[DNFSB
LETTERHEAD]
March 27, 2006
The Honorable Linton Brooks
Administrator
National Nuclear Security
Administration
U.S.
Department of
Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701
Dear Ambassador Brooks:
The staff of the Defense Nuclear
Facilities Safety Board (Board) conducted a review of the design of the
Criticality Experiments Facility (CEF) project. This facility, previously operated at Technical
Area 18 at Los Alamos National Laboratory, is to be relocated to the Device
Assembly Facility (DAF) at the Nevada Test Site. The staffs review focused on the adequacy of
the authorization basis for CEF facility, the criticality safety program, the
fire protection program, the confinement features, and the management and
oversight roles of the National Nuclear Security Administration.
As the enclosed reports
illustrate, issues were identified in each of the above areas. Major issues include inattention to the
interface requirements between the existing DAF facility and proposed CEF operations
and continued lack of acceptable resolution of safety issues previously identified
by the Board. For example, issues such
as the need for fire protection, ventilation, and criticality alarms in the
bays and cells have been languishing for more than a year. Other issues, such as potential exposure of
nearby workers and water in-leakage into DAF, have been poorly assessed for
their potential impact on the project design. These and other issues have been brought to
the attention of the design team by the Nevada Site Office’s Safety Basis
Review Team (SBRT) in its Preliminary Safety Evaluation Report. As of the time of the review by the Board’s
staff, little real progress had been made toward resolving these issues.
Therefore, pursuant to 42 U.S.C
§ 2286b(d), the Board requests a
report within 60 days of receipt of this letter describing the steps being
taken to resolve the issues raised by the SBRT, as well as the deficiencies
noted in the enclosed reports.
Sincerely,
A.
J. Eggenberger
Chairman
c: Ms. Kathleen A. Carlson
Mr.
Mark B. Whitaker, Jr.
Enclosures
DEFENSE
NUCLEAR FACILITIES SAFETY BOARD
Staff
Issue Report
February
22, 2006
MEMORANDUM
FOR: J. K. Fortenberry, Technical
Director
COPIES: Board Members
FROM: R. Layton
C.
March
SUBJECT: Fire Protection at the
Criticality Experiments Facility
This report documents a review
of the fire protection program at the Criticality Experiments Facility (CEF),
conducted at the Nevada Test Site (NTS) on January 9-13, 2006, by the staff of
the Defense Nuclear Facilities Safety Board (Board), V. Anderson, F. Bamdad, J.
Deplitch, R. Layton, C. March, R. Raabe, C. Shuffler, and R. Zavadoski. This review encompassed the relocation of CEF
to the Device Assembly Facility (DAF) at NTS.
Background. The
Board’s staff met with representatives of the Nevada Site Office (NSO), Bechtel
Nevada, Los Alamos National Laboratory, and Lawrence Livermore National Laboratory
to review fire protection and walk down facilities at CEF. The CEF project has just completed Critical
Decision-2 (CD-2) and is entering final design. The Board’s staff reviewed the facility Fire
Hazards Analysis and Documented Safety Analysis (DSA) for two bays, two cells, two storage vaults, the loading area, and control room
portions of DAF that together make up CEF.
Discussion. CEF
will occupy portions of DAF to house criticality experiments.
Remaining issues associated with
the facility involve fire modeling, combustible loading limits, removal of fire
suppression systems, fire system/ventilation system interfaces, and Department of
Energy (DOE) oversight.
Software Quality Assurance―The
CEF fire analysis
does not meet current software quality assurance (SQA) requirements of Title 10
of the Code Federal Regulations, Part 830, Nuclear Safety Management.
The fire analysis, developed using the Consolidated Fire and
Smoke Transport (CFAST) software to support the safety basis for CEF, was taken
from the DAF DSA. The DAF analysis did not reflect
current requirements because it was performed before those requirements were
published. Subsequently, in July 2004,
DOE promulgated DOE-EH-4.2.1.4, CFAST Computer Code Applications Guidance for
Documented Safety Analysis. No effort was made to satisfy
these requirements for CEF. Specifically, the critical phenomenon of the
fire calculated with the approved version of the code is whether the room will
reach “flashover,” defined as a critical level of upper gas layer temperature
leading to a rapid increase in both heat release rate and temperature-usually a
minimum of 450 to 600º
C. The fire analysis identified a number
of rooms for which temperatures higher than 450º C could be assumed, yet the
conclusion was no potential for flashover with no
further analysis. According to DOE-EH-4.2.1.4,
however, any temperature over 450º C requires further analysis. Additionally, the analysis includes no
discussion regarding the uncertainties associated with these temperatures.
Fire
Suppression Systems―It has been proposed that the fire
sprinklers presently located in DAF be removed from the bays and cells in which
critical and subcritical experiments will be conducted. DOE Order 420.1A, Facility
Safety,
specifically requires some form of automatic fire suppression system. The contractor provided an evaluation
justifying removal of the fire sprinklers, Technical
Basis for Disabling Wet-Pipe Sprinklers in
Areas of CEF,
in December 2005. The primary reasons given for not using
wet-pipe sprinklers in the area of the experiments are that water from the
sprinkler system could act as an uncontrolled reflector, resulting in increased
reactivity, and that the water could react detrimentally with experiment
materials. The evaluation does not
justify removing sprinklers from mechanical heating, ventilation, and air conditioning
(HVAC) rooms of the cells, the interlocks, staging areas, and the corridors
leading to the cells. In these areas,
criticality configurations are not expected. Additionally, this evaluation was not part of
the CD-2 package approved by DOE.
The contractor's evaluation
lacks sufficient detail to permit the conclusion that a fire in these areas
with no suppression system would not result in untenable life safety conditions
for workers and firefighters, extensive damage to adjacent criticality experiment
equipment and materials, or the release of hazardous materials. The Fire Hazards Analysis describes the criticality
experiment equipment and materials as "one-of-a-kind" items that
cannot be replaced. The potential for an
unsuppressed fire to damage this equipment and result in the release of hazardous
materials needs to be addressed. The
evaluation also does not address conversion of the wet-pipe sprinklers to a
pre-action system (normally dry pipe). This dry pipe could preclude water delivery to
the bays or cells during periods when the criticality materials are in a
near-critical configuration.
The evaluation concludes that an
alternative suppression agent (INERGEN) could be used, but assumes that its
installation would be based on a cost-benefit analysis left to the project. Basing this decision on a cost-benefit
evaluation is contrary to DOE Order 420.1A. Moreover,
no exemption or equivalency has been proposed.
Ventilation
Interface―The DAF DSA describes the interface
between the fire suppression and ventilation systems. The ventilation exhaust filtration is credited
as risk mitigation for exposure to the general public. However, fire dampers installed in the bays
and cells could close off the ductwork during a fire, precluding proper operation
of the exhaust system. The operation
sequence of the fire dampers/suppression system and the HVAC system needs to
have clear design criteria, along with system description(s) describing how
those criteria have been met. Additionally, further guidance in DOE
Technical Standard 1066, Fire Protection Design Criteria, regarding fire protection for
filtration units has not been addressed.
Fire
Analysis―The CEF Preliminary Documented
Safety Analysis (PDSA) does not include sufficient detail on the nature of fire
in the bays or cells for CEF. Section 3.4.2.4
briefly describes compartment fires, identifying a 130-megawatt fire analyzed
in the DAF DSA as the bounding case for CEF. The extent to which this description
represents fires in CEF is unclear. For
a fire in the bays and cells, for example, it is unclear to what extent the
criticality experiment equipment contributes to the fire. The event tree in Figure 3-4
of the DAF DSA,
used to calculate outcome probabilities, identifies the use of automatic suppression
systems or personnel extinguishing the fire as mitigating events, conditions
that would not be present in CEF without sprinklers. If sprinklers were removed, there would be
limited detection and alarm capabilities for notifying personnel of a fire
because the water flow signal is the primary initiator of a fire alarm. There is also no description of the
susceptibility of the criticality experiment equipment to fire damage in the
CEF PDSA.
The basis for most of the fire
analysis for CEF assumes ventilation-constrained, oxygen-limited fires. The size of the fire is reduced not because of
the lack of fuel, but a lack of oxygen in the compartment. It is true that fires in a single tight
compartment can be oxygen-limited, but as the fuel is pyrolized,
entrained into the fire plume, and raised to its ignition temperature, it lacks
only oxygen to bum. Once any amount of
this pyrolized fuel reaches oxygen, it will ignite. This could occur when the fire department
opens the door (backdraft), or the fuel could leak
out of the room and ignite in adjacent fire areas (corridors) or penetrate the
high-efficiency particulate air filtration system, which also is unprotected. Using an oxygen-limited fire is an acceptable
modeling technique, but the analysis fails to consider or even address the
subsequent potential for the spread of fire. The CEF PDSA lacks sufficient detail to enable
a full understanding of the various fire scenarios. It is not enough simply to refer to the DAF DSA.
Combustible
Loading―Combustible loading assessments performed
by the fire protection system engineer indicate the need for a 6-foot standoff
of combustibles from the criticality experiment equipment. The contractor could not describe the basis
for that distance. No technical basis
for the combustible loading limits or standoff distance has been provided.
DOE Oversight―The
Board’s staff is concerned that numerous technical issues affecting the
identification of safety systems and controls remain unresolved. The staff does not understand how DOE could
approve CD-2 without addressing the issues associated with removal of the fire
suppression systems.
DEFENSE
NUCLEAR FACILITIES SAFETY BOARD
Staff
Issue Report
February
22, 2006
MEMORANDUM
FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: V. Anderson
R.
Raabe
SUBJECT: Safety Basis for the Criticality
Experiments Facility at the Device Assembly Facility on the Nevada Test Site
This report documents a review
of the safety basis for the Criticality Experiments Facility (CEF) at the
Device Assembly Facility (DAF) on the Nevada Test Site (NTS). This review was conducted by members of the
staff of the Defense Nuclear Facilities Safety Board (Board) V. Anderson, F.
Bamdad, J. Deplitch, R. Layton, C. March, R. Raabe, C. Shuffler, and R.
Zavadoski. A meeting was held at the
site on January 10-12, 2006, to discuss the observations summarized in this
report.
Background. The
Department of Energy (DOE) is in the process of relocating devices and
materials associated with the criticality experiments currently located at
Technical Area 18 at Los Alamos National Laboratory (LANL) to NTS. A significant
portion of DAF will be dedicated to conducting the experiments and storing
special nuclear materials (SNM). DAF was originally designed for
nuclear explosive operations and as such is capable of limiting the consequences
of an accidental high explosive detonation. Two round rooms at DAF will house four
criticality experiment machines; two high bays will be used for training,
exercises, and general-purpose programmatic criticality research activities. Additionally, two high explosive/SNM staging
bunkers will be converted to SNM storage vaults.
A Preliminary Documented Safety
Analysis (PDSA) was prepared and submitted to the National Nuclear Security
Administration (NNSA) as part of the Critical Decision 2 (CD-2) milestone. This PDSA was prepared by Lawrence Livermore
National Laboratory (LLNL), which operates DAF, and by LANL, which will conduct
the experiments in CEF. The CD-2 package
was approved by NNSA on December 5, 2005. CD-2 approval by NNSA signifies acceptance of
the preliminary design for CEF and the adequacy of its safety strategy, and confirms
its associated baseline cost. However,
NNSA’s Nevada Site Office (NSO) reviewed and commented on the PDSA with the
expectation that its comments would be resolved prior to the granting of CD-3
approval (start of construction). Several design weaknesses were identified by
NSO, but it appears that their resolution was not deemed to impact the cost of
the project. The Board’s staff reviewed
the PDSA and some of the CD-2 package documents, and discussed its findings
with NSO and its contractor representatives.
Discussion. CEF
is a major design modification project being performed at an existing facility,
i.e., DAF. Its safety basis employs the
same methodology that was used for DAF instead of the latest DOE requirements. For example, the PDSA was prepared using an
outdated revision (Change Notice 1) of DOE Standard 3009-94, Preparation Guide for
U.S. DOE Nonreactor Nuclear Facility Documented Safety Analysis, that was in effect when the DAF DSA was
prepared, instead of the latest revision (Change Notice 2). Although this was deemed by the project to be
inconsequential, the design ramifications may be considerable. Change Notice 2 was issued in April 2002 and
expanded the considerations for worker safety by including the latent effects
of significant radiological exposures to workers as the basis for identification
of safety-significant structures, systems, and components (SSCs) in addition to
the acute worker fatality and serious injury included in Change Notice 1. Consequently, the adequacy of the set of safety
features identified in the PDSA for CEF relevant to protecting workers is
questionable.
Furthermore, the Design Criteria
document for CEF, submitted to NNSA as part of the CD-2 package, identifies DOE
Order 420.1A, Facility
Safety, as
one of the applicable orders and standards for which compliance is required. Several requirements in this order are not
captured in the design of CEF and may have a significant impact on the final
design of this facility. For example,
compliance with the requirements regarding multiple layers of protection and confinement
of uncontained radioactive materials is not demonstrated in the design of CEF. The main reason for this lack of compliance is
that the activities in CEF are to be performed within an existing facility, and
the project has not investigated how a facility designed for nuclear explosive
operations could meet the requirements of DOE Order 420.1A related to
criticality experiments.
Additionally, the Design
Criteria document states that fire protection design shall conform to the
requirements of DOE Order 420.1A, including installation of fire sprinkler systems
that shall be automatically actuated. The Design Criteria document also states that
the existing wet-pipe sprinkler system in the round rooms and the high bays
shall be disconnected and decommissioned because of criticality concerns. The document fails, however, to require other
alternatives for suppressing a fire in these areas that can be accommodated for
compliance with the order―for example, use of pre-action
sprinklers or alternative suppression agents. It should be noted that the current DSA for
DAF identifies the fire suppression system as safety-class for protection of
the public. Although the project appears
to have been studying the alternatives (after submitting the CD-2 package and
the PDSA), the associated cost and safety impacts (especially on worker safety)
of the alternatives are not captured as part of NNSA’s approval.
Hazards Analysis―The
PDSA and its
supporting documents for CEF have not adequately analyzed the hazards
associated with the operation of CEF. Instead, the PDSA relies mainly on the hazards
analysis for DAF and does not address the impact of those hazards on the criticality
experiments. For example, the DAF DSA
identifies the facility structure as designed to Performance Category 3 seismic
events, which may be adequate for DAF’s current operations but not necessarily
for the criticality experiments. The
PDSA also relies on the seismic design of the facility to protect the CEF
operations. This assumption may not be
valid, however, given that the critical experiments are not seismically
restrained to the facility and that an earthquake could easily topple some of
the machines and cause an unidentified hazard (e.g., criticality).
Similarly, DAF is designed to
relieve the consequences of a high explosive detonation in one of the round
rooms and protect the rest of the facility from the resulting overpressurization effects. The severe ground acceleration generated by
such an explosion, however, would be an external hazard for the CEF operations
and could have a significant impact on the safety of those operations. The PDSA does not identify or evaluate such a
hazard.
Development
and Implementation of Controls―A significant worker safety issue
associated with CEF operations is radiation exposure due to inadvertent
criticality, yet LANL and LLNL have not resolved their disagreement on what
portions of CEF will require a criticality alarm system. LANL has stated that a criticality alarm
system may not be appropriate for the round rooms where criticality machines
are located. However, it is not clear
that the same argument could be made about the rest of the facility, especially
the bays. DOE’s Criticality Safety
Support Group was asked to evaluate the positions of LANL and LLNL on the inclusion
of criticality alarm systems in light of relevant standards. The group concluded that some type of
criticality alarm system is advisable in the general-purpose bays and assembly
bay. Neither the PDSA nor the CD-2
package includes any contingencies for installation of a criticality alarm
system.
Another control related to
worker safety is the ventilation system that is in place but not appropriately
classified. Each building (e.g., round
rooms or bays) in DAF has an independent high-efficiency particulate air
(HEPA)-filtered ventilation system, with the exception of the storage vaults,
which share a common exhaust. The
majority of these systems are designated as safety-significant in the DAF DSA
to provide confinement of radioactive material in the event of spills, small
fires, and seismic events. However, the
PDSA for CEF does not identify ventilation as remaining a safety-significant
control. Several accident scenarios in
the PDSA result in sizable unmitigated doses at the site boundary, which is 6.6
miles from the facility (0.59 rem from fire, 1.6 rem from
inadvertent criticality, and 3.2 rem from reactivity insertion). Consistent with the requirements of DOE
Standard 3009, it is expected that the dose to collocated workers would be high
enough to warrant safety-significant controls, such as the ventilation systems.
In addition to problems
associated with controls that could reduce worker exposure in accident
situations, controls for the prevention of criticality may be inappropriately
credited in some cases. In the PDSA,
several potential criticality accidents are reduced in frequency from likely
(annual occurrence between 10-1 and l0-2) to beyond
extremely unlikely (annual occurrence less than 10-6) exclusively
through the use of administrative controls. While exclusive use of administrative controls
for accident prevention is not preferred practice, the situation for CEF is especially
problematic because the controls credited for reducing accident frequency are
not sufficiently independent.
Authorization
of Operations―As stated earlier, the PDSA is
based on the same methodology used to prepare the DAF safety basis,
that is, using Change Notice 1 to DOE Standard 3009. The DSA for DAF, however, will incorporate the
requirements of Change Notice 2 in its next annual update. On the other hand, the CEF project is planning
to incorporate the completed PDSA as an addendum to the DAF safety basis to
allow for a single safety basis document governing all operations within DAF. The result will be a significant discrepancy within
this single safety basis for the facility unless the PDSA is revised to be
consistent with the requirements of Change Notice 2. Currently there appears to be no plan in place
to accomplish this integration, even though it may affect the cost and the safety
posture of CEF activities as discussed above.
Authorization of operations may
also prove difficult with respect to criticality safety requirements, as
expectations for criticality safety documentation differ between the procedures
used by LANL to conduct the critical experiments and those used by LLNL to
govern DAF activities. LLNL’s procedures
(adopted at DAF) dictate full compliance with the criticality requirements of
DOE Order 420.1A, including a documented double contingency analysis, while LANL’s
procedures do not require such documentation. NNSA has approved LANL’s approach by granting
an exemption from that portion of the Order 420.1A requirements in the
laboratory’s most recent contract. On
the other hand, LLNL’s procedure has been adopted by DAF as necessary for
safely conducting activities within the facility. Since the LLNL approach is more conservative,
it would be prudent from both safety and interface standpoints for LANL to
adopt it for CEF operations.
Nuclear
Criticality Safety Program―The
Board has expressed concern in the past regarding the potential loss of
criticality experiment capability at DOE while these machines are being moved
from LANL to DAF. NNSA’s Technical Area
18 Closure Plan of October 2004 states that the loss of this capability will be
limited and will not exceed 1 year, that is, from the third quarter of fiscal
year (FY) 2005 to the third quarter of FY 2006. During the course of this review of CEF
activities by the Board’s staff, it became apparent that the early start of
COMET operations, which is essential to maintaining the Closure Plan schedule,
is no longer considered feasible by LANL. In essence, the proposed new schedule would
delay COMET operations at CEF until after FY 2009, 3 years later than NNSA’s
original commitment. NNSA may have other
plans for maintaining its critical experiment capability during this period;
however, any such plans were not shared with the Board’s staff during the
meetings held for this review.