[DNFSB LETTERHEAD]

March 2, 2000

The Honorable T. J. Glauthier
Deputy Secretary of Energy
Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-1000

Dear Mr. Glauthier:

The Defense Nuclear Facilities Safety Board (Board) has been following with interest the self-assessment performed by Los Alamos National Laboratory (LANL) regarding the quality of authorization bases for a number of facilities, consistent with Department of Energy (DOE) policy DOE P 450.5, Line Environment, Safety and Health Oversight. The self-assessment is a good example of how feedback and improvement in the context of Integrated Safety Management (ISM) can lead to actions designed to improve the effectiveness of authorization bases and enhance safety.

Under the leadership of the DOE Los Alamos Area Office (LAAO), DOE and the University of California included in the fiscal year (FY) 1999 contract for the management and operation of LANL a requirement that the laboratory assess the quality of the 10 oldest authorization bases. These older authorization bases were compared with current DOE requirements and guidance, primarily DOE Order 5480.23, Nuclear Safety Analysis Reports, and DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Safety Analysis Reports. In addition, facilities were reviewed to determine whether any immediate safety problems existed, and root causes for systemic problems with authorization bases were identified. The LANL review team recommended a centralized LANL authorization basis function for nuclear facilities, adequate funding for preparing and maintaining authorization basis documents, and actions to control the Unreviewed Safety Question Determination process and to emphasize the responsibilities of facility managers for management of authorization basis programs. The FY 2000 contract includes requirements to upgrade seven authorization bases, including two not assessed. The remaining authorization bases are to be upgraded in FY 2001.

The Board considers that similar assessments across the complex, as part of the feedback and improvement function of ISM, would lead to a better understanding of the quality of authorization bases and provide input for use in prioritizing upgrades to authorization bases. Contractor-led self-assessments, however, require well qualified analysts working directly with facility management personnel to perform accurate assessments cost-effectively. Some sites do not have enough well-qualified personnel for the purpose and would, therefore, need external assistance in performing self-assessments.

You will note from the enclosed staff report (Bamdad) that LANL will be among those sites that are expected to have successfully completed ISM Verification Reviews Phases I and II and will meet DOE's goal of having the basic elements of ISM in place by September 2000. Nonetheless, both LANL and DOE have acknowledged that some upgrading of the authorization basis documents for nuclear facilities is merited and have developed a plan for doing so. This kind of assessment and continuing upgrade program should be recognized by DOE as representative of the effort that will be warranted in the post-September 2000 period at sites other than LANL. Such programs might well be considered a Phase III effort in the implementation of ISM throughout the complex.

DOE needs to evaluate its own technical capabilities to manage such a Phase III effort. For example, the Board's staff reported that while LAAO has a technically strong individual as Safety Authorization Basis Manager, DOE resources to support the required reviews of documents being generated at LANL may not be adequate. This observation is consistent with conclusions resulting from DOE's recent Verification Review of the LANL ISM System, which the Board's staff also observed (see both enclosures). In addition, the roles and responsibilities of the DOE Albuquerque Operations Office in supporting reviews of authorization bases are not clear.

The Board requests a briefing by DOE on what other sites will be performing self-assessments of authorization bases as part of ISM, and on DOE's resources, roles, and responsibilities for reviewing authorization basis documentation.

If you have any questions on this matter, please do not hesitate to call me.

Sincerely,

John T. Conway
Chairman

c: Brigadier General Thomas F. Gioconda
Mr. Richard E. Glass
Mr. Mark B. Whitaker, Jr.
Mr. Theodore A. Wyka, Jr.

Enclosures

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

January 11, 2000

This memorandum documents a review by the staff of the Defense Nuclear Facilities Safety Board (Board) of the self-assessment of authorization bases at Los Alamos National Laboratory (LANL). This review was conducted by members of the Board's staff F. Bamdad, M. Forsbacka, A. Jordan, and C. Martin at LANL and the Department of Energy (DOE) Los Alamos Area Office (LAAO) on December 6 - 9, 1999.

Background. The Board's staff and the technical staff at DOE-LAAO have noted significant deficiencies in the quality of the authorization basis documents at LANL during the last few years. Consequently, DOE-LAAO required LANL to perform a review of the authorization basis documents for 10 facilities as part of its contractual performance measures in fiscal year (FY) 1999, to identifying any potential systemic problems. The objectives of this review were as follows:

• Provide a critique of the authorization basis for each facility by comparing it with the current DOE guidance.
  
  
• Examine each facility and its operations, and determine whether any immediate safety problems exist.
  
  
• Understand the strengths and weaknesses of the process used to generate and maintain each facility's authorization basis, i.e., determine the root causes of the problems.
  

The review took about 3000 man-hours and was completed in September 1999. The review team consisted of senior subject matter experts from the Probabilistic Risk and Hazards Analysis Group of the Technical Safety Assessment (TSA- 11) Division at LANL, and outside consultants. A report, including the root-cause analysis, was prepared and submitted to DOE LAAO, to be followed by a corrective action plan. The Board's staff held a meeting at LANL to discuss the results of the review and the path forward.

Discussion. Overall, the authorization basis quality review conducted by LANL was a success, mainly because of the technical strength of the review team. The facilities chosen for the review represented a majority of the nuclear facilities at LANL with relatively old authorization bases (there is a total of 19 such Category 2 and 3 nuclear facilities at the site). The authorization basis documents for the facilities reviewed were prepared during a 10-year period. They range from old Safety Analysis Reports (SARs) prepared in 1986, to Bases for Interim Operation (BIO), to more recent SARS prepared in 1995. The DOE guidance for these documents and the quality of DOE's reviews also varied, or in some instances did not exist. The team reviewed the authorization bases for these facilities and walked down the operations involved to identify hazards and associated controls, and to review the implementation of existing controls.

As a result of the review, one immediate safety concern was identified. At the Radioactive Liquid Waste Treatment Facility, DOE-approved Technical Safety Requirements (TSRs) were not implemented. This situation was considered a major breakdown in the authorization basis for that facility, one that could lead to unsafe operations. The facility operating organization developed interim TSRs that were approved by DOE and implemented expeditiously to prevent work from being performed outside the approved safety envelope.

The overall conclusion of the quality review of authorization bases was that documentation for almost all of the facilities had significant deficiencies and did not meet current requirements. The review team identified three general types of deficiencies that are significant and found to be prevalent among most of the facilities: (1) inadequate hazard analysis and identification of potential accidents, (2) inadequate identification and specification of controls, and (3) inappropriate use of the Unreviewed Safety Question (USQ) process to maintain authorization bases. LANL representatives believe that although the authorization bases of these facilities do not meet current standards, there are no safety issues severe enough to warrant shutdown, and operations can continue while the documents are being upgraded. This conclusion is based on a walkdown of the facilities and review of the hazards and controls by the review team. The Board's staff believes that major deficiencies are related to worker protection and reliance on administrative controls which can only be corrected through performance of a process hazard analysis during the authorization basis upgrade activities.

The review team offered four general recommendations for improving the quality and process for preparing the authorization basis documents:

• Promote a centralized authorization basis function for nuclear facilities.
  
  
• Secure the needed funding to prepare and maintain authorization basis documents.
  
  
• Control the USQ process.
  
  
• Emphasize the program management responsibilities, of facility managers with regard to authorization bases.

It should be noted that prior to February 1998, the DOE Albuquerque Field Office (ALO) was responsible for reviewing and approving LANL authorization basis documents. Since then, this responsibility has been delegated to the Area Office Manager and further down to the Safety Authorization Basis Manager. This transfer of authority has resulted in a strong working relationship between LAAO and LANL and led to the identification of the deficiencies found. Furthermore, the following actions have been taken by LANL and DOE to address the issues identified by the review team.

Single Point of Contact for Authorization Basis Matters. LANL has established the Facility Risk Management Group (ESH-3) to be the single point of contact for reviews of authorization bases of nuclear facilities and for institutional consistency. This organization will be the single interface with the DOE-LAAO Safety Authorization Basis Manager (approval authority) for consistency and for clear technical direction and guidance.

Establishment of "Czar" for LANL Authorization Bases. LANL has assigned the Program Director of the Materials and Manufacturing Program Office as the institutional coordinator and champion for preparation of authorization basis documents. Furthermore activities associated with authorization bases will be conducted as projects and the facility managers will be the designated project managers directly responsible for development and implementation of the authorization bases. Technical assistance will be provided by TSA-11 and ESH-3, complemented by technically competent outside contractors.

Improvement Plan for Authorization Bases. Major milestones have been established to improve communication of DOE expectations and guidance, as well as to provide a checkpoint for reviewing the quality of authorization bases. Reviews will be performed by DOE at 30 percent level of effort (completion of the hazard analysis), at 70 percent (completion of the accident analysis), and at 90 percent (identification and classification of the controls). These reviews will be followed by a complete review of the final product for approval by DOE. Such a comprehensive review process, combined with funding and resource limitations, will extend completion of the improved authorization basis documents and their implementation through FY 2001.

Technical Personnel Issues. LANL has a broad spectrum of resources upon which to draw in improving the authorization bases of its facilities and has committed to complete upgrades of the authorization bases of seven facilities during FY 2000. However, DOE's resources are not adequate for reviewing the documents that will result from these planned upgrades. LAAO has a technically strong individual as Safety Authorization Basis Manager, plus two engineers in training for safety analysis reviews. DOE-ALO expressed a willingness to support LAAO, but does not have a sufficient number of personnel with the necessary training and experience needed to lead reviews of authorization bases. DOE-LAAO will need additional resources to support this important task. Slippage of the upgrade schedule is undesirable. With identified inadequacies in hazard analyses and associated controls DOE may not have a clear understanding of the residual risks of these operating facilities.

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

November 30, 1999

This report documents a review of the Phase I and II Verification Reviews of the Integrated Safety Management System (ISMS) at Los Alamos National Laboratory (LANL), conducted October 12 - 22, 1999. This review was performed by members of the staff of the Defense Nuclear Facilities Safety Board (Board) M. Moury and J. DeLoach and outside expert D. Boyd. The Department of Energy (DOE) verified the ISMS Description and the related laboratory, facility, and activity-level implementation at LANL.

Background. The two Verification Reviews involved a limited-scope ISM verification performed concurrently with a special assessment (SA) required by the University of California (UC)/DOE contract. The results of the two reviews, as well as the results of ongoing and past reviews having ISM elements, were to be integrated in the final report. The UC/DOE contract states the purpose of the SA as follows: ". . . to determine whether the overall level of performance achieved is satisfactory with regard to performance objectives in Appendix F and whether substantial progress has been made in meeting the requirements of clause 5.14." Appendix F contains the Environment, Safety and Health (ES&H) performance measures for 1999 that are used to evaluate LANL's ES&H performance. Clause 5.14 requires LANL to develop and implement specific ISM mechanisms. The results of the SA could be used to terminate the contract.

Verification Team and Conduct of the Verification. The verification team consisted of a team leader, a deputy team leader, a senior technical advisor, and seven team members. All were technically qualified, and experience summaries showed that five had ISM experience as well. The senior technical advisor's contributions in advising team members and assisting them with assessment forms, reviewing their work, and integrating the various inputs were critical to the success of the review effort.

The SA team comprised a team leader, a deputy team leader, and seven subteams with leaders and a total of 24 additional members. All were technically qualified and experience summaries showed that 9 had ISM experience as well. In preparation for the reviews, leaders of both teams coordinated lines of inquiry to satisfy core expectations for Phase I and II, while also meeting SA contractual requirements.

The concurrent reviews and use of SA results to reduce the scope of the combined Phase I and II Verification Reviews resulted in efficient use of DOE and LANL resources; moreover, the normal work of participants was impacted by one instead of two visits. However, a dedicated team performing a stand-alone, full-scope review as described in the DOE ISMS Verification Team Leader's Handbook would have been more effective in verifying ISMS status. The effectiveness of the reviews was compromised by the different priorities, objectives, and criteria involved; requirements to coordinate the efforts of the two teams; and the time spent in attempting to integrate the results of numerous efforts. Compounding this problem was the fact that the maturity of the ISMS did not support a combined Phase I and II Verification Review. Permanence and consistency of implementation would have been improved by conducting separate reviews - identifying and addressing Phase I issues, assessing the effectiveness of corrective actions, and then conducting the Phase II review.

The Board's staff was also concerned that the verification team leader was absent for unrelated training during the first week of the 2-week review period. He planned and coordinated with SA team leaders before the review started, and during that first week received status reports from the deputy team leader. Nevertheless, his absence conveyed a lack of high-level management commitment to the verification. The verification deputy team leader was fully engaged in assessing his assigned areas, and overall leadership of the combined effort during the first week was provided by the SA leader and SA deputy team leader.

Verification Results. LANL met most of the Phase I core expectations, but only half of the Phase II core expectations. Reverification or outside review of outstanding Phase II core expectations will be necessary at LANL after corrective actions have been completed. The verification teams will recommend that the System Description be approved with minor changes. However, the teams identified several issues, including a lack of requirements and expectations for identifying, analyzing, and categorizing hazards at the facility level; four procedures not completed that describe the expectations for authorization bases for nuclear and non-nuclear facilities; and the need for enhancements to feedback and improvement programs to ensure continuous improvement of the ISMS.

The DOE Los Alamos Area Office (LAAO) did not meet any of the core expectations for an ISMS. The verification teams identified several issues, including (1) a lack of processes and procedures for effectively carrying out ISMS responsibilities according to the DOE Functions, Responsibilities, and Authorities Manual (FRAM) and the DOE Albuquerque Operations Office (DOE-AL) FRAM; and (2) a lack of procedures for processes that involve interaction with LANL and for oversight programs designed to ensure that work is formally authorized and safely performed. The Board's staff was particularly concerned about the large backlog of authorization basis documents that LAAO must review and approve. It appears that the approval of LANL authorization basis documents was delegated to LAAO without the necessary resources being applied. LAAO will continue to be the authorization basis bottleneck unless the current review approach is changed or additional resources are applied.

Finally, the ISMS Description (FRAM and implementing mechanisms) for DOE-AL was not within the scope of the Verification Reviews. In fact, the ISMS Description for DOE-AL and its responsibilities and interrelationships with site work have not been reviewed for any of the ISMS Verification Reviews at sites under DOE-AL jurisdiction. DOE-AL management plays a significant decision-making role in programmatic mission requirements, work planning, hazard analysis, readiness reviews, and feedback and improvement. The ISMS verification team recommended the conduct of an ISMS Verification Review of DOE-AL and its interfaces with its area offices. This review is tentatively planned for September 2000.