# Presentation: 898154

## Department of Energy Best Practices Workshop
H-Completion Criticality Safety Improvement
Phil Breidenbach, ManagerEnvironment, Safety and Healthand Mike Borders, Manager
F Disposition Project
Washington Savannah River Company

September 12-13, 2006

**Department of Energy Best Practices Workshop**
**H-Completion Criticality Safety Improvement**
**Phil Breidenbach, Manager****Environment, Safety and Health****and ****Mike Borders, Manager**
**F Disposition Project**
**Washington Savannah River Company**
**September 12-13, 2006**

**ISM at the Savannah River Site**

**Notes:**
Introductions

## Nuclear Safety

**Washington Savannah River Company (WSRC) is committed to excellence in all aspects of safety, especially nuclear safety.  **

**Savannah River Site**

- 2

**Notes:**
SRS Description
Integrated nuclear material process site covering 300 square miles with 25 major facilities
H-Canyon Description
Large, complicated nuclear chemical processing plant
Dissolve nuclear materials and purify/concentrate Uranium solution
No criticality events on SRS
Been successful for 50 years
Like mutual funds though – past performance is no guarantee of future results

## The Situation in H-Completion

**Too many errors**
- Concerns primarily in the area of criticality safety

**Production**
**Rate**

**Production rate doesn’t matter, success is event free performance.**

- 3

**Notes:**
Real goal is to decrease frequency and severity of criticality related issues
If you’re not improving, you’re degrading
We had stopped improving in this area
Notice production rate increased dramatically over the last 2 years
I could build a statistical case that each event was independent and thus a frequency argument is invalid (production rate doesn’t matter)
Even if you don’t buy that, I can tell you that from our customers perspective, production rate doesn’t matter, success is event free performance
As a result we took dramatic and aggressive action and the improvements have been dramatic
Today we will share with you what we feel worked

Purpose:  Describe the problem and make the first key point

## Significant 2005 Events

**Charge of dissolver before a criticality safety calculation was complete**
- Caused by inadequate communication and an inadequate procedure
**Potential transfer to an evaporator of solution exceeding allowable grams of Uranium**
- Caused by procedure noncompliance and an unnecessarily complex procedure

- 4

**Notes:**
That said we have not nor have we ever been perfect
Criticality safety is an administrative program created and executed by humans
We have always had issues that need to be investigated and actions need to be taken to prevent reoccurrence
Because this is so important we treat anything other than perfect execution very seriously
I’m going to now describe what I feel are the 2 most serious events we have had recently

Purpose:  Understand the type of events

## Improvement Actions

- Immediate actions
- Two-day stand down started June 9
- Added senior engineer with criticality expertise
- Increased involvement of the Criticality Safety Committee
- Longer-term actions
- Top-to-bottom review of the H-Completion Project (HCP) criticality safety program
- Review of all operating procedures for fissile material
- Conducted level of knowledge testing for HCP personnel relative to criticality safety
- Reevaluate cross qualification initiatives to ensure adequate knowledge and proficiency
- Strengthened the assessment process associated with criticality safety
- Authorized funding for implementation of engineered controls to replace some administrative controls
- Initiated integrated root cause analysis of recent events

**After the dissolver event**

- 5

**Notes:**
Saw it coming (robust self assessment process), took action, couldn’t head it off
2 day stand down with 650 people
Reviewed events, causes and corrective actions
Asked shift supervision to report back on key questions
Why is this happening?
What do we need to do to fix it?
What we thought was thorough and aggressive response turned out to be inadequate

Purpose:  show that we tried to fix the problem while operating

## Improvement Actions (Contd.)

**After the evaporator event**
- Suspended fissile operations July 1
- Management Control Plan approved July 13, which described the causes of the problems and the actions that would be complete prior to resuming fissile operations

**Some problems can’t be fixed on the run.**

- 6

**Notes:**
Another event on July 1
Improvement actions complete to date were inadequate to prevent events
Needed to accelerate completion of improvement actions
Some things can’t be fixed as you go

Purpose:  Second key point

## Common Causes

**Inadequate disciplined operations**
- Procedure compliance
- Specificity of communication
**Inadequate procedures**
- Excessive and unnecessary procedural complexity
- Inadequate defense in depth in procedures
**Inadequate leadership**
- Accountability

- 7

**Notes:**
What was wrong?

Purpose:  Explain the causes

## Improvement Strategy

**Operational pause to focus on causes and corrective actions**
**Prioritized system-by-system review**
**Operator / First Line Manager (FLM) / System Engineer teams formed for every system**
- System engineers put on shift to work with operators
**Managed as a project from the War Room**

- 8

**Notes:**

Purpose:  Describe the strategy

## Improvement Actions

**People**
- Disciplined operations leadership sessions – focus on expectations and accountability
- Shift proficiency demonstration
- Senior supervisory watch (SSW)
**Procedures**
- Criticality control review
- Procedure review
**Plant**
- System walkdowns
- Distributed Control System (DCS) review

- 9

**Notes:**
This addresses people, procedures, and plant
Short description of each key component

Purpose:  Describe our response

## Improvement Examples

**Reduced complexity**
**Improved use of DCS**
**Increased defense in depth**
**Improved DCA**

**People won’t consistently achieve excellence without excellent defenses.**

- 10

**Notes:**
Refer to improvement examples

Purpose:  Show examples of flawed defenses and good defenses

## Removing Complexity

**Fissile Material Tank Transfer**
**Before**
- Poor procedure format increasing likelihood of calculation error
**After**
- Simple table that increases chance of success

- 11

**Notes:**
People won’t consistently achieve excellence without excellent defenses
Puts stress on “Perform Work” (the people)
We had a problem with controls and execution of controls – not hazard ID

Purpose:  Third key point

## Removing Complexity—Before

_**Calculate the mass balance in Tank 11.2**_
- RECORD** Tank 8.3, 8.3/11.1 (if EU was blended), 8.3/15.2 (if 15.2 was blended), or 8.3/12.1 (if PuCs was blended) and Tank 11.4 Liquid Level data.**
**	****Tank 8.3, or 8.3/11.1, or 8.3/12.1, or 8.3/15.2 lbs transferred to Tank 11.2 from NOP 221-H-4212, Step 5.1.5 or NOP 221-H-225, Step 5.3.4, or NOP 221-H-4218, Step 5.3.4 or NOP 221-H-227, Step 5.3.4.****	**_**	**__**	**_**(**B**)**
**	****Tank 11.4 initial lbs from NOP 221-H-4212, Step 5.1.2 or NOP 221-H-225, Step 3.1.7, or NOP 221-H-4218, Step 3.1.7, or NOP 221-H-227, Step 3.1.6.**_**	**_**(**C**)**
**	****Final 11.4 weight factor (HN-16B)**_**	**_
**	****Final 11.4 lbs**_**	**_**(**D**)**
- CALCULATE** the Tank 11.4 increase.**
- Tank 11.4 Increase = Final 11.4 lbs (**D**) – Initial 11.4 lbs (**C**)
- = (	lbs)-(	lbs)
- = _	_lbs (**E**)
**3.****	**CALCULATE** the mass balance around Tank 11.2.**

- 12

## Removing Complexity—After

- 13

## Improved Use of DCS

**Improved Use of DCS**

**Receipt of Low Activity Waste in Evaporator Feed Tank 8.7**

| Complexity Indicator | Before | After |
| --- | --- | --- |
| Total pages | 21 | 10 |
| Total procedure steps | 100 | 60 |
| Total criticality safety steps | 33 | 13 |
| Total criticality safety calculations | 11 | 1 |
| Total attachments for data collection | 8 | 1 |

- 14

**Complexity is an enemy – complex administrative controls fail.**

## Increased Defense in Depth—Global Changes

**Before**
- Inconsistent use of Independent Verification and Second Person Verification
- FLM engagement not required at key points in evolutions
**After**
- Independent Verification (IV) in Critical data collection
- Second Person Verification (SPV) of calculations
- FLM verification at key transition points

- 15

## Improved DCA

**Move from Administrative Controls to Engineered Controls**
- Created DCS alarms to augment operator rounds / administrative actions
- Credited existing alarms versus administrative operator actions

- 16

**Notes:**
Shiftly requirements changed to Daily or Weekly

Credited existing alarms for tank level, evaporator level, and sump levels in OF-H

Created depletion rate alarm for 2nd U operation

## Results

**17 systems reviewed and released for operations**
**465 procedures reviewed**
- 207 procedures containing criticality safety steps revised
- 20 procedures eliminated
- Procedural complexity reduced
- Defense in depth increased
**200 training sessions conducted for 120 individuals**
**Double Contingency Analysis (DCA) improvements**
- Credited existing engineered controls versus administrative controls
- Created DCS alarms to augment administrative controls
- Tightened implementation of DCA controls in procedures

- 17

**Notes:**
17 systems released for operation
Pause started July 2
1st system released July 23 (LEU Loading)
17th system released September 15 (1st Cycle)

Purpose:  Summarize what we did

## Results (Contd.)

**“****Disciplined operations in H-Canyon had made a notable improvement since the last ISME.”**
_**WGI Independent Review, 1/06**_
**“****Significant improvement was noted in Conduct of Operations within the**** H-Completion project since the July 2005 review...” **
_**DOE OA Review, 2/06**_
**“****H-Canyon managers and operators are committed to rigorous and formal conduct of operations.  At the H-Canyon , facility management has effectively communicated its expectations for meeting conduct of operations requirements. The improvements are evident.”**

**Results (Contd.)**

- 18

**Notes:**

Purpose:  Show successful change

## Results (Contd.)

- 19

**Notes:**

Purpose:  Reinforce successful change

## Long-term Improvements

**Continue the shift from administrative controls to engineered controls**
**Restructure the DCA for event free execution**
**Continue the focus on self assessment**

- 20

**Notes:**
Sump Controls
Need to change to passive engineered control
DCA
Controls need to be restructured
Move to engineered controls where possible
Move controls closer to what needs to be protected
Strategy
Break into manageable pieces
Prioritize based on safety/operational benefit
Redevelop using team composed of operations, engineering, and criticality safety experts
Purpose:  Remember slide 3 – if not improving, declining.

## Learning Points

**Production rate doesn’t matter – success is event free performance**
**Some things can’t be fixed while operating**
**People can’t consistently achieve excellence without excellent defenses**
- You have to choose controls wisely
- Complexity is an enemy

- 21

**Notes:**
Walt Disney, “We strive for perfection but we accept excellence.”

Purpose:  Reinforce the 3 key points

## Questions

**Phil Breidenbach **
**philip.breidenbach@srs.gov**
- (803)952-9897
**Michael Borders **
**michael.borders@srs.gov**
- (803)952-4395

- 22