated with thisoperation, required hazardcontrols would have beenmore clearly identified andfollowed by the worker.

B-3


48/51

SSO and SNLManagementdid not ensurerequirementswere followedand that

systems werefullyoperational.

Managementdid noteffectivelyassess sledtrack operationsand was

unaware ofmanydeviations fromSNLs ISM andestablishedexplosive safetyprocedures andpractices.

More thoroughimplementation ofthe ExplosivesSafety Procedureswould haveprevented this

accident.

Management did not detectthe ineffectiveimplementation of explosivesafety procedures or ISM.

OperatingProceduresand Checklist

Weaknessesidentified inimplementation

The MC4152 OP didnot contain detailedsteps to implementthe SNL explosive

safety manual (e.g.,proper grounding,checking continuityof bonding andgrounding systems,and use of wriststraps). Thechecklist was notused or fullycompleted (marked)up to the point of theaccident by all of the

involved workers.

Use of detailed explosivesafety compliant checklistand procedures would haveprevented the accident from

occurring.

PersonalProtectiveEquipment(PPE) - LongSleevedCotton Shirt

The PPErequired by theOP was notimplemented

The OP requiresworkers to wear longsleeve cotton shirts.This requirementwas not rigorouslyenforced.

If AF1 had been wearing along sleeved cotton shirt perthe OP, the burns on hisarms may not have been assevere.

B-4


49/51

APPENDIX C CHANGE ANALYSIS

C-1


50/51

Change AnalysisTable C-1. Change Analysis Table

Accident SituationPrior, Ideal, orAccident-Free

SituationDifference Evaluation of Effect

AF1 inserted LED IN2 inserted LEDfor morning test.The OP calls for anIN tech to install theLED.

AF1 stated hedid not havemuchexperienceusing MDM25connectors.

AF1s inexperience withMDM25 connectors mayhave increased thelikelihood of groundingthe connector bodiesduring the installationattempt.

Electrical tape wasplaced around theLED housing toshade the LED bulbso that it could beseen by the COthrough the closedcircuit monitors.

LED bulb was notshaded for thesuccessful first testof the day.

The tape mayhave made itmore difficult toline up the LEDwith the testunit.

AF1 stated that thepresence of theelectrical tape did notinterfere with theinstallation and that thetape was on the LEDwhen he received it.

Arming ofHiCapPen changed a 5 minute timedelay was added toarming sequence

Arming ofHiCapPenperformed sled sidewas to fully armedmode.

Time delayadded toHiCapPenarmingsequence toallow time forpersonnel tomove to safetybefore theHiCapPen fullyarmed.

This change was madeto increase workersafety.

Method ofestablishingappropriateisolation betweencomponents did notpreclude flow ofelectricity to igniter.

Ideal: Test sledconfigurationshould isolateelectricallysensitivecomponents frombattery supply

Ineffectiveisolation ofcomponentsprovided a pathfor energy tothe igniter.

Rocket motor firedunexpectedly.

Grounding andbonding was not inaccordance with theExplosives SafetyManual.

Grounding andbonding isadequate tomitigate ESDhazard.

Ineffectivebonding andgrounding wasnot inaccordancewith theExplosivesSafety Manual.

Even though ESD didnot cause this accident,the ESD sensitiverocket igniter could havebeen initiated by ESDdue to ineffectivebonding and grounding.

C-3


51/51

Accident SituationPrior, Ideal, orAccident-Free

SituationDifference Evaluation of Effect

OPs did not containsufficient detail toensure that the testconfiguration werethe same for eachtest (e.g., bonding,grounding,electricalconnections,isolation).

Hazardous workperformed per OPsthat are specificand developedbased on activity-specific hazardsanalysis.

Variations in theway OPs areused in the fieldprovideopportunities forvariations in theway recognizedhazards arecontrolled.

The potential forunexpected ignition ofthe rocket motor wasnot analyzed andeffective controls werenot devised to protectagainst inadvertentactivation of the rocketmotor.

Current from theHiCapPen batteryflowed to the rocketmotor igniter.

HiCapPen batterycurrent is limitedbelow firing currentof rocket igniter.

HiCapPen currentisolated from rocketigniter.

Rocket igniterexposed toenergy sourcefrom HiCapPen.


Managementaccepted theresults of previoushazardassessments duringOP development

Prior situation: along history of sledtrack operationswithout inadvertentrocket motorinitiation.

Ideal situation: ahazard analysis isperformed to

determine howeach testseries/configurationimpacts the worstcase scenario.

The PHS, IWP,HA, SA, andMOR all identifythat the worstcase scenariofor the testseries was aninadvertentrocket motor

ignition.

None of theseprocesses addressedthe specific hazards andcontrols that couldprevent inadvertentrocket motor ignition.

Igniter wire wasshunted at end of106 ft fire cable.

Place shunt asclose to igniter wireas possible tominimize lineresistance throughthe shunt.

Placement ofshunt at the endof 106 ft cableallowedsufficientcurrent from theHiCapPen

battery to flowthrough theigniter insteadof the shunt.


Documents

Sled Track Type b Report Final