**\[DNFSB LETTERHEAD\]**

November 4, 2002

The Honorable Jessie Hill Roberson

Assistant Secretary for Environmental Management

Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0113

Dear Ms. Roberson:

The staff of the Defense Nuclear Facilities Safety Board (Board)
conducted two reviews of the process used for safety basis development
to support the design and construction of the Waste Treatment Plant
(WTP) at the Hanford Site. The staff focused on the Preliminary Safety
Analysis Reports (PSARs) and design basis events (DBEs) for the
pretreatment and high-level waste (HLW) facilities.

The WTP project has implemented a unique Integrated Safety Management
(ISM) review

process intended to evaluate the design's adequacy, and to ensure that
all safety issues have been addressed and that safety functions have
been captured and incorporated into the design. The staff's reviews
revealed that there may be systemic weaknesses in this ISM review
process. It appears that some of these ISM reviews are not sufficiently
rigorous. The staff identified a number of conditions that were not
adequately addressed in the PSARs and were not captured during the ISM
reviews. These conditions may require additional controls or design
modifications before sufficient levels of safety are achieved.

Furthermore, the staff found that the design calculations contain
numerous unverified

assumptions and incomplete design inputs that were not being properly
tracked. It is critical that all assumptions be verified and all
required design inputs be available to support the aggressive
construction schedule and to ensure adequate time for a comprehensive
design review.

The staffs review also revealed the safety requirements delineated in
Department of

Energy (DOE) Order 420.1, *Facility Safety*, and DOE standard
DOE-STD-3009-94, Change Notice 2, *Preparation Guide for U.S. Department
of Energy Nonreactor Nuclear Facility Safety Analysis Reports*, are not
being fully met. Specifically, DOE's design contractor appears to have
implemented a process that treats DOE's evaluation guidelines as fixed
criteria for determining the acceptability of the design. Appendix A to
DOE-STD-3009-94 clearly specifies that the evaluation guideline is to be
used for the classification of controls and identification of
safety-class systems, not as a firm acceptance criterion. This
misapplication of the DOE evaluation guideline could lead to the
development of a less-than-adequate design.

Pursuant to 42 U.S.C. § 2286b(d), the Board requests a report within 60
days of receipt of

this letter that documents how DOE will resolve the deficiencies
identified in the enclosed staff reports.

Sincerely,

***John T. Conway***

***Chairman***

c: Mr. Roy J. Schepens

Mr. Mark B. Whitaker, Jr.

Enclosures

**DEFENSE NUCLEAR FACILITIES SAFETY BOARD**

**Staff Issue Report**

October 3, 2002

**MEMORANDUM FOR:** J. K. Fortenberry, Technical Director

**COPIES:** Board Members

**FROM:** F. Bamdad

> S. Stokes

**SUBJECT:** Safety and Design Basis Activities, Hanford Waste Treatment
Plant

This report documents the results of a review performed by the staff of
the Defense

Nuclear Facilities Safety Board (Board) of safety and design bases for
the Hanford Waste

Treatment Plant (WTP). Staff members F. Bamdad, J. Contardi, M. Feldman,
J. Plaue, R. Quirk, S. Stokes, and A. Wong, together with the Board's
site representative, M. Sautman, participated in this review. To perform
this review, the staff examined relevant documents; toured the
construction site; and held on-site discussions April 30--May 2, 2002,
and follow-up discussions July 29--August 2, 2002.

**Background.** The Department of Energy (DOE) has contracted with
Bechtel National,

Inc. (BNI) to design, construct, and commission the WTP at Hanford. This
facility will treat and vitrify waste from the Hanford high-level waste
tank farms. The construction of this facility has begun, and design
calculations are being performed to support the construction schedule.

**Discussion.** The staffs review addressed two aspects of safety basis
development for the

WTP: (1) the safety standards and processes generated by the contractor
to meet the

requirements of DOE's Office of River Protection (ORP), and their
application to design and construction activities for the WTP; and (2)
the design basis event (DBE) analyses supporting the Preliminary Safety
Analysis Reports (PSARs) for the high-level waste and pretreatment
facilities, a representative set of which was reviewed in detail. The
following discussion summarizes issues identified by the Board's staff
related to safety standards and processes that could have an adverse
impact on the safety of the WTP facility; the technical issues related
to the DBE analyses are addressed in a companion report.

*Safety Requirements*---BNI developed a Safety Requirements Document
(SRD)

establishing a set of radiological and chemical safety standards to meet
the expectations of DOE-ORP. These safety standards are to be used in
the design, construction, and operation of the WTP facility.

The structures, systems, and components (SSCs) that serve to provide
reasonable

assurance that the facility can be operated without undue risk to the
health and safety of the public and workers are classified as important
to safety. This classification includes SSCs designated as safety design
class (SDC) and safety design significant (SDS), as well as some SSCs
that provide defense-in-depth called risk reduction components. The SDCs
are those SSCs identified to protect the public and workers from
receiving radiological or chemical exposures that exceed standards
defined in the SRD. Table 2-l of the SRD establishes radiological dose
standards that must be met to ensure adequate protection of the public
and workers. For example, the criteria for protection of the public and
workers from unlikely events (probability of 1.0E-2 to 1.0E-4 per year)
are 5 and 25 rem committed effective dose equivalent (CEDE),
respectively, and the criterion for extremely unlikely events
(probability of 1.0E-4 to 1.0E-6 per year) is 25 rem CEDE for both
populations.

Appendix B to the SRD establishes a defense-in-depth approach by
defining the minimum number of SSCs and associated engineering
requirements for the control of hazards of a particular severity. This
approach is intended to be used in conjunction with the safety
requirements discussed above. Table 1 of Appendix B lists the number and
attributes of the physical barriers, as well as the application of the
single-failure criterion to SSCs as required to implement defense in
depth adequately. The adequacy of defense in depth for a given event is
evaluated using numerical values given as target frequencies. For
example, for the hazards of the highest severity level (SL-l), two
independent physical barriers are required, the single-failure criterion
shall be applied, and the probability of the event shall be less than
1.0E-6 per year after taking credit for the controls.

The safety criteria and methodology presented in the SRD, as applied by
BNI, do not reflect several key requirements for preparation of a PSAR
as set forth in DOE Order 420.1, *Facility Safety*, and DOE standard
DOE-STD-3009-94, Change Notice 2, *Preparation Guide for U.S. Department
of Energy Nonreactor Nuclear Facility Safety Analysis Reports*. The
following examples illustrate the issues identified by the staff:

-   The numerical value of 25 rem given as the radiological exposure
    standard in Table 2-l of the SRD for protection of the public is
    consistent with the evaluation guideline established in
    DOE-STD-3009-94 for identification of safety-class SSCs. The DOE
    evaluation guideline was intended to be used in conjunction with the
    unmitigated accident consequences for identification of safety-class
    SSCs. However, the staffs review identified several instances in
    which SSCs were credited in comparing the consequences with the
    criteria given in Table 2-l of the SRD. For example, Section
    3.4.1.1.5 of the PSAR for the HLW facility credits the
    high-efficiency particulate air (HEPA) filters in calculating the
    consequences for comparison with the SRD. This is in contrast to the
    recommended approach in DOE-STD-3009-94---that the unmitigated
    consequences should be compared with the evaluation guidelines for
    classification of the SSCs. As a result, the safety significance of
    the HEPA filters may have been masked due to the lack of knowledge
    of the unmitigated consequences.

Follow-up discussions with the contractor revealed that the guidance on
using the mitigated accident consequences as the basis for comparison
with the radiological exposure standards in Table 2-1 of the SRD was
provided by DOE-ORP. Any changes to this approach would require
negotiations between the contractor and DOE, which are pending at this
time.

-   Appendix A to DOE-STD-3009-94 states that the evaluation guidelines
    are not to be used as firm criteria when determining the
    acceptability of control strategies/systems. Discussions with
    contractor representatives revealed that these radiological exposure
    standards are generally regarded as cut-offs for determining the
    effectiveness of a control system.

-   BNI is using target probabilities given in Appendix B of the SRD as
    acceptance criteria without considering the uncertainties involved
    in the analysis. For example, an SL-1 event with a calculated
    frequency of 0.65E-6 per year was given no further consideration
    because the target frequency of 1.0E-6 per year was not exceeded.
    This approach does not reflect the substantial uncertainties in this
    frequency estimate and could yield a design that does not fully
    develop the defense-in-depth concept articulated in the SRD.
    Specific examples of the uncertainties discovered in several of
    BNI's frequency estimates are cited below:

    -   The probabilities used in frequency estimates were sometimes
        inappropriately based on a best estimate rather than a
        conservative estimate.

    -   When data on the failure probability of some systems were
        unavailable, assumptions used by BNI regarding the applicability
        of similar data did not appear to be technically justified.
        Moreover, the extrapolation of these data for use within the DBE
        analysis did not appear to have been done in a conservative
        fashion.

Follow-up discussions with DOE and its contractor confirmed the staff's
findings and resulted in a potential change to the defense-in-depth
methodology applied to the WTP design. While the contractor has proposed
replacing the quantitative frequency requirements with qualitative
determination of the adequacy of the control set, there does not appear
to be a clear methodology for identifying the required SSCs, their
classification, and a concise definition of their boundaries. This
activity appears to be work in progress and may impact the design of the
SSCs important to safety if not completed in a timely manner.

*Beyond Design Basis Accidents*---The safe harbor to Title 10 of the
Code of Federal

Regulations, Part 830 (10 CFR 830), *Nuclear Safety Management*, for the
WTP is DOE standard DOE-STD-3009-94. Section 3.4.3 of DOE-STD-3009-94
states that an evaluation be performed that simply provides insight into
the magnitude of consequences of beyond design basis accidents (DBAs).
This insight from beyond DBA analysis has the potential for identifying
additional facility features that could prevent or reduce severe beyond
DBA consequences. BNI, however, does not evaluate the consequences of
chemical hazards if the unmitigated probability of an event is estimated
to be less than 1.0E-6 per year. This practice may discount chemical
hazards with significant consequences (but low probability) that may
warrant additional controls to protect the public and workers.

**DEFENSE NUCLEAR FACILITIES SAFETY BOARD**

**Staff Issue Report**

October 4, 2002

**MEMORANDUM FOR:** J. K. Fortenberry, Technical Director

**COPIES:** Board Members

**FROM:** J. Plaue and M. Feldman

**SUBJECT:** Safety Basis for Waste Treatment Plant

This report documents two reviews by the staff of the Defense Nuclear
Facilities Safety Board (Board) of the Waste Treatment Plant (WTP) at
the Hanford Site. This report focuses on technical concerns associated
with Preliminary Safety Analysis Reports (PSARs) and design basis events
(DBEs) for the pretreatment and high-level waste (HLW) facilities. A
companion report addresses the staffs findings, associated with the
process used for safety basis development for this project.

# BACKGROUND

The Department of Energy (DOE) has contracted with Bechtel National,
Inc. (BNI) to design, construct, and commission the WTP at Hanford. The
purpose of these facilities is to pretreat and vitrify high-level and
low-activity waste as a means of remediating the existing inventory of
the Hanford tank farms.

# DESIGN BASIS EVENTS

Preparation of the safety and authorization bases and the supporting
design work are

under way in support of ongoing construction. The staff's reviews
addressed the development of the DBEs to support the PSAR for the
pretreatment and HLW portions of the plant. The following discussion
summarizes significant issues related to the development of DBEs and
other technical matters.

**Hydrogen Generation Rates.** Hydrogen is a significant hazard within
the WTP. The

current control strategy is to maintain hydrogen concentrations below 25
percent of the lower flammability limit (LFL). BNI's design approach
involves providing sufficient dilution ventilation during all plant
conditions (e.g., normal operating and upset conditions) and therefore
requires an accurate understanding of hydrogen generation rates within
each WTP vessel. Dilution air is provided by the process vessel purge
(PVP) system.

BNI has chosen to model hydrogen generation rates using a model
developed for the tank

farms. This model was developed in the early 1990s to better understand
flammable gas generation in Tank SY-101. The model is based on
thermodynamic data taken from a single grab sample of Tank SY-103 and
excludes other data produced since that time. BNI believes that these
data conservatively predict hydrogen generation rates. In developing the
estimates for tank-by-tank hydrogen generation rates, however, BNI is
relying on the use of conservative inputs for only some of the
first-order parameters (temperature, total organic carbon, aluminum, and
radionuclide concentrations). This approach may not produce sufficiently
conservative generation rate values since it does not address other
important variables involved in hydrogen generation.

For example, under certain temperature and waste conditions, thermolysis
rather than

radiolysis will be the dominant contributor to the hydrogen generation
rate. An understanding of thermolysis conditions in each tank is
therefore necessary. In particular, when thermolysis is the driving
mechanism, the hydrogen generation rate is exponentially dependent upon
input values for temperature and activation energy. It is unknown
whether a PVP system sized for generation rates at maximum operating
temperature using the current estimation of activation energy (91
kJ/mole) would adequately bound generation rates expected under the
higher temperatures of accident scenarios. Furthermore, evidence exists
to suggest that 91 kJ/mole is not a conservative estimate of the
activation energy within this system.

In at least one instance, the model under-predicted by approximately 25
percent the hydrogen generation within Tank AW-101 compared to that
tank's measured generation rates. This discrepancy is significant as
Tank AW-101 will provide feed during the initial WTP operating period
(Phase 1). Moreover, this discrepancy demonstrates that the current
model may not yield conservative or bounding hydrogen generation rates.
A proper understanding of the driving mechanisms behind hydrogen
generation and the sensitivity of various inputs is required, rather
than an increase in the conservative estimates for some individual
inputs. Additionally, as the PVP system is currently in design and
nearing procurement, a sufficiently conservative predictive model for
hydrogen generation rates needs to be developed in a timely manner.

**Erosion and Corrosion of Pipes and Vessels.** The staff performed a
preliminary review of the project's design activities aimed at
determining procurement requirements for the piping systems. The project
has increased the pipe wall thickness by 0.125 inch to allow for the
predicted erosion of pipes due to the movement of waste containing solid
particles. This allowance is based on the corrosion and erosion of
similar materials in straight pipes within the chemical industry.
However, it does not account for higher erosion in nonlinear segments,
particularly in bends and elbows.

**Cesium Ion Exchange.** The cesium ion exchange process (CXP) poses
significant safety challenges due to the high radiation field resulting
from the accumulation of cesium-137

and the pressurized operation needed to prevent fluidization of resin
particles. BNI is redesigning the CXP columns to address issues related
to hydrogen accumulation. The previous design called for a gas
separation vessel connected to the top of the CXP column via piping.
Concerns regarding the ability of the column to adequately vent hydrogen
during abnormal conditions prompted a redesign. The new design
eliminates the gas separation vessel, instead carrying out the
pressurized purge ventilation functions in an enlarged column headspace.

During a loss-of-power event, two hazardous conditions could impact the
CXP system:

\(1\) buildup of hydrogen gas, resulting in a deflagration; and (2)
overheating of the resin material, leading to an explosion. As with all
vessels, the BNI strategy for preventing a hydrogen deflagration is to
provide an important-to-safety purge to the CXP columns to maintain
headspace concentrations below 25 percent of the LFL. Overheating of the
resin can be prevented by the addition of dilute caustic or water to the
CXP columns. The current design includes an emergency elution
capability; however, use of this capability has not been identified as a
control strategy. While the current control strategy should adequately
manage the overheating hazard, use of the emergency elution capability
would eliminate the hazards associated with organic ion exchange resin
under high radiation fields. It is not clear to the staff why this
capability has been included in the design yet not credited as a
preventive control strategy, and whether its utility for safety purposes
has been fully evaluated.

# INTEGRATED SAFETY MANAGEMENT

The staff observed several indications that there may be a systemic
failure to properly

execute Integrated Safety Management (ISM) within the project. The
following discussion illustrates the potential problems noted by the
staff.

**Feedback and Improvement: Tracking of Design Assumptions Critical to
Safety.**

During the staff's initial visit, design assumptions used during safety
analyses were not being tracked. BNI has taken the initiative to
partially remedy this situation by developing a method for tracking the
closure of unverified safety basis assumptions. The database had not
been fully developed and placed into use at the time of the staff's
second visit, but it was clear that significant effort had been expended
to address this issue. During a follow-on discussion with
representatives of Research and Technology (R&T) and Environment,
Safety, and Health (ES&H), it did not appear that research tasks
necessary for closure of some unverified assumptions were being properly
communicated. Specifically, discussions concerning nitric acid/resin
reactions revealed that ES&H personnel believed the data concerning aged
and air-exposed resins were still pending, while R&T personnel indicated
that the relevant experiments were complete, and no additional studies
were necessary. The staff believes that, to ensure that all unverified
safety basis assumptions are properly closed, BNI's tracking system
should indicate the significance of an assumption to the design, specify
necessary research needs, and prioritize verification activities. This
is in addition to the data tracking and issue resolution capability
already in development.

**Implementation of Safety Controls: Design Features Critical to
Safety.** In discussions with BNI and DOE personnel, the Board's staff
expressed concern that the ISM process may not be successfully capturing
critical design features being relied upon for safety. For example, BNI
determined that it was impossible for CXP resin to come in contact with
sodium permanganate. During analysis, minimal vessel heel volume was
identified as a design feature that would dilute potential improper
additions of sodium permanganate. The staff questioned whether this
design feature would be preserved for implementation in future safety
requirements, for example, to prevent emptying of the vessel and thereby
creating a significantly increased risk of CXP resin contacting sodium
permanganate. Though BNI has developed a system for tracking
safety-related requirements, this minimal heel design feature was not
added to the database properly. As a result of the staff's inquiry, BNI
is now tracking this specific design feature correctly. A closer review
of how the ISM process records other design features and assumptions and
their importance to safety would be beneficial. At the time of the
staffs review, senior BNI ES&H personnel indicated that a management
assessment would be conducted to accomplish this review.

**Analyze Hazards:** Unanalyzed Conditions. The following scenarios
identified by the staff did not appear to be identified and evaluated
during the ISM process:

Loss of Cooling Impacts---Currently, the cooling of vessels in the
pretreatment facility is

not classified as an important-to-safety function; therefore,
emergency/backup power is not supplied to this system. Following a loss
of cooling capability, however, increased tank temperatures would result
from ongoing radioactive decay and chemical reactions. This increased
tank temperature would in turn result in hazards not considered during
the Hazard and Operability Analysis or the subsequent ISM review:

-   *Increased hydrogen generation rates*---The rate of hydrogen
    generation due to thermolysis is exponentially dependent on the
    waste temperature (Arrenhius dependence). The capacity of the PVP is
    currently based on expected maximum operating temperatures. A
    loss-of-cooling accident could result in significantly higher
    temperatures, and thus exponentially higher hydrogen generation
    rates. As a result of the staff's inquiry, BNI is now evaluating the
    impact of this scenario on the PVP design.

-   *Ventilation system loading*---Significant increases in tank
    temperatures would result in an increased vapor and aerosol loading
    to the Process Vessel Ventilation System (PVVS). Preliminary
    calculations performed by BNI in response to the staffs inquiry
    indicate that the increased load resulting from just one tank
    boiling for the duration of a loss-of-offsite-power event (8 hours)
    could challenge the high-efficiency particulate air filtration
    capacity of the PWS.

*Flashing Through Spray Leaks*---Several pipes, jumpers, and vessels
located within the

Feed Evaporation Process system operate under temperature and pressure
conditions such that a spray leak event could cause the waste to flash
to vapor. The possibility of a flashing event for spray leaks was not
evaluated by BNI. As discussed above, the increased vapor load resulting
from a flashing event could significantly increase the release of
radioactive material, and potentially result in a higher dose to the
public and workers than is currently evaluated in the severity-level
calculations.

**Engineering Calculations.** The staff's initial review of DBE and
severity-level calculations revealed that these calculations lacked
technical quality. The weaknesses varied from small mathematical errors
to possibly inappropriate empirical correlations and unjustified
assumptions. As a result of the staff's observations regarding
poor-quality calculations, BNI undertook a detailed management
assessment of this issue. BNI's review showed that all calculations
contained some errors, with an average of 40 errors per calculation.
Ultimately, BNI implemented a more rigorous peer review process,
augmented by external reviewers, to address this issue. The staff
considers BNI's approach regarding poor-quality calculations to be
timely, aggressive, and sufficient to resolve the problems identified.
However, the ability of BNI to produce high-quality technical products
will continue to be challenged given the schedule necessary to support
construction, and consistent management vigilance will be required.