DEFENSE NUCLEAR FACILITIES SAFETY BOARD

September 4, 1996

1. Purpose: The Defense Nuclear Facilities Safety Board (Board) staff member Derek Barboza performed an on-site review of portions of the electrical systems at the Rocky Flats Environmental Technology Site (RFETS), Buildings 371 and 771 from June 10, 1996, through June 27, 1996. This report covers a period of approximately one year ending June 30, 1996. Robert F. Warther and Ajit K. Gwal assisted in this review. This report serves to document the results of that review.

2. Summary: Based upon this review, the staff finds that the lack of reliability of the electrical systems has the potential to lengthen the schedules for all facilities to safely stabilize and store the remaining plutonium materials at the site. A principle reason is due to frequent failures of electrical equipment that result in termination of operations. The existing electrical systems may also result in the unavailability of vital safety systems which may lead to unsafe conditions for work done in many buildings.

Numerous problems at the site and at selected buildings were observed during a detailed on- site review of electrical systems at RFETS. In addition, a staff review of occurrence reports involving electrical systems failures over the past eighteen months uncovered the following recurring problems:

• Heating, Ventilation, and Air Conditioning (HVAC) fans, some of which are considered vital safety systems, are routinely out of service. In many of these instances, a sufficient number of fans are operable such that the operational safety requirements are not violated.
• Electrical breakers arc and overheat, creating a potential fire hazard.
• Failures of electrical equipment routinely cause operations to shut down..

As a result of these reviews, the Board staff is concerned that the lack of reliable vital safety systems will significantly lower the safety margin.

The following two tables provide highlights of significant staff findings to the electrical systems at Rocky Flats. Table 1 provides findings related to the site, including technical capability in the electrical disciplines and electrical power.

Table 1. Site-wide Electrical Issues

Table 2 describes building-specific issues related to electrical system design, maintenance, and configuration management for selected buildings.

Table 2. Building-Specific Electrical Issues

The following list highlights some of these findings in greater detail.

• DOE-Rocky Flats Field Office (DOE-RFFO) presently lacks the technical capability to evaluate and assess the adequacy of the electrical systems at the site. DOE-RFFO relies on contractors to perform any necessary assessments related to electrical systems. The DOE-RFFO engineering group was unaware of a recent statement of work that had been sent out for bid that proposes to upgrade and consolidate the electrical distribution system.
• Normal and alternate power for many buildings, such as 559, 707, 771, and others, is distributed on the same utility poles. This presents a situation whereby a single-point failure may occur. The reliability of the distribution system is at risk.
• Buildings 371 and 771 have nonsafety-related loads connected to safety busses. For example, Building 771 has a guard tower and perimeter lighting connected to the emergency generator, which is overloaded. The uninterruptible power system (UPS) system for Building 371 supplies plug strips in computer rooms and the control room. The plug strips in the computer room are not controlled, and building engineers did not know what instrumentation is supplied by the plug strips in the control room. Faults in nonsafety loads could potentially lead to the loss of the entire emergency bus.
• Preventive maintenance is inadequate in both Buildings 371 and 771. The lead building engineer for Building 771 stated that he was unaware of the amount and type of preventive maintenance being performed in the building. There are no breaker or relay preventive maintenance operations at Building 371.
• Buildings 371 and 771 have been involved in plutonium operations for many years. Building 771 is over 40 years old and Building 371 is over 25 years old. Much of the equipment in each building is from the original installation. Therefore, many of the systems are old and replacement parts for much of the equipment no longer exist. This problem is exacerbated by the fact that there has been a reluctance to store spare parts on site, creating excessive delays in corrective maintenance.
• As-built drawings for the electrical systems (for voltage levels of 480V and lower) in Building 371 and 771 are inadequate. In many cases, drawings are inaccurate or do not exist. The engineers for Building 371 stated that they were in the process of walking down the electrical systems to update the drawings. There is no schedule, however, to complete this project. The resources necessary to complete this work have not been specified or budgeted.

3. Background: The cleanup program for RFETS includes processing and stabilization of residuals of the former production mission of the site and decontamination of facilities in preparation for environmental restoration. RFETS has plans to continue processing and stabilizing various forms of plutonium for several more years. The Accelerated Site Action Plan (ASAP) outlines eight alternatives to process, stabilize, and provide safe storage for the remaining plutonium on site. ASAP states that electric power can be supplied to the site by the new double ended substation (679/680) which is in the process of being constructed to replace two substations (555/558 and 661/675).

Perhaps the greatest challenge facing Kaiser-Hill and the Department of Energy (DOE) is the cleanup of Building 771. The Board and Kaiser-Hill have identified Building 771 as one of the highest, if not the highest, priority buildings at RFETS. The actual mission for Building 771 is to process and stabilize the material in the building, remove the radioactive material, and deactivate and decommission the building and its contents. This is a mission giving Building 771 a lifetime on the order of five years.

A second important facility at RFETS is Building 371. Due to the possibility of providing interim storage and processing of plutonium materials, Building 371 may be required to operate longer than any other facility at Rocky Flats. For this and other reasons, Building 371 presents a high potential hazard. Reliable electric power is necessary to kimaintain the vital safety systems of Building 371, such as ventilation, fire detection and suppression, and criticality alarms.

4. Discussion: The discussion first summarizes the organizational responsibilities of the entities at Rocky Flats and then covers four topics evaluated in this review. The first topic addresses the Technical Capability of DOE-RFFO as it relates to electrical systems. The second topic discusses power distribution to the buildings. The final two sections discuss various topics related to the electrical systems of Buildings 771/774 and 371, respectively. In these sections, material is presented in the areas of electrical systems design, maintenance, and configuration management.

DOE utilizes Kaiser-Hill, the integrating contractor, to maintain and operate the facilities at Rocky Flats. Kaiser-Hill uses various subcontractors to maintain and operate the site. Figure 1 shows the responsibilities of the subcontractors with respect to electrical systems. DynCorp is responsible for operating and maintaining systems to provide power up to the facilities. Safe Sites of Colorado (SSOC) operates and maintains the buildings, including operating and maintaining normal electric and emergency power.

Figure 1. Integrating Contractor Responsibilities for Electrical Systems

Figure 2. Department of Energy's Rocky Flats Field Office Responsibilities for Electrical Systems

DOE-RFFO has two groups that are involved with the electrical systems at RFETS, shown in Figure 2. These include the engineering and authorization basis group and the assessments group. The engineering and authorization basis group develops safety requirements. The assessments group is responsible for reviewing and evaluating the adequacy of existing operations.

a. Technical Capability: DOE-RFFO has only one electrical engineer in the entire organization. This engineer is currently in the authorization basis group and, as of June 1996, is not involved in many of the electrical issues at RFETS. An electrical engineer, who was a member of the DOE-RFFO engineering group, left several months ago.

RFFO does not presently have the technical capability to review and evaluate electrical- related activities on-site with respect to their potential impact on safety. DOE-RFFO is now searching for an electrical engineer to fill an excepted service position in the engineering group.

DOE-RFFO does not appear to be involved in reviews and assessments of electrical systems and potential upgrades at RFETS, and they were not able to produce a record of any electrical assessments performed at RFETS. Kaiser-Hill has recently issued a scope of work for an upgrade of the 13.8kV overhead distribution system. Kaiser-Hill stated that it had sent to DOE-RFFO various proposals for the upgrade; however, DOE-RFFO did not provide any feedback on them. The engineering group of DOE-RFFO was not aware of the proposals and has not reviewed the various proposals set forth by Kaiser- Hill.

Loss of experienced electrical engineering personnel is a major problem for the contractors at RFETS . With the threat of layoffs and the loss of operations-related missions at RFETS, many of the younger, degreed engineers are leaving the contractors supporting site and building activities. This problem is compounded by the fact that, with poor system configuration documentation, information on many systems is available only verbally from the knowledge of the remaining, more experienced engineers. If these engineers were to leave, no record would exist.

b. Rocky Flats Site Power: The site-wide Utilities division, operated by DynCorp, has responsibilities including operation and maintenance of site water, steam, and electric power. This division is responsible for maintaining power up to and including the building transformer. Normal and alternate power sources to the buildings are not classified as safety systems at RFETS.

Rocky Flats is presently constructing a new double-ended substation numbered 679/680 which will replace substations 555/558 and 661/675. This substation normally supplies power to Buildings 661, 881, 883, 885, 886 and others. With the present design of the distribution system, the substation can also be used to supply power to Buildings 707, 771, and 776.

There are many buildings (559, 707, 771, and others) that have both normal and alternate power supplied on the same utility poles. This situation creates the possibility of a single-point failure that may result in a single incident causing loss of both normal and alternate power to the buildings. There have been occurrences in the past where power losses of this type have occurred.

A statement of work to consolidate the 13.8kV overhead distribution system was recently submitted to an outside vendor by Kaiser Hill for evaluation. The statement of work presents three options that may be considered individually or in combination with each other. The evaluation will be completed in November 1996. Several of the options include the use of dual circuit utility poles to route normal and alternate power to the various facilities. While this design is presently used throughout much of the site, the upgrade should consider separating normal and alternate power from common utility poles. This would reduce the number of potential single-point failures in the distribution system.

c. Buildings 771/774:

1. Electrical System Design: Building 771 has various electrical systems at that are classified as vital safety systems. These include motors and controls for the ventilation system, criticality alarms, an emergency generator, an UPS, and other related equipment such as emergency switchgear, and motor control centers.

Normal and alternate power is delivered to Building 771 from substation 515/516 via three lines. Two 13.8 kV lines feed building transformers that step the voltage down to 480V and then transport the power via busses labeled 771-1 and 771-2. A third line is stepped down to 480V outside the building and delivered to bus 771-3. Switchgear 771-1 does not feed any vital safety systems. Switchgear 771-2 only feeds emergency switchgear 2B-13B. Switchgear 771-3 feeds emergency switchgear 2B-13A and nonsafety- related equipment as well as Building 774.

Building 771 has recently undergone a sizeable upgrade to the electrical distribution system and emergency power system. This included the replacement of emergency bus switchgear with automatic transfer switches, the uninterruptible power supply, three emergency motor control centers, and twelve distribution panels. Short circuit calculations and a protective device coordination study were performed as part of this upgrade. This upgrade has been completed and closed. This upgrade also added an additional emergency generator; however, the automatic tie was never completed. This second generator has not been maintained and has not operated for over one year. While this second generator could have provided excess emergency power capacity and additional backup power, it is not credited in the Safety Analysis Report.

Load sequencing for the emergency generator is not fully automatic. There are no procedural requirements or design features that prevent two fans from being started simultaneously upon loss of off-site power. Proper load sequencing is necessary to prevent overloading of the emergency generator which could potentially cause a loss of emergency power. Additionally, for motors that are automatically loaded to the emergency bus, a check should be made to determine that re-energization occurs at a point where the motor and load will not be subjected to excessive forces. This can be accomplished with a time-delay relay that prevents re-energization until the residual voltage has decayed to a safe value. There are no corrective actions in place to rectify this situation.

An indirect direct evaporation cooling (IDEC) system was to be an upgrade to the supply air system to the building. It included new supply motors, fans and controllers. This project was abandoned, however, after approximately 85% completion. Old and unreliable supply fans are being depended upon to provide air for the ventilation system. No programs are in place to complete this upgrade.

Due to deficiencies in 120 volt distribution panels in the DOE complex, DOE tasked all facilities to perform a review of their distribution panels. Building 771 has not yet completed this task. Building 771 engineering must walk down all of the panels to scope the number of deficiencies and the necessary equipment to correct any identified deficiencies. although this is a planned activity, the staff was advised by

the lead building engineer that it will be accomplished later when engineering resources become available.

The new Basis for Interim Operation (BIO) for Building 774 requires the UPS for ventilation. Presently, Building 774 is operating under a justification for continued operation (JCO) which does not require the UPS. Because of this, the UPS system has not been maintained and does not meet the criteria of the new BIO. This deficiency has been identified by building engineering and progress is being made to bring the UPS into compliance with the criteria of the BIO.

2. Maintenance: Preventive maintenance for electrical systems for Building 771 is inadequate. There are no programs for breaker maintenance and inspection. The Institute of Electrical and Electronics Engineers/American National Standards Institute's (IEEE/ANSI) standard, IEEE/ANSI 141, IEEE Recommended Practice for Electric Power Distribution for Industrial Plants, provides guidance for preventive maintenance of protective equipment. According to the standard, a maintenance program should be implemented at an interval between six and thirty- six months, depending on the specific application and environment of the equipment. The maintenance program should include removal, inspection, and electrical testing of relays to record timing characteristics to verify proper calibration and operation. Low voltage breakers should be removed, inspected, and electrically tested to verify their tripping characteristics comply with the coordination study. Medium and high voltage circuit breakers should be inspected and electrically tested.

The lead building engineer for Building 771 has been in his position for only a few months. He is presently trying to establish priorities for a preventive maintenance program. There are approximately 600 pieces of equipment that require preventive maintenance operations (PMOs) with approximately 800 total PMOs. The lead building engineer did not know which PMOs have been completed and which are being processed.

Of about 400 items in the corrective maintenance backlog, approximately one-third of these are electrical items. This list is presently being prioritized. Lack of resources is the limiting factor in performing the prioritization and implementation of both preventive and corrective maintenance. Presently, there is only one electrical foreman for Building 771. According to the lead building engineer, the additional resources needed are two electrical engineers and one electrical foreman. While Safe Sites of Colorado was searching for these additional resources, Kaiser- Hill put a freeze on subcontractor hiring. It was stated that, at present, the maintenance backlog is not being reduced.

The monthly surveillance for the emergency generator is performed under a minimum ventilation configuration. DOE standard DOE-DP-3003, Backup Power Sources for DOE Facilities, U.S. Nuclear Regulatory Commission Regulatory Guide 1.9, Selection, Design, and Qualification of Diesel-Generator Units Used as Standby Electric Power Systems at Nuclear Power Plants, and IEEE 749, Standard for Periodic Testing of Diesel Generator Units Applied as Standby Power Supplies in Nuclear Power Generating Stations all recommend that the emergency generator operate for 24 hours at continuous rating every 18 months. The emergency generator at Building 771 does not undergo extended tests to comply with this surveillance requirement.

3. Configuration Management. As part of the distribution system upgrade, the one-line diagrams for the emergency busses were upgraded. This was accomplished by walk-downs of the equipment. Because many loads have been changed over the years without proper documentation, it was necessary to upgrade one-line diagrams through walk-downs, as opposed to updating previous drawings. This effort was adequate.

Drawings for electrical systems below the 480 volt level are inadequate or in many cases do not exist. There are no plans by DOE-RFFO or its contractors to develop as-built drawings for the remaining systems in the building.

The Selected Alpha Air Monitors (SAAMs) and their respective vacuum system were stated to be supplied by the UPS system. It is not clear from the drawings that this is accurate. The SAAMs are no longer classified as vital safety systems.

d. Building 371:

1. Electrical Systems Design: The electrical-related vital safety systems at Building 371 include the ventilation system, criticality alarms, an emergency turbine generator, one UPS, emergency switchgear, and an effluent SAAM.

Normal and alternate power is delivered to Building 371 via substation 517/518. All lines from the substation to the building are underground. Six 13.8kV lines feed the building. Four of these are stepped down to 480V directly, while the other two are stepped down to 2400V before being further stepped down to 480V. Therefore, there are a total of six 480V busses and two 2400V busses. The two 2400V busses supply power to motors of the ventilation system.

The life safety disaster warning (LS/DW) system (building PA system) had been supplied by UPS B. Due to problems with UPS B, the loads were transferred to UPS E. Building engineers do not know exactly what loads are supplied by UPS E. Drawings indicate that a number of panels in the control room are supplied from the UPS E system, but these panels have plug strips, and it is not known exactly what instrumentation is being supplied from these strips. The UPS E system also supplies various outlets under a raised computer floor in several rooms in Building 371. During walkdowns of the system during the recent load transfer, various nonsafety- related equipment was plugged into these UPS outlets. While the engineers removed these loads, there is no control over the spare outlets to prevent other equipment from being plugged into these outlets.

Building 371 engineers expressed concern over an aging battery charger for the batteries supplying power to the emergency switchgear. These batteries supply the control power necessary to operate the automatic switchgear upon loss of off-site power. Recently, the loss of AC power alarm relay failed. Upon a fault in a load, failure of this system could result in the loss of the capability of the emergency power supply to automatically pick up the emergency loads and could also cause the fault to be carried back to the substation. A work order had been prepared to replace the battery charger; however, it was not clear what priority is being placed to fund the new battery charger.

Emergency lighting for the building is supplied by emergency power from the diesel generator. Some of the lighting is being replaced to include battery packs to supply uninterruptible power until the emergency generator picks up the load or in the situation that the emergency generator does not automatically start. The status and scope of what lighting needs to be upgraded are unclear. This issue has been recognized by the building engineering technical support manager as one that needs to be addressed.

IEEE/ANSI 141 requires that protective device coordination studies be completed for distribution systems. IEEE/ANSI 242, Protection and Coordination, provides guidance on performing protective device coordination studies. Proper coordination maximizes the protection of the system from faults while maintaining power to the remainder of the system. The most recent coordination study for Building 371 was performed in 1981. This is outdated and inadequate given the fact that loads have changed over the years and the breakers have not been maintained.

2. Maintenance: A scope of work is being generated by Building 371 engineers for a vendor to inspect, clean, calibrate, and test the switchgear inside the building. Given the history of maintenance of the switchgear at the site, this is an important project that needs to be funded.

In addition to this project, PMOs for cleaning, inspection, and testing of building switchgear need to be implemented. An electrical foreman and building engineers expressed concerns that the lack of maintenance presents potentially hazardous situations. Higher priority for other work is preventing improved preventive maintenance of building switchgear.

The total backlog for Building 371 is approximately 450 items, of which approximately 350 is electrical. This backlog has remained relatively steady, with a slowly increasing trend. The reasons given for not making headway in reducing the backlog include the lack of resources and materials.

Loading for the emergency generator for Building 371 is fully automatic. However, Building 371 does not meet DOE-DP STD 3003, the Nuclear Regulatory Commission's Regulatory Guide 1.9, and IEEE 749 which recommend conducting a 24 hour load test at continuous rated load once every 18 months.

The procurement of replacement parts is presenting a significant delay in repairing aged, inoperable equipment. Building 371 had an HVAC supply fan motor fail in March 1996. The work package for replacement of the coil and starter is now with building maintenance waiting to be staffed. The bill of materials was signed off several months ago, but the replacement parts have not been procured. The foreman recently checked up on the status of the equipment only to find that the paperwork had not been sent from procurement to the vendor.

It was recently discovered that some 2400 volt fuses for fan motors were incorrectly sized. In response to this discovery, engineering performed calculations to determine the correct fuse sizes. Approximately 50 percent of the fuses were checked and incorrectly sized fuses were replaced. Building maintenance is responsible for inspecting the remaining fuses.

3. Configuration Management: Engineering is presently performing system walkdowns to red-line and develop as-built one-line diagrams. This scope of this effort includes the electrical systems from the building transformer down. According to engineers at Building 371, all systems at the 480 volt level have been red-lined. Many of the drawings were found to be inaccurate. In many instances, loads were disconnected but not shown as disconnected on the drawings. The next stage is to deliver the red-lined drawings to computer-aided design to be upgraded to controlled as-built drawings. The drawings for the 120 volt systems are also planned to be upgraded to as-built. There is no schedule to complete the drawing upgrade project and the project will proceed subject to availability of resources.