March 21, 1996 The Honorable Victor H. Reis Assistant Secretary for Defense Programs Department of Energy Washington, D.C. 20585-0104 Dear Dr. Reis: Since 1994 the Defense Nuclear Facilities Safety Board (Board) has been engaged in discussions with the Department of Energy (DOE) and the nuclear weapons laboratories on the subject of integrated safety management systems for the nuclear research and development (R&D) environment. On November 14-16, 1995, members of the Board's technical staff conducted a limited review of components of Lawrence Livermore National Laboratory's (LLNL) safety management system. The Board is providing the enclosed trip report from this review for your information and use. During the course of this review, the staff members examined the implementation of LLNL's safety management system for certain specific stockpile support activities conducted at the LLNL site as well as LLNL's criticality safety program. This review was done to assess the degree of integration to be found in an actual safety management system at a nuclear R&D facility. The lack of DOE's involvement in the review and authorization of operations that are significantly outside the approved LLNL authorization basis is very troubling. The Board wishes to be advised of the follow-up actions taken on this matter. Mr. Wayne Andrews of the Board's staff will be available to provide any assistance needed to address these issues. Sincerely, John T. Conway Chairman c: Mr. Mark Whitaker Mr. James Turner Enclosure DEFENSE NUCLEAR FACILITIES SAFETY BOARD January 29, 1996 MEMORANDUM FOR: G. W. Cunningham, Technical Director COPIES: Board Members FROM: W. Andrews SUBJECT: Staff Review of Integrated Safety Management at Lawrence Livermore National Laboratory (LLNL) 1. Purpose: This memorandum provides Defense Nuclear Facilities Safety Board (Board) staff observations during a review of LLNL's integrated safety management program, application of the program to the W48 and W79 disassembly efforts, and the criticality safety program. Board staff members W. Andrews, F. Bamdad, M. Moury, and outside expert D. Boyd conducted the review from November 14-16, 1995. 2. Summary: LLNL has many components of an integrated safety management program in place, but some of those components are not well integrated. Two specific examples are LLNL's Operational Safety Procedure (OSP) review process and its criticality safety program. a. Support of W48 and W79 disassembly programs. The staff reviewed documentation provided by LLNL to demonstrate the application of the LLNL integrated Environmental, Safety and Health (ES&H) management system to support W48 and W79 disassembly programs. The documentation included the Operational Safety Procedures (OSPs) for the W48 cracked pit work done at Pantex and LLNL and the OSPs for the W79 dissolution workstation and plutonium/DMSO compatibility experiments at LLNL. Contrary to the concepts of the Unreviewed Safety Question process as defined in Department of Energy (DOE) Order 5480.21, Unreviewed Safety Questions, DOE-Oakland is not reviewing and approving activities, with fissile materials, that are outside the scope of operations authorized for the facility by the Final Safety Analysis Report (FSAR) and the Facility Safety Procedure (FSP). Both the W48 cracked pit activities and the W79 dissolution works were outside those authorized by the FSAR and FSP, but were authorized using the LLNL OSP process without DOE review and approval of the changes to the facility authorization basis. b. Criticality Safety Program. A number of deficiencies were noted with respect to LLNL's criticality safety program. These include, but are not limited to: 1) an inability to provide evidence that criticality safety analyses had been accomplished for work with fissile material whose mass was significantly in excess of limits in LLNL's Building 332 FSAR, Health and Safety (H&S) Manual and Building 332's FSP and, 2) periodic fissile material (Pu239) overmass conditions (i.e., outside the authorization basis) at the laboratory due to inconsistent definitions of dispersible plutonium in their internal safety guidance. 3. Discussion: a. Support of W48 and W79 disassembly programs. Chapter 2.02 of the LLNL's H&S Manual, Preparation of Operational Safety Procedures and Facility Safety Procedures, Appendix A states that OSPs are specifically required for ". . . new operations in a facility that are not described in the governing Facility Safety Procedure, or for changes to the facility infrastructure that will affect safety and/or require safety systems beyond those described in the governing FSP." This is inconsistent with DOE Order 5480.21, Unreviewed Safety Questions, which states ". . . the concept of the Unreviewed Safety Question was established to allow contractors to make physical and procedural changes and to conduct tests and experiments without prior DOE approval, as long as these changes do not explicitly or implicitly affect the authorization basis of the facility or result in a Technical Safety Requirement change." (Emphasis added) OSP review and approval levels are divided into Level A or Level B, with A being the most rigorous. Examples of activities requiring level A review and approval include: ". . . an activity that may produce undesired effects (i.e., death or injury to a member of the general public, damage to non-DOE property, and/or damage to the environment) . . ." ". . . any experiment involving human subjects." Yet none of these activity reviews require DOE involvement. The W79 Workstation OSP stated "The amount of explosives to be dissolved with the proposed dissolution process is not within the scope of operations authorized for the facility in which the operation will be conducted." (Emphasis added). Yet, the OSP was approved by the cognizant facility manager. The W48 Cracked Pit OSP developed to permit work on the "W48 cracker," increased the glove box fissile material limit beyond the FSAR limits by over an order of magnitude. This also did not require DOE approval. b. Criticality Safety Program. (1) There have been repeated instances in the last two years where internal and external reviewers could not determine whether any criticality safety analysis, as required by industry standards and DOE Order 5480.24, Nuclear Criticality, had been performed for operations which had mass limits significantly over those defined in the LLNL guidance documents. (a) An internal audit team (CSAM 93-78) found that "The fissile material mass limits for numerous (10) work stations were raised to 3,000 g by means of an OSP Supplement. The audit team could not find evidence of documented and peer-reviewed analysis to justify this change." (b) A draft of an internal criticality safety audit completed in May 1995, but not yet published, concluded that "Although the operating organization stated a criticality safety evaluation was conducted, the appraisal team was not provided formal documentation for the presence of the additional fissile nuclear mass (contained in two 70 gallon drums) in Room 1338 of B332. This additional fissile mass had been in Room 1338 since January 1995." (c) On the first day of the review, the Board's staff requested, for review, the criticality analyses for two workstations in Building 332. The first was the criticality analysis required for the work on the "W48 cracker." No evidence of the analysis, its peer review, or any other pertinent criticality analysis was produced prior to the review team departing LLNL two days later. The mass of the fissile material was significantly higher than the standard 220 gram limit and was, in fact, higher than other standard OSP limits (waivers). The Board's staff also requested the criticality safety analysis for the material in workstation #6906. Although it exceeded the FSAR/FSP limit by over a factor of ten, it had no current OSP associated with it waiving the authorization basis limits, nor could LLNL produce evidence of a criticality safety analysis being done. (2) LLNL has inconsistent definitions of dispersible plutonium in their internal safety documentation. This periodically results in fissile material (Pu239) overmass conditions (i.e., outside the authorization basis) at the laboratory. (a) A LLNL criticality safety audit team (CSAM 94-35) recently observed that an overmass incident took place on April 14, 1994, and ". . . was not reported as an incident or occurrence. This was the result of an interpretation by the Building 332 staff that no violation had occurred. The interpretation of the Criticality Safety Discipline representative was that the limits in the Operational Safety Procedure and the Health and Safety (H&S) Manual Appendix-31A had been exceeded." The team recommended that the ". . . Building 332 staff should adopt a policy of reporting all incidents, no matter how minor, that involve a criticality safety limit in the FSP, OSP or H&S Manual." (b) The same team observed that "In the course of reviewing the overmass incident of April 14, 1994, the audit team found several conflicting definitions of "dispersible" fissile material in laboratory documents. The documents in which these definitions are included are: 1) Previous Health and Safety Manual, Appendix 31 2) "New" Health and Safety Manual, Appendix 31-A 3) Building 332 Facility Safety Procedure 4) Building 332 Operational Safety Procedure 332.2 The Board staff confirmed that the definition of "dispersible" is different in all four documents. These differences were the direct cause of the overmass/ misunderstanding of April 14, 1994. The team recommended that the "Criticality Safety and the Plutonium Facility Building 332 staff must arrive at a mutually acceptable definition of dispersible' and take action to incorporate the new definition into all action documents." (c) A very similar incident occurred six months later when on August 16, 1994, the inconsistent definitions caused another overmass condition to exist when a total of 1145.4 grams of Pu239 was transferred to a workstation whose limit was defined as 220 grams by the OSP. This overmass condition was not reported to the DOE until September 26, 1994 (42 days later), in spite of the earlier audit team's findings on reporting incidents (Occurrence Reporting and Processing System SAN-LLNL-LLNL-1994-0065). (d) Subsequently, a memo was distributed to address this issue. It used a still different definition of "dispersible" plutonium and raised the mass limits, in some cases by a factor greater than 20. This memo does not have an expiration date identified and appeared to be current and in use by the workers "on the floor," in spite of its inconsistencies with LLNL's authorization basis documents. These changes were not coordinated with the DOE. (e) Though this issue was initially identified over 19 months ago, the conflicting definitions still exist in the various authorization basis documents. The most recent audit team (October 1995) asserted this item was closed out even though necessary changes to the authorization basis documents had not been made. (f) An unreviewed draft of an internal audit (May 1995) concluded that " . . . two documents had not been changed to account for the revised definition of "dispersible" fissile material. . . . The existence of three conflicting definitions . . . contributed to the overmass incident in April 1994, and therefore, it is important that the correct definition appear in both of the above-mentioned documents." 4. Future Staff Actions: The Board's staff will continue to review LLNL's progress toward the development and implementation of an Integrated Safety Management Program in response to the Board's Reporting Requirement on Safety in the Research and Development Environment. The Board's staff will also plan a follow-up criticality safety review to better define the extent of the deficiencies in the LLNL program.