[DNFSB LETTERHEAD]

January 15, 2002

Brigadier General Ronald J. Haeckel
Acting Deputy Administrator
for Defense Programs
Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-1000

Dear General Haeckel:

The Defense Nuclear Facilities Safety Board (Board) sent a letter to the Department of Energy (DOE) on January 8, 2001, regarding the quality and integration of hazard analyses at Lawrence Livermore National Laboratory (LLNL). Subsequently, on March 29, 2001, the Board was briefed by DOE and LLNL management on their plans for improvement, and for enhancing the safety of operations at LLNL's defense nuclear facilities.

A recent review by the Board's staff indicates that the laboratory's initiatives are on track, with several milestones having been completed on schedule. The Board notes that some progress has been made, and encourages DOE and LLNL management to continue their commitment to full implementation of all the initiatives to achieve the desired safety goals. The schedule for completion of those initiatives, however, extends over a long period of time, and the laboratory may need to integrate these efforts with some of the ongoing activities to upgrade authorization bases to fully benefit from the anticipated enhancements.

The enclosed report highlights some of the observations resulting from the staffs review and is forwarded for your information and use as appropriate. Of particular interest to the Board is continued identification of areas of inconsistency in the safety bases of defense nuclear facilities. This inconsistency has been verified by a Laboratory Baseline Document Review Team, DOE's Livermore Site Office, facility management, and the Board's staff. The Board believes that the laboratory should perform a thorough and expeditious review of all existing safety bases to ensure that such deficiencies do not exist in the final safety bases of defense nuclear facilities.

Sincerely,

John T. Conway
Chairman

c: Ms. Camille Yuan Soo Hoo
Mr. Mark B. Whitaker, Jr.

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

November 22, 2001

The laboratory's initiatives, as presented to the Board on March 29, 2001, appear to be on track, and several milestones have been completed on schedule. Several safety improvements to the ventilation, fire protection, and emergency power systems of the Plutonium Facility have been completed. Support for these improvements and initiatives on the part of LLNL management is clearly visible, and appears to be needed to continue achieving the required enhancements at the site.

Integration of Hazard Analyses. A working group has been established within LLNL's Authorization Basis (AB) Section to develop an approach for integration of hazard analyses related to environment, safety, and health and to provide recommendations to laboratory management for improving the associated activities. Although the recommendations had not been developed at the time of the staffs review, the working group has noted several ways in which this integration activity would help improve safety at the site. The working group has also concluded that integration of activities supporting the preparations of Safety Analysis Reports (SARs), emergency preparedness hazard assessments, fire hazard analyses (FHA), and environmental impact statements would increase consistency, efficiency, and effectiveness in the development of safety procedures at LLNL. The schedule for formulation of the recommendations, management review and approval of the recommendations, and development of an implementation plan, however, extends to fiscal year (FY) 2003. Such an extended schedule may not support activities now under way to improve the authorization bases of defense nuclear facilities to comply with DOE directives and the Nuclear Safety Management rule (Part 830 of Chapter 10 of the Code of Federal Regulations).

Authorization Basis Activities. LLNL's AB Section has increased its technical capabilities to about 18 full-time employees. These individuals help the facilities in conducting hazard and accident analysis activities. Although the AB Section is responsible for improving the safety bases of all nuclear and non-nuclear facilities at the laboratory, its attention is focused on nuclear facilities and on meeting the requirements of the Nuclear Safety Management rule. Consequently, some moderate- and high-hazard non-nuclear facilities may not benefit from this group's expertise in enhancing their operational safety in the near term due to the high nuclear-related workload.

Safety Basis--The current safety basis of the Plutonium Facility (Building 332) was approved by DOE in 1995. Over the years since 1995, this safety basis has improved at regular intervals as a result of internal and external reviews. Unfortunately, it still appears to need significant improvements. This need has been verified by a Laboratory Baseline Document Review Team, facility management's continyed identification of areas of inconsistency, and a review by the Board's staff of the current SAR and Technical Safety Requirements (TSRs). Although there do not appear to be any imminent safety issues related to the operations in this facility, the approved SAR does not describe the safety systems correctly, the TSRs do not capture all the safety controls and their functional requirements consistently, and credit may have been taken for mitigative systems that have not been verified or may not be based on sound technical justifications.

For example, facility management does not believe that the safety-significant fire dampers would be capable of performing their required safety function as described in the SAR, and is in the process of revising that section of the SAR. Similarly, the Board staff identified functional requirements in the SAR that are expected to be fulfilled by administrative controls but are not captured in the related section of the TSRs. Additionally, the SAR underestimates the probability of some potentially hazardous fires by unrealistically relying on the fire department to respond to and extinguish fires in a few minutes, instead of identifying more realistic preventive or mitigative measures. LLNL has not reviewed other existing safety bases to ensure that such deficiencies do not exist in the final safety bases of defense nuclear facilities.

The staff conducted a limited review of the facility's approach to establishing, verifying, and validating the effectiveness of administrative controls by examining the combustible loading control program. This program was established as a component of the fire protection program and was designed to monitor, limit, and control the combustible loading in the facility. Assumptions regarding the types and amounts of combustible material in the facility are an important component of the overall FHA. Verification of the actual combustible loading is normally done on a biweekly basis, but without a rigorous accounting for the actual types and amounts of material present in the affected spaces. Rather, the verification approach calls for an individual to conduct a broad, general assessment of the amount of combustible loading.

Although combustibles are inventoried, they are not normalized. The heat content of flammable or combustible liquids and plastics is greater than that of wood or paper; to provide a basis for fire modeling, an accurate quantification of the heat content of materials in the facility is required. Similar programs at other DOE sites normalize the heat loading on the basis of the heat content of wood, providing factors that can be used to accurately describe the higher tire challenge represented by other materials, such as plastics. Implementation of the combustible loading control program in this fashion at LLNL provides little documented assurance that the assumptions made for the tire severity modeling are protected.

The facility TSRs also call for verification of the combustible loading assumptions on a triennial basis. Presumably, this triennial review would provide for a more accurate and rigorous accounting of combustible loading. It does not appear, however, that this periodicity is appropriate for such an important assumption in the FHA and overall fire mitigation strategy, considering the issue discussed above.

The emergency diesel generators (EDGs) are classified as safety-class equipment for Building 332. They are credited with an auto start feature and are required to provide power to other safety-class equipment following certain accident scenarios. Several surveillance activities are performed to ensure that the EDGs will perform their safety function. However, there is no surveillance, testing, or supporting analysis verifying that all of the important safety equipment would continue to operate under the full range of postulated EDG operating conditions. The surveillance acceptance criteria specify acceptable operating ranges for EDG voltage and frequency. However, there is no degraded voltage analysis to ensure that the important safety- class equipment powered by the EDGs would be able to operate for the required duration under degraded voltage or frequency conditions. Additionally, the safety-class switchgear used to distribute the power to the end loads is located in an unprotected area of the basement of the building. As a result, the switchgear is vulnerable to a number of external influences, including pipe breaks from non-safety-class building support systems. Facility management indicated that a project had been approved to construct an enclosure to protect the switchgear.

Fire Hazard Analyses--During its review in November 2000, the staff observed that the FHAs were incomplete in that they contained little or no narrative description to support the conclusions presented. Some improvement has been made in this area by issuing new guidance. To date, however, only one new FHA has been prepared using the new guidance--the Building 332 FHA, performed in May 2001. Review of this FHA indicates that the new guidance may still be inadequate. Much of the content of an FHA is still left to the individual engineer. In the Building 332 FHA, there is no description of the exterior sprinkler protection for the oil-filled transformer adjacent to the building, nor is the need for fire-resistant coating in the basement discussed. Additionally, evaluation of compliance with the National Fire Protection Association (NFPA) code in the facility is incomplete. For example, natural gas is present in the facility, but conformance to NFPA 54, National Fuel Gas Code, is not evaluated; in fact, this hazard is not discussed in the FHA. Another example is the recently installed heat detection system in the loft area. According to NFPA 72, National Fire Alarm Code, detectors are to be located no more than 12 inches from the ceiling. Heat detectors in the loft are installed approximately 18 to 24 inches from the ceiling. Since the detectors are farther from the ceiling, response time will be slower if a detector responds at all. This type of code deviation should have been discovered and addressed in the FHA.

Both the FHA and the SAR reference a LLNL study that supports the use of "spray dampers" in lieu of traditional fire dampers. When requested by the staff, this study could not be located. These spray dampers are essential equipment required to cool room exhaust that could potentially contain high-temperature (815ºC) combustion products before the exhaust reaches the high-efficiency particulate air filters. This supporting documentation is needed to verify that the parameters essential to the operation of the spray dampers are maintained and the corresponding surveillance and maintenance activities are performed.

Emergency Preparedness--The LLNL emergency preparedness program continues to improve. Its improvement appears to have both management attention and commitment on the part of LLNL and DOE's Livermore Site Office (LSO). The contract between the University of California and DOE's Oakland Operations Office for LLNL contains provisions for the necessary corrective actions and designates performance measures to some elements of the program. However, the effort does not appear to be adequately planned to achieve near-term improvements and timely completion. The following additional observations were made:

• LLNL has revised many of its 17 emergency preparedness hazard assessments to address comments from the LSO. However, these assessment are minimally adequate to deal with the protective actions required for the most significant hazards at LLNL. The other elements of emergency preparedness and response, such as preparation of procedures for implementation of protective actions and training, however, have not been addressed. The Board's staff is concerned about LLNL capabilities beyond the initial response of the fire department to deal with emergencies.



• LLNL and LSO plan to complete development and implementation of the program by the end of FY 2003, with many of the elements being addressed in FY 2002. However, the LLNL Emergency Preparedness Project Management Plan lacks sufficient detail and does not provide a road map for full program development and implementation. The plan provides only a list of essential elements to be completed and a statement of intent to complete them.



• Although drills and exercises are essential to development and validation of elements of the program, no drills are planned before an exercise in July 2002. The security stand-up with activation of the LLNL emergency management center in September 2001 demonstrated that drills and exercises lead to valuable lessons learned and identification of resource requirements. It will be difficult to effectively identify needed resources and to develop an emergency response organization and procedures for response activities and notifications without related drills. Additionally, some facilities at LLNL have never practiced response to an accident or an emergency situation.