7/30/2019 Sled Track Type b Report Final
1/51
D
National Nuclear Security Administration
Sandia Site Office
Type B Accident Investigation
Employee Injured when Rocket MotorUnexpectedly Fired on October 9, 2008
at the Sandia National LaboratoriesTechnical Area III Sled Track
November 2008
7/30/2019 Sled Track Type b Report Final
2/51
7/30/2019 Sled Track Type b Report Final
3/51
TABLE OF CONTENTS
PageTABLES................................................................................................................ iiFIGURES.............................................................................................................. ii
ACRONYMS........................................................................................................ iii
EXECUTIVE SUMMARY......................................................................................11.0 BACKGROUND ......................................................................................1-1
1.1 NNSA/Sandia Site Office.....................................................................1-11.2 Sandia National Laboratories ..............................................................1-11.3 Sled Track Facility Description ............................................................1-11.4 Technical Management SolutionS, Inc. ...............................................1-21.5 Scope and Methodology......................................................................1-2
2.0 ACCIDENT DESCRIPTION AND CHRONOLOGY OF EVENTS............2-12.1 Accident Description............................................................................2-12.2 Emergency Response .........................................................................2-42.3 Description of Injuries ..........................................................................2-4
2.4 Emergency Preparedness ...................................................................2-42.5 Photographic Record of the Accident Scene .......................................2-5
3.0 ACCIDENT ANALYSIS ...........................................................................3-13.1 Measurements, Photos and Physical Evidence at Accident Scene .....3-13.2 Technical Assistance Team (TAT).......................................................3-13.3 Disassembly of Test Sled and Measurements.....................................3-13.4 TAT Assessment of Potential Causes of the Rocket Ignition...............3-23.5 TAT Determination of Potential Causes of the Rocket Ignition............3-2
4.0 MANAGEMENT SYSTEMS EVALUATION.............................................4-14.1 DOE Oversight ....................................................................................4-14.2 Explosives Safety Program Implementation ........................................4-1
4.2.1 Explosives Safety Analyses..........................................................4-14.2.2 Explosives Safety Compliance .....................................................4-2
4.3 Sandias Integrated Safety Management System................................4-44.3.1 Core Function 1, Define the Scope of Work .................................4-44.3.2 Core Function 2, Analyze the Hazards.........................................4-44.3.3 Core Function 3, Develop/Implement Controls...........................4-114.3.4 Core Function 4, Perform Work Safely.......................................4-114.3.5 Core Function 5, Feedback and Improvement ...........................4-12
5.0 CAUSAL FACTORS................................................................................5-15.1 Direct Cause........................................................................................5-15.2 Root Cause..........................................................................................5-1
5.3 Contributing Causes............................................................................5-16.0 CONCLUSIONS AND JUDGMENTS OF NEED .....................................6-17.0 BOARD SIGNATURES...........................................................................7-18.0 LIST OF BOARD MEMBERS, ADVISORS AND STAFF ........................8-1
Appendix A Appointment of Type B Accident Investigation Board................. A-1Appendix B Barrier Analysis .......................................................................... B-1Appendix C Change Analysis ........................................................................C-1
i
7/30/2019 Sled Track Type b Report Final
4/51
TABLES
Table ES-1 Conclusions and Judgments of Need........................................ES-2
Table 2-1 Event Chronology Table...............................................................2-1
Table 4-1 Consequence Guidelines .............................................................4-6
Table 4-2 Frequency Guidelines...................................................................4-6
Table 4-3 Risk Bins for Onsite Receptors.....................................................4-7
Table 4-4 Hazard Assessment for Area III Sled Track Complex...................4-8
Table 6-1 Conclusions and Judgments of Need...........................................6-1
Table B-1 Barrier Analysis Table ................................................................. B-3
Table C-1 Change Analysis Table................................................................ C-3
FIGURES
Figure 1-1 Accident Investigation Terminology..............................................1-3
Figure 2-1 Representative rocket motor and test package ............................2-5
Figure 2-2 Position of rocket and test package after accident .......................2-5
Figure 2-3 HiCapPen with LED module installed and illuminated..................2-6
Figure 2-4 Post accident MDM25 connector..................................................2-6
Figure 2-5 Post accident LED module with black electrical tape....................2-7
Figure 2-6 TAT Schematic Analysis...............................................................2-7
Figure 2-7 HiCapPen connection to sled track side box ................................2-8
Figure 2-8 Post accident sled track side box .................................................2-8
Figure 2-9 Post accident wiring to sled track .................................................2-9
Figure 2-10 Pre-accident grounding connections ............................................2-9
Figure 4-1 Validation and Qualification Sciences Experimental Complex,Quality Assurance Plan and Work Controls Program...................4-5
ii
7/30/2019 Sled Track Type b Report Final
5/51
ACRONYMS
ACLS Advanced Cardiac Life Support
AF Arming and Firing
CFR Code of Federal Regulation
CO Console OperatorCPR Corporate Process Requirement
DOE Department of Energy
EED Electroexplosive Devices
EMT Emergency Medical Technician
ERT Emergency Response Team
ESD Electrostatic Discharge
ES&H Environmental, Safety & Health
FR Facility Representative
GIF Gamma Irradiation Facility
HA Hazard Analysis
IN Instrumentation Technician
ISM Integrated Safety Management
ISMS Integrated Safety Management System
IWP Integrated Work Plan
JON Judgments of Need
KAFB Kirtland Air Force Base
LED Light Emitting DiodeMOR Management Operational Review
NNSA National Nuclear Security Administration
OP Operating Procedure
ORPS Occurrence Reporting and Processing System
PHS Primary Hazard Screening
PPE Personal Protective Equipment
RBO Risk-Based Oversight
RF Radio Frequency
SA Safety Assessment
SNL/NM Sandia National Laboratories/New Mexico
SSO Sandia Site Office
ST Mgr Rocket Sled Track Complex Manager
TA-III Technical Area III
TAT Technical Assistance Team
iii
7/30/2019 Sled Track Type b Report Final
6/51
TE Test Engineer
TMSP Test and Maintenance Support Personnel
TMSS Technical Management SolutionS, Inc.
TQP Technical Qualification Program
TSOP Test Specific Operating ProcedureUNMH University of New Mexico Hospital
VQSEC Validation and Qualification Sciences Experimental Complex
iv
7/30/2019 Sled Track Type b Report Final
7/51
EXECUTIVE SUMMARY
On the afternoon of October 9, 2008,a sled track test was to be performedinvolving a sled that consisted of a
test package connected to the frontof a Super Zuni rocket motor. Thepurpose of the test was to recordthermal battery output during theimpact with the target.
At approximately 4:45 pm, one of theArming and Firing Technicians(AF1), a TMSS employee, wasinstalling a Light Emitting Diode(LED) module into a MDM25connector on the top of the testpackage when the rocket motorunexpectedly fired. AF1 washospitalized with a broken leg andfirst and second degree burns mostlyto his hands and arms.
Analysis
The direct cause of the injury wasthe inadvertent ignition of the SuperZuni rocket motor. If therequirements of the DOE Explosives
Safety Manual had been properly
implemented, the rocket motor wouldnot have ignited. The severity of theburn injury could have been reduced
if the worker had been wearing along sleeved cotton shirt as requiredby the Operating Procedure. TheSandia Integrated SafetyManagement System was notadequately implemented for thisseries of tests. Analysis of thehazards associated with this seriesof tests did not result in operatingprocedures and practices thatprecluded ignition of the rocket
motor. Sufficient energy to fire therocket was provided by an internalbattery in the test package. Explicitcontrols were not provided to ensurethat the energy in the test packagecould not ignite the rocket motor.
The Board concludes that thisaccident was preventable. Sandiadid not provide sufficient oversight ofthe Sled Track Operations to ensurethat requirements were appropriatelyimplemented.
ES-1
7/30/2019 Sled Track Type b Report Final
8/51
Table ES-1. Conclusions and Judgments of Need
Conclusions Judgments of Need
The Board concludes that the safetyanalyses used to support the MC4152Thermal Battery Rocket Sled Testing were
not performed in sufficient detail toadequately address all scenarios associatedwith this accident.
The Board concludes the test series setupdid not provide for adequate grounding andbonding.
The Board concludes that based on the workpractices described in the OP and testimonyof the workers, management did notadequately educate and train employees inthe hazards and precautions required for
handling explosives and materials used inconjunction with explosives operation.
The Board concludes the OPs for this sledtrack test series were derived from the OPsfrom previous similar tests. Additionalhazards analysis specific to this test serieswere not documented and used during thedevelopment of the OPs for this specific testseries.
The Board concludes the cited probabilityreduction in the SA from Anticipated to
Extremely Unlikely was not supported bythe identification of specific design featuresor engineered barriers to minimize theprobability of the analyzed scenarios.
The Board concludes that because theaccident under review involves workers inclose proximity to the rocket, the reduction inseverity of the consequence would not beconsistent with the qualitative analyticalmethod described in the SA.
The Board concludes that, based on an
unmitigated scenario, the likelihood shouldbe substantially higher than BeyondExtremely Unlikely. According to the HA, ifthe frequency had been assessed asAnticipated or Unlikely, this activity wouldhave been within the Risk Rank of I or II andwould have been carried forward foradditional identification and discussion.
Sandia needs to develop and implementa plan to fulfill their responsibilities under10 CFR 851, Worker Protection and theDOE M 440.1-1A, Explosives SafetyManual to control explosives hazards.
ES-2
7/30/2019 Sled Track Type b Report Final
9/51
Conclusions Judgments of Need
The Board concludes hazards specific to thistest series were not fully analyzed and wereinformally discussed with the workers.
The Board concludes that if implementation
of the hazard assessment processes hadmore thoroughly identified hazardsassociated with this test series, requiredhazard controls could have been moreclearly identified and followed by theworkers.
The Board concludes the controls werebased on historical operations and not adetailed analysis of the rocket sled testseries as required by ISM.
The Board concludes that the actions of the
workers involved with this test series did notdemonstrate an understanding of conduct ofoperations principles.
The Board concludes that identified practicesrepresent a normalization of deviation fromestablished explosives safety work practices.
Sandia management needs to ensure
violations of explosives safetyrequirements and deviations fromestablished practices are detected andcorrected.
The Board concludes that SSOs efforts toimprove Sandias safety and healthperformance is an ongoing challenge.
SSO needs to evaluate the effectivenessof its RBO of explosives operations andfacilities.
ES-3
7/30/2019 Sled Track Type b Report Final
10/51
1.0 BACKGROUND
The organizations related to thisaccident were the National NuclearSecurity Administration Sandia SiteOffice (NNSA/SSO), Sandia
Corporation (Sandia) and TechnicalManagement SolutionS, Inc.(TMSS). A brief description of eachorganization is provided in thissection.
1.1 NNSA/Sandia Site Office
The NNSA/SSO provides oversightof Sandias activities and implementsthe Department of Energy (DOE)contract with Sandia. In addition, the
DOE/NNSA Service Center isavailable to provide support to theNNSA/SSO.
1.2 Sandia NationalLaboratories
Sandia is a national securitylaboratory involved in a variety ofresearch and development programsto help secure a peaceful and freeworld through technology. Sandia
develops technologies to sustain,modernize, and protect the UnitedStates nuclear arsenal, prevent thespread of weapons of massdestruction, defend againstterrorism, protect nationalinfrastructures, ensure stable energyand water supplies, and provide newcapabilities to the United Statesarmed forces.
1.3 Sled Track Facility
Description
The Sled Track Test Site is afederally-funded basic research anddevelopment facility and operatesunder the programmatic direction ofthe DOE Headquarters. The SledTrack Test Site is one of numerous
federally-owned facilities situated onland owned by the DOE. The SledTrack Test Site is located on Kirtland
Air Force Base (KAFB),Albuquerque, NM.
The Sled Track Complex supportsthe verification of design integrity,performance, and fusing functions ofweapon systems through thesimulation of high-speed impacts ofweapon shapes, substructures, andcomponents. Sandia NationalLaboratories, New Mexico (SNL/NM)test facilities such as the Sled TrackComplex have been specificallydesigned for the validation of
analytical modeling and thefunctional certification of weaponssystems. The facility is also used tosubject weapon parachute systemsto aerodynamic loads to verifyparachute design integrity andperformance. In addition, SandiaEnergy & Environment Programsuse the Sled Track Complex to verifydesigns in transportation technology,reactor safety, and Defense
Programs transportation systems.
Technical Area III (TA-III) isapproximately 5 miles south ofTechnical Area I in the southwestportion of KAFB. Approximately 200people work in the area, which iscomposed of 20 test facilitiesdevoted to large-scale physicaltesting and simulation of a variety ofnatural and induced environments.Over 150 structures are located
within TA-III, most of which aregrouped in small units separated byextensive open spaces.
Operations at the Sled TrackComplex include a variety of testsand test article preparation such asconducting rocket sled and rocket
1-1
7/30/2019 Sled Track Type b Report Final
11/51
launcher tests, free-flight testing, andexplosives testing. Each rocket sledtest involves the acceleration of arocket down a sled track. A test mayinvolve impacting an object onto a
target, or launching a parachute froman ejector accelerated along thetrack. Each explosive detonation isused to subject test articles to shockwaves and propel missiles into testarticles. Rocket launches are used toaccelerate test objects along a beamon a carriage that is stopped at theend of the beam, releasing testobjects into free flight at specifictargets. In free-flight launches, test
objects are launched directly intofree flight from portable launch rails.
1.4 Technical ManagementSolutionS, Inc.
TMSS, Inc. has been working withvarious government agencies forover 20 years. They provide a widerange of support and serviceapplications, consisting of:
Project Management support
Engineering support
General Technologists
System Program Administrators
Maintenance Planners
Technical Support Specialists
Project Support Specialists
Test and Maintenance SupportPersonnel (TMSP)
Under their contract with Sandia,TMSS provides maintenance andsupport of testing operations invarious test facilities of SNL/NM toinclude the Rocket Sled TrackComplex.
1.5 Scope and Methodology
The Accident Investigation Board(Board) was appointed on October14, 2008 (See Appendix A) andbegan the investigation that day.
The scope of the Boardsinvestigation was to identify allrelevant facts; analyze the facts todetermine the direct, contributing,and root causes of the accident;develop conclusions; and determineJudgments of Need (JONs). (SeeFigure 1-4 below for an explanationof accident investigationterminology). The investigation wasperformed in accordance with DOE
Order 225.1A,AccidentInvestigation, using the followingmethodology:
The accident scene wasinspected, physical evidence wascollected, and photographs weretaken of the scene.
Facts relevant to the accidentwere gathered throughinterviews, reviews of
documentation, and examinationof the physical evidence.
The facts were analyzed toidentify the causal factors usingbarrier analysis, change analysis,event and causal factors analysisand root cause analysis.
Conclusions and JONs weredeveloped to guide thedevelopment of corrective actions
that, if implemented, shouldprevent recurrence of similaraccidents.
1-2
7/30/2019 Sled Track Type b Report Final
12/51
Accident Investigation Terminology
A causal factoris an event or condition in the accident sequence thatcontributes to the unwanted result. There are three types of causal factors:direct cause(s), which is the immediate event(s) or condition(s) that caused theaccident; root cause(s), which is the causal factor that, if corrected, wouldprevent recurrence of the accident; and the contributing causal factors, whichare the causal factors that collectively with the other causes increase thelikelihood of an accident but which did not cause the accident.
Event and causal factors analysis includes charting, which depicts the logicalsequence of events and conditions (causal factors that allowed the accident tooccur), and the use of deductive reasoning to determine the events or conditions
that contributed to the accident.
Barrier analysis reviews the hazards, the targets (people or objects) of thehazards, and the controls or barriers that management systems put in place toseparate the hazards from the targets. Barriers may be physical oradministrative.
Change analysis is a systematic approach that examines planned or unplannedchanges in a system that caused the undesirable results related to the accident.
Figure 1-1. Accident Investigation Terminology
1-3
7/30/2019 Sled Track Type b Report Final
13/51
2.0 ACCIDENT DESCRIPTIONAND CHRONOLOGY OFEVENTS
2.1 Accident Description
On the afternoon of October 9, 2008,a sled track test was to be performedinvolving a sled that consisted of atest package connected to the frontof a Super Zuni rocket motor (SeeFigure 2-1). The test packageconsisted of two thermal batteriesand a hardened data recorder knownas the HiCapPen. The test packageand the rocket motor were mounted
on the west rail of the 10,000 footsled track at Station 47 (a point4,700 feet from the south end of thesled track). The objective was tolaunch the sled from Station 47 andimpact a target located at Station 32(a point 3,200 feet from the southend of the sled track). The purposeof the test was to record thermalbattery output during the impact withthe target.
At approximately 4:45 pm, one of theArming and Firing Technicians(AF1), a TMSS employee, wasinstalling a Light Emitting Diode(LED) module into a MDM25connector on the top of the testpackage when the rocket motorunexpectedly fired and proceededdown the track (See Figures 2-3 and2-4). AF1 was bending over the testpackage when the rocket fired. He
was thrown onto the test track andwas lying across both the east andwest rails. There were 3 other sledtrack personnel in the vicinity. AF2was standing near AF1 and west ofthe rails. An InstrumentationTechnician (IN1) was standing eastof the rails a few feet away and had
turned away from the test track topick up his equipment. The TestEngineer (TE) was standing east ofthe rails several feet away. The
rocket sled hit the target and came toa stop in the vicinity of Station 31.
When the smoke from the rocketexhaust cleared, AF2 saw that AF1was injured, and instructed TE to call911. AF2 and the TMSS fire crewmoved AF1 from on top of the tracksonto the ground on the west side ofthe test track. TE called the ConsoleOperator (CO) in Building 6741 andrequested that the CO call 911.
AF2, IN1, and TE did not attemptfirst aid. They tried to make AF1 ascomfortable as possible. They put afoam cushion behind AF1s headand some clothing materialunderneath his arms so he could resthis elbows. Because his arms wereburned severely and AF1 could notlay them down or put them acrosshis chest. AF1 rested his elbows
and held his forearms up in the air.AF2 stated it was obvious that AF1sleg was broken and there wasn'tanything AF2 could do.
AF2 was concerned that AF1 wasgoing into shock. AF1s breathingaccelerated and he kept asking forwater to drink. AF2 gave AF1 sips ofwater to try to keep him calm.
AF1 was wearing TMSS's company
attire consisting of safety boots,denim blue jeans, a denim short-sleeved shirt and baseball cap. Afterthe accident AF2 stated that he sawblack smoke marks and soot on
AF1s clothing and the sleeves ofAF1s shirt were tattered and torn.
2-1
7/30/2019 Sled Track Type b Report Final
14/51
Table 2-1. Event Chronology Table
Date Time Event
October 9,2008 AM At 11:00 a successful iteration of this sled track testseries. The test crew included TE, CO, AF1, AF2, IN1and IN2. IN2 installed the LED module for this test.
October 9,2008
PM AF1, AF2 and IN1 made connections to the wiresleading to the thermal batteries and fire sets andperformed a systems check to ensure they wereworking properly. The firing cable was shorted andgrounded. AF2 took possession of the fire set key.The thermal battery fire set cable from the sled wasdisconnected.
October 9,
2008
PM AF1 & AF2 team completed their rocket motor
transport and pre-arming sequence, which involvesinstalling the rocket motor on the sled track,connecting to the test sled, and shorting andgrounding the coaxial cable that is connected to therocket motor igniter.
October 9,2008
PM AF1 and AF2 contacted CO and informed him thatthey completed their tasks.
October 9,2008
PM CO announced on the radio that essential personnelmay reenter the area to complete their tasks.
October 9,2008
PM TE and IN1 return to sled area. IN1 connected hisinstrumentation system and interface control box to the
top of the sled and set the HiCapPen to a 5 minutedelayed activation state.
October 9,2008
PM IN1 disconnected his equipment from the connector onthe sled.
October 9,2008
PM IN1 requested AF1 to insert LED module into theconnector mounted on the test unit. IN1 was notpositioned to do the task and IN2 was not available.
October 9,2008
PM IN1 gave AF1 the LED module and screwdriver totighten down the connector.
October 9,2008
4:45 PM AF1 bent over the rocket sled to insert the LEDmodule.
October 9,2008
PM LED module made contact with connector housing thepin 4. AF2 heard a click.
October 9,2008
Accidentoccurs
Rocket ignited and AF1 was injured.
October 9,2008
PM AF1 landed across the rails. TE, IN1 and AF2 heardloud sound and feel the heat from the rocket.
October 9,2008
PM AF2 instructed TE to call CO to call 911.
2-2
7/30/2019 Sled Track Type b Report Final
15/51
October 9,2008
PM CO called 911.
October 9,2008
PM AF2 and TMSS fire crew helped move AF1 out oftrough.
October 9,
2008
Accident+
15 min
KAFB and SNL/NM emergency responders arrived on
scene.October 9,2008
Accident+30 min
AF1 airlifted to the UNMH.
October 9,2008
PM IN1 and AF2 went to UNMH because of ringing in theirears. Waited three hours and left without treatment.
October 14,2008
AF1 was hospitalized more than 5 days triggering aType B investigation in accordance with DOE Order225.1A,Accident Investigation.
2-3
7/30/2019 Sled Track Type b Report Final
16/51
2.2 Emergency Response
Nine minutes after receiving the 911call, KAFB Fire Department and the
SNL/NM Emergency ResponseTeam (ERT) arrived at the accidentscene. The emergency responsecrew included three EmergencyMedical Technicians Paramedics(EMT-P). KAFB Fire Departmentreached the site first and treated AF1for first/second degree burns andcompound fracture of the right femur.Paramedics then started anintravenous saline and morphine andplaced AF1 on a back board inpreparation for airlift by helicopter.The ERT located a staging area andlanding zone for the emergencyhelicopter. About 15 minutes afterKAFB and SNL/NM ERT arrived, thehelicopter arrived. AF1 was loadedinto the helicopter and the helicopterleft the scene en route to theUniversity of New Mexico Hospital(UNMH). AF2 and IN1 weretransported to UNMH complaining ofringing in their ears. TE refusedtransport and signed a refusal formfor the paramedics.
The ERT began to clean uphazardous waste such as blood,remaining bandages, and blood-borne pathogen protectiveequipment. The accident scene wasthen isolated by a barrier ofCaution tape by SNL/NM protective
force personnel. The SNL/NMprotective force maintained control ofthe accident scene until the Boardtook custody.
2.3 Description of Injuries
AF1 received a compound fracture tothe right femur, first and second
degree burns to both hands andarms, his face, and a 10 inchlaceration on his right thigh. His rightpants leg was torn and his clothing
was charred. AF1 received twosurgeries on his leg: the first surgeryoccurred on the evening of October9, 2008 to repair his femur and thesecond surgery occurred on October12, 2008 to clean up the fracturewound. His burns were treated andhe was expected to recover fully.
IN1 and AF2 waited in theemergency room at UNMH for 3hours without being seen by amedical professional. They decidedto go home.
2.4 Emergency Preparedness
The SNL/NM Emergency MedicalServices Program includes fivephysicians in the Urgent Care Clinicand three paramedics in addition tosix registered nurses and twomedical assistants. The Urgent CareClinic is equipped with two
ambulances for immediate transportfor patients requiring further care.There is a current contract with
Albuquerque Ambulance for back-uptransport of patients. Theparamedics that responded to theincident were Advanced Cardiac LifeSupport (ACLS) certified and theircertifications were current.
The attending physician at UNM
Hospital indicated the patient carecontributed to the effective treatmentand made Emergency Roomresponsibilities considerably easier.
2-4
7/30/2019 Sled Track Type b Report Final
17/51
2.5 Photographic Record of the Accident Scene
This section depicts the conditions at the accident scene.
Figure 2-1. Representative rocket motor and test package
Figure 2-2. Position of rocket and test package after accident
2-5
7/30/2019 Sled Track Type b Report Final
18/51
Figure 2-3. HiCapPen with LED module installed and illuminated
Pin #4
Figure 2-4. Post accident MDM25 connector
2-6
7/30/2019 Sled Track Type b Report Final
19/51
Figure 2-5. Post accident LED module with black electrical tape
Connector
J2-Pin 4
Ungrounded Rocket Body
Connector
J2-Case
1.2 ohm
10.8 VBattery
1.2 ohm
0.403 ohm 0.445 ohm
0.050 ohm ShuntConnector J3
Pin 5
Detonator Current = 10.8 volts (.297) = 1.97 amps > 1.5 amp all-fire
2 (0.813) ohms
LED Module
Initiators
0.30 ohm
0.20 ohm
Connector
J2-Pin 4
Ungrounded Rocket Body
Connector
J2-Case
1.2 ohm
10.8 VBattery
1.2 ohm
0.403 ohm 0.445 ohm
0.050 ohm ShuntConnector J3
Pin 5
Detonator Current = 10.8 volts (.297) = 1.97 amps > 1.5 amp all-fire
2 (0.813) ohms
LED Module
Initiators
0.30 ohm
0.20 ohm
Figure 2-6. TAT Schematic Analysis
2-7
7/30/2019 Sled Track Type b Report Final
20/51
Figure 2-7. HiCapPen connection to sled track side box
Figure 2-8. Post accident sled track side box
2-8
7/30/2019 Sled Track Type b Report Final
21/51
Figure 2-9. Post accident wiring to sled track (note oxidation on track rails)
Batteries Rocket Motor
NN
Telemetry Power Panel
Based on Pre-Accident Position of the Article
Copper Braided GroundCable; Looped to the Control
Room
HiCapPen Recorder
Ground points used pre-
accident
Ground cable to
nozzle
Wrist strap used for
installing C-Cable
leads
No Continuity toOxidized Rail
C-Cable with 20
gauge wire ground
and hot leads
HiCapPen EnableCable Signal Ground
Reported short to ground in
the telemetry box by the TAT
Post accidentshowed that this
ground was open to
the panel ground onoxidized rails.
Smart FireSetGround cable contected the
fireset, C-Cable fireset, and
ground wire to panels.
East Rail
West Rail
No continuity
between rails
Continuity
Figure 2-10. Pre-accident grounding connections (Board reconstruction)
2-9
7/30/2019 Sled Track Type b Report Final
22/51
3.0 ACCIDENT ANALYSIS
3.1 Measurements, Photos andPhysical Evidence atAccident Scene
On October 9, 2008, the Sandiainvestigative readiness team tookphotographs of the accident scene.On October 10, 2008, Sandia tookadditional photographs and madeelectrical measurements at theaccident scene. Preliminarymeasurements included the sledtrack rails, at the sled side boxes,and at the stop location on the sled
track.Starting October 14, 2008, the Boardtook additional photographs andelectrical measurements at theaccident scene and collectedphysical evidence such as wires,electrical cable, wire strippers, and asmall screwdriver. All photographsand measurements were analyzedby the Board (See Section 2.5). Apiece of physical evidence that was
not found at the time was the LEDmodule that AF1 was installing whenthe rocket ignited.
A search for the LED module wasnot initiated until the Board wasassured that all other physicalevidence and measurements hadbeen taken. On October 30, 2008, asearch team found the LED module(See Figure 2-5) approximately 250
feet north of Station 47 andapproximately 60 feet east of therocket sled track. Black electricaltape had been wrapped around theLED module (See Figure 2-5). Thepurpose of the tape was to shield theLED from sunlight in order to moreeffectively see the status of the LED
through the camera located north ofStation 47. According to testimonyfrom AF1, the presence of theelectrical tape on the LED module
did not make it difficult for him toinstall. The LED module wasprovided to the TAT for additionaltesting and analysis.
3.2 Technical Assistance Team(TAT)
Sandia formed a TAT to support theBoard. The TAT members wereselected from across SNL/NM tosupport the Board with technical
advice and analysis. To minimizepotential conflicts of interest, thepersonnel selected were notmembers of the organization thatexperienced the accident.
3.3 Disassembly of Test Sledand Measurements
On October 21, 2008, the Board metwith TAT members to discuss a planto disassemble the test sled package
and to determine appropriatediagnostic tests. On October 21 and22, 2008, the TAT, accompanied byBoard members, took diagnostic andelectrical measurements of thecondition of the rocket at the stoplocation at Station 31 on the sledtrack. On October 21, the femaleMDM25 connector on top of the testpackage was examined and a blackmark was observed near pin 4 that is
connected to the HiCapPen battery.This is the connector where AF1 wasattempting to insert the LED module(See Figure 2-4).
The test sled was towed back to theStation 47 firing location on October22 and electrical measurementswere taken with the test sled at
3-1
7/30/2019 Sled Track Type b Report Final
23/51
Station 47. Photographs were takenof the measurements process in bothlocations. After all accident scenemeasurements were taken by theTAT on October 22, the test sled
was towed to the end of the sledtrack, removed from the track, andtransported to Building 6736 fordisassembly and further diagnosticmeasurements in a more controlledenvironment.
On October 23 and 24, disassemblyand diagnostic tests of the sled testpackage occurred in the presence ofa Board member and photographswere taken of these activities. First,
the spent rocket motor wasunscrewed from the test sled. Theexposed forward end of the rocketmotor revealed that the interiorelectromagnetic barrier had beenremoved in order to expose theigniter wire as part of the test set up.The igniter wire was present but notconnected to the igniter. AF2 saidthis is not uncommon after the rockethas been fired. Next, the test
package (HiCapPen and thermalbatteries) was removed from the sledand placed on a work table. Thethermal batteries were separatedfrom the HiCapPen and the wiringharness from the HiCapPen to thefemale MDM25 connector wasremoved and provided to the TAT foradditional testing and analysis.
On October 24, the HiCapPen wasconnected to a laptop computer and
an attempt was made to downloadthe data from the HiCapPenmemory. Because the HiCapPenhad not armed, no data had beenrecorded.
During the week of October 27, theTAT took further measurements at
the accident scene and found anunexpected earth ground in thetelemetry sled side box which lateranalysis showed contributed to theignition of the rocket (See Figure 2-
10).3.4 TAT Assessment of
Potential Causes of theRocket Ignition
Using the measurements gathered atthe accident scene and informationon the sled test package, fire setcable, and test sled side boxes, theTAT developed a circuit graphic forthe test setup at the time of theaccident (See Figure 2-6). The TATalso developed a schematic of thetest package circuitry. The TATanalyzed this schematic for potentialignition sources within the test setup.In addition to the development of thecircuit analysis, the TAT alsoanalyzed other scenarios that couldhave ignited the rocket:
rocket propellant self-initiation,
radio frequency and
electromagnetic energy inducedcurrent to the igniter circuitry(e.g., from radios, cell phones,electrical power lines, etc.),
thermal battery initiation of therocket motor,
firing set initiation of the rocketmotor, and
electrostatic discharge (ESD)initiation of the rocket motor.
3.5 TAT Determination ofPotential Causes of theRocket Ignition
On October 27, 2008, the TATbriefed the Board on the results oftheir measurements, data gathering,results of examination of the female
3-2
7/30/2019 Sled Track Type b Report Final
24/51
MDM25 connector, and theirdetermination of the cause as to whythe rocket motor ignited.Microscopic photography of thefemale MDM25 connector confirmed
a black mark at the base of the pinconnected to the HiCapPen battery(See Figure 2-4). Pin #4 on thefemale MDM25 connector, bydesign, was connected directly to theHiCapPen battery in order toenergize the LED (See Figure 2-3).The output of the HiCapPen batterywas 10.8 volts and the battery wasnot current limited. The TATconcluded that the energy source
that caused the rocket ignition was ashort at Pin #4 that occurred when
the male and female MDM25connectors came in contact. Fromthe TAT analysis of the circuitschematic (See Figure 2-6), theydiscovered a circuit configuration
that would have caused the energyfrom the short to flow from theMDM25 female connector, throughthe test sled body, and through therocket igniter.The TAT did provide the Board witha formal report that is maintained inthe official investigation files. Someof the topics discussed in the reportwere deemed Official Use Only andtherefore are not included as part of
this report.
3-3
7/30/2019 Sled Track Type b Report Final
25/51
4.0 MANAGEMENT SYSTEMSEVALUATION
4.1 DOE Oversight
Starting in 2005, SSO adopted anew safety basis approach for non-nuclear facilities. This approachinvolved Risk-Based Oversight(RBO). RBO focuses a significantamount of effort on oversight ofnuclear activities and less onindustrial activities. This approachfocuses on DOE's risk related to 1)exposure to the public; 2) releases tothe environment; and 3) risk to
DOE's mission. As a result, SNL/NMnuclear facilities receive extensivetransactional oversight, as doindustrial facilities that can releasetoxic gases and expose the public.Facilities such as the low hazardNeutron Generator Facility also havesignificant DOE oversight because oftheir ability to have a dramatic effecton DOEs mission on a routine basis.
For facilities/activities that do not fall
into one of the three categoriesabove, SSO relies on a systemsbased approach to driveperformance improvement andcompliance. Additional contractualmechanisms include SandiasContractor Assurance System (e.g.Performance Evaluation Plan, andfee determination, etc.). SSO andexternal audits from OA in 2005, andfrom HS-64 in 2008 continued to find
problems with work control andISMS implementation. Although theLab has put much effort intoimproving work control and ISMSimplementation, they have hadlimited success as indicated inSandias Performance EvaluationReport for the past three years.
The Board concludes that SSOsefforts to improve Sandias safetyand health performance is anongoing challenge.
4.2 Explosives Safety ProgramImplementation
Title 10 Code of Federal Regulation(CFR) 851.24 states that DOEcontractors must have a structuredapproach to their worker safety andhealth program which at a minimumincludes provisions for explosivessafety. Contractors must comply withthe applicable standards and
provisions in 10 CFR 851, AppendixA.3, that states compliance with theDOE Manual (M) 440.1-1A, DOEExplosives Safety Manual, January9, 2006, is mandatory. Sandiaincorporated the requirements ofDOE M 440.1-1A, Explosives SafetyManual, as well as additionalrequirements and practices forconducting explosives operations atSNL into the Corporate Process
Requirement (CPR) 400.1.1.31, SNLEnvironment, Safety, and Health(ES&H) Explosives Safety Manual,dated November 9, 2007.
4.2.1 Explosives Safety Analyses
DOE M 440.1-1A,Explosives SafetyManual, Chapter II, item 2.1grequires that Safety analyses ofexplosives facilities and operationsshall be performed.
CPR400.1.1.31 SNL ES&HExplosives Safety Manual, ChapterII, item 1.7S states The [Hazard
Assessment] HA can either be astandalone document that explicitlyfollows the process outlined in thisManual and referenced within the[Primary Hazards Screening]
4-1
7/30/2019 Sled Track Type b Report Final
26/51
PHS/HA, or it can be accomplishedwithin the PHS/HA software as longas it satisfies the requirementsoutlined in this Manual.
PHS 9632456779-013, The
Primary Hazard Screening for theArea III Sled Track Complex,dated April 14, 2008 and theIntegrated Work Plan (IWP) forthe MC4152 Thermal BatteryRocket Motor Sled Testing (IWP1737 dated August 15, 2008)identified the worst case scenarioof the rocket motor asinadvertently ignites whenpersonnel are nearby without a
specific breakdown of thehazards (reference section 4.3.2).
The Board concludes that the safetyanalyses used to support theMC4152 Thermal Battery RocketSled Testing were not performed insufficient detail to adequatelyaddress all scenarios associatedwith this accident.
4.2.2 Explosives Safety
ComplianceThe following explosives safetyrequirements were not fullyimplemented:
DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item13.3.5(4) requires Test unitscontaining low-firing-currentactuators or detonators shall beclearly marked.
The rocket motor test assembly wasnot marked as containing low-firing-current detonator (igniter).
DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item6.0b states that Stray energy,such as transients and other
forms of induced energy, can beimposed on circuits affecting[Electroexplosive Devices] EEDsfrom other subsystems by variousmethods. Examples are inductive
or capacitive coupling; sneakground circuits; defectivecomponents or wiring; errors indesign, modification, ormaintenance.
The igniter was connected to thesled track side panel ground with acoaxial cable and an unexpectedground connection was discoveredat the sled track side panel.
DOE M 440.1-1A,ExplosivesSafety Manual, Chapter II, item13.8.4a1 states that for electricalinstruments used with non-initiating electrical circuits suchas the HiCapPen Each specificuse of the instrument shall beanalyzed to ensure no crediblescenario exists whereby thenormal test energy from theinstrument can ignite explosivescharges or initiators in the test.
The ST Mgr stated that he suspectedthat there was a potential hazard dueto the battery in the HiCapPen andhe instructed an electrical engineerto assess the hazard. Nodocumentation of this analysis wasprovided to the Board.
DOE M 440.1-1A, ExplosivesSafety Manual, Chapter II, 7.1states that Positive steps must
be taken to control or eliminatestatic electricity in areas wherematerials that are ignitable bystatic spark discharge areprocessed or handled. Thisincludes spark-sensitiveexplosives, propellants, andpyrotechnics as well as solvent
4-2
7/30/2019 Sled Track Type b Report Final
27/51
vapors, and flammable gases.Wires used as static groundconductors should be at least No.10 AWG or equivalent.
CPR400.1.1.31, SNL ES&H
Explosives Safety ManualChapter II, 7.1S states thatExplosive materials andexplosive devices require specialcare in handling and packagingbecause they can be set off bydischarges of static electricity atlevels commonly found in thework environment. In all cases,take special care to maintain theitem and all of its electrically
isolated parts in electrostaticequilibrium with their environmentand anyone who may touchthem.
A 20 AWG wire pigtail, a coaxialcable, and a shorting plug were usedto short the igniter. The shortingplug was grounded to the track sidepanel ground. The OPs did notspecify any bonding or groundinginstructions. The TE and techniciansdevised bonding and groundingmethods based on their experiencewith Super Zuni rocket motors. TheOPs did not specify when the INworkers were required to usewristbands.
Representatives of sled trackmanagement provided the TAT andthe Board with a bonding andgrounding graphic of how the test
series was most likely setup at thetime of the accident. The practice ofclamping bonding straps to oxidizedtrack rails did not provide anadequate common earthen ground.
The Board concludes the test seriessetup did not provide adequategrounding and bonding.
CPR400.1.1.31, SNL ES&HExplosives Safety ManualChapter II, 7.4Sa states Use ofwristbands during all operationsinvolving static-sensitive
explosive materials is mandatory.The functional check should bebetween the wearer contact pointand the wristband attachment toground. Functional checks shallbe noted in the facility log.
A wristband was not used by AF1and IN1 during the instrumentationprocedures for the HiCapPenpreparation for this test. Evidencesuggested that a wristband clamped
to the East track may have beenused during the shorting andgrounding of the rocket motor. Thiswristband was connected to theoxidized East rail and measurementsafter the accident demonstrated noconductivity with the rail. Functionalchecks of the wristband bondingconnections were not documented.
DOE M 440.1-1A, ExplosivesSafety Manual, Chapter II, item1.6 states Before beginningexplosives operations, managersshall educate and trainemployees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation. This training should bea part of the employee trainingand qualification programspecified in Chapter V.
The OP requires personnel to takeXPL-160, Explosives Safety Course.This course did not provide sufficientdetail to ensure that personnel couldeffectively implement establishedexplosives safety requirements andsafe work practices.
4-3
7/30/2019 Sled Track Type b Report Final
28/51
No records related to the Sled Trackgrounding system maintenance,inspection, or verification of systemintegrity were provided in responseto a request from the Board.
The Board concludes that based onthe work practices described in theOP and testimony of the workers,Sandia management did notadequately educate and train
employees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation.
The Board concludes that the aboveidentified practices represent anormalization of deviation fromestablished explosives safety workpractices.
CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter II, item 7.4Sc2 statesthat Wristbands without resistorsshould be visually inspected priorto each use and conductivity
verified to be less than 1,200,000ohms at least once per year.Verification shall be recorded.
4.3 Sandias Integrated SafetyManagement System
CPR400.1.2, Integrated SafetyManagement System (ISMS)Description, January 11, 2008,
documents the Sandia ISMS. TheBoard reviewed Sandiasimplementation of the five corefunctions. The Board foundweaknesses associated with four ofthe five core functions.
The wristband (W011) connected onthe east rail of the accident site wasidentified as being in fair physicalcondition during the last inspectionon February 13, 2007. Thegrounding strap (G009) used at theside panel was documented as goodphysical condition during the lastinspection on February 13, 2007.
4.3.1 Core Function 1, Define theScope of Work
No specific issues were identifiedwith respect to the definition of the
work to be performed in theexperimental series.
CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter II, item 7.1Sb3 requiresworkers to Use tools that arenon-sparking (nonferrous metal)and unpainted.
4.3.2 Core Function 2, Analyzethe Hazards
The complicated relationshipbetween the various qualitativehazard assessment methods usedby Sandia made it challenging forline management to ensure that thehazards and associated controls forthe MC4152 Sled Test Series wereclearly communicated to theworkers.
IN1 gave a ferrous screwdriver toAF1. AF1 accepted the ferrousscrewdriver to connect the LED
module to the MDM25 connector.
CPR400.1.1.31, SNL ES&HExplosives Safety Manual,Chapter I, item 8.4Sa6 states thatMaintain lightning protection andstatic grounding systems inaccordance with Chapter X.
The following diagram is an excerptfrom a diagram in the Validation andQualification Sciences ExperimentalComplex, Quality Assurance Planand Work Controls Program.
4-4
7/30/2019 Sled Track Type b Report Final
29/51
Figure 4-1. Validation and Qualification Sciences Experimental Complex, QualityAssurance Plan and Work Controls Program
The Primary Hazards Screening(PHS), Integrated Work Plan (IWP),
Hazards Analysis (HA), SafetyAssessment (SA), and ManagementOperational Review (MOR) identifiedinadvertent rocket firing as the worstcase accident scenario; however, theonly controls identified in thesedocuments were the OPs. The OPsdid not contain guidance to theworkers on specifics such asgrounding and bonding instructions,verifying continuity and resistivity of
bonding and grounding systems, andwhen using wriststraps was required.The referenced documents did notinclude an analysis of the rocket sledtest configuration. The need forelectrical isolation of all batteries inthe test package from the low energy
igniter in the rocket motor was notdocumented.
The Board concludes the OPs forthis sled track test series werederived from the OPs from previoussimilar tests. Additional hazardsanalysis specific to this test serieswere not documented and usedduring the development of the OPsfor this specific test series.
Sled Track management used theHA and SA to evaluate the risk of the
Sled Track operations. Risk iscategorized using qualitativemethods to estimate the probabilityof occurrence and the severity ofconsequences of postulatedaccidents. Tables 1 and 2 belowdefine parameters considered duringqualitative risk analysis.
4-5
7/30/2019 Sled Track Type b Report Final
30/51
Table 4-1 - Consequence Guidelines
Consequence Level Onsite (Workers)
High (H) Immediate worker fatality
Moderate (M) Life-threatening injuries
Low (L) Less than Life-threatening injuriesNegligible (N) Minor medical treatment (such as cuts, bruises,
contusions, and minor skin irritations)
Table 4-2 - Frequency Guidelines
Description Frequency (per year)
Anticipated (A) F 1.0E-02
Unlikely (U) 1.0E-02 > F 1.0E-04
Extremely Unlikely (EU) 1.0E-04 > F 1.0E-06
Beyond Extremely Unlikely (BEU) F < 1.0E-06
The Board compared two similaraccident scenarios in the hazardevaluation table of the SA-RSD-2006-0001, Rocket Sled TrackComplex Safety Assessment Safety
Assessment (SA). In scenario STT-4, an explosion occurs near the sledtrack in the vicinity of the testpackage or rocket during testpreparation and results in injury.
The test package in this scenariomay contain radioactive material andhigh explosives and the rocketmotors contain propellant. Inscenario STT-5, a normal test failswhich causes fire and/or explosion atthe sled track and result in injury.
The postulated causes of event STT-4 include an electrical short, leakingbatteries, battery overheats, staticelectricity, equipment/vehicle fire,
and equipment/vehicle collision. Thecauses of STT-5 include an electricalshort, static electricity, electricalcomponent failure, human errorduring preparation, sequenceproblem, design errors, hardwarefaults, etc. Both of these eventswere assessed to have an
unmitigated frequency level ofAnticipated, and the unmitigatedlocal physical consequence level forboth events was determined to beHigh.
Preventive features are identified inthe SA to reduce the probability ofoccurrence of the postulatedscenarios. The preventive featuresfor both accidents were Conduct ofOperations (Test Specific OperatingProcedure (TSOP), AccessControls), Fire ProtectionProgram, and Explosives SafetyProgram. Crediting these identifiedcontrols, STT-4 probability isreduced to Extremely Unlikely andSTT-5 is reduced to Unlikely. Thedifference in reduction in probabilityis not explained in the SA.
The Board concludes the citedprobability reduction in the SA fromAnticipated to Extremely Unlikelywas not supported by theidentification of specific designfeatures or engineered barriers tominimize the probability of theanalyzed scenarios.
4-7
7/30/2019 Sled Track Type b Report Final
31/51
Mitigative measures are identified inthe SA to reduce the severity of theconsequences associated with theSTT-4 and STT-5 scenarios. Bothscenarios list Conduct of Operations
(TSOP, Access Controls) andEmergency Preparedness Programas mitigative features. STT-5 alsocites a Design Feature (building6741 and 6742). No explanation ofthe attributes of the design feature isprovided for this in the SA.
The STT-4 consequence remainedHigh and the STT-5 consequencewas reduced to Negligible. Thedifference in the reduction of
consequence between STT-4 andSTT-5 is not explained in the SA.Because the hazard is anunanticipated explosion, the onlymitigation that would result in areduction from High to Negligiblewould be physical separation of theexplosive and the human receptors.
The Board concludes that becausethe accident under review involvesworkers in close proximity to the
rocket, the reduction in severity ofthe consequence would not beconsistent with the qualitativeanalytical method described in theSA.
PHS Number 9632456779-013,AreaIII Sled Track Complex, was writtento encompass all the operations atthe Sled Track. The PHScategorized the Sled Trackoperations as a Moderate hazardrequiring the development of a HA.Sled track management consideredthe HA to be a bounding analysisand elected not to develop anactivity-specific PHS for this test
series.
VQSEC Operating Procedure,OP473407, 10019 Issue B,Explosives Hazards Analysis, is theHA for TA-III. Table 3 providesguidance for identifying risk bins forhazards based on unmitigated risk.Table 4 Hazard Assessment forTA-III Sled Track Complex, containsthe hazard analysis results for thesled track operations.
Table 4-3 - Risk Bins for Onsite Receptors
Frequency Consequence
BeyondExtremelyUnlikely(BEU)
ExtremelyUnlikely (EU)
Unlikely (U) Anticipated(A)
High (H) III II I I
Moderate (M) IV III II I
Low (L) IV IV III IINegligible (N) IV IV IV III
Note: Events classified as Risk Rank I or II, based on unmitigated risk, arecarried forward for identification and discussion.
4-8
7/30/2019 Sled Track Type b Report Final
32/51
Table 4-4 Hazard Assessment for Area III Sled Track Complex
Operation Mode ofFailure
Effect Frequency ConsequenceLevel
RiskRank
MitigatingFeatures
Premature
detonation ofexplosiveswhilepersonnelare in thearea.
Human
error, suchasinadvertentcharging offireset
Injury or
death ofemployeesdue tooverpressureandfragmentation
BEU Moderate IV TWDs
EngineeringControls
Two-person rule
Grounding
Training
Range limits
Controlled Access
Proper storageand handling
Shielding
Risks are defined in terms of RiskRank I, II, III, or IV. According to theprocedure, hazards classified asRisk Rank I and II are those ofsignificant concern and hazardsclassified as Risk Rank III and IV areof less concern.
Table 4 of the HA defines the
operation being analyzed asPremature detonation of explosiveswhile personnel are in the area.The mode of failure is defined asHuman error, such as inadvertentcharging of fireset. The effect isInjury or death of employees due tooverpressure and fragmentation.The frequency level was determinedto be Beyond Extremely Unlikely(less than 1x10-6) with a
consequence level of Moderate.Potential initiators of the rocketmotor that were not included in thisanalysis include:
electrostatic discharge (ESD);
natural phenomena (e.g.,lightning);
use of ferrous tools (potentialsource of a spark);
energy from test packages (e.g.,HiCapPen); and
radio frequency (RF) sources.
Several inconsistencies were notedbetween the HA and SA for the Sled
Track Operations. The HAunmitigated frequency of BeyondExtremely Unlikely is not supportedby either example from the SA. Inthe SA, the unmitigated frequency isAnticipated and the lowestmitigated frequency is ExtremelyUnlikely. Based on the SA, theunmitigated frequency in the HAshould have been Anticipated. TheHA unmitigated consequence was
determined to be Medium. Bothexamples from the SA started withan unmitigated local physicalconsequence of High. Based onthe values in the SA, the HA shouldhave been an unmitigated Risk RankI. Proper Risk Ranking in the HAwould have resulted in the need for
4-9
7/30/2019 Sled Track Type b Report Final
33/51
additional analysis of this testconfiguration.
The Board concludes that, based onan unmitigated scenario, thelikelihood should be substantially
higher than Beyond ExtremelyUnlikely.According to the HA,if thefrequency had been assessed asAnticipated or Unlikely, thisactivity would have been within theRisk Rank of I or II and would havebeen carried forward for additionalidentification and discussion.
IWP 1737, MC4152 Thermal BatteryRocket Sled Testing, was developedto facilitate planning of this testseries. The IWP references the PHSfor the Sled Track, but does notreference the SA or HA. In the IWPInterview Questions and Answers, ano response was given for thefollowing questions:
IWP Question 31 ConcerningTSOP and OPs Haveexplosives safety issues beenreviewed?
IWP Question 32 ConcerningTSOP and OPs Have fireprotection requirements beendocumented?
IWP Question 33 ConcerningTSOP and OPs Have Lightningsafety and static electricity issuesbeen identified?
IWP Question 34 ConcerningTSOP and OPs - Have securityissues been addressed?
IWP Question 35 ConcerningTSOP and OPs Is anemergency plan in place?
IWP question 36 ConcerningTSOP and OPs Is thereadequate control of hazard area,including safety observers?
IWP question 37 ConcerningTSOP and OPs Is theredocumented engineering basis toestablish hazard area?
When asked, the IWP authors statedthat they believed the IWP questionsset was asking whether additionalreview of these areas was required.
Per the SA, prior to each testoperation, the Rocket Sled TrackComplex Manager (ST Mgr)performs a MOR to verify that ES&Hand programmatic requirements aremet. As part of this review, the STMgr, or his designee, determinesthat the requirements specified in theSA are properly implemented.
The MOR was part of the TSOPdevelopment process. Activity-specific OPs were intended tocapture the required controls for the
operation of the Sled Track and arediscussed in Section 4.3.3 of thisreport.
The HA and SA both focused on allsled track operations and were notspecific to the MC4152 Sled testseries. The primary hazardsassociated with this activity wereintroduced into the facility by eachindividual test series. AF1 statedthat he did not participate in the
MOR, but had read and signed theOP MC4152. Based on interviews, itwas determined that the hazardanalysis for this sled track test seriesby the TE and the MOR of the testconfiguration was informal, verbaland undocumented. The MORdiscussion of hazards associated
4-10
7/30/2019 Sled Track Type b Report Final
34/51
with the test series was notdocumented in the notes in the finalapproved MOR.
The Board concludes hazardsspecific to this test series were not
fully analyzed and were informallydiscussed with the workers.
The development and approval ofthe various hazards analysesassociated with this series of testsdid not demonstrate a level oftechnical inquisitiveness that couldhave increased the likelihood thatthe potential hazards associated withthe test configuration wereadequately identified and analyzed.
The Board concludes that ifimplementation of the hazardassessment processes had morethoroughly identified hazardsassociated with this test series,required hazard controls could havebeen more clearly identified andfollowed by the workers.
4.3.3 Core Function 3,Develop/Implement
Controls
ISM requires controls to bedeveloped and implemented basedon the analysis of the hazards for anoperation. The controls for this testseries were captured in theOP473407-12349, MC4152 ThermalBattery Rocket Sled Testing. TheOP was developed based on OPsfrom previous experiments; the
connection between the hazardanalysis methodologies and the OPswas not clearly demonstrated. Thispractice represents a normalizationof deviation. Those involved with thedevelopment of the OP did notquestion the adequacy of thehazards analysis.
The Board concludes the controlswere based on historical operationsand not a detailed analysis of therocket sled test series as required byIntegrated Safety Management.
4.3.4 Core Function 4, PerformWork Safely
Several OPs were used to performwork at the Sled Track. The OPsreviewed did not contain detailedinstructions (e.g., how to ground thetest configuration, when wrist strapswere required to be worn). The workwas performed by AF1, AF2, andIN1 based on the experience of theworkers and not necessarily thestated steps in the procedure.
A procedure was found in the controlroom and the CO had checked offmost of his operational steps. Acurrent OP was not found by the sledtrack and interviews confirmed thatthe sled side work was beingperformed based on each workerstraining and experience. Theprocedure checklist was not being
marked by AF and IN as required bythe OP.
The same procedure was to be usedby the CO and the workers that arephysically located by the Sled Track.Communication between the CO andworkers at the Sled Track waslimited due to the logistics of theoperation (e.g., physical separationand due to the restriction not to usethe radio within 50 feet of the rocket).
It was sled track managementsstated expectation that a coordinatedeffort would be made to sign offprocedure, but a process was not inplace to sign off the procedure atmultiple locations.
4-11
7/30/2019 Sled Track Type b Report Final
35/51
VQSEC Conduct of Operations,Chapter XVI Operations Procedures,Section 7 states that Operatorsshould have procedures with themand follow them in a step-by-step
manner when the procedurescontain sign-offs for the variousactivities.
OP473407-12349, MC4152 ThermalBattery Rocket Sled Testing statedthat long sleeved shirts wererequired PPE for this activity. AF1was wearing a short sleeved shirt atthe time of the accident.
The Board concludes that theactions of the workers involved withthis test series did not demonstratean understanding of conduct ofoperations principles.
4.3.5 Core Function 5, Feedbackand Improvement
Several SSO and Sandiaassessment reports of sled trackrelated activities were reviewed bythe Board. The assessments wereat a high level and concentrated on
documentation and did not documentobservation of actual sled trackoperations. None of the reviewedassessment reports identified thehazards analysis and controls thatfailed during this accident.Corrective actions associated withthe provided assessment reportswere not provided to the Board.
Occurrence Reporting and
Processing System (ORPS) reportDP-ALO-KO-SNL-200-1993-0004,Premature Rocket Sled Detonation,Resulting in Brush Fire, describes asituation similar to the subjectincident for this investigation. Theevent involved 25 Super Zuni rocketmotors. The direct cause identified
in the ORPS report was that the fireset was modified for the test in amanner that created an extremesensitivity to spurious noise inducedon the trigger circuit. This faulty
design was directly responsible forthe premature detonation of thepayload which occurred when thesecond-stage rocket motor ignited.
ORPS report DP-ALO-KO-SNL-2000-2000002, Employee Injuredby Detonation at ExplosiveComponents Facility, involved anunexpected detonation. The ORPSreport stated that the root cause wasthat the implementing procedure did
not include a specific requirement toconsider isolating all energy sources,including diagnostics, to thecomponent being tested.
Several of the corrective actionsfrom these two incidents could relateto this test sled incident, but thedetails of the corrective actionimplementation, closure and lessonslearned were requested by theBoard. The information was notprovided to the Board.
A 2008 SSO Self Assessmentidentified SSO and Sandia feedbackand improvement deficiencies.Weaknesses were noted associatedwith trending and analysis of data,issues management, and lessonslearned program implementation.
The Board concludes that linemanagement missed opportunities to
improve the effectiveness ofmanagement system implementationbecause of weaknesses in feedbackand improvement.
4-12
7/30/2019 Sled Track Type b Report Final
36/51
5.0 CAUSAL FACTORS
5.1 Direct Cause
The direct cause of the accident wasthe inadvertent ignition of the Super
Zuni rocket motor.5.2 Root Cause
Sandia did not fulfill theirresponsibilities under 10 CFR 851,Worker Protection and the DOE M440.1-1A, Explosives Safety Manualto control explosives hazards asevidenced by the following:
Hazards associated with thisrocket sled test series were not
accurately analyzed or fullycontrolled.
The design of this rocket sled testseries did not ensure that the testpackage was electrically isolatedfrom the Super Zuni rocket motor.
The test series set up did notprovide adequate grounding,shorting and bonding.
Sandia management did notadequately educate and train
employees in the hazards andprecautions required for handlingexplosives and materials used inconjunction with explosivesoperation.
The actions of the workersinvolved with this test series didnot demonstrate anunderstanding of explosivessafety requirements or conduct ofoperations principles.
5.3 Contributing Causes
Sandia management failed to detectviolations of explosives safetyrequirements and deviations fromestablished practices.
5-1
7/30/2019 Sled Track Type b Report Final
37/51
6.0 CONCLUSIONS ANDJUDGMENTS OF NEED
JONs are the managerial controls ansafety measures determined by the
Board to be necessary to prevent orminimize the probability or severity ofa recurrence. These JONs arelinked directly to the causal factors,
which are derived from facts andanalyses and form the basis forcorrective action plans and which arethe responsibility of line
management. The following table,Table 6-1, contains the Boardsconclusions and the JONs.
Table 6-1. Conclusions and Judgments of Need
Conclusions Judgments of Need
The Board concludes that the safetyanalyses used to support the MC4152Thermal Battery Rocket Sled Testing were
not performed in sufficient detail toadequately address all scenarios associatedwith this accident.
The Board concludes the test series setupdid not provide for adequate grounding andbonding.
The Board concludes that based on the workpractices described in the OP and testimonyof the workers, management did notadequately educate and train employees inthe hazards and precautions required for
handling explosives and materials used inconjunction with explosives operation.
The Board concludes the OPs for this sledtrack test series were derived from the OPsfrom previous similar tests. Additionalhazards analysis specific to this test serieswere not documented and used during thedevelopment of the OPs for this specific testseries.
The Board concludes the cited probabilityreduction in the SA from Anticipated to
Extremely Unlikely was not supported bythe identification of specific design featuresor engineered barriers to minimize theprobability of the analyzed scenarios.
The Board concludes that because theaccident under review involves workers inclose proximity to the rocket, the reduction inseverity of the consequence would not be
Sandia needs to develop and implementa plan to fulfill their responsibilities under10 CFR 851, Worker Protection and theDOE M 440.1-1A, Explosives SafetyManual to control explosives hazards.
6-1
7/30/2019 Sled Track Type b Report Final
38/51
Conclusions Judgments of Need
consistent with the qualitative analyticalmethod described in the SA.
The Board concludes that, based on anunmitigated scenario, the likelihood should
be substantially higher than BeyondExtremely Unlikely. According to the HA, ifthe frequency had been assessed asAnticipated or Unlikely, this activity wouldhave been within the Risk Rank of I or II andwould have been carried forward foradditional identification and discussion.
The Board concludes hazards specific to thistest series were not fully analyzed and wereinformally discussed with the workers.
The Board concludes that if implementation
of the hazard assessment processes hadmore thoroughly identified hazardsassociated with this test series, requiredhazard controls could have been moreclearly identified and followed by theworkers.
The Board concludes the controls werebased on historical operations and not adetailed analysis of the rocket sled testseries as required by ISM.
The Board concludes that the actions of the
workers involved with this test series did notdemonstrate an understanding of conduct ofoperations principles.
The Board concludes that identified practicesrepresent a normalization of deviation fromestablished explosives safety work practices.
Sandia management needs to ensure
violations of explosives safetyrequirements and deviations fromestablished practices are detected andcorrected.
The Board concludes that SSOs efforts toimprove Sandias safety and healthperformance is an ongoing challenge.
SSO needs to evaluate the effectivenessof its RBO of explosives operations andfacilities.
6-2
7/30/2019 Sled Track Type b Report Final
39/51
7/30/2019 Sled Track Type b Report Final
40/51
8.0 LIST OF BOARD MEMBERS, ADVISORS AND STAFF
Board Members
Chairperson Marcus Hayes, Occupational Safety and
Health Manager, National Nuclear SecurityAdministration Service Center
Analyst John E. Franchere, Safety Engineer,Environment, Safety and Health Office, SandiaSite Office
Member Kevin Carr, Explosives Safety Engineer,National Nuclear Security AdministrationService Center
Member Lynn Maestas, Physical Scientist, NationalNuclear Security Administration Service Center
Member Steve Muoz, Electrical Engineer, NationalNuclear Security Administration Service Center
Member Mario Murray, Safety Engineer, NationalNuclear Security Administration Service Center
Administrative Support Denise Regalado, Administrative Analyst
8-1
7/30/2019 Sled Track Type b Report Final
41/51
APPENDIX A APPOINTMENT OF TYPE BACCIDENT INVESTIGATION BOARD
A-1
7/30/2019 Sled Track Type b Report Final
42/51
A-3
7/30/2019 Sled Track Type b Report Final
43/51
A-4
7/30/2019 Sled Track Type b Report Final
44/51
A-5
7/30/2019 Sled Track Type b Report Final
45/51
A-6
7/30/2019 Sled Track Type b Report Final
46/51
APPENDIX B BARRIER ANALYSIS
B-1
7/30/2019 Sled Track Type b Report Final
47/51
Barrier AnalysisTable B-1. Barrier Analysis Table
Hazard: Rocket Motor Fires Target: AF1
What were thebarriers?
How did eachbarrier perform?
Why did the barrierfail?
How did the barrier affect theaccident?
Use of Non-ferrous Toolson a LowEnergy, ESDSensitiveArticle
No nonferroustools identifiedat accidentscene
AF1 was in positionof a ferrousscrewdriver andferrous wire stripperat the time of theincident.
The presence offerrous toolsprovided a secondpotential way to
initiate this incident.
The analysis of the incidentdetermined that the LEDmade contact with pin 4 andcaused this incident.
Ferrous tools are a secondpotential initiator for a lessthan adequately groundedrocket and should not havebeen in use at the time of theincident.
Compliancewith the DOEExplosiveSafety Manualand SNLEstablishedExplosiveSafetyProcedures
Weaknessesidentified inimplementation
EstablishedExplosives SafetyProcedures containexplicit requirementsfor working withexplosives. Severalof theserequirements werenot implemented ina manner that would
prevent thisaccident.
More thoroughimplementation of theExplosives SafetyProcedures would haveprevented this accident (e.g.,proper grounding, checkingcontinuity of bonding andgrounding systems, use ofwrist straps, isolation, andlimiting current from
HiCapPen battery).
Work planningto ensurehazards areidentified andcontrolled, anddifferent jobsarecoordinated
Thecomplicatedrelationshipbetween thevarious hazardassessmentmethodologiesmake it difficultfor linemanagement to
ensure that thehazards andassociatedcontrols areclearlycommunicatedto the worker.
The PHS, IWP, HA,and MOR identifiedinadvertent rocketfiring as the worstcase hazardscenario, however,the only controlsidentified in thesedocuments were theOPs and specific
hazards andcontrols of the testseries were notidentified.
If sled track managementsimplementation of the hazardassessment processes hadmore thoroughly identifiedhazards associated with thisoperation, required hazardcontrols would have beenmore clearly identified andfollowed by the worker.
B-3
7/30/2019 Sled Track Type b Report Final
48/51
SSO and SNLManagementdid not ensurerequirementswere followedand that
systems werefullyoperational.
Managementdid noteffectivelyassess sledtrack operationsand was
unaware ofmanydeviations fromSNLs ISM andestablishedexplosive safetyprocedures andpractices.
More thoroughimplementation ofthe ExplosivesSafety Procedureswould haveprevented this
accident.
Management did not detectthe ineffectiveimplementation of explosivesafety procedures or ISM.
OperatingProceduresand Checklist
Weaknessesidentified inimplementation
The MC4152 OP didnot contain detailedsteps to implementthe SNL explosive
safety manual (e.g.,proper grounding,checking continuityof bonding andgrounding systems,and use of wriststraps). Thechecklist was notused or fullycompleted (marked)up to the point of theaccident by all of the
involved workers.
Use of detailed explosivesafety compliant checklistand procedures would haveprevented the accident from
occurring.
PersonalProtectiveEquipment(PPE) - LongSleevedCotton Shirt
The PPErequired by theOP was notimplemented
The OP requiresworkers to wear longsleeve cotton shirts.This requirementwas not rigorouslyenforced.
If AF1 had been wearing along sleeved cotton shirt perthe OP, the burns on hisarms may not have been assevere.
B-4
7/30/2019 Sled Track Type b Report Final
49/51
APPENDIX C CHANGE ANALYSIS
C-1
7/30/2019 Sled Track Type b Report Final
50/51
Change AnalysisTable C-1. Change Analysis Table
Accident SituationPrior, Ideal, orAccident-Free
SituationDifference Evaluation of Effect
AF1 inserted LED IN2 inserted LEDfor morning test.The OP calls for anIN tech to install theLED.
AF1 stated hedid not havemuchexperienceusing MDM25connectors.
AF1s inexperience withMDM25 connectors mayhave increased thelikelihood of groundingthe connector bodiesduring the installationattempt.
Electrical tape wasplaced around theLED housing toshade the LED bulbso that it could beseen by the COthrough the closedcircuit monitors.
LED bulb was notshaded for thesuccessful first testof the day.
The tape mayhave made itmore difficult toline up the LEDwith the testunit.
AF1 stated that thepresence of theelectrical tape did notinterfere with theinstallation and that thetape was on the LEDwhen he received it.
Arming ofHiCapPen changed a 5 minute timedelay was added toarming sequence
Arming ofHiCapPenperformed sled sidewas to fully armedmode.
Time delayadded toHiCapPenarmingsequence toallow time forpersonnel tomove to safetybefore theHiCapPen fullyarmed.
This change was madeto increase workersafety.
Method ofestablishingappropriateisolation betweencomponents did notpreclude flow ofelectricity to igniter.
Ideal: Test sledconfigurationshould isolateelectricallysensitivecomponents frombattery supply
Ineffectiveisolation ofcomponentsprovided a pathfor energy tothe igniter.
Rocket motor firedunexpectedly.
Grounding andbonding was not inaccordance with theExplosives SafetyManual.
Grounding andbonding isadequate tomitigate ESDhazard.
Ineffectivebonding andgrounding wasnot inaccordancewith theExplosivesSafety Manual.
Even though ESD didnot cause this accident,the ESD sensitiverocket igniter could havebeen initiated by ESDdue to ineffectivebonding and grounding.
C-3
7/30/2019 Sled Track Type b Report Final
51/51
Accident SituationPrior, Ideal, orAccident-Free
SituationDifference Evaluation of Effect
OPs did not containsufficient detail toensure that the testconfiguration werethe same for eachtest (e.g., bonding,grounding,electricalconnections,isolation).
Hazardous workperformed per OPsthat are specificand developedbased on activity-specific hazardsanalysis.
Variations in theway OPs areused in the fieldprovideopportunities forvariations in theway recognizedhazards arecontrolled.
The potential forunexpected ignition ofthe rocket motor wasnot analyzed andeffective controls werenot devised to protectagainst inadvertentactivation of the rocketmotor.
Current from theHiCapPen batteryflowed to the rocketmotor igniter.
HiCapPen batterycurrent is limitedbelow firing currentof rocket igniter.
HiCapPen currentisolated from rocketigniter.
Rocket igniterexposed toenergy sourcefrom HiCapPen.
Rocket motor firedunexpectedly.
Managementaccepted theresults of previoushazardassessments duringOP development
Prior situation: along history of sledtrack operationswithout inadvertentrocket motorinitiation.
Ideal situation: ahazard analysis isperformed to
determine howeach testseries/configurationimpacts the worstcase scenario.
The PHS, IWP,HA, SA, andMOR all identifythat the worstcase scenariofor the testseries was aninadvertentrocket motor
ignition.
None of theseprocesses addressedthe specific hazards andcontrols that couldprevent inadvertentrocket motor ignition.
Igniter wire wasshunted at end of106 ft fire cable.
Place shunt asclose to igniter wireas possible tominimize lineresistance throughthe shunt.
Placement ofshunt at the endof 106 ft cableallowedsufficientcurrent from theHiCapPen
battery to flowthrough theigniter insteadof the shunt.
Rocket motor firedunexpectedly.