[DNFSB LETTERHEAD]

 

February 4, 2005

 

The Honorable Linton Brooks

Administrator

National Nuclear Security Administration

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

 

Dear Ambassador Brooks:

 

Enclosed for your information and use is a report prepared by the staff of the Defense Nuclear Facilities Safety Board (Board) on the Preliminary Documented Safety Analysis (PDSA) for the Pit Disassembly and Conversion Facility.  The report notes that overall, the PDSA is comprehensive.  However, it presents several comments for your consideration to improve the PDSA and the facility design.

 

The Board and its staff will continue to follow the issues noted in the report as the facility design progresses.

 

Sincerely,

 

John T. Conway

Chairman

 

c:  Mr. Mark B. Whitaker, Jr.

 

Enclosure

 

---

 

DEFENSE NUCLEAR FACILITIES SAFETY BOARD

 

Staff Issue Report

 

January 14, 2005

 

MEMORANDUM FOR:      J. K. Fortenberry, Technical Director

 

COPIES:                                 Board Members

 

FROM:                                   H. W. Massie

 

SUBJECT:                             Summary Status Report on the Preliminary Documented Safety Analysis for the Pit Disassembly and Conversion Facility

 

This report summarizes the status of issues associated with the Preliminary Documented Safety Analysis (PDSA) for the Pit Disassembly and Conversion Facility (PDCF), which is undergoing Title II design by Washington Group International (WGI).  These issues were identified in reviews conducted by the staff of the Defense Nuclear Facilities Safety Board (Board).  The safety analysis is being performed by Battelle Memorial Institute (Battelle), a major subcontractor to WGI.  Los Alamos National Laboratory (LANL) is providing design support on the plutonium and uranium processing modules and is the design authority for this work.  Westinghouse Savannah River Company is the design authority for all other design work and has responsibility for accepting the design and safety analysis.

 

Background.  The Board and its staff have been reviewing the safety aspects of the PDCF design.  The PDCF is one of two plutonium disposition facilities to be constructed at the Savannah River Site (SRS).  It is part of a joint U.S./Russian agreement under which each country will dispose of 34 metric tons of weapons-grade plutonium.  The mission of the facility is to process 25.6 metric tons of plutonium pits and metal to make oxide feed for the Mixed-Oxide Fuel Fabrication Facility, also to be located at the SRS.

 

Early in the design phase (i.e., Title I), the Board’s goal was to identify basic design issues that could have major safety impacts on the PDCF.  The Board and its staff worked with the National Nuclear Security Administration NNSA to effect the following changes in the PDCF design:

 

• Incorporation of a sand filter for building (i.e., tertiary) confinement to provide safety margins against major facility fires, explosions, and earthquakes.

 

• More effective integration of safety analysis and fire hazard analysis with respect to the use of fire barriers.

 

• Use of identical seismic response spectra for the PDCF and Mixed-Oxide Fuel Fabrication Facility.

 

• Conduct of a full-facility criticality evaluation instead of more limited evaluations of each processing module.

 

• Incorporation of additional boreholes to refine the geotechnical input to the design.

 

• Incorporation of key standards of the Institute of Electrical and Electronics Engineers for instrumentation and controls and associated software quality assurance and verification, similar to standards applied for commercial nuclear plants.

 

• Use of high-temperature plutonium oxide stabilization, consistent with Department of Energy (DOE) standard DOE-STD-3013-2000, Stabilization, Packaging, and Storage of Plutonium -Bearing Materials.

 

Review of Safety Analysis.  The staff reviewed Revision B of the PDSA and provided an initial list of questions to WGI and NNSA.  Based on WGI’s responses to these questions and a conference call held on October 20, 2004, the staff has resolved many of the issues raised, but several remain open.  The following discussion summarizes the current status of these issues.

 

Seismically Induced Facility Fire―The Board sent a letter to NNSA on May 13, 2003, regarding the need to address a seismically induced full-facility fire that was originally proposed by Battelle as a possible design basis accident.  The staff report enclosed to the Board’s letter stated:

 

During discussions held in November 1999, the Board’s staff strongly encouraged NNSA to use properly designed fire barriers, coupled with a sand filter, to provide sufficient design margin against large fires.  More recently, the Board’s staff reviewed the Title I design of the PDCF and commented that it is essential for fire barriers, irrespective of their fire rating, to survive the design basis earthquake to mitigate the full-facility fire scenario.

 

The Board also noted that not all of the fire barriers within the plutonium processing building were rated as 3-hour barriers.  Had this been the case, the potential for this accident scenario would have been eliminated.  In response to the Board’s letter, however, NNSA opted to have WGI and Battelle conduct a fire risk analysis to determine the probability of a full-facility fire occurring as the result of a design basis earthquake.  The conclusion of the fire risk analysis was that a seismically induced full-facility fire (resulting in a heat release rate of 170 megawatts) is a beyond-design-basis accident.  WGI and Battelle then developed a more reasonable design basis accident for the PDSA.  The revised accident scenario is a seismically induced three-room fire (with a heat release rate of 12 megawatts), which results in a calculated offsite dose of 0.8 rem.  The staff reviewed the basis for the analysis and found the results to be reasonable.

 

To determine the amount of safety margin provided in the design, WGI/Battelle calculated the size of a fire needed to reach the evaluation guideline of 25 rem.  In response to a question posed by the Board’s staff.  WGI/Battelle stated that the confinement ventilation design provides significant safety margin, with the ability to mitigate fires with a heat release rate in excess of 100 megawatts.  The staff determined that this statement is true only if the safe haven doors are closed; otherwise, the leak path factor increases.  However, the safe haven doors may be open during a fire to allow for employee egress.  WGI/Battelle noted that the effect of having both the safe haven doors and the shipping bay outer doors open is to double the leak path factor, which should double the calculated dose to the public.  Controls on the safe haven doors (e.g., interlocks) might provide defense in depth for large fires.

 

In summary, the staff agrees that a seismically induced full-facility fire is a beyond-

design-basis accident.  However, important assumptions behind this conclusion and the basis for the design basis fire scenarios are not adequately captured in the safety basis documentation.  The staff will continue to review additional design details related to the amount of combustibles in the facility, including cables; the placement of fire walls with dampers that isolate the material transfer system; safe haven airlock procedures; and other assumptions related to fire initiation and growth.

 

Integrity of 3023 Cans―The staff questioned the basis for the conclusion that a 3013 can would provide one level of safety-class confinement (i.e., be considered a safety-class component) during an accident involving a loss of ventilation/cooling in the main vault.  The 3013 cans store only pure plutonium oxide or uranium oxide in the main vault.  WGI/Battelle personnel responded that SRS sponsored fire tests (conducted by Southwest Research Institute) that demonstrated the robustness of the 3013 cans.  The test cans were loaded with cerium oxide to simulate plutonium oxide, and were fully engulfed in flame within a propane-fired oven.  While some container deformation occurred, no ruptures were experienced at a temperature approaching 2000°F, which is much greater than the maximum temperature that would be reached in an accident involving a loss of ventilation/cooling.  The test results were recently documented in a report for the K-Area Material Storage Project.  The staff finds that the loss of cooling issue is closed for PDCF; however, the fire testing was not sufficient to demonstrate that 3013 containers holding impure plutonium oxide or plutonium metal would survive a fire in the K-Area Materials Storage facility without the protection of a Type B shipping container.

 

Redesign of Milk Bottles―Calcined material (oxide) will be stored in the interim storage area in steel containers called “milk bottles”.  The current milk bottle design has a sealed lid, which could fail and lead to a release of material as a result of heatup and overpressurization during a loss of ventilation/cooling in the interim storage area.  The Board’s staff questioned the project’s position that this failure would be a gradual venting condition as the lid retainer yielded.  No test data on bottle failure are available.  Additional testing will be performed at LANL to determine whether moisture in a sample of oxide material is a sufficient pressurization source to cause the bottles to fail below 200°F.  This temperature is in excess of the maximum calculated oxide temperature (160°F) during the postulated loss-of-cooling accident.

 

If the testing shows that sealed milk bottles can overpressurize as a result of moisture in the material, a design feature (a porous sintered metal plug) may be added to allow filtered venting of the bottles during heatup.  However, an operational consideration is that if the bottles have a filter, the material they contain may adsorb moisture from the air and have to be recalcined to remove that moisture before being packaged into 3013 containers.  The staff will review the results of the LANL tests when they are available.

 

Explosions and Worker Safety Issues―The staff questioned the potential for a steam explosion in the Sanitization Module.  Protection of the onsite workers from such an event would require safety-significant controls in the furnace.  According to the design contractor, a redesign of the furnace is in progress.  No cooling water will be used internal to the furnace cavity, precluding the possibility of an energetic reaction.

 

Safety Controls to Prevent Melting of Plutonium Metal―In July 2004, the staff inquired about the need for safety-significant controls to prevent melting of plutonium metal in the Direct Metal Oxidation processing module.  The Direct Metal Oxidation module will heat pits and plutonium metal to about 600°C to produce plutonium oxide.  An over-temperature transient could produce molten plutonium that could melt through the glovebox and produce significant hazards to workers.  WGI responded that the design for the PDCF includes a high-high temperature switch to provide defense in depth against a melt accident.  However, the safety-significant control is a ceramic tray under the furnace to confine the postulated melt-through, and hence is a mitigative control.  Crediting a mitigative control instead of a preventive control is inconsistent with the design hierarchy which prefers preventive instead of mitigative controls.  Hence, a preventive safety-significant control, such as the high-high temperature control, appears appropriate.

 

Source Term Calculations―The staff reviewed several of the assumptions for the source term values in the PDSA, including the material at risk, the airborne release fractions, and the respirable fractions.  The presentation of the material at risk in several tables of the PDSA (e.g., Tables 3.4-3 and 3.4-37) is confusing and difficult to review.  A more logical approach would be to either prepare tables for incorporation into the PDSA or provide the material at risk for each of the accident scenarios in a separate calculation (i.e., a roadmap).