[DNFSB
LETTERHEAD]
September 27, 2004
The Honorable Linton Brooks
Administrator
National Nuclear Security
Administration
U.S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701
Dear Ambassador Brooks:
The Defense Nuclear Facilities
Safety Board (Board) recently reviewed an approved safety basis for a nuclear
facility located at Sandia National Laboratories, New Mexico SNL-NM). Based on the Board’s review, as detailed in
the enclosed report, the approved safety basis does not provide assurance that
the operational hazards have been adequately analyzed and controlled.
Many of the inadequacies
identified in the safety basis appear to reflect fundamental weaknesses in the
implementation of nuclear safety requirements at SNL-NM. The Sandia Site Office (SSO) has taken action
to require improvements in SNL-NM’s safety basis methodology, but the
inadequacies in this safety basis remain. Allowing these inadequacies to go uncorrected permits
the startup of a facility without an assurance that all hazards have been
adequately addressed. Allowing an
inadequate safety basis to go un-corrected also compromises the long-term
integrity of the change control system, which relies on adequate safety
analyses to serve as a baseline for assessing the impact of future changes.
Because of the fundamental
nature of the deficiencies identified in this safety basis, the Board has
concerns regarding the other safety bases currently approved for use at SNL-NM.
Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests a report and briefing within 90
days of receipt of this letter that addresses the following areas:
Sincerely,
John T. Conway
Chairman
c: Mr. Richard Black
Mr.
Richard Englehart
Mr.
Mark B. Whitaker, Jr.
Enclosure
DEFENSE
NUCLEAR FACILITIES SAFETY BOARD
Staff
Issue Report
August
12, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: D. Nichols
SUBJECT: Inadequate Documented Safety Analyses
at Sandia National Laboratories
This report documents issues
identified by members of the staff of the Defense Nuclear Facilities Safety
Board (Board) D. Nichols, W. Andrews, F. Bamdad, and D. Kupferer regarding the
approved Documented Safety Analysis (DSA) for the Auxiliary Hot Cell Facility
(AHCF) at Sandia National Laboratories (SNL), New Mexico. The staff reviewed the DSA and held a series
of discussions with SNL and National Nuclear Security Administration’s (NNSA)
Sandia Site Office
(SSO) personnel who were involved in the development, review and approval of
the DSA. These discussions were held on
August 3-4, 2004, at which time the Board’s staff also conducted a walkdown of
the facility.
Based on this review, the
Board’s staff concluded that the DSA does not provide confidence that workers
and members of the public are adequately protected from the hazards of the
planned operations. In making that
determination, the staff identified a number of specific hazards that had been
inadequately analyzed and/or inadequately controlled, potentially affecting both
worker and public receptors. The
methodology used to develop and present the hazard and accident analysis was
inconsistent with the approved standard for the development of DSAs. Discussions with site personnel indicated that
the underlying weaknesses are not limited to this single DSA, but reflect fundamental
problems in the approach used to analyze Technical Area (TA)-V nuclear
facilities at SNL.
Background. The
AHCF was built to facilitate the sorting, categorization, and repackaging of
legacy materials that SNL has categorized as having “no defined use”. These materials
include radioactive and transuranic waste and fissile isotopes, and may also
include mixed waste. Physically, the
AHCF is a relatively small collection of structures that are completely
contained within the high bay of an existing facility. It includes a shielded hot cell, a permanent
shield wall, eight floor silos, and a walk-in fume hood, together with
associated cranes, remote manipulators, and video cameras to record operations
and facilitate remote-handled operations. A ventilated temporary room may also be
constructed as needed behind the shield wall to accommodate items that cannot
fit in the hot cell or h m e hood. The
temporary room is considered part of the AHCF.
No systems, structures, and
components are classified as safety-class for the AHCF; the maximum unmitigated
exposure to an off-site individual from an accident at the facility is estimated
to be 5 rem.
The safety analysis identified six
safety-significant structures, systems, and components: the hot cell structure, permanent shield wall,
silo plugs, hot cell ventilation system, high-efficiency particulate air (HEPA)
filters, and trenches in the floor of the high bay. The AHCF was designed to operate as a Hazard
Category 3 nuclear facility. It has an
approved DSA and has undergone an Operational Readiness Review, but operations
have not yet commenced. The Operational
Readiness Review identified a number of significant issues, and the final
report recommended that an additional, independent verification of readiness be
performed prior to startup of the facility. The report also questioned the hazard
categorization assigned to the facility, suggesting that it may have been lower
than appropriate.
Discussion. The
Board’s staff identified significant inadequacies in the approved DSA, including
among others, deficiencies in the analysis of hazards to members of the public,
hazards not adequately identified or controlled, and inadequate design
requirements. The more significant of
these deficiencies are discussed in the paragraphs that follow; however, the inadequacies
described here are but a sampling of the problems with the DSA. Additional discussion can be found in the 111
comments made by NNSA’s Safety Basis Review Team (SBRT) on the final draft version
of the DSA that was submitted for approval to SSO. SNL’s responses to most of the SBRT’s comments
were inadequate to fully resolve the issues raised. Thus, most of those SBRT comments remain valid
concerns.
Hazards
to Members of the Public—The AHCF is situated just over
3000 m inside the boundary of Kirtland Air Force Base (KAFB) on TA-V, one
corner of a parcel of land controlled by SNL. The AHCF DSA, like all of the DSAs for nuclear
facilities within TA-V, uses the 3000 m distance to the KAFB boundary to define
the radius of a circle that SNL uses as the virtual site boundary for the
facility. The dose to the maximally
exposed offsite individual (MEOI) for the unmitigated worst-case accident at
the facility is estimated to be 5 rem
at the edge of this 3000 m circle.
However, the selection of a 3000
m radius to define a virtual site boundary is not consistent with DOE
standards, and does not properly protect members of the public who have unfettered
access to recreational areas within the 3000 m radius. DOE standards specify that the area within the
site boundary must be controlled by DOE and its contractors without the aid of outside
authorities.[1]
A number of facilities that are used by
the public are within 3000 m of TA-V. These include horse stables, a riding club (1.6
km from TA-V), and the base golf
course, and clubhouse (2 km from TA-V). These facilities and the area between them and
TA-V are not controlled by the Department of Energy (DOE) or its contractors;
they are controlled by the Department of Defense (DOD). There are no markings within the KAFB boundary
to indicate when an individual has entered the 3000 m area around TA-V, and no
provisions have been made to exclude personnel from this area. On the contrary, this area contains facilities
that invite occupancy by members of the public. The stables, riding club, and golf course are
frequently inhabited by military dependents, retirees, and invited guests. These persons fit the technical meaning of
“the public” as defined in DOE standards, and some of the military dependents
are persons who reside inside the boundaries of KAFB and have unfettered access
right up to the boundary of TA-V (less than 200 m from the AHCF). Also within the 3000 m radius are a munitions
storage facility (1.9 km), the Manzano Fire Station #3 (2.5 km), and the
Manzano offices (2.7 km), all of which are controlled and operated by DOD
personnel.
Based on charts included in the
SNL’s Emergency Planning Hazard Analysis Document, the dose to an individual at
1500 m from the AHCF can be as much as five times that at 3000 m. Thus, the evaluation guidelines are challenged
if the MEOI is more correctly identified as the military spouses and children
at the horse stables or golf course, indicating the need for safety-class
controls.
Hazards not Adequately
Identified or Controlled—A
brief review of the
DSA, together with a walkdown of the facility, revealed a number of specific
hazards that had not been addressed or that had been addressed inadequately. Examples include the following:
Inadequate
Design Requirements—The
AHCF is the result of a modification to the Temporary Hot Cell, a temporary
facility that was built inside of the high bay of Building 6597 in 1996. The modifications included the addition of a
permanent shield wall, floor silos, a new hot cell roof, a fume hood, an upgraded
ventilation system (that included HEPA filtration), upgraded cranes, and the
installation of video cameras. However,
important design requirements do not appear to have been met, either in the
original construction of the Temporary Hot Cell or in its modification to
become the AHCF. These requirements are
found in both DOE Order 420.1, Facility
Safety, which was introduced in 1995 and incorporated into the SNL-NM
contract in 1998, and its predecessor, DOE Order 6430.1A, General Design Criteria.
DOE Order 420.1 is referenced in the AHCF DSA as the basis
for its facility safety requirements.
Other
Inadequacies—The
Board’s staff identified the following additional inadequacies in the DSA:
The
second error was that the threshold fissile material quantity values that were selected
from DOE-STD- 1027-92 were only applicable for facilities in which the potential
for criticality using those values was precluded by segmentation or the nature
of the process. This was not the case
for the AHCF, which relies upon administrative double-contingency controls to
assure sub-criticality.
DOE
frequently grades its oversight and regulatory efforts based upon facility categorization,
which in turn is expected to reflect the degree of hazard associated with a
facility. Given the potential for
significant non-localized accident consequences and the potential for
criticality, Hazard Category 2 status was warranted for the AHCF.
After an independent review of
the DSA and discussions with site personnel, the Board’s staff concluded that
this DSA does not meet the requirements and expectations set forth by the Department
of Energy (DOE) in its Preparation
Guide for U.S. Department of
Energy
Nonreactor Nuclear Facility Documented Safety Analyses,
DOE Standard (STD)
3009-94 CN2, or in any other safe harbor standard approved for compliance with
the Nuclear Safety Management Rule (Title 10, U.S. Code of Federal Regulations,
Part 830 [l0 CFR 8301]). According to
site personnel, the initial version of the DSA for the AHCF submitted for
review resulted in more than 200 comments by the SBRT. The final version was reportedly a marked improvement,
but still resulted in 111 comments by the SBRT, many of which reflected fundamental
issues that had previously been identified but not adequately addressed. The SBRT was reportedly facing similar
difficulties with other TA-V DSAs. As
part of its performance evaluation process, SSO had graded SNL in the safety
basis area with its lowest rating-red-in both of the last 2 years’ performance
appraisals, again underscoring the broad nature of the difficulties the site is
facing in this area.
To address the improvements that
SSO recognized were still needed in this DSA, SSO imposed conditions of
approval that required actions by the Operational Readiness Review team to
verify the effectiveness of certain controls. SSO is relying on anticipated upgrades to the analysis
in the next annual update of the DSA, due in December 2004, to provide a more comprehensive
hazard analysis. To address the broader
concerns regarding safety basis inadequacies at TA-V facilities, SNL agreed to
take steps to strengthen its central safety basis office, and to require
approval by a central safety basis authority prior to the submission of a DSA
to SSO.
However, the approved DSA for
the AHCF remains deficient, and significant hazards have still not been
adequately addressed. The incomplete
hazard and accident analysis in the DSA will not allow the development of
effective Unreviewed Safety Question determinations for future changes. Most significantly, the operation of the
facility should not be permitted without an assurance that all hazards have
been adequately analyzed and controlled; this DSA does not provide that
assurance.
Conclusion. The
DSA for the AHCF does not appear to be consistent with the safe harbor
methodologies of the Nuclear Safety Management Rule, and does not provide an adequate
assurance that the operational hazards have been identified through a
comprehensive hazard and accident analysis. It would be advisable for NNSA to retract its
determination that this DSA is compliant with the requirements of 10 CFR 830,
and rescind its approval of the DSA until a version that meets the requirements
of the rule is submitted. Similar
actions ought to be taken for any other DSAs at SNL that have not complied with
approved safe-harbor standards.
[1] The site boundary is defined in DOE Standard (STD) 3009-94 CN2 as a “well-marked boundary of the property over which the owner and operator can exercise control without the aid of outside authorities. For the purpose of implementing this Standard, the DOE site boundary is a geographic boundary within which public access is controlled and activities are governed by DOE and its contractors and not by local authorities. A public road traversing a DOE site is considered to be within the DOE site boundary if, when necessary, DOE or the site contractor has the capability to control the road during accident or emergency conditions”. The standard defines the public as “all individuals outside the DOE site boundary”.