[DNFSB LETTERHEAD]

August 30, 2000

General John A. Gordon
Administrator of the National
Nuclear Security Administration
Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701

Dear General Gordon:

During the past year, the Defense Nuclear Facilities Safety Board (Board) and its staff have been following attempts to restart the reduction process for Enriched Uranium Operations at the Y-12 Plant. The staff recently conducted a review and identified a number of safety issues associated with the operation of the reduction furnace, many of which had been identified during previous reviews. It is unclear to the Board why these issues have not been resolved in the 9 months since the last failed attempt to restart this critical national security capability.

The Board would like to be briefed on the Department of Energy's (DOE) resolution of the issues summarized in the enclosed staff issue report before the DOE Operation Readiness Review of the reduction process commences.

Sincerely,

John T. Conway
Chairman

c: Ms. Gertrude Leah Dever
Mr. Mark B. Whitaker, Jr.

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

August 25, 2000

Background. The reduction process converts uranium tetrafluoride (UF₄) to uranium metal by reaction with calcium in a sealed "bomb" reactor vessel, which is heated in an induction furnace to initiate the reaction. The hazard analysis for the reduction process noted scenarios that could result in rupture of the pressure vessel during firing, causing death or serious injury to workers from flying debris and significant exposure to collocated workers. Furthermore, the reactor vessels will be subjected to significant pressure and temperature conditions during firings. Certification in accordance with the Boiler and Pressure Vessel Code would help ensure safe operation, but the pressure vessels used were not code stamped and had no code-required relief protection. LMES did not have needed information on pressure and temperature within the vessel during firing; therefore, they decided to instrument the pressure vessel for data collection and to monitor the reaction remotely until a code stamped vessel could be designed and procured.

The Board's staff raised the following issues with respect to the operation and integrity of the reduction vessel during a July 1999 review of readiness to restart operations:

• During the staffs review of the credited controls, the contractor could not produce data to validate that purging and inerting vessels prior to firing would prevent overpessurization for all possible levels of moisture in existing feed material. Accordingly, it appeared that full reliance was being placed on mitigation instead of prevention.



• A hazard analysis of the operation of the reduction furnace developed several scenarios that included the possibility of breaching the reactor vessel because of vessel flaws and moisture in the material. During the staff's review, analytical personnel stated their assumption that feed material would be fresh from the hydrogen fluoride process, and no analysis was conducted to determine whether long-term storage could result in material characteristics that could cause the vessel to rupture during firing. Although visual inspections had been performed on the reactor vessels, there were no standards governing the details of this inspection. Safety basis personnel were also unaware of the types of inspections required for certified vessels.



• The hazard analysis also postulated overheating of the reactor vessel due to improper setting of the furnace power factor. Historically, engineered safety systems were credited to prevent this scenario (e.g., 20 kW furnace output control, high-temperature alarm system, high-temperature cutoff system). Additionally, the Criticality Safety Evaluation stated that failure to insert an igniter or failure of the igniter could result in a higher vessel skin temperature at the onset of the exothermic reaction, which would almost certainly exceed the pressure vessel design temperature. These scenarios were not analyzed in the Basis for Interim Operation (BIO).

As discussed below, none of these issues have been fully addressed, and additional issues have been identified.

Integrity of Reduction Vessel. A March 2000 interpretation from DOE's Office of the Assistant Secretary for Environment, Safety and Health (EH) on the use of the current vessels recommended remote operation of the furnace in addition to actions designed to protect against chemical or radiological consequences of a vessel failure. EUO personnel intend to protect the operators by evacuating the room during reactor firing, but no actions are planned to protect collocated workers and the public, who are estimated to receive 7 and 0.4 rem, respectively, from this accident. In fact, EUO personnel have discontinued previous efforts to install either a blast barrier or high-efficiency particulate air (HEPA) ventilation, citing the DOE-approved safety basis for EUO operations in Building 9212, which requires no such equipment. While the BIO characterizes this event as "unlikely," the uncertainty in the reaction conditions and the use of uncertified pressure vessels may increase the likelihood to "anticipated." LMES has not yet documented a technical justification for its path forward on closing out the vessel integrity issues or for ignoring EH's recommendations.

LMES recently began work on developing a technical basis and quantifying the margin of safety expected while using the current reduction vessels. However, despite citations in earlier safety documents and technical reports of higher reaction temperatures and pressures, LMES engineers initially focused on recent test data that supported their safety assertions. An initial review by the Board's staff of these recent test data suggested that the conditions favored lower temperatures and pressures (e.g., higher surface-to-volume ratio, resulting in a lower heat flux and resultant vessel wall temperature, and better preparation of the charge to remove moisture). After this information was conveyed to EUO personnel they agreed to incorporate historical information from production operations that documented peak vessel temperatures significantly higher than those observed in the recent tests.

Technical Basis for Safety Controls. During the last year, the Board's staff has been concerned with the adequacy of the safety basis for the reduction furnace and questioned the elimination of previously used safety controls (e.g., high-temperature cutoff). EUO personnel have insisted that the high-temperature cutoff is unnecessary, but have provided no technical justification for this position. As a result of the staffs questions during the July 2000 review, the Y-12 development staff independently suggested that such a cutoff would be an expected safety feature to preclude excessive reactor temperatures.

Since the staffs review, EUO personnel have been reevaluating their B1O accident scenarios, and have concluded that the likelihood of a reactor leak event should be changed from "unlikely" to "anticipated" because of the potential for operator errors. This change necessitates additional safety controls. LMES also continues to evaluate the need for more stringent temperature and moisture controls. Although LMES had previously incorporated a procedural limit on moisture content in the material, a review by the Board's staff of the recent Y-12 development experiments revealed an inability to account for the magnitude of the observed pressure rises based on the "known" moisture content of the UF₄. Uranyl fluoride (an impurity of UF₄) may contribute to this pressure spike, through either release of waters of hydration or decomposition.

Technical Basis for Reduction Vessel Test Plan. EUO personnel intended to conduct the first set of reduction runs within a formal "test" program under the control of the EUO test organization. Unfortunately, the approved test procedure contained no explicit control over the operations, nor did it include acceptance criteria for identified hold points or the adequacy of data collected. EUO management assumed that engineering personnel would promptly review all data and provide a determination on the safety of continued runs. As a result of the staff's review and feedback, LMES has chosen to abandon the test plan. Instead, the data collection plan will be revised to include formal roles and responsibilities, safety criteria, and safety approvals by an appropriate design authority.

Status of Preparation for Operational Readiness Reviews (ORRs). Since the failure of the DOE Readiness Assessment (RA) in November 1999, DOE and LMES have determined that both an LMES and DOE ORR will be conducted to confirm readiness of the reduction furnace to resume operations. The staff reviewed the draft Plan of Action for the LMES ORR and found it to be deficient. A number of missing core objectives that should be within the scope of the review plan are related to the competence of management and support operations (such as electricians doing surveillances on the furnace); problems in these areas were a major contributor to the failure of the DOE RA in November 1999. Both the Board's staff and EH's Office of Independent Oversight identified these weaknesses, and the plan is being revised.

Conclusion. There are a number of unresolved safety issues associated with the operation of the reduction furnace, many of which have been identified during previous staff reviews. Resolution of these issues has been hindered by the lack of technical justification for many of the insertions made by LMES personnel. LMES has also failed to justify its plans to forego use of controls previously designated as safety features. Initial plans for the contractor's ORR were found to be inadequate. These concerns have again been conveyed to EUO personnel, who finally appear to be working toward their resolution; however, the Board and its staff will need to ensure that these issues are closed in a technically satisfactory manner.