May 21, 2004
The Honorable Linton Brooks
National Nuclear Security Administration
U.S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701
Dear Ambassador Brooks:
The Defense Nuclear Facilities Safety Board (Board) has been closely following developments at the Technical Area 18 (TA-18) Critical Experiments Facility at the National Nuclear Security Administration’s (NNSA) Los Alamos National Laboratory (LANL). The enclosed reports prepared by the Board's staff identify a number of issues that need to be addressed in the near term to ensure continued safe operations in TA-18 in advance of the relocation of the facility's mission.
The unmitigated consequences predicted for the worst nuclear accidents at TA-18 are the second-highest at LANL, but these postulated accidents are fundamentally different from those at the laboratory's other nuclear facilities. While other facilities would require a catastrophic event for the worst accident, a sequence of operator errors at TA-18 could initiate its worst accident—an uncontrolled reactivity excursion leading to melting and partial vaporization of a plutonium core or sample. NNSA and LANL are relying on the compliance of operators with a set of administrative controls and interim compensatory measures to prevent such an accident.
The enclosed reports identify a number of issues related to current operations in TA-18, including a high reliance on administrative controls, increased uncertainty due to NNSA’s recent decision to accelerate relocation of the facility’s mission, a lack of effective operational oversight by NNSA and LANL in TA-18, and lack of formal closure of previously identified issues involving proposed burst mode operations in the Solution High Energy Burst Assembly (SHEBA). In particular, administrative controls intended to prevent these accidents in TA-18 are not included in the current list of those to be reviewed in response to the Board’s Recommendation 2002-3, Requirements for the Design, Implementation, and Maintenance of Administrative Controls, even though these controls may constitute the most important set of such controls at LANL.
The above issues are in addition to those raised by the Board in a letter to NNSA dated July 9, 2003, on the adequacy of the TA-18’s new in-core temperature monitoring system (ITMS). NNSA intends ITMS to be a safety-class engineered control capable of preventing some (but not all) postulated uncontrolled reactivity excursions in TA-18. The Board’s July 9, 2003, letter requested NNSA to provide a report to the Board by September 2004 on resolution of the issues related to the ITMS. The Board is aware that its staff has been discussing these issues with NNSA’s Los Alamos Site Office and LANL management, and that NNSA and LANL are taking related actions, including LANL’s conduct of a management self-assessment at TA-18.
The Board remains concerned about the capabilities of the Department of Energy to continue to train and qualify criticality safety engineers and to conduct criticality experiments, which are essential to maintaining analytical capabilities within the Nuclear Criticality Program. As such, it is important that the issues identified in the enclosed reports be resolved in order to ensure continued safe operation in TA-18. Also, the relocation of the TA- 18 mission must be orchestrated carefully to ensure that the experiment capability remains viable with minimal disruption, as discussed in the Board’s letter to the Secretary of Energy on August 7, 2003.
In light of the issues discussed above and in the enclosed reports, and considering the significance of the postulated accidents in TA-18, the Board, pursuant to 42 U.S.C. § 2286b(d), requests that NNSA provide a briefing within 45 days of receipt of this letter on the status and path forward of efforts to address these issues.
John T. Conway
c: The Honorable Everet H. Beckner
Mr. Edwin L. Wilmot
Mr. Mark B. Whitaker, Jr.
DEFENSE NUCLEAR FACILITIES SAFETY BOARD
Staff Issue Report
April 30, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: C. H. Keilers, Jr.
SUBJECT: Technical Area 18 Critical Experiments Facility at Los Alamos National Laboratory
This report documents a review by the staff of the Defense Nuclear Facilities Safety Board (Board) of the Technical Area 18 (TA-18) Critical Experiments Facility at the Department of Energy's (DOE) Los Alamos National Laboratory (LANL). This review was conducted by staff members C. Goff, C. Keilers, D. Kupferer, C. Martin, and R. Quirk. This report identifies issues that need to be addressed in the near term to ensure continued safe operations in TA-18.
Background. TA-18 has three 1950s-era laboratory buildings housing five critical assemblies that are remotely controlled. The assemblies include two general-purpose platform-lift machines (Planet and Comet), one highly reflected spherical benchmark assembly (Flattop), one unreflected fast-burst assembly (Godiva IV), and one solution high-energy burst assembly (SHEBA). All five assemblies are capable of delayed-critical operations (i.e., excess reactivity up to $1.00, administratively limited to $0.80 for Planet, Comet, and Flattop). Godiva and SHEBA are capable of going beyond prompt-critical, referred to as burst mode. SHEBA has yet to operate in burst mode.
Accelerated Relocation. TA-18 now operates in an environment of uncertainty because of a recent National Nuclear Security Administration (NNSA) decision to accelerate relocation of the facility’s mission to the Nevada Test Site starting in September 2004. At this time, the plan is for Godiva, Comet, and Flattop to be shut down in the near term and be placed in storage for several years, while Planet and SHEBA will continue to operate for the near term at TA-18 in a campaign mode.
Postulated Accidents. TA-18 is located one-half mile from the nearest site boundary and 3 miles from the town of White Rock. The laboratory buildings containing the critical assemblies offer no confinement in the event of an accident with a radiological release.
The postulated accidents in TA-18 with the highest off-site consequences involve uncontrolled reactivity excursions in critical assemblies containing a core or sample of plutonium. For example, LANL analyses approved by NNSA indicate that an uncontrolled $1.00 step insertion with a plutonium core in Flattop would cause a transient exceeding the plutonium melting point (640°C) in about 2 seconds, ultimately reaching above 1,500°C; the core would partially vaporize; and, conservatively calculated, the maximally exposed off-site individual (MEOI) would receive on the order of 1,000 rem committed effective dose equivalent (CEDE) unless the accident were mitigated.
This is the second-highest-consequence nuclear accident postulated at LANL. The highest-consequence accidents postulated for the laboratory’s other nuclear facilities are initiated by catastrophic events, such as a large earthquake or full facility fire. The comparable postulated accident in TA-18 might be initiated by a sequence of operator errors, due to incorrect analysis, incorrect procedures, or failure to follow procedures that would result in an assembly with too much fissile material being assembled in an uncontrolled matter.
It appears credible to drive these assemblies into a temperature regime that could melt plutonium. There has been at least one instance in which a uranium-fueled assembly at another site partially melted because of improper operations. Uranium melts at 1130°C, which is comparable to temperatures predicted in accident analyses for LANL, while plutonium melts and vaporizes at 640° C and 3235° C, respectively. Reaching these high temperatures in critical assemblies with transuranic cores or samples could lead to high off-site consequences. Accidents with uranium-fueled assemblies with small transuranic samples (e.g., less than 25 g plutonium metal) would fall below DOE’s evaluation guidelines (25 rem CEDE).
Engineered Controls. LANL’s selection and implementation of engineered controls are not compelling. NNSA has approved a new engineered control—the in-core temperature monitoring system (ITMS)—that is intended to shut down an assembly undergoing an uncontrolled reactivity excursion before damage occurs. The Board identified issues related to the ITMS in a letter to NNSA dated July 9, 2003. The Board requested that NNSA provide a report before removing interim controls that protect the fuel and sample temperatures, but no later than September 2004. This report needs to demonstrate that the ITMS will operate reliably and effectively to prevent critical assemblies from overheating. More recently, three other sets of independent reviewers (including those from LANL) have raised similar issues regarding whether the ITMS will perform its intended safety function and whether its design, procurement, and installation meet the pedigree expected for safety-class systems.
Currently, installation of the ITMS has stalled, and the system is not declared operational in any of the assemblies. It is unclear whether the ITMS will function as intended; even if it does so, it is envisioned to provide protection only for delayed critical operations up to $0.80. NNSA and LANL have no expectation that this system would prevent damage during higher-reactivity excursions—including during burst mode operations in Godiva and SHEBA and during delayed critical mode operations above $0.80 in any of the assemblies.
Reliance on Administrative Controls. NNSA and LANL are relying on the compliance of operators with a set of administrative controls and interim compensatory measures to prevent TA-18’s worst accident, even after the ITMS is operational. Recognizing that such administrative controls having a safety-class function should be implemented with the same degree of rigor and quality assurance as that afforded engineered controls with similar safety importance, the Board issued Recommendation 2002-3, Requirements for the Design, Implementation, and Maintenance of Administrative Controls. In its Implementation Plan for this Recommendation, DOE committed to reviewing the field implementation of such controls. On March 25, 2004, the NNSA Los Alamos Site Office provided NNSA headquarters a list of LANL administrative controls to be verified. Administrative controls related to reactivity excursion accidents in TA-18 are not on the current list, even though they may constitute the most important set of such controls at LANL.
Reliance on Operational Management and Operator Qualification. The effectiveness of the interim administrative controls in TA-18 depends greatly on the management, training, and qualification of the operators. TA-18 is currently undergoing an operations management turnover. The previous operations manager now works at the division level, is located in LANL’s main administrative area (TA-3), and is focused on the mission relocation effort. The Critical Experiments Facility team leader is the new operations manager. In discussions with the Board’s staff, the operational staff in TA-18 appeared highly confident about their experience and capabilities and of the low-power nature of the critical assemblies. LANL management has committed to conducting a management self-assessment of TA-18 operations by mid-May.
Operational Oversight by NNSA and LANL. TA-18 has not had an NNSA Facility Representative since mid-December 2003 and will likely not have a full-time qualified Facility Representative for several more months. Recent federal oversight in TA-18 has been minimal. On the contractor side, LANL depends on its Reactor Safety Committee to provide safety oversight. In the past several years, the support of LANL’s senior management for this committee has been marginal at best. In 2000, most of the committee members resigned. The committee was later reconstituted as an advisory panel to TA-18 line management. Its reports are currently reviewed by LANL’s Nuclear Safety Executive Board, chaired by the laboratory’s director. Committee reports during the last 3 years have tended to focus more on advocating for continued operations (e.g., mission relocation impacts) than on independently identifying safety issues and verifying the adequacy of their resolution.
Conclusions. The unmitigated consequences predicted for the worst nuclear accidents in TA-18 are the second-highest at LANL, but these postulated accidents are different from those at the laboratory’s other nuclear facilities. While other facilities would require a catastrophic event for the worst accidents, a sequence of operator errors at TA-18 could initiate its worst accident—an uncontrolled reactivity excursion resulting in melting and partial vaporization of a plutonium core or sample.
NNSA and LANL are currently relying on a set of administrative controls and interim compensatory measures to prevent this accident. These administrative controls appear to be equivalent to safety-class controls, as described in the Board’s Recommendation 2002-3. However, most of these controls are missing from the current list of those to be verified in response to the Board’s Recommendation. It appears that these controls ought to be included and to have priority for verification. The importance of this verification has grown as a result of increased uncertainty regarding TA-18’s mission, the lack of operational oversight, and recent changes in operational management.
DEFENSE NUCLEAR FACILITIES SAFETY BOARD
Staff Issue Report
March 24, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: C. Martin
SUBJECT: Los Alamos National Laboratory Technical Area 18-Preparations for Burst Mode Operation of the Solution High Energy Burst Assembly
This report documents a review by the staff of the Defense Nuclear Facilities Safety Board (Board) of the Solution High Energy Burst Assembly (SHEBA) located in Technical Area 18 (TA-18) at the National Nuclear Security Administration’s (NNSA) Los Alamos National Laboratory (LANL). This review was conducted by staff members C. Goff, C. Keilers, D. Kupferer, C. Martin, and R. Quirk.
Background. SHEBA was designed to simulate criticality accidents with solutions that are handled in U.S. enrichment plants. SHEBA has operated only in delayed critical mode, although it was designed to permit prompt supercritical (burst mode) experiments. LANL personnel have indicated that no solution critical assembly has ever operated in burst mode using 5 percent enriched uranyl fluoride solution (1000 gU/1), which is the fuel currently used in SHEBA. This solution fuel tends to have higher density and to be more viscous than other solution fuels. Currently, the site has a 20 percent enriched solution of uranyl nitrate (150–190 gU/l) in storage ready for use in future experiments.
During normal burst mode operations, the SHEBA critical assembly vessel is slowly filled until it has been brought to delayed critical with the safety rod removed. Then the safety rod is inserted, taking the reactor back to subcritical. The operator continues to fill the vessel to the level described in the experiment plan up to an administrative limit of $2.40 excess reactivity. The safety rod (which is also the burst rod) is then ejected, driving the vessel supercritical on prompt neutrons. As the fuel heats up, the large negative temperature coefficient of reactivity drives the assembly back to subcritical once again. At the same time, the burst yield measurement system causes the system to scram. According to site personnel, the scram system is expected to drive the assembly to subcritical on approximately the same time scale as the reactivity feedback mechanism because of the fuel temperature increase. The scram system ensures that the assembly remains subcritical after the experiment.
Documented Safety Analysis. The accident analysis for SHEBA indicates that the off-site consequences for an accident involving a $2.40 reactivity insertion while operating with a postulated 700 gram plutonium sample can reach nearly 700 rem cumulative effective dose equivalent; essentially all of this amount is from vaporization of the sample. The $2.40 limit is specified in the Technical Safety Requirements for TA-18, but LANL personnel reported that it is physically possible to insert up to $3.40 excess reactivity. Thus the $2.40 limit constitutes an administrative control of the type described in the Board's Recommendation 2002-3, Requirements for the Design, Implementation, and Maintenance of Administrative Controls.
The Safety Evaluation Report (SER) of NNSA’s Los Alamos Site Office (LASO) identified seven conditions of approval (COAs) that would have to be resolved before LANL would be authorized to conduct burst mode operations with SHEBA. During the on-site portion of the staffs review, LANL personnel stated that all of the COAs had been addressed and accepted for closure by signature of the former NNSA Facility Representative. Therefore, LANL considers TA-18 nearly ready for a Readiness Assessment—the last step prior to authorization for burst mode operations.
However, authorization basis personnel from LASO stated that open issues remain involving potential common-mode failure of the safety shutdown mechanisms, which consist of two identical valves and drain lines from the critical assembly vessel. They stated further that they had not reviewed the closure of the COAs. Although LASO personnel will observe the LANL Readiness Assessment, LASO has no further reviews scheduled before LANL begins burst mode operations with SHEBA. Subsequent to the on-site portion of this review, the Board’s staff learned that the former facility representative had closed out only two of the COAs, and that LANL personnel no longer consider the COAs to be completed. The Board’s staff could not be provided with clear documentation verifying closure of the COAs. Therefore, the seven COAs shown below remain open:
Additional Technical Issues. Burst mode operations in SHEBA have been contemplated for nearly 7 years but have been held up by a series of issues, such as generation and recombination of flammable gas. Past experience with SHEBA indicates that free runs in delayed critical mode exhibit power oscillations at periods of between 20 and 40 seconds. These oscillations appear to be related to the formation of bubbles in the viscous liquid fuel and are different for each run. This suggests some sort of chaotic behavior related to bubble nucleation and growth. It may be possible that during burst operations, gas pressure in the critical assembly vessel will interfere with operation of the two identical dump valves, which are the safety shutdown mechanisms. It may also be possible that bubble formation above the dump valves will lead to cavitation at the inlet of the valve, interfering with the operation of the dump valves.
In addition, the Board’s staff found that the criteria for what would constitute an abnormality during the approach to burst operations require further clarification.
Conclusion. Overall, significant progress has been made toward the goal of burst mode operations in SHEBA. However, LANL and LASO have not adequately closed the known issues. It appears to be prudent to conduct an independent review to confirm that adequate controls are in place and that the open issues and questions have been thoroughly addressed before SHEBA is allowed to operate in burst mode. This review should include an assessment of all of the analyses and the preparations for prompt critical operations before readiness is declared.