[DNFSB LETTERHEAD]

April 23, 2002

General John A, Gordon
Under Secretary for Nuclear Security and Administrator
of the National Nuclear Security Administration
U. S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701

Dear General Gordon:

The staff of the Defense Nuclear Facilities Safety Board (Board) recently reviewed the new Aqueous Recovery Line for Plutonium-238 (Pu-238) Scrap at Los Alamos National Laboratory (LANL) scheduled for initial operations by the end of the fiscal year 2002. When operational, this scrap recovery line will be the only Department of Energy (DOE) source of purified Pu-238 oxide. The enclosed staff report describes observations from the review of this recovery line.

The Board notes that the LANL project staff exhibited thorough knowledge of the process and equipment. However, this knowledge does not appear to have been utilized adequately to identify and analyze the hazards associated with this operation, and to identify and classify the necessary controls. As a result, DOE imposed a number of additional safety-class and safety-significant controls as a condition of approval for this activity. Even with the controls added by DOE, it remains unclear whether all of the hazards have been adequately addressed.

DOE actions notwithstanding, the control strategy currently accepted by DOE and LANL for this Pu-238 operation relies heavily on administrative controls rather than design features. Furthermore, LANL presently does not plan to incorporate many of these safety-related administrative controls into Technical Safety Requirements prior to startup. Such tactics are not considered to be good safety practices nor are they consistent with the laboratory's procedures.

The Board believes that the high hazard nature of the materials involved and the deficiencies cited in the work planning process warrant a further evaluation of the safety basis and safety-related controls. Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests a report within 60 days of receipt of this letter that documents how DOE will resolve the deficiencies identified in the enclosed staff report relative to:

• The hazard identification and analysis for this activity.



• The use of administrative controls where engineered controls are available and use of mitigative controls where preventive controls are available.



• The specification of Technical Safety Requirements that capture all the relevant safety controls identified in the approved authorization basis, consistent with DOE directives.

Sincerely,

John T. Conway
Chairman

c: Mr. Mark B. Whitaker, Jr.

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

April 9, 2002

Background. The Department of Energy (DOE) has no current capability for producing Pu-238 for programmatic applications. Therefore, LANL is developing a capability to reclaim and purify scrap Pu-238. The new scrap recovery line in the Plutonium Facility (Technical Area [TA]-55) consists of six gloveboxes and will have a normal design throughput of 5 kg of Pu-238 oxide per year. The system uses a process flow sheet similar to that employed for other plutonium processing operations, such as HB-Line at the Savannah River Site.

The process involves five unit operations: (1) scrap oxide comminution (i.e., grinding and milling), (2) nitric acid dissolution, (3) anion exchange purification, (4) oxalate precipitation, and (5) calcination followed by oxygen-16 exchange. Recovery of Pu-238 from waste streams will be accomplished by hydroxide precipitation and ultrafiltration/polymer filtration. LANL is currently installing and testing process equipment and anticipates conducting readiness assessments during the summer and hot operations before the end of fiscal year 2002.

Discussion. The staff interviewed personnel, toured the facility, and reviewed the applicable LANL Process Hazards Analysis (PrHA) and DOE approval memorandum, which together constitute the TA-55 safety basis addendum for this operation. The PrHA identified three bounding accident scenarios: (1) ejection of a comminution ball mill jar, (2) thermal excursion during the oxalate precipitation, and (3) glovebox fire during calcination.

DOE's approval memorandum identified nonconsexvatisms in the PrHA and recalculated the consequences of the bounding accident scenarios, Based on the increased consequences, DOE specified that a number of controls be designated safety-class or safety-significant. DOE also identified additional safety-class and safety-significant controls related to ion exchange resin accident scenarios that had not been considered bounding in the LANL PrHA.

The principal issues identified during the staff's review involved inadequacies in the safety basis, concerns related to the project's reliance on administrative controls, and the need for improved rigor in the implementation of safety-related administrative controls. These issues are summarized below.

Inadequate Safety Basis--Significant accident scenarios were apparently not adequately analyzed by LANL and DOE; the result was incomplete identification of controls in the safety basis. Contributing to this problem was the fact that DOE's approval memorandum made major changes to the safety basis without complete analysis and without requiring LANL to correct and update its PrHA. The deficiencies in the safety basis proposed by LANL might have been resolved more effectively had DOE held LANL responsible for reanalyzing the potential accident scenarios and developing a compfete set of functionally classified safety controls. Examples of incompletely evaluated hazards, accident scenarios, and controls include the following:

• Deflagration--Flammable gas generation by thermal and radiolytic decomposition received only a superficial evaluation, but it appears to be a major hazard warranting designated safety controls. For example, it may be appropriate to designate as a safety system the argon sparge that purges flammable gases from the dissolver system.



• Resin Accidents--There are two principal examples of the incomplete analysis of scenarios related to anion exchange column accidents:

-As a condition of approval, DOE required that prevention of resin dryout be treated as a safety-class control. However, LANL has not identified safety-class controls that would be effective in the event of a facility power failure and subsequent building evacuation. The anion exchange columns have an auto-elution system, powered by an uninterruptible power supply, that might serve this function. It may be appropriate to evaluate this as a potential designated safety system and thereby ensure its reliability.

-DOE designated the mesh screens around the anion exchange columns as safety-significant, presumably as mitigation against missile fragments that could breach the glovebox in the event of column overpressurization. However, preventive safety-significant controls such as relief valves or rupture discs do not appear to have been considered. The columns are equipped with relief valves, but the relief valves are not designated as safety systems and therefore may not be tested and maintained with the appropriate rigor.

• Mechanical Hazard--DOE designated the comminution ball mill jars as safety- significant, and the physical restraint systems (e.g., locking tabs, protective cover) that prevent ejection of the jars as defense-in-depth. Thus there is greater control on mitigation (the jars) rather than prevention (the restraint system). It is not clear that mitigative, rather than preventive, controls are preferred in this case. Furthermore, it does not appear that LANL evaluated whether the jars, if ejected, would adequately contain the plutonium oxide powder. It may be appropriate to investigate the restraint mechanisms as possible safety-related, preventive controls.



• Chemical Hazard--The laboratory intends to use hydroxylamine nitrate (HAN) as a reducing agent prior to oxalate precipitation. Under certain conditions, HAN has been known to undergo autocatalytic decomuosition in the presence of nitric acid. In its approval memorandum, DOE Pointed out that recommendations for safe handling of HAN were provided in the February 1998 Technical Report on Hydroxylamine Nitrate, DOE-EH-0555. The staff believes HAN can be used safely in the scrap recovery process, provided that the recommendations in the technical report (particularly those regarding temperature, concentration, and storage criteria) are rigorously implemented. The laboratory has yet to demonstrate how it will implement the DOE recommendations; it may be appropriate to develop safety-significant controls to prevent accident scenarios involving HAN.

Reliance on Administrative Safety Controls--The staff review found that the safety strategy for the scrap recovery process relies in many cases on administrative controls, when engineered safety features could be credited. Examples include:

• Strong acid can react violently with the ion exchange resin. LANL plans to use procedural controls on the make-up of the acid used to elute the ion exchange resin. An engineered safety feature may be warranted to prevent strong acid from contacting the resin inadvertently.



• Resin dryout can lead to an energetic reaction that would be outside the current design basis. As noted earlier in this report, DOE has designated prevention of resin dryout to be a safety-class control. LANL proposes to verify moisture procedurally, by having the operators check the liquid level in the column using a sight glass. An engineered safety feature may be a more appropriate means to implement this safety-class control.

Implementation of Safety Controls--The staff review identified concerns regarding the effectiveness with which the proposed administrative controls would be implemented. Based on discussions with LANL personnel. LANL plans to start up the scrap recovery process before incorporating many of the safety-related administrative controls--including controls that implement functions designated as safety-class by DOE--into Technical Safety Requirements (TSR). LANL intends to make such changes to the plutonium facility TSR in its 2003 annual update. Many of the DOE-mandated controls warrant the more stringent TSR-level implementation and surveillance requirements before startup of the process.

Additional Observations--The staff observed that transfers of solutions will be accomplished using Tygon tubing temporarily routed through connecting doors between the gloveboxes. This practice appears to be questionable for two reasons. First, DOE specifically required LANL to minimize opening these doors to protect assumptions regarding material-at-risk (MAR). Although each solution transfer is expected to be of short duration, they still will violate the MAR assumptions. More importantly, performing transfers using temporary hoses attached with quick-disconnect fittings is not consistent with the production nature of this process (i.e., long- term, nearly continuous operation). This approach provides operational flexibility, but it may result in excessive contamination in the gloveboxes due to inadvertent drips and spills of solutions. LANL may be better served to investigate a solution transfer method that does not require repeated connection and disconnection of transfer lines.

Conclusion. The staff believes that further evaluation of the safety basis and safety-related controls is warranted prior to startup of the Pu-238 scrap recovery process.