[DNFSB
LETTERHEAD]
May 21, 2004
The Honorable Linton Brooks
Administrator
National Nuclear Security
Administration
U.S. Department of Energy
1000 Independence Avenue, SW
Washington, DC 20585-0701
Dear Ambassador Brooks:
The Defense Nuclear Facilities Safety
Board (Board) has been closely following developments at the Technical Area 18
(TA-18) Critical Experiments Facility at the National Nuclear Security
Administration’s (NNSA) Los Alamos National Laboratory (LANL). The enclosed reports prepared by the Board's
staff identify a number of issues that need to be addressed in the near term to
ensure continued safe operations in TA-18 in advance of the relocation of the
facility's mission.
The unmitigated consequences
predicted for the worst nuclear accidents at TA-18 are the second-highest at
LANL, but these postulated accidents are fundamentally different from those at
the laboratory's other nuclear facilities. While other facilities would require a
catastrophic event for the worst accident, a sequence of operator errors at
TA-18 could initiate its worst accident—an uncontrolled reactivity excursion leading to melting and
partial vaporization of a plutonium core or sample. NNSA and LANL are relying on the compliance of
operators with a set of administrative controls and interim compensatory
measures to prevent such an accident.
The enclosed reports identify a
number of issues related to current operations in TA-18, including a high
reliance on administrative controls, increased uncertainty due to NNSA’s recent
decision to accelerate relocation of the facility’s mission, a lack of
effective operational oversight by NNSA and LANL in TA-18, and lack of formal
closure of previously identified issues involving proposed burst mode
operations in the Solution High Energy Burst Assembly (SHEBA). In particular, administrative controls
intended to prevent these accidents in TA-18 are not included in the current
list of those to be reviewed in response to the Board’s Recommendation 2002-3, Requirements for the
Design, Implementation, and Maintenance of Administrative Controls,
even though these
controls may constitute the most important set of such controls at LANL.
The above issues are in addition
to those raised by the Board in a letter to NNSA dated July 9, 2003, on the
adequacy of the TA-18’s new in-core temperature monitoring system (ITMS). NNSA intends ITMS to be a safety-class
engineered control capable of preventing some (but not all) postulated
uncontrolled reactivity excursions in TA-18. The Board’s July 9, 2003, letter requested
NNSA to provide a report to the Board by September 2004 on resolution of the
issues related to the ITMS. The Board is
aware that its staff has been discussing these issues with NNSA’s Los Alamos
Site Office and LANL management, and that NNSA and LANL are taking related actions,
including LANL’s conduct of a management self-assessment at TA-18.
The Board remains concerned
about the capabilities of the Department of Energy to continue to train and
qualify criticality safety engineers and to conduct criticality experiments, which
are essential to maintaining analytical capabilities within the Nuclear
Criticality Program. As such, it is
important that the issues identified in the enclosed reports be resolved in
order to ensure continued safe operation in TA-18. Also, the relocation of the TA- 18 mission
must be orchestrated carefully to ensure that the experiment capability remains
viable with minimal disruption, as discussed in the Board’s letter to the
Secretary of Energy on August 7, 2003.
In light of the issues discussed
above and in the enclosed reports, and considering the significance of the
postulated accidents in TA-18, the Board, pursuant to 42 U.S.C. § 2286b(d),
requests that NNSA provide a briefing within 45 days of receipt of this letter
on the status and path forward of efforts to address these issues.
Sincerely,
John T. Conway
Chairman
c: The Honorable Everet H. Beckner
Mr.
Edwin L. Wilmot
Mr.
Mark B. Whitaker, Jr.
Enclosures
DEFENSE
NUCLEAR FACILITIES SAFETY BOARD
Staff
Issue Report
April
30, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: C. H. Keilers, Jr.
SUBJECT: Technical Area 18 Critical
Experiments Facility at Los Alamos National Laboratory
This report documents a review
by the staff of the Defense Nuclear Facilities Safety Board (Board) of the
Technical Area 18 (TA-18) Critical Experiments Facility at the Department of
Energy's (DOE) Los Alamos National Laboratory (LANL). This review was conducted by staff members C.
Goff, C. Keilers, D. Kupferer, C. Martin, and R. Quirk. This report identifies issues that need to be
addressed in the near term to ensure continued safe operations in TA-18.
Background. TA-18
has three 1950s-era laboratory buildings housing five critical assemblies that
are remotely controlled. The assemblies
include two general-purpose platform-lift machines (Planet and Comet), one
highly reflected spherical benchmark assembly (Flattop), one unreflected
fast-burst assembly (Godiva IV), and one solution high-energy burst assembly (SHEBA).
All five assemblies are capable of
delayed-critical operations (i.e., excess reactivity up to $1.00,
administratively limited to $0.80 for Planet, Comet, and Flattop). Godiva and SHEBA are capable of going beyond
prompt-critical, referred to as burst mode. SHEBA has yet to operate in burst mode.
Accelerated Relocation. TA-18
now operates in an environment of uncertainty because of a recent National
Nuclear Security Administration (NNSA) decision to accelerate relocation of the
facility’s mission to the Nevada Test Site starting in September 2004. At this time, the plan is for Godiva, Comet,
and Flattop to be shut down in the near term and be placed in storage for
several years, while Planet and SHEBA will continue to operate for the near
term at TA-18 in a campaign mode.
Postulated Accidents. TA-18
is located one-half mile from the nearest site boundary and 3 miles from the
town of White Rock. The laboratory
buildings containing the critical assemblies offer no confinement in the event
of an accident with a radiological release.
The postulated accidents in
TA-18 with the highest off-site consequences involve uncontrolled reactivity
excursions in critical assemblies containing a core or sample of plutonium. For example, LANL analyses approved by NNSA
indicate that an uncontrolled $1.00 step insertion with a plutonium core in
Flattop would cause a transient exceeding the plutonium melting point (640°C) in about 2 seconds,
ultimately reaching above 1,500°C; the core would partially
vaporize; and, conservatively calculated, the maximally exposed off-site individual
(MEOI) would receive on the order of 1,000 rem committed effective dose
equivalent (CEDE) unless the accident were mitigated.
This is the second-highest-consequence
nuclear accident postulated at LANL. The
highest-consequence accidents postulated for the laboratory’s other nuclear
facilities are initiated by catastrophic events, such as a large earthquake or
full facility fire. The comparable postulated
accident in TA-18 might be initiated by a sequence of operator errors, due to
incorrect analysis, incorrect procedures, or failure to follow procedures that
would result in an assembly with too much fissile material being assembled in
an uncontrolled matter.
It appears credible to drive
these assemblies into a temperature regime that could melt plutonium. There has been at least one instance in which
a uranium-fueled assembly at another site partially melted because of improper
operations. Uranium melts at 1130°C, which is comparable to
temperatures predicted in accident analyses for LANL, while plutonium melts and
vaporizes at 640° C
and 3235° C,
respectively. Reaching these high
temperatures in critical assemblies with transuranic cores or samples could
lead to high off-site consequences. Accidents
with uranium-fueled assemblies with small transuranic samples (e.g., less than
25 g plutonium metal) would fall below DOE’s evaluation guidelines (25 rem
CEDE).
Engineered Controls. LANL’s
selection and implementation of engineered controls are not compelling. NNSA has approved a new engineered control—the in-core temperature monitoring
system (ITMS)—that
is intended to shut down an assembly undergoing an uncontrolled reactivity
excursion before damage occurs. The
Board identified issues related to the ITMS in a letter to NNSA dated July 9, 2003.
The Board requested that NNSA provide a report
before removing interim controls that protect the fuel and sample temperatures,
but no later than September 2004. This
report needs to demonstrate that the ITMS will operate reliably and effectively
to prevent critical assemblies from overheating. More recently, three other sets of independent
reviewers (including those from LANL) have raised similar issues regarding whether
the ITMS will perform its intended safety function and whether its design,
procurement, and installation meet the pedigree expected for safety-class
systems.
Currently, installation of the
ITMS has stalled, and the system is not declared operational in any of the
assemblies. It is unclear whether the
ITMS will function as intended; even if it does so, it is envisioned to provide
protection only for delayed critical operations up to $0.80. NNSA and LANL have no expectation that this system
would prevent damage during higher-reactivity excursions—including during burst mode
operations in Godiva and SHEBA and during delayed critical mode operations
above $0.80 in any of the assemblies.
Reliance on Administrative
Controls. NNSA and LANL are relying on the
compliance of operators with a set of administrative controls and interim
compensatory measures to prevent TA-18’s worst accident, even after the ITMS is
operational. Recognizing that such administrative
controls having a safety-class function should be implemented with the same degree
of rigor and quality assurance as that afforded engineered controls with
similar safety importance, the Board issued Recommendation 2002-3, Requirements for the Design, Implementation,
and Maintenance of Administrative Controls. In
its Implementation Plan for this Recommendation, DOE committed to reviewing the
field implementation of such controls. On
March 25, 2004, the NNSA Los Alamos Site Office provided NNSA headquarters a
list of LANL administrative controls to be verified. Administrative controls related to reactivity excursion
accidents in TA-18 are not on the current list, even though they may constitute
the most important set of such controls at LANL.
Reliance on Operational
Management and Operator Qualification. The
effectiveness of the interim administrative controls in TA-18 depends greatly
on the management, training, and qualification of the operators. TA-18 is currently undergoing an operations
management turnover. The previous
operations manager now works at the division level, is located in LANL’s main
administrative area (TA-3), and is focused on the mission relocation effort. The Critical Experiments Facility team leader
is the new operations manager. In
discussions with the Board’s staff, the operational staff in TA-18 appeared
highly confident about their experience and capabilities and of the low-power
nature of the critical assemblies. LANL
management has committed to conducting a management self-assessment of TA-18 operations
by mid-May.
Operational Oversight by
NNSA and LANL. TA-18 has not had an NNSA
Facility Representative
since mid-December 2003 and will likely not have a full-time qualified Facility
Representative for several more months. Recent federal oversight in TA-18 has been
minimal. On the contractor side, LANL
depends on its Reactor Safety Committee to provide safety oversight. In the past several years, the support of
LANL’s senior management for this committee has been marginal at best. In 2000, most of the committee members
resigned. The committee was later
reconstituted as an advisory panel to TA-18 line management. Its reports are currently reviewed by LANL’s
Nuclear Safety Executive Board, chaired by the laboratory’s director. Committee reports during the last 3 years have
tended to focus more on advocating for continued operations (e.g., mission
relocation impacts) than on independently identifying safety issues and
verifying the adequacy of their resolution.
Conclusions. The
unmitigated consequences predicted for the worst nuclear accidents in TA-18 are
the second-highest at LANL, but these postulated accidents are different from
those at the laboratory’s other nuclear facilities. While other facilities would require a
catastrophic event for the worst accidents, a sequence of operator errors at
TA-18 could initiate its worst accident—an uncontrolled reactivity excursion resulting in melting
and partial vaporization of a plutonium core or sample.
NNSA and LANL are currently
relying on a set of administrative controls and interim compensatory measures
to prevent this accident. These
administrative controls appear to be equivalent to safety-class controls, as
described in the Board’s Recommendation 2002-3.
However, most of these controls are missing from the current list of
those to be verified in response to the Board’s Recommendation. It appears that these controls ought to be
included and to have priority for verification. The importance of this verification has grown
as a result of increased uncertainty regarding TA-18’s mission, the lack of
operational oversight, and recent changes in operational management.
DEFENSE
NUCLEAR FACILITIES SAFETY BOARD
Staff
Issue Report
March
24, 2004
MEMORANDUM FOR: J. K. Fortenberry, Technical Director
COPIES: Board Members
FROM: C. Martin
SUBJECT: Los Alamos National Laboratory
Technical Area 18-Preparations for Burst Mode Operation of the Solution High
Energy Burst Assembly
This report documents a review
by the staff of the Defense Nuclear Facilities Safety Board (Board) of the
Solution High Energy Burst Assembly (SHEBA) located in Technical Area 18
(TA-18) at the National Nuclear Security Administration’s (NNSA) Los Alamos
National Laboratory (LANL). This review
was conducted by staff members C. Goff, C. Keilers, D. Kupferer, C. Martin, and
R. Quirk.
Background. SHEBA
was designed to simulate criticality accidents with solutions that are handled
in U.S. enrichment plants. SHEBA has
operated only in delayed critical mode, although it was designed to permit
prompt supercritical (burst mode) experiments. LANL personnel have indicated that no solution
critical assembly has ever operated in burst mode using 5
percent enriched
uranyl fluoride solution (1000 gU/1), which is the fuel
currently used in SHEBA. This solution
fuel tends to have higher density and to be more viscous than other solution
fuels. Currently, the site has a 20
percent enriched solution of uranyl nitrate (150–190 gU/l) in storage ready for use in future experiments.
During normal burst mode
operations, the SHEBA critical assembly vessel is slowly filled until it has
been brought to delayed critical with the safety rod
removed. Then the safety rod is
inserted, taking the reactor back to subcritical. The operator continues to fill the vessel to the
level described in the experiment plan up to an administrative limit of $2.40
excess reactivity. The safety rod (which
is also the burst rod) is then ejected, driving the vessel supercritical on
prompt neutrons. As the fuel heats up,
the large negative temperature coefficient of reactivity drives the assembly
back to subcritical once again. At the
same time, the burst yield measurement system causes the system to scram. According to site personnel, the scram system is
expected to drive the assembly to subcritical on approximately the same time
scale as the reactivity feedback mechanism because of the fuel temperature
increase. The scram system ensures that
the assembly remains subcritical after the experiment.
Documented Safety Analysis. The
accident analysis for SHEBA indicates that the off-site consequences for an
accident involving a $2.40 reactivity insertion while operating with a postulated
700 gram plutonium sample can reach nearly 700 rem cumulative effective dose equivalent;
essentially all of this amount is from vaporization of the sample. The $2.40 limit is specified in the Technical
Safety Requirements for TA-18, but LANL personnel reported that it is
physically possible to insert up to $3.40 excess reactivity. Thus the $2.40 limit constitutes an administrative
control of the type described in the Board's Recommendation 2002-3, Requirements for the
Design, Implementation, and Maintenance of Administrative Controls.
The Safety Evaluation Report
(SER) of NNSA’s Los Alamos Site Office (LASO) identified seven conditions of
approval (COAs) that would have to be resolved before LANL would be authorized
to conduct burst mode operations with SHEBA. During the on-site portion of the staffs
review, LANL personnel stated that all of the COAs had been addressed and accepted
for closure by signature of the former NNSA Facility Representative. Therefore, LANL considers TA-18 nearly ready
for a Readiness Assessment—the
last step prior to authorization for burst mode operations.
However, authorization basis
personnel from LASO stated that open issues remain involving potential
common-mode failure of the safety shutdown mechanisms, which consist of two
identical valves and drain lines from the critical assembly vessel. They stated further that they had not reviewed
the closure of the COAs. Although LASO
personnel will observe the LANL Readiness Assessment, LASO has no further
reviews scheduled before LANL begins burst mode operations with SHEBA. Subsequent to the on-site portion of this review,
the Board’s staff learned that the former facility representative had closed
out only two of the COAs, and that LANL personnel no longer consider the COAs
to be completed. The Board’s staff could
not be provided with clear documentation verifying closure of the COAs. Therefore, the seven COAs shown below remain
open:
Additional Technical
Issues. Burst mode operations in SHEBA
have been contemplated for nearly 7 years but have been held up by a series of
issues, such as generation and recombination of flammable gas. Past experience with SHEBA indicates that free
runs in delayed critical mode exhibit power oscillations at periods of between
20 and 40 seconds. These oscillations
appear to be related to the formation of bubbles in the viscous liquid fuel and
are different for each run. This
suggests some sort of chaotic behavior related to bubble nucleation and growth.
It may be possible that during burst
operations, gas pressure in the critical assembly vessel will interfere with
operation of the two identical dump valves, which are the safety shutdown
mechanisms. It may also be possible that
bubble formation above the dump valves will lead to cavitation at the inlet of
the valve, interfering with the operation of the dump valves.
In addition, the Board’s staff
found that the criteria for what would constitute an abnormality during the
approach to burst operations require further clarification.
Conclusion. Overall,
significant progress has been made toward the goal of burst mode operations in
SHEBA. However, LANL and LASO have not
adequately closed the known issues. It
appears to be prudent to conduct an independent review to confirm that adequate
controls are in place and that the open issues and questions have been thoroughly
addressed before SHEBA is allowed to operate in burst mode. This review should include an assessment of all
of the analyses and the preparations for prompt critical operations before
readiness is declared.