**\[DNFSB LETTERHEAD\]**

August 19, 2003

The Honorable Everet H. Beckner

Deputy Administrator for Defense Programs

National Nuclear Security Administration

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0104

Dear Dr. Beckner:

The staff of the Defense Nuclear Facilities Safety Board (Board)
recently conducted a review of electrical and lightning protection
systems employed at selected defense nuclear facilities at Los Alamos
National Laboratory (LANL). Enclosed is a report detailing relevant
observations resulting from this review.

The Board is particularly concerned about the lightning protection
system at the Weapons Engineering Tritium Facility (WETF). The
Documented Safety Analysis (DSA) for WETF, which was approved in April
2002 but has not yet been fully implemented, identifies the lightning
protection system as a safety-class control for certain accident
scenarios. A study completed in March 2003 analyzing potential lightning
threats to the facility revealed that WETF's existing lightning
protection system could not perform its credited safety function. Months
after the study was completed and more than a year after the DSA was
approved, WETF continues to operate without effective safety controls
for an accident deemed credible by the National Nuclear Security
Administration (NNSA) and LANL. Additionally, even if the lightning
protection system were an effective control, WETF does not appear to be
maintaining this system in a manner commensurate with its approved
functional classification.

The Board is also concerned that a portion of the electrical
distribution system at the Chemistry and Metallurgy Research (CMR)
facility appears to serve a safety-significant function, but has not
been classified as a safety-significant system. The Board understands
that LANL is aware of this situation and is working to resolve it. In
identifying appropriate compensatory measures for this system, NNSA and
LANL should consider the possibility that the facility lifetime for CMR
could be a decade or longer.

Pursuant to 42 U.S.C. § 2286b(d), the Board requests to be informed
within 30 days of receipt of this letter as to NNSA's plans for
establishing and maintaining defensible lightning protection at WETF and
addressing safety system functional classification issues at CMR.

Sincerely,

***John T. Conway***

***Chairman***

c: Mr. Mark B. Whitaker, Jr.

Mr. Ralph E. Erickson

Enclosure

**DEFENSE NUCLEAR FACILITIES SAFETY BOARD**

# Staff Issue Report

August 19, 2003

**MEMORANDUM FOR:** J. K. Fortenberry, Technical Director

**COPIES:** Board Members

**FROM:** B. Broderick

**SUBJECT:** Review of Electrical and Lightning Protection and Detection
Systems for Facilities at Los Alamos National Laboratory

This report documents a review by the staff of the Defense Nuclear
Facilities Safety Board (Board) of electrical and lightning protection
and detection systems employed by Los Alamos National Laboratory's
(LANL) Weapons Engineering Tritium Facility (WETF) and Chemistry and
Metallurgy Research (CMR) facility. Staff members B. Broderick, A. Gwal,
A. Jordan, C. Keilers, and W. White met with laboratory personnel and
representatives from the National Nuclear Security Administration's
(NNSA) Los Alamos Site Office (LASO) to discuss the status of previously
identified issues and to assess the adequacy of lightning protection and
electrical systems relied upon to ensure safety in selected LANL
facilities.

**Weapons Engineering Tritium Facility.** In April 2002, NNSA approved a
Documented Safety Analysis (DSA) for WETF that was intended to comply
with the requirements of Part 830 to Title 10 of the Code of Federal
Regulations. The Technical Safety Requirements derived in the approved
DSA will go into effect after a readiness assessment has verified their
successful implementation. In the interim, the facility is being
operated under the Operational Safety Requirements associated with the
facility's previous Safety Analysis Report. The staff reviewed
electrical systems and lightning controls that are identified and
credited in the new DSA. Relevant observations are discussed below.

*Safety-Class Lightning Protection System*―The approved DSA designates
the lightning protection system at WETF as a safety-class engineered
control to prevent lightning-related accident scenarios that could
result in significant radiological releases. The existing WETF lightning
protection system, whose design and installation were intended only to
meet basic general-service requirements, was called upon to serve the
important dual safety functions of minimizing the possibility of a
facility fire that could impact material at risk, and preventing
lightning current from arcing onto potentially vulnerable process
equipment and storage canisters.

To reduce uncertainties associated with how and to what extent lightning
hazards could adversely impact the facility and its inventory, a
commitment was made in the DSA to perform an engineering study analyzing
the potential effects of lightning on WETF. On March 14, 2003, LANL
submitted the results of this study. One of the conclusions of the study
was that the current lightning protection system, which was designed on
the basis of principles codified in National Fire Protection Association
(NFPA) Standard 780, *Standard for the Installation of Lightning
Protection Systems*, cannot be expected to perform the arc prevention
safety function for which it is credited. A further conclusion was that
the probability of a material release caused by lightning current
"burning through" process equipment piping could be as high as 1.3
xl0^-3^ per year, using conservative assumptions. Although the study did
not conclude that the lightning-related accidents postulated in the DSA
are incredible or adequately prevented or mitigated by other controls,
LANL's cover letter transmitting the study's results requests that the
lightning protection system be downgraded from safety-class to
safety-significant based on its "demonstrated ineffectiveness" to
perform its credited safety function.

Four months after the lightning study and downgrade request were
submitted, NNSA had not responded. This lack of response leaves an
operating nuclear facility with a long remaining lifetime (approximately
40 years) with no defensible control strategy for accident scenarios
deemed credible by LANL and NNSA that have significant consequences.
Consequently, rapid resolution of issues associated with the WETF
lightning protection system would appear warranted.

Additionally, even if the lightning study had supported the assertion
made in the DSA that a lightning protection system compliant with NFPA
780 could perform all its credited safety functions, deficiencies
exhibited by the current system might still render it inadequate. A
letter from the Board dated August 8, 2002, communicated the results of
a review by the Board's staff that identified several instances in which
the lightning protection system was not compliant with NFPA 780. A
subsequent lightning protection inspection performed by LANL identified
21 deficiencies associated with the lightning protection system for
WETF. Most of these deficiencies remain more than a year after the
Board's staff first identified code-compliance issues with this system.
Given that an NFPA 780 compliant lightning protection system is credited
in the DSA and that numerous deficiencies with poorly understood safety
impacts persist, it does not appear that LANL and NNSA have developed a
clear definition of what types and what magnitude of degradation to this
safety-class system would require a suspension of hazardous operations.
In addition, facility modifications completed since the approval of the
WETF DSA do not appear to have been evaluated against requirements in
NFPA 780, and these modifications may have negatively impacted the
functionality of the lightning protection system. Thus it does not
appear that the change control and configuration management practices
applied to the WETF lightning protection system have been commensurate
with the approved functional classification for this system.

*Seismic Qualification of Uninterruptible Power Supply*―The
safety-significant uninterruptible power supply (UPS) system for WETF
provides emergency power to a number of credited safety controls,
including the Inert and Oxygen Monitoring System and the Tritium
Monitoring System. The DSA identifies a performance criterion stating
that the UPS must be able to function during a performance category 2
(PC-2) seismic event. However, a WETF seismic vulnerability assessment
concluded that the UPS would fail in the event of a PC-2 earthquake. A
cost-benefit analysis has determined that seismic upgrades are
warranted, but a firm schedule for their implementation has not been
set. Modifications facilitating seismic robustness for this system ought
to be made in as timely a manner as possible to ensure the availability
of systems that are relied upon during analyzed accident scenarios to
protect worker safety.

*Electrical Calculations*―WETF personnel could not locate a
short-circuit analysis that included and evaluated all relevant facility
electrical equipment and loads. Several short-circuit analyses exist for
subsections of the electrical distribution system. However, a complete,
system-wide analysis is necessary to develop appropriate estimates of
the magnitude of short-circuit current that could challenge equipment
protective devices. Such an evaluation would verify the ability of
installed electrical equipment to mitigate the effects of a worst-case
short-circuit without initiating a fire or explosion. Industry-standard
software that can be used to perform short-circuit analysis is available
at other facilities on site, including the CMR facility.

**Chemistry and Metallurgy Research Facility.** The Department of Energy
(DOE) has authorized the design and construction of a replacement
facility for CMR. Given its status as a limited-life facility, CMR is
operating under a Basis for Interim Operation (BIO) that assumes that
the current facility's core mission will be moved to the replacement
building in 2010. However, the present state of progress in siting and
designing the replacement facility indicates that 2010 may be an
optimistic estimate and that operations may have to continue in CMR for
longer than was assumed by the BIO. The staff reviewed CMR's electrical
and lightning protection systems, being mindful of the limited (but
potentially increasing) service life of the facility. Relevant
observations are discussed below.

*Functional Classification of the Electrical Distribution System*―The
CMR BIO identifies a number of safety-significant structures, systems,
and components (SSCs). Some of these SSCs, including the ventilation
system, rely on electrical power to operate. Although it provides an
important support function for credited safety systems, the electrical
distribution system is currently designated as general-service, which is
not consistent with the functional classifications of systems it
supports.

The CMR ventilation system is relied upon to minimize the concentration
of airborne radioactive material in occupied spaces, and to direct air
flow through the stacks and exhaust filtration to reduce quantities of
radioactive material released from the facility. These safety functions
protect both workers and the public under various accident scenarios.
The ventilation system has no backup power supply; if normal facility
power is lost, it becomes inoperable. CMR personnel stated that the
safety functions provided by the ventilation system are not required
upon loss of power because workers are trained to evacuate the facility.
However, some analyzed accidents (e.g., filtered and contained medium
wing-wide fires) credit the ventilation system for more than worker
protection. As such, it is not clear that this worker egress action
alone eliminates the need for ventilation system operation and the power
to run it during all scenarios, including those in which loss of power
could be a consequence of the accident.

Subsequent to the staffs review, LANL personnel reevaluated the current
general-service designation of the electrical distribution system and
concluded that site standards (in the form of Laboratory Implementation
Requirements \[LIRs\]) would require this system to be functionally
classified as safety-significant. The laboratory is working to determine
why this system was originally classified in a manner that appears
inconsistent with both laboratory requirements and DOE expectations, and
to discern what compensatory actions are appropriate.

*Functional Classification of Emergency Lights*―The continuous air
monitors (CAMS) are another example of credited safety-significant
controls that do not have backup power. In this case, the worker
evacuation action that results from a loss of power does eliminate the
need for the CAMs' safety function under facility blackout conditions.
However, the timely and safe evacuation of CMR personnel (the action
eliminating the need for the CAMs' safety-significant function) requires
emergency lighting. Thus, the emergency lights and their dedicated
backup power sources appear to serve a safety-significant function, and
ought to be functionally classified accordingly.

*Cable Condition Monitoring*―Many of the electrical cables used in the
CMR facility are approaching or past their intended service life. As
cables age, their electrical characteristics may degrade past an
acceptable level, thereby decreasing the reliability of both the cables
and the systems they support. Because aged cables provide power for a
number of facility safety systems, it may be prudent to consider
incorporating a cable condition monitoring capability into the existing
CMR preventative maintenance regime. Cable condition monitoring could
improve the service life and reliability of electrical equipment by
detecting damaged and deteriorating power and instrumentation and
control cables prior to equipment failure. This type of capability could
prove particularly useful and appropriate if the electrical system is
reclassified as safety-significant.

*External Oil-Filled Transformers*―A number of oil-filled transformers
that service CMR are located around the exterior of the facility. The
type of mineral oil used by these transformers for cooling and
insulation is a flammable material. Given the physical locations of
these transformers, a fire caused by transformer leakage or failure
could potentially impact the building structure or collocated electrical
equipment that provides power for facility safety systems. It was not
clear that this hazard and its potential impacts had been well
characterized and evaluated. To address this issue, CMR personnel have
decided to replace the existing oil with an appropriate type of less
hazardous, fire-resistant material.

**Site-wide Electrical and Lightning Issues.** The following general
electrical and lightning issues are of a site-wide nature.

*Laboratory-wide Lightning Detection*―Weather can vary widely across the
laboratory's 43 square miles because of LANL's topography, and storms
sometimes form directly above nuclear and explosive facilities that
house potentially lightning-sensitive materials and operations. Without
the benefit of a site-wide lightning detection and warning system, some
nuclear and explosive facilities with a compelling safety interest in
the timely notification of impending lightning activity must rely on
either audio/visual observations or information supplied by localized
lightning detection systems (such as that one used by the Dynamic
Experiments Division). These localized systems are designed to service
only selected sections of the laboratory, and it is not clear that they
can provide adequate coverage for all potential on-site users.

It does not appear that significant progress has been made in
investigating or implementing an effective laboratory-wide lightning
detection system since this subject was broached in a report dated
September 22, 1999, and reiterated in a subsequent report dated August
6, 2002.

*Electrical Safety and Lightning Protection Expertise at Los Alamos Site
Office*―LASO has no subject matter experts assigned to provide oversight
for electrical safety or lightning protection activities. In the past,
LASO had staffed this important function with an engineer from DOE's
Albuquerque service center. However, the retirement of this individual
has left the service center unable to provide this capability. It is
difficult to see how LASO will be able to assess the adequacy of LANL's
electrical safety program and lightning protection systems effectively
without a knowledgeable and experienced individual (or individuals)
assigned to perform oversight in these areas.

*Status of Previous Issues*―LANL has made several significant positive
strides in addressing issues raised previously by the staff in the areas
of electrical safety and design requirements for new safety-related
electrical systems:

-   In the interest of establishing a comprehensive and effective
    laboratory-wide electrical safety program, LANL developed an LIR
    that defines roles and responsibilities for individuals whose job
    functions have a nexus to electrical safety. The LIR also addresses
    necessary training for personnel and the development of controls for
    electrical hazards. Additionally, LANL has assembled an electrical
    safety committee that serves as the site-wide electrical Authority
    Having Jurisdiction. This committee conducts division-level
    self-assessments; participates in critiques of electrical incidents;
    and develops training classes for electrical safety officers,
    electricians, and researchers. The electrical safety committee has
    also developed methods of approval for equipment and components that
    are not listed by a Nationally Recognized Testing Laboratory.
    Evaluations for about 50,000 of these nonlisted items are expected
    to be completed by the end of September 2003.

-   The laboratory has added a section to the LANL Engineering Standards
    Manual (Manual) that establishes expectations and requirements for
    the design of new safety-class and safety-significant electrical
    systems for Hazard Category 2 and 3 nuclear facilities. With this
    addition, the Manual effectively captures relevant guidance related
    to electrical system design contained in DOE Guide 420.1-1,
    *Implementation Guide for Nonreactor Nuclear Safety Design Criteria
    and Explosives Safety Criteria*.