[DNFSB LETTERHEAD]

June 14, 2000

The Honorable Bill Richardson
Secretary of Energy
1000 Independence Avenue, SW
Washington, DC 20585-1000

Dear Secretary Richardson:

In the past few years, improved and more detailed safety analyses for defense nuclear facilities have demonstrated that fire remains one of the main sources of risk to the public and workers. The tremendous energy a fire can generate results in a high potential to disperse radioactive and toxic materials into the atmosphere and thus create risk to the public. It is for this reason that fire is often the dominant public-risk accident at the Department of Energy's (DOE) nuclear facilities. Moreover, fires are a major source of risk to workers and can quickly lead to fatalities, as occurred in 1997 at a facility undergoing decommissioning. As more DOE facilities are decommissioned, many hazardous activities will be undertaken that will increase the risk of fire.

The Defense Nuclear Facilities Safety Board (Board) has closely monitored development and implementation of DOE's fire protection standards and requirements at new or existing facilities. While DOE has had a good record on fire safety, the Board notes instances during the past several years in which fire protection standards and practices at defense nuclear facilities have fallen below acceptable levels. These instances have been made known to DOE through letters from the Board that are cited in the enclosed report, as well as in a March 29, 2000 letter to General Gioconda on the fire protection program at Pantex.

The enclosed report prepared by the Board's staff reviews technical concepts and principles important to maintaining the quality of DOE's fire protection program. The Board and its staff will continue to closely monitor fire protection program standards and implementation at defense nuclear facilities using the principles and good practices identified therein. The Board invites comments by DOE and its contractors in the interest of improving fire protection practices at defense nuclear facilities.

Sincerely,

John T. Conway
Chairman

c: Mr. Mark B. Whitaker, Jr.

Enclosure

DNFSB/TECH-27

FIRE PROTECTION

AT

DEFENSE NUCLEAR FACILITIES

Defense Nuclear Facilities Safety Board

Technical Report

June 2000

This report was prepared for the Defense Nuclear Facilities Safety Board by the following staff members:

William M. Shields
Farid Bamdad
Ajit K. Gwal

with assistance from:

Ronald W. Barton
Wayne L. Andrews
Charles M. Coones

EXECUTIVE SUMMARY

Since its inception, the Defense Nuclear Facilities Safety Board (Board) has closely monitored the Department of Energy's (DOE) fire protection program. It is now established that at many nuclear facilities, fires are the dominant source of risk to workers and the public. This is especially true at aging facilities and at facilities undergoing decommissioning. In past decades, several major fires have occurred at defense nuclear facilities. While no such fires have occurred in more recent times, this experience should not lead to complacency. A single major fire could result in serious damage to the DOE nuclear program and in the worst case, cause harm to workers or the public.

This report reviews technical concepts and principles important to maintaining the quality of DOE's fire protection program. The following topics are covered:

• Safety analysis, fire hazards analysis, and safety controls
  
  
• Safety system classification and defense in depth
  
  
• Emergency planning
  
  
• Criticality
  
  
• Configuration management
  
  
• Performance criteria and reporting
  
  
• Assessment and inspection findings
  
  
• Professional staff
  
  
• Fire departments
  
  
• Research on fire phenomena
  

DOE and its predecessor agencies have had a good record on fire safety. This performance record must be continued into the indefinite future by rededication to the principles set forth in this report.

TABLE OF CONTENTS

1. INTRODUCTION

Prevention, detection, control, and mitigation of fires are important elements of safety at all defense nuclear facilities. Uncontrolled fires in facilities pose hazards to the health and safety of the public and workers, particularly should a release of radioactive material occur. Since its inception, therefore, the Defense Nuclear Facilities Safety Board (Board) has closely monitored development and implementation of the Department of Energy's (DOE) fire protection standards and requirements at new and existing facilities.

In the past few years, improved and more detailed safety analyses for defense nuclear facilities have demonstrated that fire remains one of the main sources of risk to the public and workers. The tremendous energy a fire can generate results in a high potential to disperse radioactive and toxic materials into the atmosphere and thus create risk to the public. It is for this reason that fire is often the dominant public-risk accident at DOE nuclear facilities. Moreover, fires are a major source of risk to workers and can quickly lead to fatalities, as occurred in 1997 at a facility undergoing decommissioning. As more DOE facilities are decommissioned, many hazardous activities will be undertaken that will increase the risk of fire. For example, additional combustibles may be brought into a building at the same time that cutting and welding are taking place. Older but vital facilities will be kept in operation, and in these facilities, maintenance and control of combustibles maybe critical measures to ensure fire safety.

DOE and its predecessor agencies have had a good record on fire safety. Fire losses have been kept to a minimum during the past 30 years. This performance record must be continued into the indefinite future. Fires at defense nuclear facilities must be prevented, or controlled once started, to ensure the safety of the public and workers.

This report reviews technical concepts and principles important to maintaining the quality of DOE's fire protection program. The Board invites comments on this report by DOE and others having an interest in fire protection at defense nuclear facilities.

2. SAFETY REQUIREMENTS AND STANDARDS

The cornerstone of any safety program is an adequate set of safety requirements and standards. This principle applies filly to fire protection, a safety discipline with a long empirical history and an extensive array of consensus standards. Nuclear facilities present special hazards, however, that may call for the application of different or more stringent requirements than might apply to a typical industrial facility.

The necessity for special fire protection features for nuclear facilities has long been recognized, first by the Atomic Energy Commission (AEC) and later by the Nuclear Regulatory Commission (NRC) and DOE. AEC began a program to upgrade fire protection at contractor-operated government facilities following a damaging fire at Rocky Flats in 1969. NRC followed suit with much more stringent fire protection requirements for reactors to prevent a recurrence of the Browns Ferry fire of 1975. The National Fire Protection Association (NFPA) has supported such government efforts by developing three codes specific to nuclear facilities--NFPA 801, 802, and 803.

DOE has in place a comprehensive set of fire protection criteria for nuclear facilities. This set includes the following:

• DOE Order 420.1, Facility Safety (U.S. Department of Energy, 1995)
  
  
• DOE Order 440.1A, Worker Protection Management for DOE Federal and Contractor Employees, (U.S. Department of Energy, 1998)
  
  
• DOE Implementation Guide for use with DOE Orders 420.1 and 440.1, Fire Safety Program (U.S. Department of Energy, 1995)
  
  
• DOE C 420.1, Contractor Requirements Document, Facility Safety, (U.S. Department of Energy, 1995)
  
  
• DOE-STD 1066-99, Fire Protection Design Criteria (U.S. Department of Energy, 1999)
  
  
• DOE-STD-1088-95, Fire Protection for Relocatable Structures (U.S. Department of Energy, 1995)
  
  
• DOE-HDBK- 1062-96, DOE Fire Protection Handbook (U.S. Department of Energy, 1996)
  
  
• DOE Fire Protection Qualification Standard Competencies (U.S. Department of Energy, 1995)
  

Incorporated in DOE Order 420.1 (U.S. Department of Energy, 1995), is the critically important requirement that the NFPA codes and applicable building codes be met at all DOE facilities. DOE has also issued numerous guidance documents on topics such as quality assurance for fire protection systems, contents of fire hazards analyses (FHAs), and medical standards for firefighters. As stated in DOE Order 420.1, Section 4.2(3) (U.S. Department of Energy, 1995), this set of standards is intended to achieve "a level of fire protection that is sufficient to fulfill the requirements of the best-protected class of industrial risks ('Highly Protected Risk' or 'Improved Risk')." DOE facilities, sites, and activities are to be provided this level of protection "to achieve defense-in-depth."

As noted in Section 1, throughout its history the Board has remained fully involved in DOE's development of fire protection requirements and guidance. The Board has found DOE's fire protection criteria, if diligently and rigorously applied, to be adequate to protect public health and safety, workers, and the environment.

A limited number of DOE sites and facilities have chosen to use the Work Smart Standards (WSS) approach to the selection of requirements and standards. This approach can result in the adoption of adequate requirements and guidance for fire protection programs at defense nuclear facilities. In several recent instances, however, the Board's staff has observed departures from established DOE requirements that have resulted in an unacceptable standards set. In a letter to the Acting Assistant Secretary for Defense Programs dated September 22, 1999, the Board noted with regard to fire protection at the Los Alamos National Laboratory (LANL):

The Board expects that the WSS for safety-related systems will comply with the safety system requirements in DOE Order 420.1. In particular, if a program feature is made mandatory by an Order or requirement, it is disappointing if it only appears as guidance in WSS.

In another case, inadequate contract requirements may have contributed to a potential safety problem. The Board observed in an October 5, 1999, letter to the Director of DOE's Office of Science with regard to Oak Ridge National Laboratory (ORNL):

In the area of program requirements, the staff observed that a recent change to the ORNL WSS redressed a deficiency created several years ago when DOE Order 5480.7A, Fire Protection (U.S. Department of Energy, 1995), was deleted from the contract.

The Board found that ORNL'S fire department was insufficiently staffed:

The staff found that a prompt review of ORNL fire department staffing is needed to ensure the availability of sufficient shift complements. Based on the latest DOE Baseline Needs Assessment, insufficient fire department personnel are available on the backshift.

DOE's existing fire protection requirements and guidance for nuclear facilities are based on many years of AEC and DOE experience. While it is possible to construct an alternative set of requirements and guidance using the WSS approach, the following principles need to be followed:

• The WSS set is demonstrably equivalent to the requirements contained in DOE Orders 420.1 and 440.1, and DOE Implementation Guide for use with DOE Orders 420.1 and 440.1 Fire Safety Program (U.S. Department of Energy, 1995).
  
  
• There is no retreat from the principles of highly protected risk and defense in depth.
  
  
• The NFPA codes and applicable building codes are adopted as contract requirements.
  
  
• Fire protection design criteria equivalent to DOE-STD 1066-99 (U.S. Department of Energy, 1999), are adopted as guidance.
  

3. ROLE OF FIRE PROTECTION IN OVERALL SAFETY APPROACH

The activities at defense nuclear facilities involve all the ingredients needed for initiation of a fire. In fact, there are many fires at these facilities every year that are controlled and prevented from propagating and expanding into major fires. Fire losses are kept to a minimum by an established program to (1) identify ignition sources and combustible materials; (2) provide and maintain fire control features, both active and passive; and (3) ensure fire extinguishment through fire attack preplans and drills.

The FHA is the main tool used to identify systematically and comprehensively the sources of fire and the need for related controls. The types of controls and their location, adequacy, and functionality are determined in the FHA, which can then be used in support of the facility's authorization basis. The site emergency management organization and fire department, however, play a major role in the control of fire and overall emergency response. In the following subsections, the interdependencies of these activities and the need for their integration are discussed in more detail.

3.1 SAFETY ANALYSIS AND FIRE HAZARDS ANALYSIS

The safety analysis and FHA for a facility should be closely related. DOE Order 420.1, Paragraph 4.2. 1(5), states:

The conclusions of the FHA shall be incorporated in the Safety Analysis Report (SAR) Accident Analysis and shall be integrated into design basis and beyond design basis accident conditions.

Paragraph 4.16 of the Implementation Guide for this Order is to the same effect:

When both an FHA and a SAR are developed for a facility, the developmental effort should be coordinated to the maximum extent possible to avoid duplication of effort. . . . the FHA and its conclusions should be addressed in the facility SAR in such a manner as to reflect all relevant fire safety objectives. . . .

Safety analysis systematically and methodically identifies the hazards at a facility and determines their potential impact. It also devises controls for the hazards that will protect the public, workers, the environment, and government property.

Fire and explosion are two of the most energetic means by which radioactive material, and any other hazardous materials involved, can be dispersed to the outside environment. The FHA identifies the sources of fire, the potential for the spread of fire, and features that might mitigate a fire. The SAR classifies the mitigating features and assesses their adequacy for meeting the operational requirements of the design of the facility with regard to dose consequences. The fire protection features relied upon in the SAR to maintain the authorization basis of the facility are covered by Technical Safety Requirements (TSRs) to ensure availability and reliability.

3.2 SAFETY CONTROLS

The application of requirements and standards to hazards at a specific nuclear facility leads to the identification of safety controls in the form of TSRs, administrative controls, procedures (e.g., prefire plans), and manuals. These controls are based on safety documents such as the FHA, the SAR, and the Baseline Needs Assessment for the fire department. Some of these controls become part of the authorization basis, a formal set of documents submitted to DOE by its contractor, designed to ensure safe operation of the facility.

Certain principles must be observed when selecting fire protection controls:

• A conservative approach should be taken that ensures margin in all calculations of safety adequacy.
  
  
• Risk assessment techniques should be used to identify and rank sources of fire hazards, but should not be used to circumvent safety requirements such as NFPA codes or to weaken defense in depth.
  
  
• Engineering and design controls should be favored over administrative controls, especially in the design of new facilities.
  

3.3 SAFETY SYSTEM CLASSIFICATION AND DEFENSE IN DEPTH

The SAR should classify the fire protection features and administrative programs and determine which of these should be identified in the TSR document. Designation of safety-class or safety-significant structures, systems, and components (SSCs), administrative controls, and engineered design features is determined through a prescribed methodology (DOE-STD-3009-94 [U.S. Department of Energy, 1994] and DOE G 420.1-2 [U.S. Department of Energy, 2000]), that relies to a large extent on the engineering judgment of the safety analysts and designers. Overall, the objective is to prevent a fire, or to control and confine a fire should one occur. Methods of accomplishing this objective are set forth in NFPA codes that have been a requirement of the DOE program for decades. It is essential that decisions concerning the application of these codes and the selection of features and controls be made by qualified and experienced fire protection engineers. In general, the following measures are among the most effective in ensuring that fires do not harm workers or the public.

Reducing or Eliminating Ignition Sources. The FHA and the process hazard analysis prepared in support of the SAR are the best tools for identifying processes and activities that contribute to fire risk and controls to reduce that risk. These controls, such as providing an inert atmosphere or using sparkless tools, represent the first line of defense against fire. As such, they may need to be designated as safety-significant SSCs to provide protection for close-proximity workers.

Establishing the design requirements and safety classification of systems and equipment that come into direct contact with hazardous materials is most important for the design of new facilities. Identification of hazards at this stage significantly reduces the probability of a major fire or explosion. For example, design of a furnace to the appropriate NFPA requirements for the specific application, based on a hazard analysis, may obviate the need for safety systems to prevent or mitigate some fire scenarios. Similarly, a detailed process hazard analysis of the activities performed in a glovebox may reduce the potential for small fires. The recent lithium hydride fire in Building 9204-2 at the Oak Ridge Y-12 Plant is a good example of the consequences of failing to perform a detailed process hazard analysis closest to the source of the hazard. In this case, hot metal chips from a drilling activity in the glovebox ignited lithium hydride that was stored nearby inside the same glovebox.

Fire Barriers. An important feature for fire protection of a building is compartmentalization of the activities within the facility and their separation by fire-resistant barriers. Such barriers have a proven record of limiting the spread of fire, improving the chances for prompt extinguishment by manual firefighting, and reducing the amount of hazardous material that may be involved in a fire. These barriers should be identified as engineering design features and maintained according to their design requirements.

A recent FHA for Building 9204-2E at the Y-12 Plant identified many fire barriers that had been credited in the authorization basis, but had not been maintained to their specific design requirements (Letter, Conway to Gioconda, November 3, 1999). The FHA recommended repair or replacement of these fire barriers to comply with their design requirements and enable them to perform their intended function.

Enhanced Capabilities to Control Fire. Prevention of small fires is not entirely possible; there is always a potential for a fire to start. Small fires occur at defense nuclear facilities on a routine basis and are effectively controlled. Thus what is important is the capability to extinguish a fire before it propagates and becomes more hazardous. This capability can be provided by controls ranging from portable fire extinguishers to extensive fire alarm and sprinkler systems. Fire sprinkler systems relied upon for worker safety and public protection should be classified as safety-class or safety-significant SSCs because they provide the most effective, automated, and quick response to a fire.

Westinghouse Savannah River Company (WSRC) recognized the importance of an effective fire suppression system in its hazard analysis for the Consolidated Tritium Facilities at the Savannah River Site (SRS) and classified them as safety-class SSC (Letter, Conway to Moniz, March 18, 1999). WSRC also launched an inspection and maintenance program to ensure the functional reliability of the system. In a similar activity, LANL identified the fire sprinkler system in the Chemistry and Metallurgy Research (CMR) Facility as a vital system and began an effort to inspect and test the system for functional performance.

Minimizing of Transient Combustibles. This administrative control, both a preventive and mitigative measure, is among the most cost-effective means of limiting fire hazards. Good housekeeping and minimizing of the combustible loading on operating floors can prevent incipient fires from propagating and increase the probability of extinguishing a fire before it becomes a major hazard.

Recent implementation of administrative controls on the combustible material loading at the CMR Facility resulted in removal of more than 10 tons of combustible materials. By contrast, Building 9206 at the Y-12 Plant houses huge quantities of transient combustible materials in the office spaces directly below storage areas containing significant amounts of uranium in solution and uranium solids in the form of fine particles (Letter, Conway to Glauthier, October 6, 1999). Implementation of a program for reduction of combustible materials would significantly reduce the potential for a fire event at the facility.

Confinement of Release and Filtering of Plumes. Fires generate plumes that are toxic by nature, and additionally maybe contaminated with radioactive material or other toxic gases. The heating, ventilation, and air-conditioning (HVAC) systems at most defense nuclear facilities are equipped with high-efficiency particulate air (HEPA) filters that can significantly reduce the radioactive material content of plumes and thus reduce the consequences to collocated workers and the public. For this system to be effective, however, the plumes should be directed to pass through intact HEPA filters that have adequate margin to absorb the additional strain caused by the fire. To this end, the building confinement must be maintained and tested, the HVAC system must operate according to specific procedures, and the HEPA filters must be qualified to withstand the abnormal environment generated by the fire. The HEPA filters are expected to have a specific service life for a given facility. In general, however, HEPA filters are not qualified to withstand high-temperature plumes for long periods or significant amounts of fire-generated particles. Therefore, they can be relied upon only for relatively small fires. This limited capability places an additional burden on the building fire sprinkler system.

DOE Order 420.1, Facility Safety (U.S. Department of Energy, 1995), requires that the design of new nonreactor nuclear facilities be based on confinement of hazards. The Board has supported this requirement and noted further that the confinement systems should be safety-class or safety-significant (Letter, Conway to Glauthier, July 8, 1999). The HVAC systems and HEPA filters maybe considered part of a facility's confinement system. For existing facilities, consideration should be given to classifying these features as safety-significant for the defense-in-depth purpose of backup to fire suppression systems, if they have not already been identified as safety systems for other reasons.

Other Features. Other systems and components that are more facility- or activity-specific may provide the capabilities discussed above. Such features should also be analyzed for their intended operability and function, and classified accordingly. In so doing, it is necessary to keep in mind that one layer of protection is not adequate, and that a simple control will be more effective than detailed probabilistic calculations in reducing risk. Preference should be given as follows:

• Passive design features should be preferred to active systems.
  
  
• Active systems should be preferred to administrative controls.
  
  
• Preventive administrative controls should be preferred to mitigative ones.
  

For conservatism, emergency planning and preparedness activities should not be credited as a safety control for protection against fire when the controls are devised. Rather, these activities should be viewed as the last defense-in-depth layer for protection of workers and the public.

3.4 FIRE PROTECTION AND EMERGENCY PLANNING

DOE Order 5480.23, Nuclear Safety Analysis Report (U.S. Department of Energy, 1992), requires that a section of a SAR be dedicated to discussion and commitments regarding emergency planning and preparedness. DOE Order 151.1, Comprehensive Emergency Management System (U.S. Department of Energy, 1995), requires DOE sites and facilities to develop and participate in an integrated and comprehensive emergency management system to ensure that appropriate response measures are taken to protect workers, the public, the environment, and the national security. The Order states that implementation of a comprehensive emergency management program should be commensurate with the hazards involved, and that each DOE site or facility with significant quantities of hazardous material, radiological or nonradiological, should develop and maintain a quantitative hazard assessment. Quantitative hazard assessments should be used for event classification and for determination of the size of the Emergency Planning Zone. The results of the analysis should also be used to indicate the potential for an alert, site area emergency, or general emergency using Protective Action Guides as defined by the Order.

The hazard analyses supporting the SAR and the emergency management system have to be consistent and integrated with the FHA and Baseline Needs Assessment to identify a complete set of fire scenarios that may require controls and assistance from the emergency management organization and the fire department. Consistent assumptions and methodologies should be used in these analyses, if they all refer to the same set of circumstances. More specifically, the initial conditions, the event progression, and the systems response should be consistent for all of these analyses to achieve the planned goal of controlling the fire as quickly as possible, rescuing personnel, and conducting evacuations as needed.

The most important emergency response assumptions for a fire scenario in the SAR are (1) the fire department's response time and its ability to control the fire upon arrival, and (2) the Emergency Operations Center's (EOC) response time to shelter or evacuate on-site or off-site people in response to a fire. Although these assumptions are very important in evaluating the risk from a fire, the related statements in the SAR or other authorization basis documents are often optimistic and unsupported. This situation can be attributed primarily to the lack of familiarity of the SAR hazard analysts with the real-time operations of the EOC and the fire department. For example, the SAR may assume that collocated workers are evacuated from the site within 30 minutes from the initiation of an event, or that off-site individuals are evacuated within 2 hours after initiation. A more realistic value would be the real-time periods experienced at the site during the last emergency exercise. Taking the latter approach will ensure consistency between the emergency management activities and the assumptions made in the SAR Exercises also serve to identify response deficiencies whose remediation will improve overall safety and preserve the authorization basis.

3.5 FIRE PROTECTION AND CRITICALITY

Another hazard that is often overlooked in the FHA is the threat of accidental criticality resulting from use of water to extinguish a tire. Special precautions may need to be taken by the fire department fighting a fire in a facility containing fissile material. These precautions should be identified in procedures prepared by a joint effort between fire protection and criticality safety engineers. The requirements for this activity are identified in DOE Order 420.1, Facility Safety (U.S. Department of Energy, 1995), Section 4.3.3(k):

The fire protection program. . . shall establish guidelines for fire fighting within, or adjacent to, moderation controlled areas. These guidelines shall be based on comparisons of risks and consequences of a criticality accident with the risks and consequences of postulated fires for the respective areas(s). Risk and consequence comparisons may be a qualitative evaluation. The basis for the guidelines shall be documented.

Additional guidance on this important topic can be found in paragraph 5-1.8, "Accident Involving Fissionable Materials," in NFPA 801, Standard for Fire Protection for Facilities Handling Radioactive Materials (1998). Evaluation of this issue must include effects of the actuation of automatic sprinkler and deluge systems (in fire or inadvertent), application of hose sprays, and accumulation of water from either of these sources. Inadvertent actuation leading to a criticality in seismic events is addressed in Section 7.3 of the recent revision to DOE-STD-1066-99, Fire Protection Design Criteria (U.S. Department of Energy, 1999).

4. MAINTAINING THE QUALITY OF FIRE PROTECTION PROGRAMS

4.1 CONFIGURATION MANAGEMENT

The safety envelope of a nuclear facility is defined by its SAR Analyses presented in the SAR are based on the design requirements of certain SSCs within the facility. If the as-built facility does not reflect these design requirements, the safety envelope is compromised. Configuration management maintains fidelity between design requirements and the as-built facility.

Fire protection systems and equipment must be maintained under a configuration management program to ensure that system performance remains as designed and that inadvertent degradation does not occur. Configuration management involves the verification of selected equipment, computer software, and documents to ensure that they conform to current design requirements. Since modifications to a nuclear facility occur on a frequent basis, an effective configuration management program should be an ongoing effort to monitor and control change for the life of the facility.

In its first Recommendation, 90-1, Savannah River Site Operator Training (Defense Nuclear Facilities Safety Board, 1990), the Board recognized the importance of an effective configuration management program in providing a well-documented understanding of a nuclear facility's configuration and in supplementing operator training. If a nuclear facility's physical conditions, such as equipment alignment, availability, or conformance to design requirements, are unknown, operators may take actions on the basis of improper information. Doing so could put the facility in a worse situation, such as occurred at one of the Three Mile Island nuclear reactors and at the Union Carbide pesticide plant in Bhopal, India. An effective configuration management program can reduce or eliminate situations in which the plant's physical conditions and its conformance to design requirements are unknown to the operators.

Review of occurrences during the past 4 years at DOE nuclear facilities reveals instances of inadequacies related to configuration management in fire protection systems. For example, delinquent inspections of the fire protection system in the FB Line facility at SRS were identified (Occurrence Report No. SR--WSRC-FBLINE-1999-0013). The SRS fire protection program was found to have programmatic deficiencies that precluded the timely completion of testing and inspection of facility fire systems. In response, WSRC initiated an assessment of SRS's overall fire protection program. The assessment team identified various repeated deficiencies that included the inadequate configuration management of fire protection systems. In another example, potential issues associated with configuration management of the auxiliary/standby power generators were identified at the Oak Ridge Y-12 Plant (Occurrence Report No. ORO--LMES-Y12SITE-1998-0017). The direct cause was determined to be inadequate flowdown of procedures/directives from NFPA 110, Standard for Emergency and Standby Power Systems (1999), to site-level procedures.

DOE-STD-1073-93, Guide for Operational Configuration Management Program (U.S. Department of Energy, 1993), addresses configuration management programs as well as the adjunct programs of design reconstitution and material condition and aging management. This standard, applicable to DOE nuclear facilities in the operational phase, presents the program criteria and implementation guidance for an operational configuration management program for DOE facilities. A configuration management program should also include the following elements:

• A baseline configuration management process for existing systems, including walkdowns of fire protection systems.
  
  
• Review of the status of drawings and the effectiveness of drawing walkdowns and procedures by cognizant engineers and operators to verify conformance to design requirements, system alignment, operability, proper component identification, and sequencing of steps.
  
  
• Inspection of labels on system components, such as fire panels, valves, instruments, and other components.
  
  
• A change process that encompasses development of new drawings and changes to operating and maintenance procedures and maintenance changes.

Note: Maintenance activities can be a major contributor to changes in the plant, and therefore, maintenance management and personnel should be sensitive to the need for proper technical review of any changes to plant systems or equipment. Replacement with like kind is probably the most prevalent type of maintenance change. Procurement of replacement parts that differ from the original item should be identified for technical review. Any difference, including a so-called manufacturer's equivalent, needs to be formally evaluated and documented by the design engineering organization to ensure that safety and reliability have not been degraded and that conformance to the design requirements is maintained.

• Operator training based on changes.
  
  
• Validation of the process for the flow of configuration information.
  
  
• Evaluation of the effectiveness of DOE field offices with respect to configuration management.
  

Useful guidance on configuration management can also be found in Report on Configuration Management in the Nuclear Utility Industry (Institute of Nuclear Power Operations, 1987).

4.2 PERFORMANCE CRITERIA AND REPORTING

Performance measures are needed to track overall fire safety performance complex-wide. (It should be noted that tracking of overall performance is broader than tracking of fire losses, which DOE has performed for many years.) Diligent monitoring of performance will enable DOE to identify negative trends at one or more sites and take action before a damaging event occurs. The need for performance measures to ensure safety was emphasized in a Secretarial Memorandum on Fire Safety Programs (Moler, 1998):

An adequate fire safety program. . . assures performance feedback through routine DOE oversight and contractor self-assessments, including the collection and analysis of complete and accurate fire protection program data and statistics, and an effective issues management system that demonstrates validation and closure of corrective measures.

Thus, fire protection performance measures and an associated complex-wide reporting system serve the dual purpose of ensuring contractor performance in the area of environment, safety, and health (ES&H) and enabling DOE to follow trends and take action as needed to strengthen fire safety programs.

DOE is working on changes to DOE Order 231.1, Environment, Safety and Health Reporting (U.S. Department of Energy, 1996), and the associated manual. These changes would require each DOE site to file an Annual Fire Protection Program Summary. The information contained in these annual summaries should allow DOE's ES&H organization to monitor complex-wide fire safety performance.

4.3 RESOLUTION OF ASSESSMENT AND SURVEILLANCE FINDINGS

Consistent with the Board's Recommendation 98-1, Integrated Safety Management and the Department of Energy (DOE) Facilities (Defense Nuclear Facilities Safety Board, 1998), findings from assessments of fire protection programs, including deficiencies, must be addressed promptly and timely corrective actions taken to ensure safety. A robust fire protection program includes aggressive efforts to identify, prioritize, and monitor the status of findings and recommendations resulting from such assessments, inspections and surveillances, until resolution has been achieved. Resolution can be achieved in a variety of ways, including modification of the plant design, changes to procedures, fire safety equivalency, or exemption.

DOE Order 420.1, Facility Safety (U.S. Department of Energy, 1995), requires that DOE and its contractors develop, implement, and maintain an acceptable fire protection program that includes the following elements:

• A comprehensive, documented self-assessment program for fire protection that includes all aspects (program and facility) of the fire protection program. Assessments should be performed on a regular basis at a frequency established by DOE guidance.
  
  
• A program to identify, prioritize, and monitor the status of the findings and recommendations of fire protection-related assessments and surveillances until final resolution has been achieved.
  
  
• When final resolution will be significantly delayed, implementation of appropriate interim compensatory measures to minimize the fire risk.

These requirements are explained in greater detail in Section 7.0, DOE Implementation Guide for use with DOE Orders 420.1and 440.1 (U.S. Department of Energy, l995). Whether or not a facility is contractually bound by this Order, the fundamental concepts, objectives, and features of the assessment program described in this guide should be followed at nuclear facilities.

Although DOE Orders and guidance describe an adequate program for the resolution of assessment and inspection findings, it is important for top-level line managers to prioritize the resolution of those findings to focus on issues related to the safety of the public and workers.

Fire protection modifications required for closure of findings should be prioritized as follows:

• Fire protection features relied upon to maintain the safety envelope of the facility.
  
  
• Fire protection features relied upon to provide defense in depth.
  
  
• Fire protection features relied upon to protect property.
  

4.4 FIRE PROTECTION STAFF

In Recommendation 93-2, The Need for Critical Experiment Capability (Defense Nuclear Facilities Safety Board, 1993), the Board stated:

Effective functioning of any organization, whether in the private sector or government, is highly dependent upon the capabilities of people and the way they are guided and deployed. Nowhere is this dependency more crucial than in the Department of Energy's (DOE) defense nuclear complex, where the potential hazards inherent in nuclear materials production, processing, and manufacturing require high quality technical expertise to assure public and worker safety.

The Secretarial Memorandum on Fire Safety Programs (Moler, 1998), noted above attributes equal importance to this same principle:

Our commitment [to fire safety] warrants a focused effort designed to evaluate . . . the adequacy of staffing of qualified fire protection professionals.

Because fire protection remains a critical safety program for defense nuclear facilities, it is essential that DOE maintain a strong professional staff in this area, both at Headquarters and in the field. Each DOE program office and field office managing defense nuclear facilities should have on staff at a minimum one experienced fire protection engineer (or equivalent). Determination of whether one such individual is sufficient to meet the need should be based on DOE's responsibility for program direction, not on budgetary considerations.

DOE's fire protection community, comprising safety professionals horn DOE and its contractors, is a unique group that has worked together to achieve a strong record of fire safety. The annual DOE Fire Protection Conference (which incorporates training courses) and the activities of the Fire Safety Committee are vehicles for the sharing of fire safety knowledge and experience among many sites and programs, leading to greater safety and cost savings.

4.5 SUPPORT FOR FIRE DEPARTMENTS

At many defense nuclear facilities, fire safety hinges on a highly trained and dedicated on-site fire department or an off-site fire department trained and equipped to respond on DOE premises. The fire department is the primary responder not only for fires, but also for worker injuries and health emergencies, hazardous materials accidents, and vehicle accidents. Yet the remoteness of many sites and the unique hazards of the facilities make reliance on off-site assistance impossible or at best untimely. For these reasons, adequate resources must be devoted to maintaining staffing levels, limiting reliance on overtime, and providing adequate training and equipment.

Section 2, DOE Order 420.1, Facility Safety (U.S. Department of Energy, 1995), requires that an acceptable fire safety program include both "access to a qualified and trained fire protection staff, including a fire protection engineer(s), technicians, and fire fighting personnel:" and a "baseline needs assessment that establishes the minimum required capabilities of site fire fighting forces." The Secretarial Memorandum on Fire Safety Programs (Moler, 1998), reiterates the importance of this requirement by affirming that an "adequate fire safety program. . . defines minimum response capabilities to site fire emergencies ('Baseline Needs')." As discussed in Section 3.4 above, fire department response is an important element in planning for fire emergencies.

For these reasons, it remains critical for DOE to provide strong support for all fire departments protecting defense nuclear facilities, whether on or off site. As the Board has often observed, in many cases decommissioning activities may be even more hazardous, especially to workers, than were previous production operations. Wherever radioactive materials are present, firefighters face special hazards and must accept greater risk to protect the public and workers. This risk is minimized by adequate shift staffing, training, prefire plans, off-site assistance agreements, and procedures. The Board's staff will continue to monitor the status of fire departments at all facilities under the Board's jurisdiction to ensure that the fire departments are supported at a level that provides adequate protection to workers, the public, and the firefighters themselves.

4.6 FUNDING OF RESEARCH ON FIRE PHENOMENA

Research often helps reduce future program costs and fire losses by leading to increased understanding of the causes of fires and their effects on safety systems and equipment. Historically, DOE and its predecessor agencies have supported research aimed at characterizing or understanding fire phenomena unique to DOE facilities. This fire safety research program has contributed substantially to the very good fire damage record associated with defense nuclear facilities.

In Recommendation 93-2, The Need for Critical Experiment Capability (Defense Nuclear Facilities Safety Board 1993), the Board made the following observation with respect to criticality research:

For all the above reasons, the Board believes that continuation of an experimental program of general purpose critical experiments is necessary for continued safety in handling and storing fissionable material. It is needed to improve the basis for the methodology. It is needed as part of the process of properly educating criticality control engineers. It is needed to ensure the capability of answering criticality questions with new and previously unresearched features.

These same principles apply to fire protection. DOE is responsible for the control of fire risk at a wide variety of facilities, old and new, processing and storage, operating or being dismantled. While many of the fire protection challenges maybe suitably mitigated by use of existing codes and standards, there are instances in which more data are needed to quantify risk and identify cost-effective solutions.

At the time of the Board's inception a decade ago, DOE conducted a modest but important fire phenomena research program managed by the ES&H organization. That program was gradually reduced, and a few years ago ceased to exist. Although program offices and sites occasionally fired project-related experiments, it appears that no funds are currently available for generic fire safety research.

This situation should be reexamined. Carefully focused research could yield important insights into fire risk based on tests rather than analysis, identify new vulnerabilities, and suggest the need for additional standards and guidance to control fire hazards. Strategic partnerships between DOE and other Federal agencies or non-profit organizations maybe one method to increase available funding.

REFERENCES

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to E. J. Moniz, Under Secretary, U.S. Department of Energy, concerning the review of the draft Consolidated Tritium Safety Analysis Report for the Savannah River Site, Washington, D.C., March 18.

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to T. J. Glauthier, Deputy Secretary, U.S. Department of Energy, concerning guidance set forth in draft Guide 420.1-X, Implementation Guide for Non-Reactor Safety Design Criteria, and draft Appendix A to DOE-STD-3009-94, Washington, D.C., July 8.

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to T. F. Gioconda, Acting Assistant Secretary for Defense Programs, U.S. Department of Energy, concerning observations regarding electrical, instrumentation and control, and fire protection systems at Los Alamos National Laboratory, Washington, D.C., September 22.

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to T. J. Glauthier, Deputy Secretary of Energy, concerning a review of the status of safety analyses and safety analysis documentation that support nuclear operations at the Oak Ridge Y-12 Plant, Washington, D.C., October 6.

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to M. A. Krebs, Director, Office of Science, U.S. Department of Energy, concerning the site visit observation that a recent change to the Oak Ridge National Laboratory Work Smart Standards redressed a deficiency created when DOE Order 5480.7A, Fire Protection, was deleted from the contract, Washington, D.C., October 5.

Conway, J. T., Chairman, Defense Nuclear Facilities Safety Board, 1999, Letter to T. F. Gioconda, Acting Assistant Secretary for Defense Programs, U.S. Department of Energy, concerning assessment by the Board's staff of the status of preparations for the first new dismantlement campaign at the Y-12 Plant, Washington, D.C., November 3.

Defense Nuclear Facilities Safety Board, 1990, Recommendation 90-1, Savannah River Site Operator Training, Washington, D.C., February 22.

Defense Nuclear Facilities Safety Board, 1993, Recommendation 93-2, The Need for Critical Experiment Capability, Washington, D.C., March 23.

Defense Nuclear Facilities Safety Board, 1998, Recommendation 98-1, Integrated Safety Management, and the Department of Energy (DOE) Facilities, Washington, D.C., September 28.

Institute of Nuclear Power Operations, 1987, Report on Configuration Management in the Nuclear Utility Industry, INPO 87-006, July.

Moler, E. A., Deputy Secretary, U.S. Department of Energy, 1998, Memorandum, Fire Safety Programs, to Program Secretarial Officers, DOE Operations Office Managers, and DOE Field Office Managers, Washington, D.C., May 14.

National Fire Protection Association, 1998, Standard for Fire Protection for Facilities Handling Radioactive Materials, NFPA 801 (1998 Edition), Quincy, MA.

National Fire Protection Association, 1999, Standard for Emergency and Standby Power Systems, NFPA 110 (1999 Edition), Quincy, MA.

Occurrence Report No. SR--WSRC-FBLINE-1999-0013, 1999, Delinquent Inspections of Fire Protection System, June 14 (final).

Occurrence Report No. ORO--LMES-Y12SITE-1998-0017, 2000, Potential Concerns and Issues Associated with the Configuration Management of the Auxiliary/Standby Power Generators, January 7 (final).

U.S. Department of Energy, 1995, DOE C 420.1, Contractor Requirements Document, Facility Safety, Washington, D.C., October 13.

U.S. Department of Energy, 1992, DOE Order 5480.23, Nuclear Safety Analysis Report, Washington, D.C., April 30.

U.S. Department of Energy, 1993, DOE Order 5480.7A, Fire Protection, Washington, D.C., February 17.

U.S. Department of Energy, 1995, DOE Order 151.1, Comprehensive Emergency Management System, Washington, D.C., September 25.

U.S. Department of Energy, 1995, DOE Order 420.1, Facility Safety, Washington, D.C., October 13.

U.S. Department of Energy, 1996, DOE Order 231. 1 Chg. 2, Environment, Safety and Health Reporting, Washington, D.C., November 7.

U.S. Department of Energy, 1998, DOE Order 440.1A, Worker Protection Management for DOE Federal and Contractor Employees, Washington, D.C., March 27.

U.S. Department of Energy, 1993, DOE-STD-1073-93-Pt. 1 & 2, Guide for Operational Configuration Management Program, Washington, D.C., November.

U.S. Department of Energy, 1994, DOE-STD-3009-94, Change Notice No. 1, January 2000, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, Washington, D.C., July.

U.S. Department of Energy, 1995, DOE-STD-1088-95, Fire Protection for Relocatable Structures, Washington, D.C., June.

U.S. Department of Energy, 1999, DOE-STD-1066-99, Fire Protection Design Criteria, Washington, D. C., July.

U.S. Department of Energy, 1995, Implementation Guide for use with DOE Orders 420.1 and 440.1 Fire Safety Program, Washington, D.C., September 30.

U.S. Department of Energy, 1995, Fire Protection Qualification Standard Competencies, Washington, D.C., May.

U.S. Department of Energy, 2000, DOE Guideline 420.1-2, Guide for the Mitigation of Natural Phenomena Hazards for DOE Nuclear Facilities and Nonnuclear Facilities, Washington, D.C., March 28.

U.S. Department of Energy, 1996, DOE-HDBK-1062-96, DOE Fire Protection Handbook, Washington, D.C.

GLOSSARY OF ACRONYMS AND TERMS