September 21, 1994 The Honorable Thomas P. Grumbly Assistant Secretary for Environmental Management Department of Energy Washington, D.C. 20585 Dear Mr. Grumbly: A Defense Nuclear Facilities Safety Board staff review team visited the Savannah River Site on July 27 - 29, 1994. The focus of the review was on the safety analyses for the In-Tank Precipitation (ITP) Facility and the Tank Farms. The Board understands that the safety analysis documentation for ITP is still under Department of Energy review. The enclosed report includes observations from our staff review and is provided as information for your review of the ITP safety analysis documentation. The staff will continue to review the basis of the conclusions in the ITP safety analysis. Sincerely, John T. Conway Chairman c: The Honorable Tara O'Toole, EH-1 Mr. Mark Whitaker, Acting EH-6 Dr. Mario Fiori, Manager Savannah River Operations Office Enclosure DEFENSE NUCLEAR FACILITIES SAFETY BOARD August 4, 1994 MEMORANDUM FOR: G. W. Cunningham, Technical Director COPIES: Board Members FROM: A. De La Paz SUBJECT: Report on Review of Safety Analyses for the Tank Farms and for In-Tank Precipitation Facility - Savannah River Site 1. Purpose: This report documents a review of safety analyses for the In-Tank Precipitation (ITP) Facility and for the Tank Farm hydrogen deflagration scenario by the Defense Nuclear Facilities Safety Board (DNFSB) technical staff Timothy Arcano, Andrew De La Paz, David Lowe, Dominic Napolitano, and Joseph Roarty. This review was conducted on July 27-29, 1994. 2. Summary: Westinghouse Savannah River Company (WSRC) believes that a waste tank hydrogen deflagration is an incredible event. WSRC has also determined that a vapor explosion or solids fire in ITP Tanks 48 and 49 is incredible. This analysis is currently under DOE review. The primary reason for these judgments is that after an initiating event occurs, WSRC personnel have determined that they will have a minimum of three days for ITP Facility tanks (nine days for other Tank Farm tanks) to detect the loss of ventilation, and restore the permanent ventilation system or install backup ventilation. The completion of these tasks relies heavily on operations personnel actions, as well as component reliability. The DNFSB staff will review the basis for the probability estimates that support the WSRC position that the above scenarios are incredible. Additional DNFSB staff concerns are noted below regarding event response capability, implementation of operational safety requirements (OSRs), and ITP safety basis and system classification. 3. Background: WSRC personnel are now conducting cold chemical runs in the ITP Facility, which is currently scheduled to begin radioactive operations in December 1994, following a DOE Operational Readiness Review for startup of a hazard category two nuclear facility. The Extended Sludge Processing (ESP) Facility has already commenced processing the first of six batches of sludge. 4. Discussion/Observations: a. Tank Farm Facilities Authorization Basis Change for the Hydrogen Deflagration Scenario: The DNFSB staff reviewed the analysis performed by WSRC to justify the authorization basis change for the hydrogen deflagration scenario. This scenario was revisited by WSRC due to concerns that the consequences from a hydrogen deflagration in a tank are higher than as documented in the DOE-approved Tank Farm facilities safety analysis report (SAR). For the Tank Farm facilities, the new position of WSRC is that the hydrogen deflagration accident scenario is incredible. This conclusion is based upon the assumption that after an initiating event occurs, WSRC personnel have a minimum of nine days to detect a loss of ventilation and take mitigative actions. Such actions consist of either providing tank ventilation via one of the Backup Ventilation Systems (BVSs) or restoring the permanent purge exhaust ventilation. WSRC plans to make two "enhancements" to the OSRs for the Tank Farms. The first enhancement is the maintenance of the assumption of a minimum time of nine days to the lower flammability limit (LFL) of hydrogen in the tank vapor space. This assumption is currently maintained by restricting transfers of waste to tanks such that a three million BTU/hr heat load is not exceeded thus limiting hydrogen generation by radiolysis. The enhancement would include OSR and procedural changes to preclude the transfer of waste to any tank that would reduce the minimum time to the LFL for hydrogen below nine days. WSRC calculations indicate that, assuming loss of tank ventilation, the minimum time for any tank to reach the LFL for hydrogen is currently about 13 days. This enhancement will not be put in place until the new Technical Safety Requirements (TSRs) are completed by WSRC and approved by DOE (to be submitted by WSRC in March 1995). The second enhancement is to define the existing OSR requirement for backup ventilation to include all necessary components and require one dedicated system in each area of the Tank Farms. This change to the OSR implementing procedure is planned to be completed soon. The DNFSB staff has the following specific concerns regarding the Tank Farm authorization basis change for the hydrogen deflagration scenario: 1. The BVS units are stored in areas susceptible to damage as a result of natural phenomena events. WSRC supports their position by citing that approximately fifty exhausters/blowers and more than a hundred portable generators on site could also be used in the event that the BVSs are not available. This is inconsistent with the position taken by WSRC for the ITP Facility, where eight dedicated backup systems are maintained, with four stored in a "remote safe storage location" in the C-Area. 2. WSRC personnel have not performed a drill on the recovery procedure for loss of ventilation under simulated accident conditions. Such a drill is necessary to provide confidence in the ability of WSRC personnel to repair the permanent ventilation system or install a BVS under realistic accident conditions. Such accident conditions may necessitate the use of additional personal protective equipment beyond that used today in normal day-to-day tasks in the Tank Farms. 3. WSRC is using interim OSRs, in addition to the older DOE-approved OSRs, for the Tank Farms. These interim OSRs have not received DOE approval. In addition, DOE specific guidance on their usage has not been provided to WSRC, as well as formal comments to identify DOE issues. DOE personnel stated that they did not plan to approve the interim OSRs because they believed that they are not adequate. However, DOE is allowing WSRC to use the interim OSRs since the older DOE-approved OSRs are even less adequate. 4. WSRC has not transferred the lessons learned at the Replacement Tritium Facility (RTF) and F-Canyon to either the Tank Farms or ITP for the development, verification, validation, and maintenance of a linking database. Such a linking database is being utilized at RTF and F-Canyon to provide a link between SAR assumptions, OSR commitments, etc., down to the implementing procedures for the facility. Such a database tracks the maintenance of the safety envelope by operations personnel. The DNFSB staff is especially concerned that the WSRC process for inter- organizational communication of such information is not effective. b. In-Tank Processing Facility Safety Documentation: WSRC has completed a probability analysis to determine the frequency of deflagration in the ITP process tanks (Tanks 48 and 49) as a result of a loss of the nitrogen purge system. The conclusion of this analysis is that a vapor explosion or solids fire in Tanks 48 and 49 is incredible. This conclusion results in the elimination of all Tank 48 and Tank 49 fire and explosion scenarios (except for a fire in a waste tank annulus). The elimination of these scenarios from consideration in the SAR means that consequence analyses are not performed, nor are specific preventive and mitigative systems and administrative controls identified in the SAR. Here, a key assumption in the analysis is that operators have at least three days to recognize a loss of the nitrogen purge system and either repair the nitrogen purge system or install and activate the emergency purge ventilation exhauster (EPVE) system. Imbedded in this analysis is a significant reliance on operator action. The conclusion that a solids fire or vapor explosion in Tanks 48 and 49 is incredible formed the basis for the conclusion that a hydrogen deflagration in the Tank Farm is incredible, since a minimum time of nine days (versus three days in ITP tanks) is assumed to be necessary to reach the LFL for hydrogen upon a loss of tank ventilation. The DNFSB staff has the following specific concerns related to the ITP process: 1. DOE and WSRC do not plan to complete a basis for interim operation (BIO) document for the ITP and Tank Farms until December 1994. DOE review and approval of a BIO for the ITP process are currently not planned prior to startup of the facility. WSRC personnel stated that the recent revisions to the ITP DOE Order 5481.1B-format SAR and OSRs, and subsequent DOE review, are equivalent to the BIO. DOE Order 5480.23, Nuclear Safety Analysis Reports, requires that BIOs be submitted with the implementation plans for the Order. As part of the BIO, the contractor is to determine what additional administrative controls are needed during the SAR upgrade process. Currently, the integrated Tank Farm and ITP SAR which meets DOE Order 5480.23 requirements is not planned to be submitted to DOE until December 1996. The DNFSB staff believes that a DOE-approved BIO is required prior to radioactive operations or that DOE must approve WSRC justification for not completing a BIO. 2. System classification is inconsistent between the Tank Farms and the ITP Facility. For example, Tank Farms personnel classify the Backup Ventilation System as General Service (the lowest of four system classification levels at the Savannah River Site); whereas ITP facility personnel classify the Emergency Purge Ventilation Exhaust (EPVE) System as Nuclear Safety (the highest of the four system classification levels). The BVS and the EPVE are similar physical systems that provide the same safety function. The DNFSB staff believes that this distinction lacks technical justification. 3. WSRC has created a commitment matrix document that links various requirements such as those in the SAR and OSRs to procedures. However, WSRC has not reviewed the implementing procedures to determine if the requirements of the higher level documents are met by the procedures. c. Tank Cooling Coil Corrosion: The DNFSB staff noted the potential vulnerability of carbon steel cooling coils to corrosion or corrosion-erosion induced wall thinning and subsequent leakage. As noted from F-Canyon experience, the heat-affected zone adjacent to welds has exhibited instances of corrosion. As a safety enhancement, it may be possible to adapt robotic steam generator tubing inspection, heat treatment, and repair to SRS cooling coil applications. 5. Future Staff Actions: In addition to following up on the concerns noted above, the DNFSB staff will perform additional reviews of the ITP accident analyses to further review the basis for the various probability estimates, especially for the Tank 48 and 49 solids fire and vapor explosion scenarios. Also, the staff will review system design and reliability data, as well as operational requirements, for the Waste Tank Nitrogen Purge Ventilation and EPVE Systems for the ITP Facility. This will include the review of a sample of emergency, alarm response, and surveillance procedures. All reviews will be conducted prior to ITP radioactive operations.