[DNFSB LETTERHEAD]

March 25, 1999

The Honorable Victor H. Reis
Assistant Secretary for Defense Programs
Department of Energy
1000 Independence Avenue, SW
Washington, D.C. 20585-0104

Dear Dr. Reis:

It has been more than 17 months since the Defense Nuclear Facilities Safety Board (Board) first brought the lightning protection issue to your attention by requesting in September 1997 that the Department of Energy (DOE) provide a technical report to the Board concerning lightning protection at Pantex. That report has not been forthcoming. Since that time, the Board's staff has been closely monitoring this activity. The Board's staff has reported considerable progress on some upgrade initiatives, such as the electrical bonding of Zone 12 facilities. Overall, however, the upgrade effort has been lagging. In a recent review by the Board's staff of the lightning protection systems and the lightning warning and detection system at the Pantex Plant, it was seen that progress has been slow in resolving many open lightning protection issues. The observations of this review are enclosed for your consideration.

It appears to the Board that neither the Field Office nor the Pantex contractors share the same degree of concern with this issue the Board has. If so, the Board would welcome a presentation from them as to their views on this matter. In any case, the Board believes the commitment by DOE to provide a technical report on this subject to be long overdue. Your attention to this matter will be appreciated.

The Board and its staff will continue to closely follow the ongoing efforts to upgrade lightning protection controls for nuclear explosive operations at Pantex.

Sincerely,

John T. Conway
Chairman

c:
Mr. Mark B. Whitaker, Jr.
Mr. Bruce Twining
Mr. Steve Goodrum

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD
Staff Issue Report

March 23, 1999

This report documents a lightning protection review performed at the Pantex Plant by the staff of the Defense Nuclear Facilities Safety Board (Board). Staff members A. Gwal and W. White were at Pantex February 23-24, 1999, to review the work accomplished to date by the Lightning Protection Project Team (LPT).

Background. After several on-site reviews in 1996 and 1997, it became clear to the Board and its staff that the potential hazards to nuclear explosive operations from lightning had not been comprehensively and consistently addressed at Pantex. In September 1997, the Board requested that the Department of Energy (DOE) prepare a detailed technical report providing a comprehensive analysis of the hazards posed to nuclear explosive operations by lightning, the controls necessary to prevent and mitigate those hazards, and the path forward for implementing and preserving the identified controls. DOE has not completed the requested technical report (a recent schedule implies a due date of October 1999, with an early draft in April 1999), but DOE and its contractor have made significant progress in defining the set of controls necessary to adequately address the hazard to nuclear explosive operations posed by lightning.

To address the lightning protection issue at Pantex, DOE formed the LPT and tasked it to define a technically justifiable control scheme for addressing potential lightning hazards to nuclear explosive operations at Pantex. Since 1997, DOE, Mason and Hanger Corporation (MHC), and the national laboratories have identified and installed many additional protective measures that can be expected to make nuclear explosive operations at Pantex less vulnerable to threats from lightning. These protective measures include electrically bonding metallic penetrations into bays and cells and certifying certain transportation containers as providing protection for lightning- induced hazards. Taken together, these and other improvements represent a significant enhancement to the safety of nuclear explosive operations at Pantex.

However, other areas for improvement that have been identified remain unimplemented. As discussed below, key controls recommended by the LPT have not been effectively implemented. In addition, there remain several open issues that may require research by the national laboratories. Little progress has been made on these open issues during the past 9 months.

Identification, Development, and Implementation of Controls. Staff members were briefed by MHC on the current approach to the implementation of lightning protection controls for Zone 12 facilities at Pantex. For most operations, these controls consist of two key components: electrically bonding metallic penetrations into the bays and cells to reduce the electrical threat, and establishing electrical isolation between the nuclear explosive and any penetrations into the facility to prevent arcing of current onto the nuclear explosive. For most facilities, the electrical bonding has been completed, and the electrical isolation distance required takes credit for this bonding. DOE and MHC are currently considering the more conservative approach of maintaining an electrical standoff distance that does not take credit for the bonding. For those facilities in which this is not possible, a redundant method of bonding (either two bonds for each penetration or one bond plus verification of intrinsic bonding of the penetration to the facility rebar) could be used.

After the briefings, the staff toured various bays in Zone 12, the emergency operations center in Zone 12, and reviewed lightning detection equipment off site to observe how lightning protection controls had been implemented in specific facilities. The following points summarize staff concerns regarding the key elements of the lightning protection control scheme.

Electrical Bonding and Surge Suppression-Perhaps the most effective control for reducing the threat of lightning to nuclear explosive operations is providing electrical bonding and surge suppression for metallic penetrations into the facilities. MHC has divided nuclear explosive facilities into three prioritized classes or categories with regard to the urgency of completing lightning protection upgrades, Class 1 being most important, and Class 3 being ancillary. For most Category 1 and 2 facilities, the electrical bonding of metallic penetrations is being effectively implemented. To date, all but three of these facilities (12-60 Bay 1, 12-104 Bay 16, and 12-98 Cell 4) have been bonded. In addition, MHC is in the process of developing effective surveillance procedures and equipment to facilitate long-term maintenance of these controls.

The issue of surge suppression has not been resolved, however. Surge suppression has been completed for most AC power circuits, but not for many communications circuits. Although the LPT has issued a recommendation addressing surge suppression for communications circuits, it is unclear whether DOE will choose to implement this recommendation because of the cost involved. If DOE chooses not to find surge suppression for communications circuits, the electrical isolation (as discussed below) from these unprotected communications circuits must be carefully evaluated.

Electrical Isolation-Implementation of administrative controls has been problematic. Of particular concern is the apparent lack of understanding among operations personnel of the requirements necessary to maintain an effective standoff distance for electrical isolation. For example, during a tour of Zone 12 facilities, staff members questioned whether weighing operations being conducted in conjunction with dynamic balancing in Building 12-60, Bay 2, were in compliance with the 12-inch electrical isolation distance required in the Basis for Interim Operations (BIO). After lengthy discussions, MHC halted the weighing operations until the BIO could be revised to clarify the lightning protection controls, as agreed upon by DOE, MHC, and national laboratory personnel.

In general, the implementation of standoff distances lacks the level of clear definition and formality necessary to ensure that appropriate electrical isolation is consistently maintained in many bays and cells. The current implementation relies on a single posted distance in each bay or cell. For most facilities, this posted distance is defined in an MHC engineering instruction, and it may or may not be applicable to all operations within the bay or cell. In addition, specific actions (such as the use of metallic equipment connected to a wall) that are likely to violate that standoff distance are not always clearly identified in a manner that would allow operations personnel to effectively maintain the required distance.

Lightning Warning and Detection System-The staff also reviewed the lightning warning and detection system, which is a critical control for those operations in which electrical bonding and electrical isolation are not effective. For certain operations at Pantex (e.g., hoisting and transportation) this system provides the only credited control that adequately increases preventing a lightning strike from imparting significant energy into a nuclear explosive. Of course, there are multiple defense-in-depth measures that would also prevent such an occurrence, but these measures are not credited and maintained as safety-related controls.

In past reviews, the staff has stressed the importance of upgrading the reliability of this system. Several of the issues raised informally with MHC and DOE during these past reviews have been addressed. These issues include the use of additional detectors, verification of compliance with vendor installation requirements for sensors, and detailed evaluation of various failure modes for the system.

Opportunities still exist, however, to enhance the reliability of this system. MHC is currently considering such items as obtaining access to the National Lightning Detection Network to back up the local system, providing automated warning notifications, and providing additional operator coverage to support the system. In addition, the LPT will further evaluate the overall reliability of this system and may recommend additional upgrades. Given the enhancements discussed above, the use of this system provides very good defense-in-depth. It is unclear, however, whether this system could ever reach the level of reliability one would expect in a safety-class control.

Effective use of this control not only depends on the interaction of multiple digital systems, but also depends heavily on actions taken by personnel in different MHC organizations.

Given the uncertain reliability of this system, it maybe prudent to replace reliance on this mostly administrative control with more effective engineered controls where possible. DOE and MHC are currently evaluating several candidate controls. For example, rather than suspending many transportation operations during lightning warnings, MHC and the national laboratories could design and evaluate transportation containers that would provide effective protection from lightning. MHC could also design or procure electrical isolation devices that would provide protection for many hoisting and lifting operations, eliminating the need to stop these operations during lightning warnings.

Remaining Issues. There are several additional issues regarding lightning protection that remained open at the time of the staffs review. One of the most important of these issues is the development of Technical Safety Requirements (TSRs) to implement the lightning protection control scheme discussed above. If properly implemented, these TSRs could help provide a more effective approach to lightning protection for Zone 12 operations. TSR development at Pantex is problematic, however. A first draft of the TSR-level requirements was to be completed by the end of January 1999, but the latest schedule indicates an April 1999 delivery date. Schedule projections beyond that date for publication of the final TSR-level requirements are not considered reliable. Other key issues that remain unresolved are discussed below.

Use of Weapon Design Features as Safety Controls at Pantex-DOE, MHC, and the national laboratories are currently evaluating the existing policy of the DOE nuclear explosive safety community not to take credit for weapon design features as safety controls at Pantex. Although specific exceptions to this policy have been made for past operations, it was thought best in general to use these design features (such as strong links) as defense-in-depth and not to depend on the weapon to protect itself from accident scenarios at Pantex. For certain operations (e.g., transportation, purge and backfill, and hoisting) involving weapons with all safety features intact, DOE and MHC may find it easier to justify taking credit for the weapon's protecting itself than to prove that other controls (which are often administrative) provide a sufficient level of protection against a lightning strike, given the potential consequences involved.

Before making any policy change of this nature, however, it would be prudent for DOE to consider carefully all the ramifications involved. Operations that are allowed to rely on weapons' protecting themselves may no longer have the amount of defense-in-depth that previously existed In addition, more stringent surveillance requirements may need to be initiated to evaluate the ongoing ability of certain weapon components to provide the safety function they are given credit for providing at Pantex.

Explosive Safety Manual Update-The Explosive Safety Committee is currently considering an update to the lightning protection section of the DOE Explosive Safety Manual to reflect the most recent information from the ongoing LPT efforts at Pantex. The initial revision did not receive appropriate input and review from the LPT and did not adequately reflect current lightning protection requirements. DOE and MHC subsequently recognized this communication problem and are working to address the issue.

Completion of Event Tree Analysis for Lightning Scenarios-At DOE's request during a lightning protection workshop last year, Sandia National Laboratories agreed to complete an event tree analysis for various lightning hazard scenarios involving nuclear explosives. Despite months of effort, this event tree remains in a preliminary draft state. Completion of this event tree should provide DOE and MHC with insight into where additional controls may be necessary, assist in justifying the controls already in place, and enable better prioritization of the remaining research efforts described below.

Remaining Research and Development Efforts-MHC and the national laboratories are currently involved in several research efforts related to lightning protection at Pantex. Some of these have been ongoing for nearly a year without significant progress. These include completing and publishing facility test activities at Pantex, evaluating the effect of high mast lights on the lightning protection system, and evaluating the effects of lightning (through rocket-triggered lightning tests) on catenary systems protecting structures similar to those in Zone 12 at Pantex.

Future Actions. The staff will continue to follow the development and implementation of lightning protection controls at Pantex. The staff will review the TSR-level controls when they are complete and will conduct other reviews to evaluate the resolution of the open issues discussed above.