January 29, 2007, Board letter regarding the Container Surveillance and Storage Capability Project at the Savannah River Site

[DNFSB LETTERHEAD]

January 29, 2007

The Honorable James A. Rispoli

Assistant Secretary for Environmental Management

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0113

Dear Mr. Rispoli:

The Department of Energy (DOE) has tasked Washington Savannah River Company wit= h the design of the Container Surveillance and Storage Capability (CSSC) project = at the Savannah River Site. CSSC= is a major modification within the K-Area Complex that will provide examination, stabilization, and repackaging capabilities for plutonium-bearing materials packaged in accordance with DOE-STD-3013, Stabilization, Packaging, and Storage of Plutonium-Bearing Materials. It will also provide rack storage for approximately 1,900 containers. The projec= t received Critical Decision-1 approval in March 2006.

The Defense Nuclear Facilities Safety Board (Board) recently completed a review= of the preliminary design and safety strategy for this project. Observations of the Board’s s= taff are documented in the enclosed report and transmitted to you for information and use as appropriate. The B= oard notes that many significant safety issues, which are identified in the encl= osed report, remain to be addressed.

Sincerely,

A. J. Eggenberger

Chairman

c: Mr. Jeffrey M. Allison=

Mr. Mark B. = Whitaker, Jr.

Enclosure

DEFE= NSE NUCLEAR FACILITIES SAFETY BOARD

Staf= f Issue Report

January 4, 2007

MEMORANDUM FOR: J. K. Fort= enberry, Technical Director

FROM: &nb= sp; = &nb= sp; C. Shuffler

SUBJ= ECT: &= nbsp; &nbs= p; Review of the Container Surveillance and Storage Capability Project

This report documents a review by the staff of the Defense Nuclear Facilities Sa= fety Board (Board) of the Container Surveillance and Storage Capability (CSSC) project at the Savannah River Site (SRS). CSSC is a major modification within= the K-Area Complex that will provide examination, stabilization, and packaging capabilities for plutonium-bearing materials in 3013 containers. It will also provide rack storage f= or approximately 1,900 3013 containers. Members of the Board’s staff V. Anderson, F. Bamdad, R. Kasdor= f, R. Layton, and C. Shuffler and site representative J. Contardi met with representatives of Washington Savannah River Company (WSRC) and the Departm= ent of Energy (DOE) during the week of November 13, 2006, to review the organization of the project team and activities related to the preliminary = design and safety basis development.

Background. SRS is being considered for consolidated storage of excess plutonium from across the DOE complex, most = of which is packaged in accordance with DOE-STD-3013, Stabilization, Packag= ing, and Storage of Plutonium-Bearing Materials. The standard provides criteria to ensure that safe storage conditions are maintained for= 50 years, but this is contingent upon periodic surveillance of the 3013 contai= ners to validate key assumptions. = If unsafe conditions are detected (e.g., pressurization, corrosion), the stand= ard provides criteria for stabilizing and repackaging plutonium oxide and metal into new 3013 containers. = Surveillance, stabilization, and repackaging capabilities were originally slated for F-Area, but changes to = the design basis threat in 2004 drove project costs too high. = A decision was made to relocate th= e project to K-Area to take advantage of the existing K-Area Materials Storage (KAMS) security infrastructure, th= us maintaining only one Category I storage facility at SRS.

The CSSC project received Critical Decision-1 (CD-1) approval in March 2006. As part of the CD-1 package, WSRC performed a preliminary hazards analy= sis (PHA) = and identified initial safety-related structures, systems, and components (SSCs= ). The facility’s ventilation sy= stem was designed as safety-significant to operate during a= nd after a fire. Subsequent prel= iminary design calculations showed that the filters were not protected from excessi= ve soot loading. In May, DOE directed WSRC to per= form an engineering evaluation of potential design solutions to the postfire act= ive confinement problem. Solutions included different functional classifications for fire detection and suppression systems, fire zones, and ventilation systems. WSRC forwarded the completed study= to DOE in September with a thorough description of a recommended alternative. = WSRC provided detailed discussion o= f this alternative during the staff’s review, as described in the next secti= on of this report. DOE has not yet approved the new= design. WSRC estimates that the new s= afety strategy will increase the total project cost by about $15 million. The preliminary total project cost = range at CD-1 was $79 to $97 million.

Facility Description. CSSC is a Hazard Category 2 facility that will provide nondestructive examination of 3013 containers and 9975 shipping packages (about 100/year) and destructive examination of 3013 containers (about 27/year). N= ondestructive examination of 3013 containers involves contamination surveys and visual inspections, weight measurements, digital radiography, and nondestructive a= ssay (i.e., gamma and calorimetric assay). Digital radiography verifies accept= able storage pressure in the inner 3013 container by measuring lid deflection. <= span style=3D'mso-spacerun:yes'> Nondestructive examination of 9975 shipping packages includes visual inspections, weight measurements, dimensi= onal verifications (o-rings, Celotex insulation), and temperature measurements.<= /p>

Destructive examination occurs within a glovebox, where 3013 containers are opened, gas= and material samples are collected,[1] and plutonium is stabilized. = Oxide materials are stabilized in a furnace, where high temperature and an oxidiz= ing atmosphere drive off moisture and volatile compounds. These compounds can pressurize the container through radiolytic and thermal degradation during storage. Metal is stabilized by brushing off= any loose oxide coating. Alternat= ively, metal may be converted to oxide in the furnace before undergoing normal oxi= de stabilization. Stabilized plutonium is seale= d into welded inner and outer 3013 containers, and placed into a 9975 shipping pac= kage for return to KAMS; 3013 containers may also be stored directly in the rack storage area= of CSSC.

The facility design recommended by WSRC divides CSSC into five major process ar= eas: (1) the packaging area (nondestruc= tive surveillance of 3013 containers and 9975 shipping packages); (2) the neutron multiplicity area (nondestructive assay of 3013 containers); (3) the gloveb= ox control area (destructive examination of 3013 containers and stabilization = and repackaging activities); (4) the mezzanine area (safety-related equipment storage); and (5) the rack storage area.

The proposal provides each area with its own safety-class fire detection and safety-class gaseous fire suppression system, safety-class fire barriers (building structure, fire dampers, fire = doors, penetration seals), and safety-significant active confinement ventilation s= ystem. The ventilation system is sup= ported by a safety-significant backup diesel generator. All fire barriers, fire detection a= nd suppression equipment, and ventilation system components, including the die= sel generator are designed to Performance Category-3 (PC-3) criteria. If a fire occurs in a process area,= the area is passively sealed, and FM-= 200 gaseous agent is introduced. The facility’s ventilation supply shuts down, and the exhaust system transitions to a low-flow mode. This is accomplished by isolating the normal 40 horsepower exhaust fans and starting a lower-flow 5 horsepower unit.= The low-flow fan provides enough su= ction to maintain differential pressure zones within the facility without compromising the integrity of the passively sealed fire area (i.e., it limi= ts leakage of the FM-200 suppression agent from the fire area). It is the ventilation hardware and controls supporting this low-flow mode that are classified as safety-significant. The normal design exhaust flow rate is 9,100 cubic feet per minute, but the rate will = be reduced to about 600 cubi= c feet per minute when required.

Project Execution. The project’s applicat= ion of the critical decision process described in DOE Order 413.3, Program and Project Management for the Acquisition of Capital Assets, is nontraditional although within the bounds allowed by the Order for flexibil= ity. Specifically, the project is pursuing four phased combinations of the performance baseline and construct= ion milestones (i.e., CD-2 and CD-3). The co= ntent and estimated approval date for each milestone are as follows:

CD-2A/3A authorizes dismantlement and removal activities in project areas for old K-Reactor hardware. Approval is ex= pected in January 2007.

CD-2B/3B authorizes fabrication of the safety-significant glovebox and safety-class 3013 storage racks. Major inp= uts include the fire safety strategy and the criticality and accident anal= yses. Approval is expected in = July 2007.

CD-2C/3C approves the design of remaining safety systems. Major inputs include a Prelimi= nary Documented Safety Analysis (PDSA), Fire Hazards Analysis, and Nuclear Criticality Safety Evaluation (NCSE). Approval is expected by the en= d of 2007.

CD-3 approves the enti= re design and authorizes full construction activities. An estimated approval date is = not available.

Staff Observations. The staff’s review yie= lded the observations summarized below.

Hazards Identification and Analysis&= #8212;The PHA was recently revised to support WSRC’s design proposal for postfire active confinement ventilation. The staff reviewed this document and identified several weaknesses. Examples include lack of considerat= ion of tox= icological hazards from process gases (e.g., FM-200, CO₂,), lack of assessm= ent of los= s of ventilation cooling in the rack storage area and its potential consequences, and insufficient basis for concluding that a seismically induced full-facil= ity (i.e., the CSSC facility) fire is incredible. This latter concern will be address= ed in a future calculation. The sta= ff also pointed out that the controls selection matrix improperly screens out low-probability operational events with moderate worker consequences (i.e., less than 100 rem) from consideration for facility controls. This contradicts guidance provided = in Appendix A of DOE-STD-3009= , Preparation Guide for U.S. Department of Energy Non-Reactor Nuclear Fa= cility Documented Safety Analyses.<= o:p>

Unmitigated consequence calculations supporting the PHA do not apply guidance provided = in the Office of Environmental Management’s (EM) July 18, 2006, memorand= um on the early integration of safety into design. Most notably, the direction to appl= y 95 percent meteorology and a 3 cm surface roughness factor to collocated worker dose calculations was not followed. The most significant hazard at CSSC= involves a fire-induced pressurized release of material from a 3013 container. Estimated doses to the off-site pub= lic and collocated workers are 1.3 rem and 695 rem per container, respectively. Five containers are conservatively assumed to be at risk in the worst-case fire accident, increasing the consequences to 6.5 rem and 3475 rem, respectively. These doses, and others supporting = the hazards analysis, would increase if the EM guidance were applied, potential= ly leading to the identification of additional safety controls.

WSRC was receptive to the staff’s comments, and DOE has already directed W= SRC to revise the PHA to incorporate the EM guidance. Safety basis development is still at an early stage, and appears adequate for this phase of the project. WSRC plans to issue a draft PDSA by= the end of 2007.

Safe= ty Systems—The PHA identifies 17 potential safety-significant and safety-class SSCs for CSSC. Several of these and other engineer= ed controls credited as general service are under review by WSRC for potential reclassification as a result of new design information and the evolving safety strategy for the facility. For example, the safety-significant transport cart used to move 3013 containers between workstations in a critically safe configuration may require a safety-class designation if cart features protecting containers from direct flame impingement are credited in the evolving fire protection strategy. The safety-significant can-puncture device, which vents 3013 containers within the glovebox before opening, may also need to be upgraded and redesigned to accommodate flammable mixtures of hydrogen and oxygen in 3013 containers.

The fire detection and suppression system is designated safety-class to prevent= a fire-induced pressurized release of material from the facility. It also supports operation of the a= ctive confinement ventilation system by limiting soot loading on the filters. Each fire area, including the stora= ge vault, has redundant fire detection, gaseous suppression, and fire dampers = to meet single-failure criteria. Although no guidance currently exis= ts for the design of safety-class fire suppression systems, the staff believes the proposed design is reasonable.

WSRC discussed criteria under development to protect 3013 containers in the inte= rim between initiation of a fire and activation of the suppression system. Current proposals center on prevent= ing direct flame impingement on containers. The staff believes a critical element of the protection approach will be the design of the fire detection system. Its sensitivity and therefore response time is heavily dependent on such factors as type of combustibles, ventilation system operation, compartment geometry, and smoke transport characteristics. Al= l of these factors will need to be considered as the design of this safety-class system moves forward. In addition, the expansion joint= that is part of the CSSC structure needs to be assessed during a seismic event. = Like the structure, this joint has a safety-class function to confine radioactive material during accidents and FM-200 agent during fires.

The staff also discussed the criticality safety strategy for CSSC. WSRC believes that sufficient administrative and engineered controls will be implemented to render the probability of a criticality event incredible (i.e., below 10^-6 = per year). Nuclear Incident Monit= ors (NIMs) are therefore not include= d in the design. Such an approach = is allowed under DOE Order 42= 0.1A, Facility Safety, as invoked in the current WSRC contract. Revision B of the Order, which WSRC plans to apply to its criticality evaluation, does not allow the incredibility argument. Instead, it refers to American Nati= onal Standards Institute/American Nuclear Society Standard 8.3, Criticality Accide= nt Alarm System, and direction that is not as clear when determining the n= eed for criticality alarms. The standard is subject to interpretation, and must be reviewed in combination with the criticality analysis and control set proposed by the facility. The NCSE will be available in early= 2007, and the staff will perform a detailed review of the criticality safety stra= tegy and the proposed NIMs exem= ption at that time.

General Observations—The sta= ff identified a few additional weaknesses with the potential for a negative im= pact on project safety. For exampl= e, major inputs and assumptions for preliminary design are scattered throughout several safety and design documents, making the job of implementing and tracking these key criteria a difficult = task for the WSRC-design authority. Developing a systematic program to maintain unverified inputs and assumptions, document their origin, and track them to completion could be of great benefit. Another example involves the integr= ation of radiological controls with process design to minimize the spread of contamination. WSRC plans to introduce 3013 containers into the glovebox from its maintenance side, whic= h has a higher potential for contamination than the operating side. The staff questioned why this opera= tion could not be performed from the operating side. WSRC agreed to evaluate this issue = when it performs time and motion studies. Finally, the staff questioned the b= asis for excluding nonseismic natural phenomenon hazards from the design criteria for the safety-significant PC-3 ventilation system and diesel generator. The staff encouraged WSRC to either document this basis or protect the assumption that nonseismic natural phenomenon hazards do not pose a significant risk to workers or the off-site public.