September 27, 2004
The Honorable Linton Brooks
National Nuclear Security Administration
U.S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701
Dear Ambassador Brooks:
The Defense Nuclear Facilities Safety Board (Board) recently reviewed an approved safety basis for a nuclear facility located at Sandia National Laboratories, New Mexico SNL-NM). Based on the Board’s review, as detailed in the enclosed report, the approved safety basis does not provide assurance that the operational hazards have been adequately analyzed and controlled.
Many of the inadequacies identified in the safety basis appear to reflect fundamental weaknesses in the implementation of nuclear safety requirements at SNL-NM. The Sandia Site Office (SSO) has taken action to require improvements in SNL-NM’s safety basis methodology, but the inadequacies in this safety basis remain. Allowing these inadequacies to go uncorrected permits the startup of a facility without an assurance that all hazards have been adequately addressed. Allowing an inadequate safety basis to go un-corrected also compromises the long-term integrity of the change control system, which relies on adequate safety analyses to serve as a baseline for assessing the impact of future changes.
Because of the fundamental nature of the deficiencies identified in this safety basis, the Board has concerns regarding the other safety bases currently approved for use at SNL-NM. Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests a report and briefing within 90 days of receipt of this letter that addresses the following areas:
John T. Conway
c: Mr. Richard Black
Mr. Richard Englehart
Mr. Mark B. Whitaker, Jr.
DEFENSE NUCLEAR FACILITIES SAFETY BOARD
Staff Issue Report
August 12, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: D. Nichols
SUBJECT: Inadequate Documented Safety Analyses at Sandia National Laboratories
This report documents issues identified by members of the staff of the Defense Nuclear Facilities Safety Board (Board) D. Nichols, W. Andrews, F. Bamdad, and D. Kupferer regarding the approved Documented Safety Analysis (DSA) for the Auxiliary Hot Cell Facility (AHCF) at Sandia National Laboratories (SNL), New Mexico. The staff reviewed the DSA and held a series of discussions with SNL and National Nuclear Security Administration’s (NNSA) Sandia Site Office (SSO) personnel who were involved in the development, review and approval of the DSA. These discussions were held on August 3-4, 2004, at which time the Board’s staff also conducted a walkdown of the facility.
Based on this review, the Board’s staff concluded that the DSA does not provide confidence that workers and members of the public are adequately protected from the hazards of the planned operations. In making that determination, the staff identified a number of specific hazards that had been inadequately analyzed and/or inadequately controlled, potentially affecting both worker and public receptors. The methodology used to develop and present the hazard and accident analysis was inconsistent with the approved standard for the development of DSAs. Discussions with site personnel indicated that the underlying weaknesses are not limited to this single DSA, but reflect fundamental problems in the approach used to analyze Technical Area (TA)-V nuclear facilities at SNL.
Background. The AHCF was built to facilitate the sorting, categorization, and repackaging of legacy materials that SNL has categorized as having “no defined use”. These materials include radioactive and transuranic waste and fissile isotopes, and may also include mixed waste. Physically, the AHCF is a relatively small collection of structures that are completely contained within the high bay of an existing facility. It includes a shielded hot cell, a permanent shield wall, eight floor silos, and a walk-in fume hood, together with associated cranes, remote manipulators, and video cameras to record operations and facilitate remote-handled operations. A ventilated temporary room may also be constructed as needed behind the shield wall to accommodate items that cannot fit in the hot cell or h m e hood. The temporary room is considered part of the AHCF.
No systems, structures, and components are classified as safety-class for the AHCF; the maximum unmitigated exposure to an off-site individual from an accident at the facility is estimated to be 5 rem. The safety analysis identified six safety-significant structures, systems, and components: the hot cell structure, permanent shield wall, silo plugs, hot cell ventilation system, high-efficiency particulate air (HEPA) filters, and trenches in the floor of the high bay. The AHCF was designed to operate as a Hazard Category 3 nuclear facility. It has an approved DSA and has undergone an Operational Readiness Review, but operations have not yet commenced. The Operational Readiness Review identified a number of significant issues, and the final report recommended that an additional, independent verification of readiness be performed prior to startup of the facility. The report also questioned the hazard categorization assigned to the facility, suggesting that it may have been lower than appropriate.
Discussion. The Board’s staff identified significant inadequacies in the approved DSA, including among others, deficiencies in the analysis of hazards to members of the public, hazards not adequately identified or controlled, and inadequate design requirements. The more significant of these deficiencies are discussed in the paragraphs that follow; however, the inadequacies described here are but a sampling of the problems with the DSA. Additional discussion can be found in the 111 comments made by NNSA’s Safety Basis Review Team (SBRT) on the final draft version of the DSA that was submitted for approval to SSO. SNL’s responses to most of the SBRT’s comments were inadequate to fully resolve the issues raised. Thus, most of those SBRT comments remain valid concerns.
Hazards to Members of the Public—The AHCF is situated just over 3000 m inside the boundary of Kirtland Air Force Base (KAFB) on TA-V, one corner of a parcel of land controlled by SNL. The AHCF DSA, like all of the DSAs for nuclear facilities within TA-V, uses the 3000 m distance to the KAFB boundary to define the radius of a circle that SNL uses as the virtual site boundary for the facility. The dose to the maximally exposed offsite individual (MEOI) for the unmitigated worst-case accident at the facility is estimated to be 5 rem at the edge of this 3000 m circle.
However, the selection of a 3000 m radius to define a virtual site boundary is not consistent with DOE standards, and does not properly protect members of the public who have unfettered access to recreational areas within the 3000 m radius. DOE standards specify that the area within the site boundary must be controlled by DOE and its contractors without the aid of outside authorities. A number of facilities that are used by the public are within 3000 m of TA-V. These include horse stables, a riding club (1.6 km from TA-V), and the base golf course, and clubhouse (2 km from TA-V). These facilities and the area between them and TA-V are not controlled by the Department of Energy (DOE) or its contractors; they are controlled by the Department of Defense (DOD). There are no markings within the KAFB boundary to indicate when an individual has entered the 3000 m area around TA-V, and no provisions have been made to exclude personnel from this area. On the contrary, this area contains facilities that invite occupancy by members of the public. The stables, riding club, and golf course are frequently inhabited by military dependents, retirees, and invited guests. These persons fit the technical meaning of “the public” as defined in DOE standards, and some of the military dependents are persons who reside inside the boundaries of KAFB and have unfettered access right up to the boundary of TA-V (less than 200 m from the AHCF). Also within the 3000 m radius are a munitions storage facility (1.9 km), the Manzano Fire Station #3 (2.5 km), and the Manzano offices (2.7 km), all of which are controlled and operated by DOD personnel.
Based on charts included in the SNL’s Emergency Planning Hazard Analysis Document, the dose to an individual at 1500 m from the AHCF can be as much as five times that at 3000 m. Thus, the evaluation guidelines are challenged if the MEOI is more correctly identified as the military spouses and children at the horse stables or golf course, indicating the need for safety-class controls.
Hazards not Adequately Identified or Controlled—A brief review of the DSA, together with a walkdown of the facility, revealed a number of specific hazards that had not been addressed or that had been addressed inadequately. Examples include the following:
Inadequate Design Requirements—The AHCF is the result of a modification to the Temporary Hot Cell, a temporary facility that was built inside of the high bay of Building 6597 in 1996. The modifications included the addition of a permanent shield wall, floor silos, a new hot cell roof, a fume hood, an upgraded ventilation system (that included HEPA filtration), upgraded cranes, and the installation of video cameras. However, important design requirements do not appear to have been met, either in the original construction of the Temporary Hot Cell or in its modification to become the AHCF. These requirements are found in both DOE Order 420.1, Facility Safety, which was introduced in 1995 and incorporated into the SNL-NM contract in 1998, and its predecessor, DOE Order 6430.1A, General Design Criteria. DOE Order 420.1 is referenced in the AHCF DSA as the basis for its facility safety requirements.
Other Inadequacies—The Board’s staff identified the following additional inadequacies in the DSA:
The second error was that the threshold fissile material quantity values that were selected from DOE-STD- 1027-92 were only applicable for facilities in which the potential for criticality using those values was precluded by segmentation or the nature of the process. This was not the case for the AHCF, which relies upon administrative double-contingency controls to assure sub-criticality.
DOE frequently grades its oversight and regulatory efforts based upon facility categorization, which in turn is expected to reflect the degree of hazard associated with a facility. Given the potential for significant non-localized accident consequences and the potential for criticality, Hazard Category 2 status was warranted for the AHCF.
After an independent review of the DSA and discussions with site personnel, the Board’s staff concluded that this DSA does not meet the requirements and expectations set forth by the Department of Energy (DOE) in its Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, DOE Standard (STD) 3009-94 CN2, or in any other safe harbor standard approved for compliance with the Nuclear Safety Management Rule (Title 10, U.S. Code of Federal Regulations, Part 830 [l0 CFR 8301]). According to site personnel, the initial version of the DSA for the AHCF submitted for review resulted in more than 200 comments by the SBRT. The final version was reportedly a marked improvement, but still resulted in 111 comments by the SBRT, many of which reflected fundamental issues that had previously been identified but not adequately addressed. The SBRT was reportedly facing similar difficulties with other TA-V DSAs. As part of its performance evaluation process, SSO had graded SNL in the safety basis area with its lowest rating-red-in both of the last 2 years’ performance appraisals, again underscoring the broad nature of the difficulties the site is facing in this area.
To address the improvements that SSO recognized were still needed in this DSA, SSO imposed conditions of approval that required actions by the Operational Readiness Review team to verify the effectiveness of certain controls. SSO is relying on anticipated upgrades to the analysis in the next annual update of the DSA, due in December 2004, to provide a more comprehensive hazard analysis. To address the broader concerns regarding safety basis inadequacies at TA-V facilities, SNL agreed to take steps to strengthen its central safety basis office, and to require approval by a central safety basis authority prior to the submission of a DSA to SSO.
However, the approved DSA for the AHCF remains deficient, and significant hazards have still not been adequately addressed. The incomplete hazard and accident analysis in the DSA will not allow the development of effective Unreviewed Safety Question determinations for future changes. Most significantly, the operation of the facility should not be permitted without an assurance that all hazards have been adequately analyzed and controlled; this DSA does not provide that assurance.
Conclusion. The DSA for the AHCF does not appear to be consistent with the safe harbor methodologies of the Nuclear Safety Management Rule, and does not provide an adequate assurance that the operational hazards have been identified through a comprehensive hazard and accident analysis. It would be advisable for NNSA to retract its determination that this DSA is compliant with the requirements of 10 CFR 830, and rescind its approval of the DSA until a version that meets the requirements of the rule is submitted. Similar actions ought to be taken for any other DSAs at SNL that have not complied with approved safe-harbor standards.
 The site boundary is defined in DOE Standard (STD) 3009-94 CN2 as a “well-marked boundary of the property over which the owner and operator can exercise control without the aid of outside authorities. For the purpose of implementing this Standard, the DOE site boundary is a geographic boundary within which public access is controlled and activities are governed by DOE and its contractors and not by local authorities. A public road traversing a DOE site is considered to be within the DOE site boundary if, when necessary, DOE or the site contractor has the capability to control the road during accident or emergency conditions”. The standard defines the public as “all individuals outside the DOE site boundary”.