[DNFSB LETTERHEAD]

March 18, 1999

The Honorable Ernest J. Moniz
Under Secretary of Energy
1000 Independence Avenue, SW
Washington, DC 20585-1000

Dear Dr. Moniz:

The staff of the Defense Nuclear Facilities Safety Board (Board) has reviewed the draft Consolidated Tritium Safety Analysis Report (SAR) for the Savannah River Site (SRS) tritium facilities. The Westinghouse Savannah River Company prepared this draft document as part of the sitewide SRS effort to upgrade SARs to meet the requirements of Department of Energy Order 5480.23, Nuclear Safety Analysis Reports. The draft Consolidated Tritium SAR uses current industry standards and practices for the accident analyses. This has resulted in a substantial analytical advance over existing—and sometimes outdated—safety analyses. An important example of this analytical change is the SRS application of revised National Fire Protection Association (NFPA) guidance to estimate the maximum room temperature in an unmitigated fire. The new analysis shows that it is important to prevent such fires from a risk reduction standpoint.

The Board notes with satisfaction that SRS has used a "defense-in-depth" approach in establishing the safety measures for the Consolidated Tritium Facilities and have not used the evaluation guidelines of 25, 5, and 0.5 rem (CEDE) values as the sole measure of sufficiency. The Board encourages and commends the defense-in-depth approach.

Sincerely,

John T. Conway
Chairman

c:
Mr. Mark B. Whitaker, Jr.
Mr. Greg Rudy

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD
Staff Issue Report

February 10, 1999

This report documents observations of the staff of the Defense Nuclear Facilities Safety Board (Board) resulting from its review of the Consolidated Tritium Safety Analysis Report (SAR) and meetings held at the Savannah River Site (SRS) on January 5-6, 1999.

Background. The Replacement Tritium Facility (RTF) at SRS started its production operations after a Board public hearing in November 1993 and a thorough review of several technical areas. The Final Safety Analysis Report (FSAR) for RTF was amended in September 1993 to account for some physical modifications and changes to the Technical Safety Requirements (TSR) document made as a result of the Board's review. Since 1993, Westinghouse Savannah River Company (WSRC) has been engaged in developing authorization basis documentation for SRS facilities, an effort that includes upgrading SARs to meet the requirements and implementation guidance for Department of Energy (DOE) Order 5480.23. To this end, WSRC has written a draft consolidated SAR to cover all of the H-Area tritium facilities. This consolidated SAR uses the latest DOE guidance and industry standards to perform hazard analysis and identify the controls needed to protect the public and workers. The draft SAR identifies a different set of bounding accidents from those analyzed for RTF, and consequently leads to a different set of TSRs.

Discussion. To upgrade the authorization bases of all tritium facilities at SRS, WSRC prepared a consolidated tritium SAR that encompasses Buildings 233-H (RTF), 232-H (tritium extraction facility), 238-H (tritium reclamation facility), and 234-H (tritium receiving, packaging, and storage facility). The consolidated tritium SAR significantly enhances the safety analysis of the tritium facilities, which were constructed and placed in operation decades before the startup of RTF. As noted, this document uses the latest DOE guidance and industry standards for hazard analysis and identification of controls. It uses evaluation guidelines of 25, 5, and 0.5 rem cumulative effective dose equivalent (CEDE) for accidents with probabilities of 10-6–10-4,

10-4–10-2–1, respectively, for protection of the public. The evaluation guidelines used for protection of workers are fatalities, major injuries, or exposure to doses of 100 and 25 rem CEDE for accidents with probabilities of 10-6–10-4 and 10-4–1, respectively.

The Board's staff reviewed the consolidated tritium SAR and identified several issues that required further discussion with DOE-Savannah River (DOE-SR) and WSRC technical staff. Among these issues were significant changes in the assumed worst-case fire scenarios and their impact on the accident analyses, new accident scenarios, and reclassification of some of the safety-class systems at RTF.

The hazard analysis performed in support of the consolidated tritium SAR identified several fire scenarios as the most dominant hazards, requiring further study and potential identification of new controls. The worst-case evaluation basis accident scenarios for tritium facilities are identified as multiple-room fire for Building 232-H, full-facility fire for Building 234-H and full- facility fire (with or without a seismic event) for Building 233-H. The controls identified for these scenarios, as well as other scenarios estimated to exceed the evaluation guidelines for the public, are identified in the consolidated tritium TSR document as safety-class systems.

The new analyses using current, conservative methodologies for estimating the average room temperature during a fire identified higher temperatures for some fire scenarios than were previously assumed in the FSAR for RTF. Consequently, it became more important to prevent large fires and avoid the corresponding higher temperatures that would exceed the environmental qualification of some existing safety-class systems and components. Controlling incipient fires through operability of a more reliable fire suppression system would make large fires less likely to occur. To substantially reduce the predicted likelihood of such fires to the "extremely unlikely" frequency range, WSRC reclassified the fire suppression (and some detection) systems as safety class. TSRs will be applied to fire protection systems falling in this category. In addition, administrative controls on combustibles will be included in the TSRs to gain greater assurance that combustible loading limits assumed in the SAR are not violated.

WSRC acknowledges that installed fire suppression systems will not meet criteria such as redundancy or nuclear-grade quality assurance, nor are these systems seismically qualified. Imposition of safety-class requirements means that, in addition to meeting National Fire Protection Association (NFPA) code requirements, higher levels of maintenance and surveillance and of operability for these systems will be addressed in the TSRs. The intent is to increase the reliability of the suppression systems to maintain the SAR assumption that full-facility fires will be extremely unlikely. The TSRs will require that immediate actions be taken, such as cessation of operations and posting of a fire watch, should a safety-class fire suppression system be taken out of service or found to be inoperative.

The current version of the consolidated tritium TSR document does not identify some previously designated safety-class systems (such as the seismic tritium confinement system) as such because (1) they are not credited in the accident analysis to reduce public exposure below the evaluation guidelines, and (2) they no longer meet the environmental qualification parameters needed to guarantee operability in bounding accident scenarios. The Board's staff suggested that these systems should nonetheless be strictly controlled and maintained since they would perform a safety function in scenarios less severe than the analyzed bounding fire scenarios. As a result of staff interaction, DOE-SR has expressed its intent to identify these systems as "defense-in-depth" systems and maintain them at a reliability level close to that identified in the FSAR for RTF. In this context, "defense-in-depth" at SRS refers to a new functional classification for the identification of controls that help reduce the risk of operations to the public, workers, and the environment. As defense-in-depth systems, these systems will have a level of maintenance and surveillance similar to that for safety-class systems.

Walkdown Observations. The tritium facilities are protected throughout by sprinkler systems, and by smoke and heat detectors wired to central alarm panels. On the basis of a brief walkdown, detector coverage appeared to be adequate in all areas observed. Sprinkler coverage appeared adequate in some areas, but questionable in others. Some instances were observed in which sprinklers were positioned over ducts with cable trays below, or were parallel to or below cable trays. This observation was made during a meeting with SRS staff. WSRC is currently verifying as-built drawings of all fire protection systems in the tritium facilities. As part of the upgrade to safety class, the contractor plans to walk down all sprinkler systems to confirm adequate coverage in conformance with NFPA code requirements.

Housekeeping was good in all areas, but many waste cans were observed to be full or nearly full of paper and other combustible materials. WSRC agreed to look into the procedure for emptying the cans. Spot checks of extinguishers indicated frequent checks using a sign off card attached to the extinguisher. Access and egress for these buildings are adequate, and emergency lighting was present in all observed areas. A recent test of battery packs by WSRC resulted in a 4-hour rating, more than adequate to ensure lighting in the event of a fire with loss of building power. Occupancy of the buildings is fairly light, if the occupancy during the staff tour was typical.

Future Staff Actions. The staff will (1) review the final consolidated tritium TSRs when published, (2) ensure that adequate controls are placed on systems classified as defense-in-depth, and (3) monitor the contractor's progress in verifying that installed suppression systems comply with NFPA code requirements.