DEFENSE NUCLEAR FACILITIES SAFETY BOARD

December 1, 1993

MEMORANDUM:
G. W. Cunningham, Technical Director
COPIES: Board Members
FROM: A.K. Gwal
SUBJECT: Defense Waste Processing Facility (DWPF) Site Visit, September 1-3, 1993.
  1. Purpose: This memorandum provides a report of the DNFSB staff visit-to the Savannah River Site to review fire protection, electrical, and control systems of the DWPF.

  2. Summary: The review identified the following potentially significant issues and observations:


  3. Background: On September 1-3, 1993, DNFSB staff members Ajit Gwal and Dan Ogg visited the DWPF to review the fire protection system; loss of power incident of July 13, 1993, and station blackout analysis; distributed control system (DCS); and GWSB systems. The staff also discussed the open technical issues from previous review on April 21-23, 1993 of the facility's electrical system. An expanded listing of the topics and issues covered is attached to this report (Attachment A).

  4. Discussion: Attachment B lists the handouts distributed by DOE/WSRC during the briefing to the DNFSB staff. DNFSB staff observations and findings are as follows:

    1. Distributed Control System (DCS): Several design modifications to the distributed control and monitoring system were implemented at DWPF to improve their reliability. These included installation of a fiberoptic network, static charge dissipation system, and uninterruptible power supply (UPS) fed from a set of batteries and two a-c sources, the addition of a ground ring conductor connected to chemical grounding, and the isolation of the DCS electrical supply system. These modifications will reduce network interference, inhibit lightning strikes, protect the DCS from loss of power, eliminate equipment interference, and reduce ground resistance.

      Control of most processes is conducted from the Central Control Room (CCR) in Building 210-S. This building is not a seismic structure. There also exists an Emergency Control Room (ECR) on the-second level, east corridor of the Vitrification Building in the same room as the Field Operating Station (FOS) 1. The ECR is located within a seismically qualified structure. Its purpose is to allow the vitrification process to be shut down in a safe and orderly manner in an emergency situation, such as the unavailability of the CCR due to damage done by a tornado or earthquake. All the safety systems have been hardwired from the CCR to the ECR. A pinch-off circuitry is installed to eliminate any spurious operation due to hot shorts at the CCR. The function of this circuitry is to electrically isolate certain DCS components of the CCR from the ECR. This is a very desirable feature because the entire process can be controlled from the ECR during a tornado or seismic event.

      The staff is concerned about the design, management, and handling of alarms at DWPF. Of the approximately 12,000 monitoring points (measurement points, interlocks, and alarms) at the DWPF about 2,100 are process alarms. The high number of alarms activated simultaneously may confuse the control room operators during certain accident scenarios. For example, during the loss of power event of July 13, 1993, approximately 300 alarms were activated simultaneously and there was a great deal of confusion among control room operators, thus preventing the operators from assessing and addressing the critical issues in a timely manner. DWPF has since instituted an Alarm Management Program based on short, intermediate, and long-term needs. They have used outside experts (e.g., Dr. Cecil Smith) to prepare alarm selection/validation guidelines and to provide direction and assistance in handling and managing alarms. However, it was observed that the recommendations by outside experts had not been systematically implemented. No documents exist to confirm the implementation of outside experts' recommendations. The DNFSB staff will continue to monitor the Alarm Management Program.

    2. Station Blackout Analysis and Loss of Power Incident of July 13, 1993: WSRC at DWPF has performed an analysis for power loss accidents and determined that loss of power alone would not cause accidents and that no credible accident sequences would result in a station blackout. During power outages the cooling water, steam, air purge, CO2 purge, and ventilation systems would be lost. However, backup purging systems and a backup system are available to safely shutdown the process and plant.

      The DNFSB staff reviewed the effect of the loss of power incident of July 1993 at DWPF. It was observed that the redundant instrument busses are fed from the same load center. Therefore, when this load center lost power, flow instrumentation for both HVAC supply units and both chillers were lost. DWPF had previously discovered this design flaw, and is in the process of correcting this deficiency as a priority item.

      The DNFSB staff also reviewed the engineering and operations lessons-learned and recommendations from the July 13, 1993 power loss incident. The staff will continue to follow the implementation of recommendations.

    3. Battery Room Ventilation System: Design of the ventilation system in the battery room of the main processing building may not be adequate for the removal of hydrogen as required by industry standards. The staff is concerned that hydrogen generated by the batteries may accumulate and create a potential for explosion when HVAC is non-operational in the battery room. There is neither a local or remote indicator nor an alarm or a flow switch to alert plant operators to a failure of battery room exhaust. WSRC is considering a design modification to resolve this issue. DNFSB staff will review the design modification when available.

    4. Glass Waste Storage Building (GWSB): The Glass Waste Storage Building is designed for safe handling and interim storage of filled glass waste canisters while they await transfer to a permanent storage location. The GWSB is designed to store 2,300 stainless steel canisters. There are four major areas inside the GWSB; the storage vault, the operating area, the air inlet shafts, and the air exhaust shafts. The storage vault and the below grade portion of the air inlet and exhaust shafts are designed to withstand seismic events; the remaining system above grade (e.g., HVAC, electrical system, and offices) is a non-seismic design. The GWSB vault has been designated a safety class item. The safety function of the vault is to maintain its integrity following a design basis earthquake to preclude damage to the stored waste canisters. It is also required that the vault must perform this safety function with long-term loss of cooling. WSRC has performed a calculation for GWSB vault heat-up versus time assuming total loss of ventilation and determined that the vault will reach a steady state temperature of 305·F based on the average of winter and summer conditions. Analysis results show that the safety factor above code stress for reinforced steel and concrete are 1.06 and 2.26, respectively.

      It was observed, however, that if only summer average temperatures are postulated, a steady state temperature of 361·F would be reached in the vault and the safety factor will be less than allowed by code. In this case the vault may not remain intact and may not perform its safety function. This was discussed with DWPF representatives and they have committed to evaluate this condition and submit the results to the DNFSB for review.

    5. Emergency Lighting: In the event of an earthquake, emergency lighting is needed for personnel egress from the facility. The DNFSB staff made the observation that emergency lighting equipment is neither seismically qualified nor seismically supported. WSRC will evaluate this condition.

    6. Diesel Generator (DG) Loading: Strip chart recorder data for diesel load sequencing were reviewed to determine diesel generator adequacy for accepting load and voltage regulation. These data are based on the operation of an existing diesel generator loaded to approximately 50%. Based on anticipated design modifications, as stated by DWPF electrical personnel, the DG may be loaded to 99.9% of its full capacity. Therefore, DG load sequencing and voltage regulations are to be re-tested. The DNFSB will review new test/calculated data for DG adequacy to accept safety loads and perform its safety functions.

    7. Fire Protection System: DWPF is classified as a moderate hazard facility. DWPF was designed to meet DOE's older General Design Criteria in Order 6430.1 and the recently revised fire protection Order 5480.7 (now 7A).

      1. Active systems (e.g., automatic wet pipe sprinkler system, dry pipe sprinkler system, CO2,. water spring system, deluge sprinkler system, aqueous film forming foam system, and Halon system), passive systems and components (e.g., fire doors, penetration levels, fire dampers), and special fire consideration for facility construction are utilized at DWPF. Fire detection and alarms systems include heat detectors, smoke detectors, infrared and line detection by thermistor cable.

        The fire protection system is deficient in many areas, as indicated in various audits and independent reviews. DWPF has initiated a design modification project (PS-4620) to resolve the fire safety audit findings, Fire Hazards Analysis findings, fire protection oversight, Factory Mutual findings, Halon replacement/decommissioning, and various independent review recommendations. Implementation is divided into two stages. Stage 1 consists of design modification and implementation required before radioactive startup, and Stage 2 consists of modifications not required before radioactive startup. The DNFSB staff will monitor the modification and implementation activity.

      2. Fire Pump/Motor (electrical and diesel driven). Technical review could not be performed due to lack of documents-for cable sizing and motor design and electric circuit breakers.

      3. Halon versus water in the control room. WSRC intends to provide water sprinkler systems in lieu of Halon systems in severa1 areas containing electrical equipment, including the central control room. The staff is concerned that water intrusion into electrical panels could result in electrical shorts and spurious operations, thereby making it difficult to control the plant from remote control panels. DNFSB staff will monitor resolution of this concern.


    8. Rosemount Transmitters: The DWPF process system utilizes a large number (400-500) of Rosemount transmitters (RT). Some of the T models used at commercial nuclear plants were found to be defective and are addressed in NRC IE bulletins. A list of all the RTs used at DWPF was requested by the DNFSB staff so that an evaluation can be performed of its adequacy to perform the safety/operational function.

Attachment A
Topics and Issues at DWPF

Distributed Control System:

Station Blackout Analysis:

Fire Protection System:

Glass Waste Storage Building:

Open Items From previous DNFSB Staff Reviews:

Attachment B

Handouts Used by DOE/WSRC During the Briefing on
September 1-3, 1993 at DWPF