**\[DNFSB LETTERHEAD\]**

April l0, 2003

The Honorable Linton Brooks

Acting Administrator

of the National Nuclear Security Administration

U. S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

Dear Ambassador Brooks:

The staff of the Defense Nuclear Facilities Safety Board (Board)
recently observed significant deficiencies in the current safety bases
for some of Lawrence Liver-more National Laboratory's (LLNL) defense
nuclear facilities (most notably the Plutonium Facility, Building 332).
The Department of Energy (DOE) has also identified many of these
weaknesses and has directed LLNL to correct them. In some cases,
however, lack of vigorous DOE oversight has allowed these deficiencies
to exist for years. As such, DOE should ensure that these identified
weaknesses are adequately addressed in a timely manner or establish
appropriate compensatory measures until deficiencies are adequately
addressed.

Additionally, the Board's staff observed deficiencies related to
maintaining mass limits for hazardous chemicals in non-nuclear
facilities and the ability of nuclear facilities to accurately and
effectively assess the potential adverse impacts posed by external
hazards from non-nuclear facilities. One non-nuclear facility was found
to have more than twice its prescribed limit of a hazardous chemical.
This lack of vigilance in maintaining inventory limits and coordinating
site-wide hazard assessments could result in higher than expected
consequences or the existence of unanalyzed hazards.

The enclosed issue report provides additional details regarding these
observations. Given the significance and persistence of the identified
deficiencies, it appears that further attention is necessary to ensure
the complete and timely remediation of these weaknesses and the
development of rigorous and comprehensive Documented Safety Analyses
that fully comply with the requirements of Part 830 to Title 10 of the
Code of Federal Regulations, *Nuclear Safety Management*. Therefore,
pursuant to 42 U.S.C. § 2286b(d), the Board requests a report within 60
days of receipt of this letter that documents how DOE will resolve
issues identified in the enclosed report.

Sincerely,

***John T. Conway***

***Chairman***

c: The Honorable Jessie Hill Roberson

Mrs. Camille Yuan-Soo Hoo

Mr. Mark B. Whitaker, Jr.

Enclosure

**DEFENSE NUCLEAR FACILITIES SAFETY BOARD**

# Staff Issue Report

March 25, 2003

**MEMORANDUM FOR:** J. K. Fortenberry, Technical Director

**COPIES:** Board Members

**FROM:** B. Broderick

**SUBJECT:** Hazard Assessment and Control at Lawrence Livermore
National Laboratory

This report documents a review of hazard assessment and control at
Lawrence Livermore

National Laboratory (LLNL), conducted by members of the staff of the
Defense Nuclear Facilities Safety Board (Board). Staff members W.
Andrews, F. Bamdad, B. Broderick, and J. Shackelford met with
representatives of the National Nuclear Security Administration's (NNSA)
Livermore Site Office (LSO) and LLNL to discuss the content of safety
basis documentation and implementation of controls at several defense
nuclear facilities and selected non-nuclear facilities whose operations
could potentially impact nuclear facilities.

**Background.** Documented Safety Analyses (DSAs) that comply with the
mandates of

Part 830 to Title 10 Code of Federal Regulations, *Nuclear Safety
Management*, are required to be submitted for applicable LLNL defense
nuclear facilities by April l0, 2003 (October 10, 2003, for the
Plutonium Facility, per NNSA extension). In many cases, these DSAs will
contain updated or revised hazard and accident analyses and associated
modifications to the set of safety controls identified to address
facility hazards. With preparation of these documents being in various
stages of development, the Board's staff conducted a review of current
safety basis documentation to serve as a baseline for the assessment of
future DSAs, and to provide comments and observations relative to
existing Safety Analysis Reports (SAR) (under which facilities are
currently operated) that could prove beneficial in the generation of
DSAs and subsequent annual updates. The staff focused special attention
on evaluating the following areas to support this objective: existing
hazard and accident analyses as they pertain to the derivation of hazard
controls; the configuration, capabilities, and adequacy of structures,
systems, and components (SSC) that figure prominently in the control
schemes designed to prevent or mitigate postulated accident scenarios;
and potential impacts on defense nuclear facilities that could result
from hazards associated with the operation of LLNL's non-nuclear
facilities.

**Potential Inadequacies in Existing Safety Bases at Nuclear
Facilities.** The Board's staff reviewed the current SARs for the
Plutonium Facility (Building 332), the Hardened Engineering Test
Facility (Building 334), and the Material Management Source Vault
(Building 23lV), in addition to conducting walkdown assessments of
safety-related SSCs employed in these facilities to prevent or mitigate
accident scenarios. Relevant observations are discussed below.

*Building 332*―The Board's staff reviewed the current facility SAR and
Technical Safety

Requirements (TSRs), dated August 2002, and noted a number of
inadequacies and weaknesses. These inadequacies included postulated
accident scenarios for which unmitigated consequences had been evaluated
to exceed the off-site evaluation guidelines, but for which no
safety-class controls had been identified. Additionally, it was observed
that in some cases, SSCs had been implicitly credited with performing a
safety function, but had not been assigned a formal functional
classification. The staff also observed that support systems for some
safety-class and safety-significant SSCs did not carry a functional
classification commensurate with the classification of the SSCs they
supported. The following specific examples illustrate the issues
identified by the staff:

-   The hazard analysis for the unmitigated rupture and subsequent fire
    of a waste drum containing transuranic waste had resulted in
    consequence estimates that exceeded the off-site evaluation
    guidelines by a factor of 20. However, no safety-class or
    safety-significant controls had been identified for this scenario.

-   The fire suppression system for Building 332 had been functionally
    classified as safety class. Water essential for the operation of
    this system was being provided by a combination of off-site sources
    that are not under direct LLNL control and an emergency water source
    housed in the facility basement. Given the critical importance of
    preventing the development of tire-related accident sequences in
    this facility, it did not appear that all reasonable steps had been
    taken to understand, justify, and ensure the adequacy, in terms of
    reliability and availability, of the Building 332 fire suppression
    water supply. In particular, the boundaries of this safety-class
    system are not well defined in current safety basis documentation.
    Furthermore, the compressed air system that is necessary to provide
    the motive force for the emergency water source had not been
    functionally classified with respect to this important safety
    function. The compressed air system also supported other
    safety-related features at the facility.

-   The fire analysis had not developed an appropriate unmitigated
    analysis for a postulated fire in a certain area of Building 332
    where the material at risk could far exceed that assumed in the
    generic unmitigated room fire scenario. As a result, important
    safety controls may not have been identified.

These specific issues, as well as the staffs overall concerns regarding
the safety basis, were communicated to NNSA and the contractor. In many
cases, the general concerns articulated by the staff had been identified
by NNSA as weak or problematic areas in Building 332 safety bases dating
as far back as January 1995. However, many previously identified
deficiencies continue to exist in the September 2002 SAR. These
deficiencies were numerous enough to prompt NNSA to establish 33
conditions of approval in its Safety Evaluation Report (SER), some as
significant as directing the contractor to "completely redo the hazards
analysis" to ensure that all hazards had been appropriately described
and analyzed. The SER sets the expectation that these conditions of
approval are to be met in the forthcoming rule-compliant DSA. However,
the significance and persistence of these deficiencies suggest that
increased vigilance may be warranted on the part of NNSA and the
contractor to ensure that these weaknesses are corrected in a timely
manner or that appropriate compensatory measures are established.

*Building 231V*―The staff reviewed the facility SAR dated November 2001,
which designated Building 231V as a Hazard Category 3 nuclear facility,
but identified no safety-significant SSCs to control facility hazards.
In its April 2002 SER, NNSA had approved the facility's SAR with 10
conditions of approval, one of which directed the contractor to
functionally classify the building's structure, vault ventilation system
(including fume hood exhaust and high-efficiency particulate air
\[HEPA\] filters), and vault continuous air monitors as
safety-significant SSCs. In May 2002, the facility submitted and
subsequently withdrew a nominally rule-compliant DSA that did not
address important NNSA conditions of approval, including the functional
reclassification of SSCs and the development of TSRs to protect these
controls. It appeared that NNSA had not adequately followed up to ensure
that these required modifications were being implemented. As a result,
more than 10 months had elapsed without the necessary conditions of
approval having been met and without reasonably assertive oversight
having been exercised by NNSA.

*Building 334*―The staff reviewed the current Building 334 SAR, dated
January 2000.

Given the existing limitations on operations and material forms and
quantities allowed in this facility, as mandated by the January 2000
SAR, it appeared that the current safety basis was adequate. The staff
noted, however, that thermal testing conducted in two specially
engineered thermal chambers, one of the facility's most hazardous
operations, had ceased because of prohibitive budgetary and security
constraints, yet the safety basis still allowed these operations to take
place. The contractor committed to formally precluding the use of
thermal testing chambers while special nuclear material was present in
the facility by instituting a TSR-controlled lockout-tagout
administrative control in the forthcoming DSA.

**Cognizance and Control of External Hazards.** The Board's staff
reviewed identified external hazards to nuclear facilities and walked
down a number of non-nuclear facilities. These included the Chemical and
Material Science Isotope Laboratories (Building 151), the
Microfabrication Laboratory (Building 153), and the Materials
Fabrication Shop (Building 321). The intent was to understand and
evaluate the external hazards posed by accidents in these facilities to
nuclear facilities. The staff also reviewed the controls and protocols
in place in these non-nuclear facilities to prevent or mitigate
accidents that could affect nuclear facilities.

*Inventory Control in Non-Nuclear Facilities*―Hazard Analysis Reports
(HARs) comprise the safety bases for non-nuclear facilities. HARs set
inventory limits for materials that could cause adverse chemical and
toxicological impacts on nuclear facilities and codify processes
designed to ensure that these inventory limits are satisfied.

The HAR for Building 153, dated January 2001, identified a mass limit of
15.87 lb for the amount of chlorine that could be stored in the
facility. In February 2003, it was discovered that the actual mass of
chlorine in Building 153 was approximately 33 lb, and that this
condition had existed even prior to the approval of the 2001 HAR. Not
only had the amount of chlorine exceeded the approved mass limit since
the HAR's inception, but nearly 40 separate inventory checks and
continuous facility use of the laboratory-wide chemical inventory and
tracking system, ChemTrack, had failed to identify this situation.

The prolonged chlorine over-mass condition in Building 153, as well as
other recent inventory control-related occurrences, suggests that
increased vigilance is required in non-nuclear facilities to ensure that
consequences associated with an accident in one of these facilities
would not exceed the expected severity and invalidate carefully
developed emergency preparedness plans and procedures aimed at
mitigating such adverse effects, including impacts on nuclear
facilities. The Building 153 event also demonstrates potential safety
benefits that could be associated with the development or identification
of a system better suited to the safety-related role of chemical
inventory control and management than the currently employed ChemTrack
system, which was not designed to serve this purpose.

*Integration of Hazard Assessments*―The Building 332 SAR identifies a
chlorine release from the local Zone 7 water treatment plant as the most
significant off-site, external chemical hazard to this facility. The
staff inquired as to whether a memorandum of agreement had been
established with the owners of the treatment plant to ensure that
personnel from LLNL and Building 332 would be notified in a timely
manner should a chlorine release event occur. However, managers and
authorization basis personnel for Building 332 were unable to provide
details relevant to this situation. Upon further inquiry by the staff,
the site fire chief indicated that the Zone 7 plant had altered its
treatment process more than a year ago such that the facility no longer
posed a threat to Building 332 or any other nuclear facility for which
this external hazard may have been identified. The lack of coordination
and integration between hazard assessments in this example had resulted
in an inefficient expenditure of resources to analyze and address a
hazard that no longer existed. In this instance, the lack of
coordination had not degraded the completeness or conservatism of the
existing analysis. However, the staff noted that the lack of overall
coordination at the site could result in undesirable consequences if a
new hazard were introduced, and a similar lack of coordination and
integration resulted in a failure to address the issue.