[DNFSB LETTERHEAD]

 

April l0, 2003

 

The Honorable Linton Brooks

Acting Administrator

of the National Nuclear Security Administration

U. S.  Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

 

Dear Ambassador Brooks:

 

The staff of the Defense Nuclear Facilities Safety Board (Board) recently observed significant deficiencies in the current safety bases for some of Lawrence Liver-more National Laboratory’s (LLNL) defense nuclear facilities (most notably the Plutonium Facility, Building 332).  The Department of Energy (DOE) has also identified many of these weaknesses and has directed LLNL to correct them.  In some cases, however, lack of vigorous DOE oversight has allowed these deficiencies to exist for years.  As such, DOE should ensure that these identified weaknesses are adequately addressed in a timely manner or establish appropriate compensatory measures until deficiencies are adequately addressed.

 

Additionally, the Board’s staff observed deficiencies related to maintaining mass limits for hazardous chemicals in non-nuclear facilities and the ability of nuclear facilities to accurately and effectively assess the potential adverse impacts posed by external hazards from non-nuclear facilities.  One non-nuclear facility was found to have more than twice its prescribed limit of a hazardous chemical.  This lack of vigilance in maintaining inventory limits and coordinating site-wide hazard assessments could result in higher than expected consequences or the existence of unanalyzed hazards.

 

The enclosed issue report provides additional details regarding these observations.  Given the significance and persistence of the identified deficiencies, it appears that further attention is necessary to ensure the complete and timely remediation of these weaknesses and the development of rigorous and comprehensive Documented Safety Analyses that fully comply with the requirements of Part 830 to Title 10 of the Code of Federal Regulations, Nuclear Safety Management.  Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests a report within 60 days of receipt of this letter that documents how DOE will resolve issues identified in the enclosed report.

 

Sincerely,

 

John T. Conway

Chairman

 

c:  The Honorable Jessie Hill Roberson

Mrs. Camille Yuan-Soo Hoo

Mr. Mark B. Whitaker, Jr.

 

Enclosure

 

 

---

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

 

Staff Issue Report

 

March 25, 2003

 

MEMORANDUM FOR:      J.  K.  Fortenberry, Technical Director

 

COPIES:                                 Board Members

 

FROM:                                   B. Broderick

 

SUBJECT:                             Hazard Assessment and Control at Lawrence Livermore National Laboratory

 

This report documents a review of hazard assessment and control at Lawrence Livermore National Laboratory (LLNL), conducted by members of the staff of the Defense Nuclear Facilities Safety Board (Board).  Staff members W. Andrews, F. Bamdad, B. Broderick, and J. Shackelford met with representatives of the National Nuclear Security Administration’s (NNSA) Livermore Site Office (LSO) and LLNL to discuss the content of safety basis documentation and implementation of controls at several defense nuclear facilities and selected non-nuclear facilities whose operations could potentially impact nuclear facilities.

 

Background.  Documented Safety Analyses (DSAs) that comply with the mandates of Part 830 to Title 10 Code of Federal Regulations, Nuclear Safety Management, are required to be submitted for applicable LLNL defense nuclear facilities by April l0, 2003 (October 10, 2003, for the Plutonium Facility, per NNSA extension).  In many cases, these DSAs will contain updated or revised hazard and accident analyses and associated modifications to the set of safety controls identified to address facility hazards.  With preparation of these documents being in various stages of development, the Board’s staff conducted a review of current safety basis documentation to serve as a baseline for the assessment of future DSAs, and to provide comments and observations relative to existing Safety Analysis Reports (SAR) (under which facilities are currently operated) that could prove beneficial in the generation of DSAs and subsequent annual updates.  The staff focused special attention on evaluating the following areas to support this objective:  existing hazard and accident analyses as they pertain to the derivation of hazard controls; the configuration, capabilities, and adequacy of structures, systems, and components (SSC) that figure prominently in the control schemes designed to prevent or mitigate postulated accident scenarios; and potential impacts on defense nuclear facilities that could result from hazards associated with the operation of LLNL’s non-nuclear facilities.

 

Potential Inadequacies in Existing Safety Bases at Nuclear Facilities.  The Board’s staff reviewed the current SARs for the Plutonium Facility (Building 332), the Hardened Engineering Test Facility (Building 334), and the Material Management Source Vault (Building 23lV), in addition to conducting walkdown assessments of safety-related SSCs employed in these facilities to prevent or mitigate accident scenarios.  Relevant observations are discussed below.

 

Building 332―The Board’s staff reviewed the current facility SAR and Technical Safety Requirements (TSRs), dated August 2002, and noted a number of inadequacies and weaknesses.  These inadequacies included postulated accident scenarios for which unmitigated consequences had been evaluated to exceed the off-site evaluation guidelines, but for which no safety-class controls had been identified.  Additionally, it was observed that in some cases, SSCs had been implicitly credited with performing a safety function, but had not been assigned a formal functional classification.  The staff also observed that support systems for some safety-class and safety-significant SSCs did not carry a functional classification commensurate with the classification of the SSCs they supported.  The following specific examples illustrate the issues identified by the staff:

 

• The hazard analysis for the unmitigated rupture and subsequent fire of a waste drum containing transuranic waste had resulted in consequence estimates that exceeded the off-site evaluation guidelines by a factor of 20.  However, no safety-class or safety-significant controls had been identified for this scenario.

 

• The fire suppression system for Building 332 had been functionally classified as safety class.  Water essential for the operation of this system was being provided by a combination of off-site sources that are not under direct LLNL control and an emergency water source housed in the facility basement.  Given the critical importance of preventing the development of tire-related accident sequences in this facility, it did not appear that all reasonable steps had been taken to understand, justify, and ensure the adequacy, in terms of reliability and availability, of the Building 332 fire suppression water supply.  In particular, the boundaries of this safety-class system are not well defined in current safety basis documentation.  Furthermore, the compressed air system that is necessary to provide the motive force for the emergency water source had not been functionally classified with respect to this important safety function.  The compressed air system also supported other safety-related features at the facility.

 

• The fire analysis had not developed an appropriate unmitigated analysis for a postulated fire in a certain area of Building 332 where the material at risk could far exceed that assumed in the generic unmitigated room fire scenario.  As a result, important safety controls may not have been identified.

 

These specific issues, as well as the staffs overall concerns regarding the safety basis, were communicated to NNSA and the contractor.  In many cases, the general concerns articulated by the staff had been identified by NNSA as weak or problematic areas in Building 332 safety bases dating as far back as January 1995.  However, many previously identified deficiencies continue to exist in the September 2002 SAR.  These deficiencies were numerous enough to prompt NNSA to establish 33 conditions of approval in its Safety Evaluation Report (SER), some as significant as directing the contractor to “completely redo the hazards analysis” to ensure that all hazards had been appropriately described and analyzed.  The SER sets the expectation that these conditions of approval are to be met in the forthcoming rule-compliant DSA.  However, the significance and persistence of these deficiencies suggest that increased vigilance may be warranted on the part of NNSA and the contractor to ensure that these weaknesses are corrected in a timely manner or that appropriate compensatory measures are established.

 

Building 231V―The staff reviewed the facility SAR dated November 2001, which designated Building 231V as a Hazard Category 3 nuclear facility, but identified no safety-significant SSCs to control facility hazards.  In its April 2002 SER, NNSA had approved the facility’s SAR with 10 conditions of approval, one of which directed the contractor to functionally classify the building’s structure, vault ventilation system (including fume hood exhaust and high-efficiency particulate air [HEPA] filters), and vault continuous air monitors as safety-significant SSCs.  In May 2002, the facility submitted and subsequently withdrew a nominally rule-compliant DSA that did not address important NNSA conditions of approval, including the functional reclassification of SSCs and the development of TSRs to protect these controls.  It appeared that NNSA had not adequately followed up to ensure that these required modifications were being implemented.  As a result, more than 10 months had elapsed without the necessary conditions of approval having been met and without reasonably assertive oversight having been exercised by NNSA.

 

Building 334―The staff reviewed the current Building 334 SAR, dated January 2000. Given the existing limitations on operations and material forms and quantities allowed in this facility, as mandated by the January 2000 SAR, it appeared that the current safety basis was adequate.  The staff noted, however, that thermal testing conducted in two specially engineered thermal chambers, one of the facility’s most hazardous operations, had ceased because of prohibitive budgetary and security constraints, yet the safety basis still allowed these operations to take place.  The contractor committed to formally precluding the use of thermal testing chambers while special nuclear material was present in the facility by instituting a TSR-controlled lockout-tagout administrative control in the forthcoming DSA.

 

Cognizance and Control of External Hazards.  The Board’s staff reviewed identified external hazards to nuclear facilities and walked down a number of non-nuclear facilities.  These included the Chemical and Material Science Isotope Laboratories (Building 151), the Microfabrication Laboratory (Building 153), and the Materials Fabrication Shop (Building 321).  The intent was to understand and evaluate the external hazards posed by accidents in these facilities to nuclear facilities.  The staff also reviewed the controls and protocols in place in these non-nuclear facilities to prevent or mitigate accidents that could affect nuclear facilities.

 

Inventory Control in Non-Nuclear Facilities―Hazard Analysis Reports (HARs) comprise the safety bases for non-nuclear facilities.  HARs set inventory limits for materials that could cause adverse chemical and toxicological impacts on nuclear facilities and codify processes designed to ensure that these inventory limits are satisfied.

 

The HAR for Building 153, dated January 2001, identified a mass limit of 15.87 lb for the amount of chlorine that could be stored in the facility.  In February 2003, it was discovered that the actual mass of chlorine in Building 153 was approximately 33 lb, and that this condition had existed even prior to the approval of the 2001 HAR.  Not only had the amount of chlorine exceeded the approved mass limit since the HAR’s inception, but nearly 40 separate inventory checks and continuous facility use of the laboratory-wide chemical inventory and tracking system, ChemTrack, had failed to identify this situation.

 

The prolonged chlorine over-mass condition in Building 153, as well as other recent inventory control-related occurrences, suggests that increased vigilance is required in non-nuclear facilities to ensure that consequences associated with an accident in one of these facilities would not exceed the expected severity and invalidate carefully developed emergency preparedness plans and procedures aimed at mitigating such adverse effects, including impacts on nuclear facilities.  The Building 153 event also demonstrates potential safety benefits that could be associated with the development or identification of a system better suited to the safety-related role of chemical inventory control and management than the currently employed ChemTrack system, which was not designed to serve this purpose.

 

Integration of Hazard Assessments―The Building 332 SAR identifies a chlorine release from the local Zone 7 water treatment plant as the most significant off-site, external chemical hazard to this facility.  The staff inquired as to whether a memorandum of agreement had been established with the owners of the treatment plant to ensure that personnel from LLNL and Building 332 would be notified in a timely manner should a chlorine release event occur.  However, managers and authorization basis personnel for Building 332 were unable to provide details relevant to this situation.  Upon further inquiry by the staff, the site fire chief indicated that the Zone 7 plant had altered its treatment process more than a year ago such that the facility no longer posed a threat to Building 332 or any other nuclear facility for which this external hazard may have been identified.  The lack of coordination and integration between hazard assessments in this example had resulted in an inefficient expenditure of resources to analyze and address a hazard that no longer existed.  In this instance, the lack of coordination had not degraded the completeness or conservatism of the existing analysis.  However, the staff noted that the lack of overall coordination at the site could result in undesirable consequences if a new hazard were introduced, and a similar lack of coordination and integration resulted in a failure to address the issue.