DNFSB/Tech-3

This issue paper was prepared for the Defense Nuclear Facilities Safety Board by the following staff: Roger Zavadoski with advice from the following staff members: Joseph Roarty; David Lowe; and Andrew DeLaPaz.

CONTENTS

I. Summary

II. Introduction

III. Requirements

IV. Detailed Requirements

A. Operability

B. Single Failure and Redundancy

C. Emergency Power

D. Periodic Testing

E. Control Room Habitability

F. Elevated Release

G. Site Boundary Considerations

V. Management Issues

A. Order Compliance

B. Configuration Management

C. Technical Oversight

VI. Conclusions

APPENDIX A: DOE ORDER 6430.1A General Design Criteria

APPENDIX B: AEC MANUAL CHAPTER 6301 General Design Criteria

APPENDIX C: NRC REGULATORY GUIDE 3.12

APPENDIX D: FACILITIES AND REQUIREMENTS MATRIX

References

I. SUMMARY

From the time nuclear weapons production began, special controlled airflow, negative pressure, and filtration schemes have been used to protect the health and safety of the worker, the public, and the environment from plutonium. These special schemes are called confinements and ventilation systems when dealing with plutonium. The Department of Energy's Order 6430.1A (DOE 6430.1A), General Design Criteria, reflects the Department's experience in designing plutonium facilities. This order includes design criteria formerly embodied in the Atomic Energy Commission's Manual Chapter 6301 (AEC 6301). Both DOE 6430.1A and AEC 6301 compare favorably with commercial nuclear practices articulated in the Nuclear Regulatory Commission's Regulatory Guide 3.12 (NRC 3.12).

Unfortunately, many of DOE's plutonium facilities were neither built nor operated in accordance with DOE's own requirements for ventilation systems. Furthermore, at many of these facilities, the method of recording and compensating for deviations from requirements is not as specified in applicable DOE orders. There are numerous instances of a lack of an adequate accounting of how, and whether, facilities meet and maintain specific requirements.

As a result of these shortcomings, DOE's plutonium facilities may not: 1) have a required safety system available during a design basis accident (DBA); 2) withstand the single failure of safety features; 3) have emergency power; 4) provide adequate protection for control room personnel; or 5) provide adequate public protection. These weaknesses point to a lack of adequate DOE oversight during construction and operation. They also demonstrate a lack of compliance with DOE's own Orders. Order compliance is the subject of the Defense Nuclear Facilities Safety Board's Recommendation 90-2. This recommendation has been accepted by the DOE and work is ongoing to demonstrate compliance with the Orders.

II. INTRODUCTION

In order to provide adequate protection for the people and environment, the United States has utilized special buildings and enclosures with negative pressure, controlled air flow, and filtration to safety handle plutonium. These buildings and enclosures with a negative pressure and controlled airflow are called confinements and the associated filtration is the ventilation system. Early facilities used multiple structural barriers and ventilation systems driven by diverse and redundant power sources. This paper reviews the current role of ventilation systems at selected DOE plutonium facilities against some current requirements. Many of the deficiencies noted have been brought to the attention of the individual sites involved through trip reports, public meetings and conversations.

Requirements for ventilation systems at plutonium facilities are covered by DOE 6430.1A, General Design Criteria. DOE 6430.1A requires that a confinement system, defined as a composite of the structure and its associated ventilation systems, remain "fully functional following any credible DBA," and that "unfiltered/unmitigated releases of hazardous levels of such materials shall not be allowed following such accidents." In addition, DOE 6430.1A requires that "to the extent practical, [As Low As Reasonably Achievable] ALARA concepts shall be applied when designing special facilities to mitigate post-DBA releases of hazardous materials." ALARA also applies during normal operations. Keeping plutonium inside a facility using existing technology following a DBA or process upset conditions, as well as during normal operations, is a reasonable requirement; it also coincides with prevailing commercial designs.

This review is limited to ventilation systems. The structures in which they operate obviously affect those systems and a problem in either the structure or its ventilation systems could compromise the confinement concept. Even though the structure and the ventilation systems have been separated here, they should be thought of as inseparable.

As part of this review, field visits were made to a variety of sites and facilities over a two-year period, including:

A. Los Alamos National Laboratory (LANL)

• The Plutonium Facility (PF-4 at TA-55)

• The Chemical and Metallurgical Research (CMR) Laboratory

B. Lawrence Livermore National Laboratory (LLNL)

• Building 332

C. Hanford

• The Plutonium Finishing Plant (PFP)

D. Rocky Flats

• Building 707

• Building 771

• Building 559

• Building 371

E.Savannah River Site

• H-Canyon

• HB-Line

• F-Canyon

• FB-Line

III. REQUIREMENTS

In most cases, it is difficult to ascertain the original design criteria for a particular ventilation system since safety analysis reports (SARs) generally do not specify how the particular design criteria are met.

Three condensations of pertinent design criteria (DOE 6430.1A, AEC 6301, and NRC 3.12) have been prepared, each including key criteria pertaining to ventilation systems. Specific criteria concerning seismic design and fire protection are beyond the scope of this review, but the overall requirement that ventilation systems be designed to withstand seismic and fire events has been included. The condensed versions of the criteria are found in Appendices A-C.

The referenced documents represent a partial history of the collected design experience for handling plutonium. The three documents span the last twenty-five years and are consistent and comparable in their guidance.

DOE 6430.1A and AEC 6301 both contain "mandatory and minimally acceptable requirements," including applicability to "alterations" and "modifications" to existing facilities. Each enumerates specific procedures to follow for deviations and exceptions to the requirements. According to representatives at the various facilities, there are apparently no DOE Headquarters-approved deviations for ventilation systems at their plutonium facilities. Apparently, DOE Headquarters has not ensured compliance with DOE 6430.1A. Further, where deviations have been found locally acceptable by DOE at a particular facility, they have not been reviewed for applicability across the complex. This suggests the lack of an effective system of control and technical oversight of the facility's design basis.

Unlike commercial facilities, neither DOE nor its predecessors established an effective system for controlling or recording compliance with requirements. Most facilities have altered or modified their ventilation systems, yet little documentation or other evidence exists that the facilities have been substantially reviewed for applicability of the criteria contained in DOE 6430.1A or AEC 6301. In short, neither DOE nor its predecessors seem to have had mechanisms in place to assure initial or continuing conformance to mandatory, minimally acceptable requirements, and no such mechanisms presently exist.

IV.DETAILED REQUIREMENTS

The following selected requirements were reviewed:

A. Operability during DBAs

B. Ability to withstand a single failure

C. Redundant emergency power

D. Periodic Testing

E. Control area protection for off-normal conditions

F. Stack height considerations

G. Assumed locations of the public used for postulated accident assessments

In the following sections, the basis for each of these requirements is described followed by discussions of the as-found conditions from selected field visits. A listing of all the facilities and requirements reviewed is in Appendix D. At the end of this section, Table 1 presents a synopsis of the findings.

A. Operability

DOE 6430.1A, Section 1300-1.4.2 states ". . . at least one confinement system . . . ," (which includes the structure and the ventilation systems), ". . . remains fully functional following any credible DBA, i.e., unfiltered/unmitigated releases of hazardous levels of such accidents shall not be allowed following such accidents. Facility design shall provide attenuation features for postulated accidents (up to and including DBAs) that preclude off-site releases that would cause doses in excess of the DOE 5400 series limits for public protection." Additionally, "ALARA concepts shall be applied . . . to mitigate post-DBA releases."

From the above, the requirement to continually operate at least one confinement system is not conditionally mandated through a probabilistic risk assessment nor through mitigation of off-site exposures (as delineated in Sections 0200-1.2 and 1.3 of DOE 6430.1A). However, probabilistic risk assessments have been used to define credible DBAs. Simply stated, the special plutonium facilities covered by this section shall have an operational filtration system and enclosure which continues to function up through the DBA stage.

The postulated exposures in the DOE 5400 series citation entail a public limit of 100 millirems. The ALARA requirement suggests the use of any systems that may be available following a DBA. These systems should be used even though they may not be designed specifically for the task.

Section 1550-99.0.1 of DOE 6430.1A requires that: (1)" The failure of ventilation . . . systems not designed as safety class systems shall not prevent other facility safety class systems from performing their required safety functions," and (2) "Adequate instrumentation and controls shall be provided to assess ventilation system performance and allow the necessary control of system operation." These requirements presume the presence of trained personnel to intervene as conditions warrant, and are only two of many that demand some degree of assessment and manipulation of controls.

As-found field conditions relating to operability during DBAs varied widely in both staffing and design. PFP at Hanford and PF-4 at Los Alamos are staffed round-the-clock, as are Buildings 707, 771, 559 and 371 at Rocky Flats and F- and H-Canyons at Savannah River. HB- and FB- Line control rooms are not staffed continuously on back shifts. Response is provided from the H- and F-Canyon control rooms and routine surveillance patrols. The B-Lines are physically located above the canyon control rooms. In the event of an alarm in the unoccupied B-Line control rooms, the canyon control rooms are automatically notified. The main canyon control rooms are staffed around-the-clock.

The situation for Building 332 at Lawrence Livermore is considerably different. Control room operators are on site only on weekday day shifts. Their presence is not required in the control room or at the remote video room outside the control room where most, but not all, of the control panels can be monitored but not manipulated. At nights, on weekends and other non-work days, alarms in the control room are transmitted to a maintenance facility located outside the security fence. The alarm responders on back shifts and weekends are mechanics trained on the safety systems at Building 332, but they are not trained operators. Thus, the control room for Building 332 is staffed less than twenty-five percent of the time. No deviations from Order requirements have been filed or approved.

Another example of failure to meet Order requirements for operability is the use of the emergency diesel generator at PF-4 in area TA-55, Los Alamos, during or after seismic events with a concurrent loss of off-site power. As found, Los Alamos would not automatically start the emergency generator in the event of a loss of off-site power during a seismic event. The emergency procedures required that the inlet dampers be closed, outlet dampers opened and the building allowed to breathe through the building's exhaust high-efficiency particular air (HEPA) filters. This concept is called "passive safe shutdown." Subsequent to discussions with the Board's staff, during which evidence of existing unmitigated leakage paths was shown to the Los Alamos staff, PF-4 changed their emergency procedures to manually start the diesel and load the necessary ventilation systems. The "passive safe shutdown" concept does not meet the DOE 6430.1A operability requirements of one fully functional confinement system with no unmitigated leakage, nor were any deviations filed or approved by DOE Headquarters.

Los Alamos had considered a test program that involves melting kilogram quantities of plutonium at the CMR facility. The Board has previously expressed doubt about the CMR's seismic design. Also, it does not have special safety equipment, like a seismically-designed ventilation system or an emergency generator. Furthermore, it relies on the same type of passive safe shutdown as PF-4. As discussed above, this approach is contrary to the requirements of DOE 6430.1A and deviations have neither been requested nor approved.

In summary, there are some DOE plutonium facilities where the operability requirements contained in DOE Orders for personnel and functioning safety equipment are not being met.

B. Single Failure and Redundancy

Section 1300-3.3 of DOE 6430.1A establishes requirements for special safety equipment to be redundant and be able to withstand a single failure. For plutonium facilities, the ventilation systems are typically part of the special safety equipment. The Order states: "The design shall ensure that a single failure . . . does not result in the loss of capability of a safety class system to accomplish its required safety functions. To protect against single failures, the design shall include diversity to minimize the possibility of concurrent common mode failures of redundant items."

Section 1300-3.2 also states that: "Safety class items are systems, components, and structures, including portions of process systems, whose failure could adversely affect the environment or the safety and health of the public. Specifically, safety class items are those systems . . . whose failure would produce exposure consequences" in excess of DOE 5400 series limits (i.e., 100 millirems from DOE Order 5400.5) for public exposure "at the site boundary or nearest point of public access."

This review disclosed some diversity with regard to meeting redundancy requirements and the single failure criterion. At the PFP, fans for the critical ventilation systems not only had redundant electrical power, but also were backed up by steam driven fans using a diverse steam source. although designed to the seismic requirements of the time, none of the fans can meet today's requirements. Therefore, they are susceptible to a common mode failure.

At LANL's PF-4, the large inlet and outlet butterfly dampers do not meet the single failure criterion. The inlet dampers must close to preclude possible building pressurization and to preclude a potential leak path where only one bank of HEPA filters may be available. A recent surveillance of the alignment of these dampers at PF-4 (May 1994) showed that they failed to position properly due to difficulties encountered with the compressed air system. Obviously, the application of the single failure and redundancy criteria has not been applied.

C. Emergency Power

Emergency power requirements are covered in several sections of DOE 6430.1A. Section 1161-4 states: "Safety class items of the ventilation system shall be supplied with emergency power." Section 1550-99.0.2 states that "If the maintenance of a controlled confinement airflow is required, . . . ." (Section 1300-1.4.2 requires the confinement system to remain fully functional, i.e., maintain the controlled air flow and negative pressure, for plutonium processing and handling facilities), then ". . . electrical equipment and components required to provide this airflow shall be supplied with safety class electrical power and provided with an emergency power source." The glossary of DOE 6430.1A defines Emergency Power, in part, as a "DBA qualified and seismic category-I- qualified, fully redundant power generation, switching, and distribution system that meets the [Institute of Electrical and Electronics Engineers] IEEE 1E criteria."

As originally installed, there are no redundant emergency power sources provided at PF-4 and no requests or approvals for deviations were sought, whereas many other DOE plutonium facilities have redundant emergency diesel generators.

Additionally, when leakage was discovered on the main diesel fuel oil storage tank at PF- 4, removal of the tank from service was deemed acceptable on the basis that an emergency generator was not needed for PF-4. The tank has been removed. This leave the generator with only a nominal day tank (approximately four hours of fuel available at full load). Furthermore, the diesel cannot be tied to a live load, which makes testing very difficult. Currently, by procedure, the diesel is manually started and tied as soon as possible after the loss of off-site power.

The emergency power requirements for redundancy, testing and single failure contained in DOE 6430.1A are not being met at PF-4. DOE Headquarters has not approved a deviation or exception, although a justification was approved by the DOE Field Office.

D. Periodic Testing

The ventilation systems filtration efficiency cannot be assured unless the system is field tested on a frequent basis. It is the efficiency which guarantees the protection of the worker, plubic and environment. Testing requirements for ventilation systems are covered in Section 1300-3.6 of DOE 6430.1A. This section states: "The design shall include provisions for periodic testing of monitoring, surveillance and alarm systems. In addition, the design shall provide the capability to test periodically, under simulated emergency conditions, safety class items that are required to function under emergency conditions. All systems for which credit is taken to meet the criteria of Section 1300-1.4.2, Accidental Releases, shall be in-place testable in terms of pressure, filtration or removal efficiency, alarm capability, leak resistance, and the like . . . . The facility shall allow for routine in- place testing of HEPA filtration systems as outlined by American Society of Mechanical Engineers (ASME) N510." Once again, for plutonium facilities, the safety class items referred to here, in part, are the ventilation systems.

ASME N510-1989, Testing of Nuclear Air Treatment Systems includes several sections. Section 10 deals with HEPA Filter In-Place Tests, Section 12 deals with Duct Damper Bypass Test, and Section 13 deals with Systems Bypass Test. These sections require the periodic in-place test of the HEPA banks, the periodic leak testing of safety related components, such as dampers that must realign during a DBA, and duct work whose integrity must be maintained to prevent an unmitigated release path.

Review of periodic testing requirements in the field revealed several discrepancies with the requirements of DOE 6430.1A. At Rocky Flats, some facilities (Buildings 707 and 559) were required to test each HEPA filter bank in the exhaust stream while others (Buildings 771 and 371) only tested one HEPA filter bank of the three or four exhaust HEPA filter banks. After determining that several previously non-tested HEPA filter banks could not meet the acceptance criteria, the contractor completed a formal Unreviewed Safety Question Determination (USQD) for the HEPA filter banks not tested previously. The contractor has formally evaluated the number of HEPA filter banks required for each facility and instituted a test program for each.

The requirements for systems and dampers bypass leakage is not being addressed at DOE plutonium facilities. The four facilities at Rocky Flats mentioned above are not testing in accordance with Sections 12 and 13 of ASME N510-1989. The bypass leakage characteristics of these systems are unknown. Another example is the large butterfly valves used on the supply ducts at PF-4 in Los Alamos. During a loss of off-site power, leakage past these valves could release to the environment contaminated air filtered by only one HEPA inlet filter, not the three or four HEPA filter exhaust banks assumed in the Safety Analysis Report. Still another example is the FB-Line exhaust duct at Savannah River. A portion of this duct passes through the F-Canyon Exhaust Tunnel and is under more negative pressure than the tunnel. The FB-Line exhaust in the F-Canyon Exhaust Tunnel is downstream of its filtration devices, whereas the tunnel exhaust is upstream of its filtration device. Any leakage into the FB-Line exhaust could thus lead to an unmitigated release path. When the exhaust line was recently tested for the first time, it showed a small leak. In conclusion, testing requirements for bypass leakage contained in DOE 6430.1A and ASME N510-1989 are not being followed.

E. Control Room Habitability

Protecting control room personnel so that they can adequately cope with an emergency situation without fear for their own safety is one unique aspect of plutonium facilities design. Section 1550-99.02 of DOE 6430.1A establishes some requirements for protection of control room personnel. This section states "Where places, such as a control room, are to be occupied during abnormal events, safety class filtration systems shall be provided on the air inlets to protect the occupants." Also, "stack location and height shall also consider intakes on the facility and adjacent facilities to preclude uptake." Since the presence of control room personnel is usually required to cope with off-normal conditions, control room ventilation systems should be provided as safety class filtration systems. Consequently, the ventilation systems should meet single failure and redundancy requirements and should be supplied with emergency power. The ventilation systems should be able to withstand natural phenomena and be operable during and after DBAs.

As previously noted, operators are not required to be present in the control room at LLNL Building 332 at all times. For the day shift, the operator may be in the video room monitoring station that has not been provided with a safety class filtration system.

This habitability requirement has also not been adequately taken into account at PF-4 at Los Alamos. At PF-4, the single ventilation intake for the control area is on the same side of the facility and in relative proximity to the discharge duct work. This presents an unnecessary potential for uptake to control area personnel—particularly when building wake effects are considered. This mode of entry to the control area filters has not been thoroughly analyzed in the Safety Analysis Report.

The control room habitability requirements of DOE 6430.1A are not being met in either of the above examples.

F. Elevated Release

Releasing hazardous material safely often requires an elevated discharge point. The design of an elevated discharge must take into account numerous different considerations. Some of these considerations are found in section 1550-99.0.2 of DOE 6430.1A for plutonium processing and handling facilities. This section states that "to limit on site doses and to reduce off site doses by enhancing atmospheric dispersion, elevated confinement exhaust discharge locations are required. The height of the exhaust discharge location shall ensure that the calculated consequences of normal or accidental releases shall not exceed the radiological guidance contained in Section 1300-1.4, 'Guidance on Limiting Exposure of the Public.' To the extent practical, all normal and accidental releases shall be maintained at ALARA levels." Additionally, "an elevated stack shall be used for confinement discharge. Provisions shall be made to ensure an adequate ventilation exhaust path in the event of stack failure. The stack shall be located so that it cannot fall on the facility or an adjacent facility containing safety class items. The alternative is the construction of a stack that shall remain functional following a [Design Basis Earthquake] DBE, severe natural phenomena, and man-made events. Stack location and height shall also consider intakes on the facility and adjacent facilities to preclude uptake." Additional criteria on elevated releases may be found in the Assumptions Used for Evaluating the Potential Radiological Consequences of Accidental Nuclear Criticality in a Fuel Reprocessing Plant, Nuclear Regulatory Commission's Regulatory Guide 3.33, out for comment in April 1977. This guide is referenced under a "shall consider" statement in DOE 6430.1A. Section C.4 states in part that "Credit for an elevated release should be given only if the point of release is (1) more than two and one-half times the height of any structures close enough to affect the dispersion of the plume, or (2) located far enough from any structure that could have an effect on the dispersion of the plume. For these plants without stacks, the atmospheric diffusion factors assuming ground level releases should be used," and "Elevated releases should be considered to be at a height equal to no more than the actual stack height. Certain site-dependent conditions may exist that will have the effect of reducing the actual stack height, e.g., elevated topography or nearby structures. The degree of stack height reduction should be evaluated on an individual case basis."

These considerations for accepting elevated releases during DBAs have been commonly applied to the commercial nuclear industry for at least 25 years. As stated, the two and one-half height rule is to prevent the wake effects of nearby buildings from capturing the plume and bringing it down towards ground level. The release height no higher than the physical height of the stack is to prevent an overestimation of the dispersion from a relatively heated exhaust. Since thermal inputs cannot be guaranteed, they are not taken into account.

At Savannah River, separate stacks are used for the plutonium processing and handling facilities in the H-area and F-area. Each stack serves the canyon and the B-Line for its area. Each is a freestanding structure separate from the facility it serves, but does not meet today's seismic standards. At the PFP facility, the stack is quite similar to the Savannah River type stacks, and it also does not meet today's seismic standards.

PF-4 and CMR at Los Alamos have no real stacks, merely extended duct work above the building roof line. In the case of PF-4, the duct work extends some ten to fifteen feet above the roof and, as previously noted, is located on the same side of the building as the control area ventilation intake. The site boundary dose calculations estimate that this release point contributes approximately a factor of ten reduction at the site boundary dose. No consideration was presented for the special topographic features of the facility. The LANL administrative area sits uphill from the PF-4 discharge and, if taken into account, it would reduce the effective stack height for discharge.

There appears to be very little guidance, and less control, on how to take stack height assumptions into account for an elevated discharge at the DOE plutonium facilities during DBAs. As a result, the requirements for the effective discharge stack height and the location of intakes on the facility and adjacent facilities are not always being met.

G. Site Boundary Considerations

The location of the general public relative to the discharge from a plutonium facility can greatlly influence the selection of removal mechanisms (ventilation systems) used for the public protection. DOE 6430.1A addresses potential public radiation exposure in several places. First, Section 0200 states: "Radiation dose to an off-site individual receiving maximum exposure shall be evaluated . . ." and ". . . the off-site individual receiving the maximum dose shall be assumed to be located at the point of highest concentration (or highest exposure rate) outside the boundary controlled by the site . . . . The dose assessment shall consider both the duration of the event, and, consistent with emergency response capability to control or evacuate individuals, the duration of the exposure. The duration of the exposure should not exceed two hours . . ." and ". . . . The maximum calculated dose shall not exceed 25 rem to the whole body . . . . These requirements apply to the siting of all non-reactor facilities."

Section 1300 provides additional guidance on limiting the exposure of the public from special facilities such as plutonium processing and handling facilities. In part, Section 1300-1 states: "The design of special facilities shall . . . protect the public and facility personnel from hazards associated with the use of radioactive and other hazardous materials as a result of normal operations, anticipated operational occurrences, and DBA conditions, including the effects of natural phenomena pertinent to the site, . . . maintain these effects ALARA . . . , and "minimize exposures of personnel and the general public to hazardous materials by emphasizing ALARA concerns during all design, construction, and operational phases of special facilities." It further states that: "the confinement of hazardous materials produced, processed, or stored in special facilities shall be designed to minimize dose to a maximally exposed member of the public;" and "releases of hazardous materials postulated to occur as a result of DBAs shall be limited by designing facilities such that at least one confinement system remains fully functional following any credible DBA (i.e., unfiltered/unmitigated releases of hazardous levels of such materials shall not be allowed following such accidents). Facility design shall provide attenuation features for postulated accidents (up to and including DBAs) that preclude off-site releases that would cause doses in excess of the DOE 5400 series limits for public exposure. To the extent practical, ALARA concepts shall be applied when designing special facilities to mitigate post-DBA releases of hazardous materials." Additionally, Section 1300-3.2 states: "safety class items are systems, components, and structures, including portions of process systems, whose failure could adversely affect the environment or the safety and health of the public. Specifically, safety class items are those systems, components, and structures whose failure would produce exposure consequences that would exceed the guidelines in Section 1300-1.4, Guidance on Limiting Exposure of the Public, at the site boundary or nearest point of public access."

As previously noted, the glossary to DOE 6430.1A defines confinement as the structure plus its associated ventilation systems. Also, it should be noted that Section 1300 limits public exposure to less than 100 millirems (by the reference to the 5400 series of Orders) during credible postulated DBAs at the point of nearest public access, and that unmitigated releases are not allowed. This number should not be confused with the 25 rem cited above which is used for site suitability. The glossary of DOE 6430.1A defines the Point of Nearest Public Access as the "Location inside or outside the site boundary where a member of the public could legally be (e.g., visitor center or public highway) without the specific knowledge of the owner or operator." It should also be noted that many sites allow public access on roads through the sites. Section 1300 of DOE 6430.1A requires that such individuals be considered for dose assessment "at the point of nearest public access." Under Section 0200, the public must be considered in the emergency plans for the facility.

Typically, SARs for plutonium handling and processing facilities address the site boundary dose assessment required by Section 0200-1.2, Radiological Siting Requirements, of DOE 6430.1A. This dose assessment evaluates the off-site individual receiving the maximum dose at the point of highest concentration outside the boundary controlled by the site.

What is typically not addressed or poorly addressed is the potential public exposure at the "nearest point of public access" as required by Sections 1300-1.4.2 and 1300-3.2 of DOE 6430.1A. Examples include the parking lot and public road in front of PF-4 at Los Alamos, the public walkway (within tens of feet) and public road in front of CMR at Los Alamos, the public access roads at Savannah River and Hanford, and the publicly accessible parking lots at Lawrence Livermore.

The limit of 100 millirems contained in Section 1300-1.4.2 of DOE 6430.1A (by reference to the 5400 series of Orders) was not being applied by any of the facilities reviewed. No deviations or exemptions have been filed with DOE Headquarters.

On the following page is Table 1, a summary of the ventilation problems noted in the text of this report and in Appendix D. Two trends are noteworthy. For the facilities and requirements listed, LANL has the greatest number of problems noted. On the requirements side, lack of bypass leakage testing stands out. An adequate and timely Order compliance assessment of DOE 6430.1A in response to the Board's Recommendation 90-2 should resolve many of these problems.

Table 1. Summary Facilities and Requirements Matrix

X = Problems Noted; NR = Not Reviewed; For details of problems noted, see either the text or Appendix D

IV. MANAGEMENT ISSUES

A. Order Compliance

The DOE 6430.1A requirements are used as the basis for the reviews discussed in this report. A review of the older AEC 6301 and NRC 3.12 (truncated versions of which appear in Appendices B and C) reveals that they all are fairly consistent in their requirements. NRC 3.12 specifically applies to commercial plutonium processing facilities.

DOE 6430.1A contains a process that allows for the controlled deviation from the Order's requirements. This process calls for the submittal of certain deviations to DOE Headquarters for approval. Generally, this review discovered that approvals for deviations are not being requested. Though, in a few instances, deviations were requested and approved by the local DOE office. These practices are not in compliance with DOE 6430.1A requirements.

The lack of compliance with the requirements of DOE 6430.1A (i.e., round-the-clock staffing, redundancy, emergency generators, testing, control room protection, stack height considerations, and consideration of public proximity) represent a serious weakness in safety practices at plutonium facilities. In addition, it appears that there is no organization within DOE responsible for assuring compliance with DOE 6430.1A and ensuring uniform practices across the complex. The Order compliance assessments implemented by DOE in response to the Board's Recommendation 90-2 need to be started, accelerated if started, and maintained current for these plutonium facilities.

B. Configuration Management

The configuration of ventilation systems at DOE plutonium facilities has changed over the years. However, DOE plutonium facilities cannot show continuing conformance, or approved deviation, to a given requirement in either DOE 6430.1A or its predecessors. Additionally, the requirement to apply the criteria in DOE 6430.1A to ventilation system modifications is not being followed. This lack of a controlled ventilation system design/configuration for DOE plutonium facilities increases the risk of operating these facilities.

C. Technical Oversight

DOE's predecessors, the AEC and the Energy Research and Development Agency (ERDA), were preeminent in the field of nuclear air cleaning. ERDA 76-21, the Nuclear Air Cleaning Handbook, was at the forefront of nuclear air cleaning technology and replaced its predecessor published five years earlier. Today, these capabilities are greatly diminished and there does not appear to be any real effort within DOE to develop these technical capabilities. For example, the revision of ERDA 76-21 has been underway for more than ten years, but is still not complete. Additionally, the recent retirement of a key individual at DOE associated with nuclear air cleaning has left a void in addressing technical issues associated with filtration systems.

DOE has recently completed an analysis of data in the Occurrence Reporting and Processing System (ORPS) database, Ventilation Systems at Department of Energy Facilities (May 1994). This review noted three generic programmatic deficiencies: (1) insufficient/ improper maintenance and testing, (2) procedural deficiencies, and (3) inadequate management of wear out/aging. The present evaluation is not in conflict with the DOE findings. However, many of the noncompliances with DOE 6430.1A previously discussed would not show up in ORPS unless they had evolved into a positive USQD or an accident occurrence. Database reviews can be useful, but they are not a substitute for detailed technical oversight during all phases of a facility's life cycle. In conclusion, DOE's technical oversight is weak and needs improvement.

V. CONCLUSIONS

Historically, the ventilation requirements for plutonium facilities contained in DOE 6430.1A are in reasonable agreement with its predecessors, the AEC 6301 and the NRC 3.12. These standards all assume the continuous operation of a confinement ventilation system before, during, and after a DBA. This means that the systems meet the redundancy, emergency power, and single failure requirements of the standards. Neither the application nor the maintenance of the requirements have been consistent as evidenced by the multitude of unique solutions that are outside the requirements. Deviations from Order requirements have not followed the prescribed procedure thus resulting in the perpetuation of unique unapproved solutions.

The above points to the lack of an effective administrative infrastructure within DOE that would ensure that the ventilation requirements for plutonium facilities have been and are being met. There is little or no system in place to ensure uniformity of application or deviations on an across-the-complex basis. There is little or no attempt to capture the history and keep it current, nor is there a system to oversee the uniform application of the requirements. This situation is not acceptable because it places the public and workers at increased risk. The Board issued Recommendation 90-2 concerning Order compliance. To obtain full compliance with DOE 6430.1A and resolve many of the problems identified in this report, the Order compliance assessments carried out in response to Recommendation 90-2 should be expedited.

Appendix A

DOE ORDER 6430.1A GENERAL DESIGN CRITERIA

Division 1

General Requirements

0101 CRITERIA PURPOSE AND APPLICATION

0101-1 GENERAL

These criteria provide mandatory, minimally acceptable requirements for facility design. The predominant model building code in the region shall govern on issues not covered in these criteria.

These criteria apply to any building acquisition, new facility, facility addition and alteration, and leased facility that is required to comply with DOE 4300.1B. This includes on-site constructed buildings, preengineered buildings, plant-fabricated modular buildings, and temporary facilities. For existing facilities, original design criteria apply to the structure in general; however, additions or modifications shall comply with this Order and the associated latest editions of the references herein.

0101-2 CRITERIA DEVIATIONS

Headquarters-level review and approval shall be required for deviations proposed for safety-class items (as defined in Section 1300-3.2, Safety Class Items, and determined by DOE 5481.1B) when such deviation will or may constitute an adverse impact on environmental protection, safety or health or other DOE design policies or objectives.

0101-3.2 "Shall" and "Shall Consider"

"Shall" in these criteria denotes a requirement.

"Shall consider" requires that an objective assessment be performed to determine to what extent the specified factor, criterion, guideline, standard, etc., will be incorporated into or satisfied by the design. The results and basis of this assessment shall be adequately documented. Such documentation shall be retrievable and can be in the form of meeting minutes, reports, internal memoranda, etc. Some sections of these criteria contain other documentation requirements.

Division 2

Site and Civil Engineering

0200 SITE DEVELOPMENT

0200-1 FACILITY SITING

0200-1.2 Radiological Siting Requirements

For those facilities in which radioactive materials are processed, used, or stored, or those facilities that incorporate radiation-producing machines, the acceptability of the site shall be evaluated in terms of potential radiological consequences. The accidents to be considered are those attributable to both operational events (determined by using a deterministic and/or a probabilistic approach) and natural phenomena as applicable to the facility and the site.

Radiation dose to an off-site individual receiving maximum exposure shall be evaluated. For both on-site and off-site individuals, emergency response planning shall be an important criterion in determining the acceptability of a site.

The off-site individual receiving the maximum dose shall be assumed to be located at the point of highest concentration (or highest exposure rate) outside the boundary controlled by the site. Meteorological conditions used in dose calculations shall be representative of unfavorable dispersion, determined by comparing the 0.5 percent dispersion factors (X/Q) for each sector to the five percent overall site X/Q and selecting the highest value. The dose assessment shall consider both the duration of the event and, consistent with emergency response capability to control or evacuate individuals, the duration of exposure. The duration of exposure should not exceed two hours. The dose calculated shall be compared to the numerical guidelines within 0200-1.2, Radiological Siting Guidelines.

0200-1.3 Radiological Siting Guidelines

The maximum calculated dose shall not exceed 25 rem to the whole body, 300 rem to the thyroid, 300 rem to the bone surface, 75 rem to the lung, or 150 rem to any other organ. If multiple organs receive doses from the same exposure, the effective dose equivalent from all sources shall not exceed 25 rem when calculated by using the ICRP Report No. 26 weighing factors.

1161-4 VENTILATION

A ventilation system shall be installed on all enclosure systems to maintain a minimum negative pressure differential of 0.3 in. of water inside the enclosure (except open-face hoods) with respect to the operating area. Safety class items of the ventilation system shall be supplied with emergency power. Failure of any single component or control function shall not compromise minimum adequate ventilation.

HEPA filters shall be provided at the interface of the enclosure outlet and the ventilation system to minimize the contamination of ductwork and at the enclosure inlet to prevent movement of contamination within the enclosure to the operating area in the event of a flow reversal. A roughing filter should be installed to reduce HEPA filter loading.

Division 13

Special Facilities

1300 GENERAL REQUIREMENTS

1300-1 COVERAGE AND OBJECTIVES

1300-1.1 Coverage

The criteria in this section of Division 13 (Section 1300, General Requirements) apply to all nonreactor nuclear facilities and to explosives facilities. Subsequent sections provide additional criteria that are applicable to specific types of nonreactor nuclear facilities and to explosives facilities. (Reactors and their safety systems shall be sited and designed according to DOE 5480.6.)

There may be some facilities for which these criteria are not sufficient and for which additional criteria must be satisfied in the interest of safety. Also, some criteria may be determined by safety analysis to be unnecessary or inappropriate for a specific facility. For facilities such as these, departures from the criteria shall be identified and justified. See Section 0101-2, Criteria Deviations.

Design criteria for nonreactor nuclear facilities and explosives facilities thus appear in three places:

• In the conventional sections of the other criteria divisions, e.g., Section 1550 provides criteria on HVAC systems that apply to all DOE facilities.
• In the -99.0, -99.1, and -99.4 sections of the non-Division 13 divisions, e.g., Sections 1550-99.0 and 1550-99.4 provide additional criteria on HVAC systems that apply only to nonreactor nuclear facilities and explosives facilities, respectively.
• In Division 13, e.g., special criteria that do not relate to the building systems and design specialties covered in the other criteria divisions.

1300-1.3 Objectives

The design of special facilities shall:

• Protect the public and facility personnel from hazards associated with the use of radioactive and other hazardous materials as a result of normal operations, anticipated operational occurrences, and DBA conditions, including the effects of natural phenomena pertinent to the site, and maintain these effects ALARA.

The design of new or modification of existing special facilities shall address the health hazards represented by all hazardous materials in enclosures, general work areas, and noncontaminated areas.

Protection of employees within the facility and at nearby facilities shall be a requirement in all aspects of the design. Protection shall be provided for normal operation and for those accidents that can be anticipated as occurring during the facility lifetime such as radioactive material spills and small fires controlled by the facility fire suppression system.

1300-1.4 Guidance on Limiting Exposure of the Public

1300-1.4.1 General

The confinement of hazardous materials produced, processed, or stored in special facilities shall be designed to minimize dose to a maximally exposed member of the public.

1300-1.4.2 Accidential Releases

Releases of hazardous materials postulated to occur as a result of DBAs shall be limited by designing facilities such that at least one confinement system remains fully functional following any credible DBA, i.e., unfiltered/unmitigated releases of hazardous levels of such materials shall not be allowed following such accidents. Facility design shall provide attenuation features for postulated accidents (up to and including DBAs) that preclude off-site releases that would cause doses in excess of the DOE 5400 series limits for public exposure. To the extent practical, ALARA concepts shall be applied when designing special facilities to mitigate post-DBA releases of hazardous materials.

1300-3 SAFETY CLASS CRITERIA

1300-3.1 General

Special facility components, systems, and structures shall be designed, fabricated, erected, and tested to standards and quality commensurate with the hazards and potential consequences associated with both the facility and the role of each component, system, and structure in mitigating the consequences of DBAs.

1300-3.2 Safety Class Items

Safety class items are systems, components, and structures, including portions of process systems, whose failure could adversely affect the environment or the safety and health of the public. Specifically, safety class items are those systems, components, and structures with the following characteristics:

• Those whose failure would produce exposure consequences that would exceed the guidelines in Section 1300-1.4, Guidance on Limiting Exposure of the Public, at the site boundary of nearest point of public access.
• Those required to achieve and maintain the facility in a safe shutdown condition.

1300-3.3 Single Failure Criterion and Redundancy

The design shall ensure that a single failure (see glossary) does not result in the loss of capability of a safety class system to accomplish its required safety functions. To protect against single failures, the design shall include appropriate redundancy and shall consider diversity to minimize the possibility of concurrent common-mode failures of redundant items.

1300-3.6 Testing

The design shall include provisions for periodic testing of monitoring, surveillance, and alarm systems. In addition, the design shall provide the capability to test periodically, under simulated emergency conditions, safety class items that are required to function under emergency conditions.

All systems for which credit is taken to meet the criteria of Section 1300-1.4.2, Accidental Releases, shall be in-place testable in terms of pressure, filtration or removal efficiency, alarm capability, leak resistance, and the like. Safety class items shall be designed to be testable on a regular schedule.

The facility design shall allow for routine in-place testing of HEPA filtration systems as outlined by ASME N510.

1300-7 CONFINEMENT SYSTEMS

1300-7.1 Objectives

Confinement systems shall accomplish the following:

• Minimize the spread of radioactive and other hazardous materials within the unoccupied process areas
• Prevent, if possible, or else minimize the spread of radioactive and other hazardous materials to occupied areas
• Minimize the release of radioactive and other hazardous materials in facility effluents during normal operation and anticipated operational occurrences.
• Limit the release of radioactive and other hazardous materials resulting from DBAs including severe natural phenomena and man-made events in compliance with the guidelines contained in Section 1300- 1.4.2, Accidental Releases.

1300-7.2 General

Confinement capabilities, including confinement barriers and associated ventilation systems, shall maintain a controlled, continuous airflow pattern from the environment into the confinement building, and then from noncontaminated areas of the building to potentially contaminated areas, and then to normally contaminated areas.

The number of confinement systems required in different locations of a facility may vary depending on the potential consequences from hazards during normal operation, anticipated operational occurrences, and DBAs. although individual confinement systems are not required to withstand the effects of every accident, they shall effectively perform their required functions for the DBAs they are required to withstand. Sufficient redundancy shall be provided in the unlikely event of a confinement system failure. At least one of the confinement systems shall be designed to ensure that it can withstand the effects of severe natural phenomena and man-made events (see Section 0111-99.0, Nonreactor Nuclear Facilities - General), including the postulated DBAs and DBF initiated by these events, and remain functional to the extent that the guidelines of Section 1300-1.4.2, Accidental Releases, are not violated. The adequacy of the design of these confinement systems to effectively perform their required functions shall be demonstrated by the safety analysis.

1304 PLUTONIUM PROCESSING AND HANDLING FACILITIES

1304-1 COVERAGE

Section 1300, General Requirements, shall apply. The requirements of Section 1300 are in addition to the requirements of that section and other applicable sections of these criteria, particularly those sections numbered -99.0, Nonreactor Nuclear Facilities - General.

PPHFs include facilities principally dedicated to processing and handling plutonium in substantial quantities, e.g., to be used in nuclear explosives production, nuclear reactor fuel assemblies, or heat source packages.

1304-2 OBJECTIVES

The design objective shall be to ensure that conservatively estimated consequences of normal operations and credible accidents are limited in accordance with the guidelines contained in Section 1300-1.4, Guidance on Limiting Exposure of the Public.

1304-5 SPECIAL DESIGN FEATURES

In general, only hazardous gases or liquids that are necessary for a process shall be used in PPHFs. no natural gas for heating purposes shall be used unless the heating occurs in a separate building that is clearly isolated form the primary facility.

Exhaust ventilation systems shall be provided with HEPA filtration to minimize the release of plutonium and other hazardous material through the exhaust path. In addition, intake ventilation systems shall also be provided with either HEPA filtration or fail-safe back flow prevention to minimize the release of plutonium and other hazardous material through the inlet path. Additional requirements and guidance are provided in Section 1550-99, Special Facilities.

The design professional shall consider the criteria presented in the following guides for applicability to PPHFs:

• Regulatory Guide 3.12

1304-6 CONFINEMENT SYSTEMS

1304-6.1 General

The following provisions shall be considered as typical for a PPHF confinement system. The actual confinement system requirements for a specific plutonium facility shall be determined on a case-by-case basis.

Generally, three confinement systems are used to achieve the confinement system objectives at PPHFs. They consist of the following:

• Primary confinement. Primary confinement is provided by piping, tanks, glove boxes, encapsulating material, and the like, and any off-gas system that controls effluent from within the primary confinement. It provides confinement of hazardous material to the vicinity of its processing.
• Secondary confinement. Secondary confinement is provided by walls, floors, roofs, and associated ventilation exhaust systems of the cell or enclosure surrounding the process material or equipment. Except in the case of glove box operations, the area inside this barrier is usually unoccupied; it provides protection for operating personnel.
• Tertiary confinement. Tertiary confinement is provided by the walls, floor, roof, and associated ventilation exhaust system of the facility. It provides a final barrier against release of hazardous material to the environment.

Which (if not all) of several barriers shall be designed to withstand a particular DBA shall be determined on a case-by-case basis. For example, the cell structure may be a more appropriate barrier than the process vessels in the instance of the DBE.

The effectiveness of each confinement barrier shall be checked analytically against all challenges it is expected to withstand without loss of function.

1550-99 SPECIAL FACILITIES

1550-99.0 Nonreactor Nuclear Facilities - General

1550-99.0.1 General Ventilation Criteria

These criteria cover ventilation that are classified as safety class items in accordance with Section 1300-3.2, Safety Class Items. Safety class ventilation systems are generally designed to operate in conjunction with physical barriers to form a confinement system to limit the release of radioactive or other hazardous material to the environment and to prevent or minimize the spread of contamination within the facility.

Ventilation systems shall be designed to provide a continuous airflow pattern from the environment into the building and then from noncontaminated areas of the building to potentially contaminated areas and then to normally contaminated areas. Thus, the airflow is toward areas of higher radioactive or hazardous material contamination. Dampers shall be located so that cross-contamination will not occur in case of a localized release of material.

Ventilation system balancing shall be specified to ensure that the building air pressure is always negative with respect to the outside atmosphere.

Portions of ventilation systems that provide required functions following a seismic event shall be designed to be functional following a DBE.

The use of down draft ventilation within occupied process areas shall be considered as a means to reduce the potential inhalation of contamination.

The failure of ventilation systems not designed as safety class systems shall not prevent other facility safety class systems from performing their required safety functions.

Components of ventilation systems that require electric power to perform their safety functions shall be considered safety class loads.

Adequate instrumentation and controls shall be provided to assess ventilation system performance and allow the necessary control of system operation.

Equipment in ventilation systems shall be appropriately qualified to ensure reliable operation during normal operating conditions, anticipated operational occurrences, and during and following a DBE.

1550-99.0.2 Confinement Ventilation Systems

The design of a confinement ventilation system shall ensure the ability to maintain desired airflow characteristics when personnel access doors or hatches are open. When necessary, air locks or enclosed vestibules shall be used to minimize the impact of this on the ventilation system and to prevent the spread of airborne contamination within the facility. The ventilation system design shall provide the required confinement capability under all credible circumstances with the addition of a single failure in the system.

If the maintenance of a controlled continuous confinement airflow is required, electrical equipment and components required to provide this airflow shall be supplied with safety class electric power and provided with an emergency power source.

Air cleanup systems shall be provided in confinement ventilation exhaust systems to limit the release of radioactive or other hazardous material to the environment and to minimize the spread of contamination within the facility as determined by the safety analysis. The following general cleanup system requirements shall be met, as appropriate, for ventilation system design:

• An elevated stack shall be used for confinement exhaust discharge. Provisions shall be made to ensure an adequate ventilation exhaust discharge path in the event of stack failure. The stack shall be located so that it cannot fall on the facility or an adjacent facility containing safety class items. The alternative is the construction of a stack that shall remain functional following a DBE, severe natural phenomena, and man-made events. Stack location and height shall also consider intakes on the facility and adjacent facilities to preclude uptake.
• Safety class air filtration units shall be designed to remain functional throughout DBAs and to retain collected radioactive material after the accident.
• The number of air filtration stages required for any area of a facility shall be determined by safety analysis based on the quantity and type of radioactive materials to be confined.
• Air filtration units shall be installed as close as practical to the source of contaminants to minimize the contamination of ventilation system duct work .
• Ducts shall be sized for the transport velocities needed to convey, without settling, all particulate contaminants.
• The cleanup system shall have installed test and measuring devices and shall facilitate monitoring operations, maintenance, and periodic inspection and testing during equipment operation or shut down, as appropriate.

In facilities where plutonium or enriched uranium is processed, the following additional requirements shall be met:

• Wherever possible, the designer shall provide enclosures for confining the process work on plutonium and enriched uranium.
• A safety analysis under DOE direction shall establish the minimum acceptable performance requirements for the ventilation system and the response requirements of system components, instrumentation, and controls under normal operations, anticipated operational occurrences, and DBA conditions.
• If advantageous to operations, maintenance, or emergency personnel, the ventilation system shall have provisions for independent shutdown. Shut down of a ventilation system under such conditions shall be considered in light of the effects on air flows in other interfacing ventilation systems. When a system is shut down, positive means of controlling back flow of air to noncontaminated spaces shall be provided by positive shutoff dampers, blind flanges, or other devices.
• The supply air to enclosures that confine the processing of plutonium and enriched uranium shall be filtered by HEPA filters at the ventilation inlets to the enclosures and area confinement barriers to prevent the transport of radioactive contamination in the event of a flow reversal.
• If room air is recirculated, at least one stage of HEPA filtration shall be provided in the recirculation circuit.
• Ventilation system components and controls that require electric power to perform safety functions shall be supplied with a safety class UPS and/or emergency power supply as is determined to be required by a systems design/safety analysis.
• The number of required exhaust filtration stages to limit the quantity and concentration of airborne radioactive or other hazardous materials released to the environment from any area of the facility shall be determined by the safety analysis.
• Airborne contaminant cleaning systems shall be designed for convenient maintenance and the ability to decontaminate components and replace components in the supply, exhaust, and cleanup systems without exposure of maintenance or service personnel to hazardous materials. Filtration systems shall be designed so that a bank of filters can be completely isolated from the ventilation systems during filter element replacement.
• Where spaces, such as a control room, are to be occupied during abnormal events, safety class filtration systems shall be provided on the air inlets to protect the occupants. As a minimum, air inlets shall be filtered to limit the loading of exhaust filters with normal atmospheric dust.
• Either HEPA filtration or fail-safe back flow prevention for process area intake ventilation systems shall be provided.
• Consideration shall be given to providing roughing filters or prefilters upstream of a HEPA filter to maximize the useful life of the HEPA filter and reduce radioactive waste volume.

GLOSSARY

Confinement System. The barrier and its associated systems (including ventilation) between areas containing hazardous materials and the environment or other areas in the facility that are normally expected to have levels of hazardous materials lower than allowable concentration limits.

Credible Accident. Those accidents with an estimated probability of occurrence >10-6/year. Natural phenomena use separate probability criteria as stated in UCRL-15910.

Critical Facilities. Facilities such as those for radioactive material handling, processing, or storage and those facilities having high replacement value or vital importance to DOE programs.

Design Basis Accidents (DBAs). Postulated accidents or natural forces, and resulting conditions for which the confinement structure, systems, components and equipment must meet their functional goals. These safety class items are those necessary to assure the capability: to safely shut down operations, maintain the plant in a safe shutdown condition, and maintain integrity of the final confinement barrier of radioactive or other hazardous materials; to prevent or mitigate the consequences of accidents; or to monitor releases that could result in potential off-site exposures.

Emergency Power. DBA qualified and seismic category-I-qualified, fully redundant power generation, switching, and distribution system that meets the IEEE 1E criteria. It is designed to activate on loss of the normal power supply (or in the case of UPS systems, be on-line and is used to supply SC-1 items, components, and/or systems with power to allow them to maintain their safety class functions.

Emergency Power Systems. The auxiliary power systems that provide power to safety and security related equipment during periods of partial or total power failure of associated primary power system.

Engineered Safety Feature (ESF). Systems or design characteristics that are provided to prevent or mitigate the potential consequences of postulated design basis accidents. An engineered-safety-feature system is a safety class system.

High-Efficiency Particulate Air (HEPA) Filters. A high-efficiency particulate air filter having a fibrous medium that produces a particle removal efficiency of at least 99.97% for 0.3-micrometer particles of dioctylphthalate (DOP) when tested in accordance with MIL-STD-282.

Plutonium Processing and Handling Facility. Any facility constructed primarily to process plutonium (including Pu 238) and that handles substantial quantities of in-process plutonium where there is a possibility of a release of plutonium to the environs under normal operations or design basis accident conditions in excess of limits set forth in the directive on Radiation Protection of the Public and the Environment in the DOE 5400 series.

Point of Nearest Public Access. Location inside or outside the site boundary where a member of the public could legally be (e.g., visitor center or public highway) without the specific knowledge of the owner or operator.

Public Travel Route. Any public street, road, highway, or passenger railroad (including roads on DOE- controlled land open to public travel).

Safety Class (SC). Three levels that are assigned to items (components, systems, or structures) that must be designed to provide specific functions to protect operators, the public, or the environment. These levels are as follows:

SC-1: Provides function and/or structural integrity for mitigation of event severities up to and including DBAs:

SC-2: Provides function and/or structural integrity for mitigation of event severities up to and including OBAs.

SC-3: Provides function and/or structural integrity for mitigation of event severities up to and including UBC and those that are industrial safety related

Further description is contained in Section 1300-3.2, Safety Class Items.

Safety Class Item. Systems, components and structures, including portions of process systems, whose failure could adversely affect the environment or safety and health of the public. Determination of classification is based on analysis of the potential abnormal and accidental scenario consequences as presented in the SAR (as required by 5481.1B).

Single Failure. An occurrence that results in the loss of capability of a component to perform its intended safety function(s). Multiple failures, i.e., loss of capability of several components, resulting from a single occurrence are considered to be a single failure. Systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor, (2) a single failure of any passive component (assuming active components function properly) results in loss of the system's capability to perform its safety function(s).

Site Boundary. A well-marked boundary of the property over which the owner or operator can exercise strict control without the aid of outside authorities.

Standby Power. A reserve power generation or supply with switching devices that will supply power to selected loads in the event of a normal power failure. It is not required to have redundant equipment or to operate through events greater than UBC. A standby power system shall not be classified SC-1.

Appendix B

U.S. ATOMIC ENERGY COMMISSION

AEC MANUAL

Chapter 6301 General Design Criteria

6301-01 Policy

It is the policy of the AEC to incorporate quality, economy, safety, and sound practices in the design of AEC facilities.

6301-055 Deviations.

Deviations from criteria set forth in appendix 6301 shall be authorized by officials at Headquarters except when the design criteria are clearly inappropriate for components of production and technical facilities or when minor deviations are necessary and unavoidable due to the conditions under which the project is being performed.

PART 1

BASIC DESIGN

SECTION A. APPLICATION, OBJECTIVES, PLANNING, AND

SPECIAL REQUIREMENTS

1. Application and Objectives. This appendix contains general design criteria to be followed in the performance of engineering design for AEC buildings and facilities. The criteria cover some types of buildings and facilities in more detail than others where it has been found that thorough knowledge of design requirements is not widespread.

a. The criteria are applicable to the design of new buildings and facilities, including turnkey and preengineered types, and to the design of modifications and additions to existing buildings and facilities.

b. This part I contains the basic design criteria, including the basic codes and standards, applicable to the architectural and engineering design disciplines for buildings and facilities. Part II contains criteria for specific types of buildings and facilities. Part III contains criteria for outside utilities. Part IV contains criteria for protective construction and personnel shelters. Specific codes, standards, and requirements are contained in parts II, III, and IV.

In the application of this appendix, the criteria are to be used as a whole since individual parts are not necessarily complete in themselves.

Part III: BUILDINGS AND FACILITIES DESIGN

SECTION I. PLUTONIUM FACILITIES

1. Coverage. These criteria establish minimum requirements for design of new plutonium facilities handling substantial quantities of in-process plutonium.

2. Objectives. The objectives of these criteria are to assure that the design of the facility will:

a. Protect the public and operation personnel from hazards associated with normal plutonium operations or design basis accident (DBA) conditions, including the effects of natural phenomena pertinent to the site.

3. Definitions.(For purposes of these criteria)

a. Confinement Area - the structure or system from which releases of plutonium are controlled.

b. Critical Area - any area handling plutonium where the plutonium could be accidently dispersed and cause exposures to either operating personnel or to the public.

c. Critical Items - those structures, systems, equipment, and components whose continued integrity and/or operability are essential to assure confinement are essential to assure confinement of radioactive materials in the event of a DBA. Critical items shall be capable of performing required safety functions.

d. Design Basis Accidents (DBA's) - the postulated accidents and resulting conditions for which the confinement structure, systems, and equipment must meet their functional goals.

i. Facility Boundary - the fence which surrounds and prevents uncontrolled access to the facility or facilities.

j. Fail-safe - a unit or system which in the event of a failure of its services will move to its safe position and remain safe.

k. Operating Area Compartment - an area or series of areas which contain enclosures, and/or their attendant equipment located within that area or series of areas. The compartment shall have a separate ventilation system to assure adequate flow of air in the event of a credible breach in the compartment. The walls of the compartment shall be firewalls of a rating adequate for the DBF.

m. Plutonium Facility - any facility constructed primarily to process plutonium (including Pu-238) and which handles substantial quantities of in-process plutonium where there is a possibility of a significant release of plutonium to the environs under normal operations or DBA conditions.

n. Site Boundary - the perimeter of the AEC-controlled land in which the facility is contained.

5. Site Evaluation and Studies. Site evaluation and studies shall be conducted using the guidelines of appendix 6203.

Site evaluation and studies necessary to provide the technical basis for location, design, and operation (under normal operations and DBA conditions) of the facility shall include but not be limited to the items shown below. In addition, appropriate consideration shall be given to long-term as well as immediate consequences of releases, including ground decontamination.

a. Location

1.Determination of Location. In evaluating sites from the standpoint of hypothesized accidental releases, consideration shall be given on a case-by-case basis to the approach of 10 CFR 100 (see appendix 0550). The releases assumed for such calculations shall be based upon a major accident hypothesized for purposes of site analysis or postulated from consideration of possible accidental events that would result in potential hazards not exceeded by those from any accident considered credible. Dose guidelines comparable to those of 10 CFR 100 should be used for the purpose of such analyses (i.e., 150 rems bone, 25 rems whole body, 300 rems thyroid, and 75 rems for all other organs). Lifetime dose commitments shall be used.

b. Meteorology. All available meteorological data shall be evaluated. At a minimum, at least one year of valid meteorological data (windspeed, direction, and stability) shall be used to properly develop estimated joint frequency distribution of windspeed and stability conditions. These data shall be used to estimate dispersal of effluents under normal and accident conditions.

c. Hydrology. Site studies shall be performed to determine ground water levels, precipitation, flooding runoff, drainage, etc.

6. Plant Features

a. Facility Design

1.General. Critical items of the structure and its critical equipment and systems (ventilation, electrical, fire protection, and utility systems) shall be designed to provide confinement of radioactive materials under normal operations and DBA conditions. The degree of confinement of radioactive materials shall be sufficient to limit releases to the environment to the lowest practicable level. In no case shall the applicable exposure regulations be exceeded, either with respect to the operating personnel, or to the public at the boundary. Consideration shall be given to the probability and effects of DBA's. Protection of employees within the facility shall be a consideration in all aspects of the design. Consideration shall also be given to the isotopes of plutonium to be handled.

e. Ventilation

1.General

(a) Ventilation systems shall be designed to confine radioactive materials under normal and DBA conditions and to limit radioactive discharges to a practicable minimum.

Utilization of recycle ventilation systems shall be considered.

(b) During normal operation, ventilation supply air shall flow from nonradioactive zones to moderately radioactive zones, to highly radioactive zones. The design of ventilation systems shall assure that, in normal operation, proper airflows are maintained at all times.

(c) The number of required exhaust filtration stages from any area of the facility shall be determined by analysis to limit quantities and concentrations of airborne radioactive or toxic materials released to the environment during normal and accident conditions, in conformance with applicable standards, policies, and guidelines. Roughing filters and/or enclosure prefilters are not considered to be a radioactive particulate filtration stage, but their use shall be considered to avoid needless dust loading and plugging of HEPA filters.

(d) The principle of compartmentalization shall be employed to limit the extent of contamination and minimize loss of productivity and property in the event of a DBA.

(e) Use of downdraft ventilation within enclosures shall be considered as a means of reducing fire and contamination spread potential.

2.Ventilation Requirements

(a) Room supply air shall be appropriately conditioned commensurate with operational requirements.

(b) A partial recirculating ventilation system shall be considered for economic and safety reasons; however, such systems shall be designed to preclude the entry into room air recirculating system.

(c) Critical items of the ventilation system and the related fire suppression and detection system shall be supplied with emergency power. Controls for these systems shall be supplied with uninterruptible emergency power.

(d) Sufficient redundancy and/or spare capacity shall be provided to assure adequate ventilation during normal operations and DBA conditions.

(e) Failure of any single component or control function shall not compromise minimum adequate ventilation.

(f) The exhaust system shall be designed to provide cleanup of radioactivity and noxious chemicals of the discharge air and as stated in 8., below.

(g) Design of the system shall include an analysis to assure that the ventilation system is capable of operating under DBF conditions. It should be designed to assure, to the maximum extent practicable, that products of combustion are not spread beyond the room of origin unless directed through appropriate ventilation channels safely.

(h) Provisions shall be made for independent shutdown of ventilation systems where this could possibly be an advantage to operations, maintenance, or emergency procedures, such as firefighting.

(i) A HEPA shall be installed as close as practical to the source of contaminants in the enclosure to minimize the contamination of ductwork. A roughing filter shall be installed to reduce high efficiency filter loading. These provisions are not to be construed as the first stage of the airborne contamination cleaning systems.

(j) The filtration systems shall be designed to allow reliable in-place testing of the high efficiency filters and ease of filter replacement to the maximum extent practicable.

3.Ventilation Systems

(a) In design of the filtration system, consideration shall be given to such items as prefilters, scrubbers, process vessel vent systems, HEPA filters, sand filters, glass fiber filters, demisters, distribution baffles, fire suppression systems, heat removal systems, pressure and flow measurement devices, and a drain system including tanks to prevent the formation of an unsafe geometry when water is used in fire suppression activities.

(b) Supply air shall be appropriately filtered.

(c) The ventilation system and associated fire suppression system shall be designed for fail-safe operations.

(d) The ventilation system shall be appropriately instrumented and alarmed (with readouts in control areas located in the utilities services area for the facility) to report and record its behavior.

(e) Consideration shall be given to both automatic and manual controls to alter system operation during unusual conditions.

(f) Provision shall be made for maintenance and/or replacement of components in the supply, exhaust, and filtration system.

h. Contamination Confinement. Primary contamination confinement shall be the process enclosures and their ventilation system; secondary confinement shall be the operating area compartments and their ventilation system; and the tertiary confinement shall be the structure and its ventilation system.

7. Utilities

a. General. The design of utility services shall provide reliability consistent with operational requirements, value, and potential hazard for all probable conditions. Utility systems essential to the support of critical areas of the plutonium facility shall be designed to the same integrity as the critical areas of the facility which they serve.

f. Electric Utilities

3.Emergency Power. The emergency power source shall be completely independent of both the preferred and alternate primary feeders. This power source shall start automatically in the event both preferred and alternate sources fail. The emergency power source shall have adequate capacity to carry those loads which are necessary to maintain the integrity of the facility, and provide for personnel safety.

16. Requests for Deviations from these Criteria

a. Conformance to these minimum design criteria for new plutonium facilities is mandatory, unless Headquarters' approval 's approval is obtained for deviation. In special cases where, for technical and/or other overriding reasons, certain portions of the criteria cannot be met, a request for deviation shall be submitted to the Director, Division of Construction in accordance with chapter 6301-035 b.(1). Copies of the request for deviation shall be furnished to the appropriate program division director and to the Director, Division of Operational Safety. Headquarters' authorization procedures are contained in chapter 6301-032c.

b. The same request and approval procedures, described in a., above, apply to deviations from exhibit 1 and exhibit 2, tornado design requirements, as described in 6.a.2.(a)., above.

Appendix C

REGULATORY GUIDE 3.12

GENERAL DESIGN GUIDE FOR VENTILATION SYSTEMS

OF PLUTONIUM PROCESSING AND FUEL FABRICATION PLANTS

INTRODUCTION

At plutonium processing and fuel fabrication plants, a principal risk to health and safety is the release and dispersal of radioactive materials. The prevention of such release and dispersal is an important function of the ventilation systems. Ventilation systems are important to safety because they serve as principal confinement barriers in a multiple confinement barrier system which guards against the release of radioactive or other potentially dangerous materials during normal or abnormal conditions. Ventilation systems will be subject to effects of natural phenomena such as seismic motion and floods, missiles, fire and explosion, and other accidents.

The systems must continue to perform their safety functions effectively under all conditions by confining radioactive or other potentially dangerous materials. The continuity of necessary ventilation can be assured by means such as standby equipment and fail-safe control systems. The ability of the systems to perform their safety functions effectively can be assured by periodic testing of safety-related components during normal operation.

GENERAL SAFETY

• The ventilation systems of a plutonium processing and fuel fabrication plant should assure the confinement of hazardous materials during normal or abnormal conditions including natural phenomena, fire, and explosion.
• The ventilation systems should confine radioactive materials within the process areas as close to the point of origin as practicable. Confinement of radioactive materials should be provided by multiple zones.
• Pressure differentials should be maintained between building confinement zones and also between the building confinement zones and the outside atmosphere to assure that air flow is from zones of lesser potential for contamination to zones of greater potential for contamination.
• All ventilation systems should be designed so that the failure of any one component (equipment or control device) will not affect the continuous operation of the ventilation systems. Ventilation systems and components should have fail-safe features with provision for alarm indication.
• On-site emergency power supply systems should be provided to operate the ventilation systems and components as well as other systems and components important to safety. Ventilation systems should be capable of operating, during normal power outage, at capacities required to maintain confinement of contaminants. The on-site emergency power sources and the electrical distribution circuits should have independence and testability to assure performance of their safety functions assuming a single failure.
• The ventilation systems should be designed to withstand any credible fire and explosion and continue to act as confinement barriers.
• Components of the ventilation systems should be designed to withstand the effects of earthquakes and remain functional to the extent that they will prevent the uncontrolled release of radioactive materials to the environment.

OCCUPIED AREA VENTILATION SYSTEMS

• Part of the Zone II or Zone III filtered air may be recirculated to reduce thermal loads. Recirculated air should be passed through two stages of fire-resistant HEPA filters in series before it is returned to Zone II or Zone III areas.
• A final filter plenum should have at lest two stages of fire-resistant HEPA filters in series. Final filtration systems incorporating high-efficiency filters other than HEPA filters and having equivalent efficiency and resistance to fire are also acceptable.
• The filtered air should be discharged to the environs through a stack of sufficient height to reduce close- in ground-level concentrations of radioactive or other potentially dangerous contaminants.

PROCESS VENTILATION SYSTEMS

• Air or inert gas should enter each ventilated glove box or process enclosure through at least one fire- resistant HEPA filter and be discharged through at least one fire-resistant HEPA filter to exhaust duct work leading to a final filter system. The inlet filter prevents any back flow of contaminants into the work areas, and the outlet filter minimizes contamination of the exhaust duct work.
• All process ventilation systems should have adequate capacity and appropriate controls to maintain at least 125 linear feet per minute inward air flow through the maximum credible breach and thereby prevent the escape of particulates.
• Air or inert gas from glove boxes or other process enclosures where wet chemical operations take place should be treated to protect the ventilation duct work, final filters, and filter plenums from exposure to wetting or deleterious chemical attack.

FANS

• Installed spare fans and isolation dampers should be provided for the supply air and exhaust air systems. When any one fan is inoperative in a system, a back-flow damper should automatically isolate the idle fan from the system. Standby fans should automatically start and have sufficient capacity to maintain minimum system air flow.
• Supply air fans should be interlocked with an exhaust air plenum pressure sensor to prevent supply fan operation unless the exhaust fans are running. This will prevent pressurization of any process room or area should exhaust ventilation fail. Emergency power should be supplied to fans in the event of failure of the normal power supply.

VENTILATION SYSTEM CONSTRUCTION AND LAYOUT

• Ducts and housings should be designed, fabricated, and erected with a minimum of ledges, protrusions, and crevices that could collect dust and moisture or that could impede personnel or create a hazard in performance of their work. Duct runs and flow distributors should assure uniform, representative air flow past monitoring and sampling stations as well as through filter installations.
• The design should permit convenient inspection, maintenance, decontamination, and/or replacement of critical components such as filters, fans, and dampers.
• The ventilation systems should be appropriately instrumented to read out and alarm in one or more central control areas. These areas should be designed to permit occupancy and actions to be taken to operate the ventilation systems safely during normal or abnormal conditions.

VENTILATION SYSTEM TESTING AND MONITORING

· All exhausting ducts and stacks which may contain plutonium contaminants should be provided with two monitoring systems: a continuous monitor [Continuous Air Monitoring System (CAMS)] and a fixed sampler. The probes for sampling purposes should be designed for isokinetic sampling and located to obtain representative samples. Each system should be connected to an emergency power supply. The continuous stack sampler should alert cognizant personnel through an audible and visual annunciator if the airborne radioactive effluents reach prescribed limits.

FILTRATION SYSTEMS

• Each exhaust filter housing should have a rigid mounting frame for the filter. The complete housing structure should have minimum leakage from outside to inside, inside to outside, or across the filter sealing barrier (exclusive of the filter).
• The filter access opening in these housings should permit filter removal and replacement with minimum exposure to personnel performing this task and with minimum release of contaminants outside of the housing.
• The filter housings should be equipped with necessary test ports to permit reliable in-place testing of all filter stages with dioctyl phthalate (DOP).
• Damper valves should be so located that a bank of filters can be completely isolated from the ventilation systems during filter replacement operations.
• A HEPA filtration system serving as a final means of effluent cleaning should have at least two stages of fire-resistant filters in series in a filter plenum. A heat removal system and a spark arrester should precede the first stage of filters.
• HEPA filter systems should be tested after filter installation using a "cold DOP" test. Acceptance should be based on an efficiency of 99.95% or better for DOP having a light-scattering mean diameter of approximately 0.7 microns. Regular in-place testing of both on-line and standby filter installations should be performed because of system deterioration that can take place even when the installations are not being used.
• Final filtration systems incorporating high-efficiency filters other than HEPA filters and having equivalent efficiency and resistance to fire are also acceptable.

Appendix D

FACILITIES AND REQUIREMENTS MATRIX

REFERENCES

1. The American Society of Mechanical Engineers, Testing of Nuclear Air Treatment Systems, ASME N510-1989, December 15, 1989.
2. C. A. Burchsted, et.al., Nuclear Air Cleaning Handbook, ERDA 76-21, 1976.
3. U.S. Atomic Energy Commission, AEC Manual, Chapter 6301, General Design Criteria, AEC6301- 01. CONS, February 7, 1973.
4. U.S. Atomic Energy Commission, Regulatory Guide 3.12, General Design Guide for Ventilation Systems of Plutonium Processing and Fuel Fabrication Plants, August, 1973.
5. U.S. Department of Energy, General Design Criteria, DOE Order 6430.1A, April 6, 1989.
6. U.S. Department of Energy, Office of Special Projects (DP-35), Operating Experience Review, Ventilation Systems at Department of Energy Facilities, May, 1994.
7. U.S. Nuclear Regulatory Commission, Regulatory Guide 3.32, General Design Guide for Ventilation Systems for Fuel Reprocessing Plants, issued for comment, September, 1975.