December 5, 1996

The Honorable Victor H. Reis
Assistant Secretary for Defense Programs
Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0104

Dear Dr. Reis:

Enclosed for your consideration and action, where appropriate, are the observations developed by the members of the Defense Nuclear Facilities Safety Board (Board) staff concerning electrical and ventilation systems of the TA-55 facility at the Los Alamos National Laboratory (LANL). These observations are based on reviews of available documents, and discussions with Department of Energy (DOE) staff and contractor personnel at LANL on August 13-15, 1996.

In the enclosed report, the Board staff conclude that the electrical safety program at LANL needs upgrading. The staff noted that the existing electrical safety programs does not meet the regulations of the Occupational Safety and Health Administration in some respects. The report also provides a number of design-related observations regarding areas for further improvement. For example, leaks in the fire suppression supply lines at TA-55 are of particular note because this situation calls into question the viability and readiness of the fire protection system to perform as required.

The Board believes that the electrical safety program at LANL needs to be upgraded to comply with the DOE Electrical Safety Guidelines. The Board also expects that the Integrated Safety Management Systems being developed at LANL in response to Recommendation 95-2 will address these issues.

The report is being provided for whatever actions you may deem appropriate in the furtherance of our mutual interest in safe operations. Should you need further information, please do not hesitate to call me.

Sincerely,

John T. Conway
Chairman

c. Mr. Mark B. Whitaker, Jr.
Mr. Bruce Twining

Enclosure

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

October 11, 1996

1. Purpose

This report documents a review of the electrical and ventilation systems of the TA-55 facility at Los Alamos National Laboratory (LANL). This review was performed by Defense Nuclear Facilities Safety Board (Board) staff members Ajit Gwal, Derek Barboza, and Roger Zavadoski on August 13–15, 1996.

2. Issues

The review identified the following major issues:

LANL does not have an adequate electrical safety program, and at the time of the review was not aware of the Department of Energy's (DOE) Electrical Safety Guidelines, which were issued to various DOE sites with no compliance requirements. Thus DOE and contractor employees at LANL are not receiving the full benefit of protection addressed in the guidelines, particularly in the area of safe electrical work practices.

At a location at the LANL site where two 115 kV transmission lines cross, there is the potential for a failure of these lines, and this situation could isolate the site from off-site power for an extended period. If such a failure were to occur, it would take days to repair the lines. Because the back-up diesel generator at TA-55 has only a 4-hour supply of fuel for a fully loaded bus, systems important to safety, such as ventilation systems, may not be available to perform their intended functions during an extended loss of power.

Leaks due to corrosion of fire suppression supply lines at TA-55 are becoming sufficiently serious to require replacement of the lines in the near future. Adequate measures have not been taken to justify the continued use of the lines until they are replaced in 1 year.

Sixty-two gloveboxes in Building PF-4 at TA-55 would not be able to withstand the increased forces of a redefined LANL seismic event. Upgrading is in progress on 14 of these gloveboxes, which dominate the potential source term, but work on the remaining 48 is not funded.

3. Background

LANL has completed a feasibility study aimed at defining the constraints on creating an active safe shutdown condition for Building PF-4 at TA-55. Implementation of such a condition will require various upgrades, such as installation of new redundant uninterruptible power supply (UPS) systems, modification of a diesel generator control system, installation of a new motor control center, and replacement of facility control systems. Board staff have also reviewed the final Type A accident investigation reports for the electrical accidents at LANL on January 17, 1996, and July 11, 1996.

4. Discussion/Observations

The review identified the following potentially significant issues at the TA-55 facility. A discussion of other relevant issues is provided in Attachment A.

Electrical Safety Program. LANL does not have an adequate electrical safety program, and as of this review was not aware of the DOE Electrical Safety Guidelines (DOE/ID-10600, dated May 1993), which were issued to various DOE sites with no compliance requirements. These guidelines include electrical safety requirements of Occupational Safety and Health Administration (OSHA) regulations contained in 29 CFR 1910 and 29 CFR 1926. Their objective is to enhance electrical safety awareness and mitigate electrical hazards to workers and the public.

DOE briefed the Board staff on two recent electrical accidents that occurred on January 17, 1996, and July 11, 1996. In the former case, an employee was seriously injured and remains in a deep coma as a result of coming in contact with a 13.2 kV electrical cable. In the latter case, a student employee received a 4000 V shock while conducting electrical measurements on a microwave oven; this employee is expected to recover fully from his injuries. Board staff reviewed the final Type A accident investigation reports on these two accidents and observed that DOE's Electrical Safety Guidelines document was not referenced. Because existing procedures at LANL do not include important elements of the DOE guidelines, DOE and contractor employees are not receiving the full benefit of protection addressed in the guidelines, particularly in the area of safe electrical work practices.

LANL intends to establish an adequate electrical safety program.

Transmission Line Single Failure. Two high-voltage (115 kV) transmission lines that provide power to the LANL site cross each other at one location on site. A failure of the transmission lines at this point could isolate the site from power for an extended period. This situation could be resolved by routing one of the transmission lines underground. LANL will review this issue.

Fire Suppression System. Fire suppression supply lines (10 inch diameter) at TA-55 have corroded and developed leaks in various sections of the pipe. At some locations, the wall of the piping is less than 75 percent of its original thickness. The first leak was discovered on

June 20, 1988. Since then, approximately 27 leaks have been detected and repaired. These leaks are caused by galvanically induced pitting. The galvanic corrosion is a result of installing the uncoated carbon steel piping underground without cathodic protection. An Unreviewed Safety Question (USQ) determination (USQD-95-006) was made for the corrosion of the TA-55 fire suppression system piping; it concluded that this change does involve a USQ.

DOE, on July 5, 1996, approved a Justification for Continued Operation of TA-55 Plutonium Facility with Existing Corrosion of Fire Suppression Supply Piping. As stated in the document, TA-55 has accepted the risk of continued operations for an additional year, based on the low probability of a fire in Building PF-4 and an aggressive combustible loading minimization walkdown program, as well as other design features (i.e., ventilation dampers and fire rated facility construction). At the end of this time, LANL plans to install a new fire suppression water supply system to replace the entire existing system.

Board staff are concerned that before the water supply system is replaced, it might degrade to the point where it will become unreliable. Because of the combustible loading in TA-55, including oil transformers and cables, the staff believe that an operability limit needs to be established, and that a design modification needs to be considered that would allow the introduction of water to the sprinklers by alternate means. The operability limit could be based on the amount of leakage. DOE will evaluate and resolve this issue.

Electrical Calculations. Comprehensive short-circuit, voltage profile, and coordination studies are essential to safeguard personnel and maintain a safe and reliable power system. Such studies would be performed in accordance with Institute of Electrical and Electronics Engineers (IEEE) STD-141, IEEE Recommended Practice for Electric Power Distribution for Industrial Plant, and STD-242, IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems. LANL has completed these calculations for 13.2 kV systems only. Short-circuit analysis of 120 V systems and a protective device coordination study for 480 V and lower systems have not been performed. LANL plans to complete these analyses as part of its Capability, Maintenance, and Improvement Project. Therefore, the Board staff could not verify the capability of the electrical equipment to perform the intended functions when required.

Emergency Lighting. In the event of an earthquake, emergency lighting is needed for personnel egress from the facility. The Board staff observed that emergency lighting equipment at the TA-55 facility does not appear to be seismically supported or qualified. LANL will evaluate this issue.

Battery Room Hydrogen Explosion Hazard. The Board staff noted to LANL that the existing installation of an open filament space heater is a potential ignition source. This heater, installed above lead-acid batteries in the battery room, is in violation of the requirements of American National Standards Institute (ANSI) ANSI-C2, National Electrical Safety Code. An explosion could result if hydrogen produced by lead-acid batteries were to come in contact with the open filament of the space heater. LANL will perform an evaluation to resolve this issue.

Glovebox Seismic Upgrades. LANL analyses of a redefined seismic event have shown that 62 gloveboxes at PF-4 in the TA-55 facility would not be able to withstand the increased forces. Gloveboxes would fail because of anchorage and support inadequacies or interactions with other gloveboxes. As a result of these analyses, 14 gloveboxes, which dominate the potential source term, are being upgraded. The remaining 48 gloveboxes also need to be strengthened, but work on them has not been funded. It should be noted that the ductwork and the gloveboxes constitute a significant portion of the Zone I ventilation system and must remain intact during a seismic event.

Facility Control System. The facility control system at TA-55 is in the process of being replaced. This system monitors heating, ventilation, and air conditioning (HVAC); electrical power; continuous air monitors; criticality alarms; the fire detection and suppression system; chilled water; and compressed gases. In addition, it provides limited control functions, including switching, startup, and shutdown of HVAC fans, and alarm processing for site safety notifications.

The present system is approximately 20 years old, and replacement parts are not available. The current mean time between failures (MTBF) for subcomponents of the system is on the order of 4 days. During the week of the staff's visit, the facility control system failed three times.

The facility control system is classified as a safety-significant system. Its criterion for acceptable reliability has been specified as an MTBF of greater than 36 days. This results in an acceptable failure rate of 10 per year. The staff believe this failure rate is too high given the safety-significant classification of the system. LANL stated that the system will be upgraded to have an expected MTBF of greater than 426 days.

5. Future Staff Actions

The Board staff will continue to follow the resolution of the issues identified in this report.

ATTACHMENT A
ADDITIONAL ISSUES

1. Loss-of-Power Event

On August 10, 1996, Building PF-4 at TA-55 suffered a loss of off-site power when large portions of at least seven western states lost power. At the time of the incident, no one was in the facility, and the work area was locked. With the loss of off-site power and without operation of the diesel generator, the ventilation zones lost their negative pressure, and pressures in the building equalized in a manner of minutes. At the time of the event, the operations center was staffed by two operators; support from security and from health physics was available on site.

The operators immediately followed procedure NMT8-FMP-505-R01, Remotely Operating the Diesel Generator After Loss of Power to the North and South Emergency Motor Control Centers, dated March 25, 1996. This procedure requires that the operators verify the status of certain breaker positions on the electronic display of the facility control system before starting the diesel generator. One breaker (52-B1), which is required to be open, was shown on the display to be closed. Local verification required entry into Building PF-4, but support from security and health physics was required for this purpose.

After approximately 40 minutes, the operators were able to change out one of the computer components, and the CRT display showed the breaker in the proper position. At this point, the operators remotely started the diesel generator, which loaded in approximately 3 minutes. The generator continued to run for 1 hour until off-site power was restored. LANL representatives stated that no unexpected contamination was found after power had been restored.

Facility personnel stated that the diesel generator can operate in a loaded condition for 4 hours with the amount of fuel in the "day tank." The current procedure to operate the generator requires that the operator "contact a fuel truck . . . if the diesel generator will be run for longer than two hours . . . ." The adequacy of this statement is questionable.

2. Diesel Generator

Automatic Start Capability. The TA-55 facility currently has only one diesel generator. This generator does not start automatically after a loss of normal power. TA-55 has now confirmed that this generator will be modified for automatic start capability.

Additional Diesel Generator. A review by Board staff is currently ongoing to determine whether the facility requires emergency backup power and therefore needs an additional diesel generator and design upgrades.

Nonsafety Loads on the Diesel Generator. During the Board staff review, electrical supply from the diesel generator to the nonsafety motor control center of Building PF-8 was discussed. The motor control center provides power to hot-water boilers and associated pumps. The Board staff called to LANL's attention that any nonsafety load connection to diesel generator buses will require an isolation device, as defined in ANSI/IEEE Standard-384, Standard Criteria for Independent Class 1 Equipment and Circuits. LANL intends to use this standard in the selection of an isolation device.

Synchronization. Building PF-4 at TA-55 is fed by two 13.2 kV lines. To run the diesel generator, one of these lines must be disconnected and the generator synchronized to the remaining 13.2 kV line. In the past, it was mistakenly reported that the generator could be tied only to a dead bus. This was erroneous in that a synchronizing circuit is preset and functional, but it has not been used because of concern about getting the two energized lines out of synchronization.

Fuel Tank. As noted above, the diesel generator has a small "day tank" that has only a 4-hour supply of fuel for a fully loaded bus. During a field walkdown, it was observed that the tank could be filled only in the room where the tank and generator are located. Because entrances to the diesel generator facility are within 100 feet of the base of the discharge ductwork, additions of diesel fuel oil during a potential radiological emergency could be hazardous to workers. LANL will evaluate this issue.

3. Oil-Insulated Transformers

Four oil-insulated transformers located inside the plutonium-handling facility are part of the power distribution system. The transformer oil could ignite during a transformer failure and be the source of a fire. The National Electrical Safety Code (ANSI-C2) and the National Fire Protection Association (NFPA-70) National Electric Code require that indoor oil-insulated transformers be located in a transformer vault. In addition, the codes require that the transformer vault include fire walls and doors, ventilation, and oil containment and drainage. The TA-55 transformers do not meet these requirements. In an earlier trip report, Board staff suggested that the replacement of oil-insulated transformers with dry-type transformers would be a prudent approach to resolving this concern. LANL has confirmed that oil- type transformers will be replaced by dry-type transformers; this replacement will be part of the Capability, Maintenance, and Improvement Project.

4. Active Safe Shutdown from a Ventilation Perspective

The Board staff reviewed a feasibility study of an active safe shutdown system. This study considers the use of a new UPS system to power all eight exhaust fans in the Zone I ventilation system. During a loss of power, the new UPS would maintain four of the eight fans running and maintain a negative 0.6 inch water column in the Zone I system (relative to atmosphere) for 1 hour. LANL stated that this would allow enough time to get power restored or bring the diesel generator on line. If the UPS were to fail, the facility would revert to a passive mode.

With four Zone I exhaust fans operating after a loss of site power, the flow rate to the plant vent would be approximately 4000 standard cubic feet per minute (scfm). Studies indicate that the isokinetic probes would perform within an acceptable range at this flow rate. This confirms the adequacy of the ventilation system design.

5. Installation of New UPS

As discussed above, implementation of an active safe shutdown condition would require the installation of the new redundant UPS. This system would power critical equipment that would sustain an active safe shutdown condition. The motor that serves glovebox exhaust fans FE-850, -851, -852, -853, -854, - 855, -856, and -857 and operations center air supply fans FS-880A and -880B would be powered from the new UPS.

The fan motor electrical demand could range from 5 to 10 horsepower. Normally, a UPS is not used to feed multiple-horsepower motors. The Board staff are concerned that the new UPS might not be able to withstand the starting current transients, which could be as high as six to ten times the full load current of one motor. This condition could become worse when all eight motors and other loads are started from the UPS at the same time. LANL has agreed to perform a study to review the adequacy of the UPS design in this regard.

6. Air Inleakage at Building PF-4

LANL is in the process of developing a test method to measure the amount of air inleakage into Building PF-4. Such a test is necessary to ensure that leak rates assumed in the safety analyses are not exceeded. For example, a 6 percent leak rate factor used in an earthquake scenario produces a hypothetical 18 rem exposure.

LANL is structuring the test in accordance with American Standards for Testing Materials (ASTM) 283 and E783. The test will include verification that leakage is less than 250 scfm at negative 0.15 inch water column (versus the Final Safety Analysis Report's fire analysis of 500 cfm). At present, door seals are being replaced and tested prior to implementation of the new Technical Safety Requirements. The Board staff pointed out that it would be desirable to include all doors from Building PF-4 to the outside in the program, and to consider other penetrations for inclusion if they are not sealed and are open to the outside.