Peter S. Winokur, Chairman

Jessie H. Roberson, Vice Chainnan

John E. Mansfield

Joseph F. Bader

DEFENSE NUCLEAR FACILITIES

SAFETY BOARD

Washington, DC 20004-2901

June18, 2012

The Honorable Thomas P. D'Agostino

Administrator

National Nuclear Security Administration

U.S. Department of Energy

1000 Independence Avenue, SW

Washington, DC 20585-0701

Dear Mr. D'Agostino:

The Defense Nuclear Facilities Safety Board (Board) has reviewed the approved safety

basis for the Plutonium Facility (PF-4) at Los Alamos National Laboratory (LANL) and

concludes that for one accident the mitigated dose consequences to the public exceed 100 rem

total effective dose equivalent (TEDE), which would require additional safety controls for the

facility. The Board's analysis differs from Revision 1 ofthe 2011 Documented Safety Analysis

(DSA) by LANL that presents a mitigated offsite dose of 23 rem TEDE. A detailed review by

the Board's staffidentified a number of deficiencies in the technical basis that supports the 2011

DSA, including concerns with the quality review process for documents and analyses. The

enclosed report provides the results ofthe staff's review.

The Board issued Recommendation 2009-2, Los Alamos National Laboratory Plutonium

Facility Seismic Safety, on October 26, 2009, to address the potential consequences associated

with seismically-induced events at PF-4 and requested that the Department of Energy develop

and implement an acceptable seismic safety strategy. The mitigated consequences associated

with the seismically-induced fire scenario were two orders of magnitude higher than the

Department of Energy evaluation guideline of 25 rem TEDE. Subsequently, the National

Nuclear Security Administration (NNSA) and LANL personnel implemented near-term

compensatory measures to reduce seismic risk, identified and implemented new safety controls,

completed a series of physical upgrades to the PF-4 building structure, and developed a longterm plan to seismically upgrade the ventilation and fIre suppression systems.

Laboratory personnel also refined the analysis of the seismically-induced fire scenario to

support the 2011 DSA that was approved by the NNSA's Los Alamos Site Office (LASO) in

October 2011 and is in the process of being implemented. The Board's staffidentified multiple,

substantial deficiencies of a non-conservative nature in this refmed analysis, specifically with the

technical basis for selection of key input parameters, analytical assumptions, and methodologies.

The Board's estimate ofthis accident's mitigated dose consequence in excess of 100 rem TEDE

accounts for conservatism in the leak path factor and respirable fraction for one material.

Additional use of appropriately conservative parameters would further increase the dose

consequence for this postulated accident. The staff also identified issues with the quality

assurance process that was applied to documents and analyses that support the DSA. In
The Honorable Thomas P. D'Agostino Page 2

particular, key DSA input documents were not independently reviewed as required by laboratory

procedures. The Board has discussed many ofthese issues with NNSA in its review of previous

DSA revisions.

Contractor development and submission of high quality DSA documents in accordance

with Title 10 Code ofFederal Regulations Part 830, Nuclear Safety Management; and thorough

and critical review by NNSA, are fundamental elements for ensuring safe operations at defense

nuclear facilities. The issues identified above and in the enclosed report require prompt action

by NNSA. Therefore, pursuant to 42 U.S.C. § 2286b(d), the Board requests a briefing and

report, within 30 days ofthe receipt ofthis letter, which contain the following:

1. NNSA plans for providing a sound and technically justifiable Safety Basis that

includes correction ofthe non-conservative deficiencies identified in the enclosed

report.

2. Necessary actions to ensure that quality assurance requirements are adequately

implemented at LANL for Safety Basis development.

3. NNSA actions to ensure Safety Basis review and approval processes are perfonned

with sufficient rigor to prevent technically deficient Safety Bases from being

approved.

Sincerely,

QCW../)-

Peter S. Winokur, Ph.D.

Chairman

Enclosure

c: Mr. Kevin W. Smith

Mrs. Mari-Jo Campagnone
DEFENSE NUCLEAR FACILITIES SAFETY BOARD

StaffIssue Report

May 8,2012

MEMORANDUM FOR:

COPIES:

FROM:

SUBJECT:

T. J. Dwyer, Technical Director

Board Members

F. Bamdad, T. Chapman

Documented Safety Analysis and Post-Seismic Accident

Consequences, Plutonium Facility, Los Alamos National Laboratory

This report documents a review by the staff of the Defense Nuclear Facilities Safety

Board (Board) of the 2011 Documented Safety Analysis (DSA) for the Plutonium Facility (PF-4)

at Los Alamos National Laboratory (LANL). The review included assessment of the 2011 DSA

update and revisions, the safety evaluation report developed by the National Nuclear Security

Administration's (NNSA) Los Alamos Site Office (LASO) to approve the DSA, as well as an

on-site review performed during the week of March 19, 2012. Follow-up discussions with

LANL and NNSA personnel occurred on April 26, 2012. Staffmembers F. Bamdad,

B. Broderick, T. Chapman, T. Davis, C. March, J. Pasko, and R. Verhaagen participated in

elements of the review.

Background. In December 2008, the LASO manager approved the first major update to

PF-4's safety basis since 1996. The 2008 DSA postulated a seismically-induced fue scenario for

PF-4 and reported a mitigated offsite dose consequence of greater than two thousand rem total

effective dose equivalent (TEDE) for this event. As a result of this large mitigated offsite

consequence, the Board issued Recommendation 2009-2, Los AlamosNational Laboratory

Plutonium Facility Seismic Safety. In this Recommendation, the Board urged NNSA and LANL

to execute both immediate and long-term actions to reduce the risk posed by a seismic event at

PF-4.

In response to the Board's Recommendation, NNSA and LANL personnel: (1) executed

a series of near-term compensatory measures designed to reduce the risk of a seismicallyinduced fire at PF-4; (2) identified a number of new safety-class engineered controls, including

seismic cutoffswitches for electrical power, seismically qualified material storage safes, and

fire-rated material storage containers; and (3) developed a Project Execution Plan for longer-term

upgrades to enable the confmement ventilation and fire suppression systems to perform safetyclass functions following a Performance Category (PC)-3 seismic event.

In addition to physically upgrading the building structure and implementing new safetyclass engineered controls, laboratory personnel completely reanalyzed the seismically-induced

fire scenario in the 2011 DSA. The new analysis in the 2011 DSA concludes that the mitigated

offsite dose consequence for the seismically-induced fire scenario is 23 rem TEDE, which is less
than the Department of Energy (DOE) Evaluation Guideline of 25 rem TEDE. This analyzed

offsite dose consequence is two orders of magnitude lower than the mitigated offsite dose

consequence calculated by the 2008 DSA. The roughly 1oo-fold decrease results from changes

to four accident analysis parameters: the quantity of material at risk, airborne release fractions,

respirable fractions, and leak path factor (LPF). Revision 1.0 of the 2011 DSA was approved by

LASO on October 13, 2011, and the DSA and its associated technical safety requirements (TSR)

are currently scheduled to be implemented by June 25, 2012.

Justification for Continued Operations. Subsequent to the Recommendation and

efforts by LANL that considerably reduced offsite dose consequences, LANL engineers

evaluated the impact ofthe most recent update to the site's Probabilistic Seismic Hazard

Analysis (PSHA). These PSHAs are conducted approximately every ten years to update the

threats from earthquakes. This latest PSHA predicted an increase in the magnitude ofseismic

ground motions, leading to severe seismic accident scenarios, such as facility collapse, becoming

more credible. A Justification for Continued Operations (JCO) that addressed these new severe

seismic accident scenarios was approved by NNSA in July 2011. This JCO supplements the

DSA as the governing safety basis for the facility. It will serve as the safety basis of record until

superseded by implementation of the 2011 DSA.

In response to the discovery that critical structural elements of PF-4 were seismically

vulnerable, NNSA and LANL personnel initiated and successfully completed physical upgrades

that addressed all known structural vulnerabilities. (However, further seismic analysis is in

progress that could reveal additional vulnerabilities.)

Path Forward. Once implementation of the 2011 DSA is independently verified, LANL

personnel intend to retire the seismic Jeo. Consequently, the Board's staff carefully reviewed

the four accident analysis parameters that serve as the underpinning of the 2011 DSA: the

quantity of material at risk, airborne release fractions, respirable fractions, and LPF. The

Board's staff noted a substantial number of issues, discussed below, that challenge the technical

basis for these parameters and, consequently, for the 23 rem TEDE mitigated offsite dose

consequence reported in the 2011 DSA.

Leak Path Factor Analysis. The 2008 DSA postulated that a seismically-induced fire

would engulf the entire laboratory floor of PF-4 and generate sufficient thermal energy to drive a

large fraction of aerosolized material out of the building resulting in a LPF of 40 percent. The

2011 DSA uses a 3 step approach to derive a new, lower LPF for the reanalyzed seismicallyinduced fire scenario. The first step analyzes historical data related to the number of fIres

reported following earthquakes in California and Alaska to develop a probabilistic argument that

seismically-induced fires will be limited to some number of individual laboratory rooms rather

than affecting the entire laboratory floor. The second step uses Consolidated Model of Fire and

Smoke Transport (CFAST) software to model fires and develop thermal and material transport

profIles as a function of time for selected laboratory rooms where seismically-induced fues were

assumed to be present. The fmal step uses Methods for Estimation of Leakages and

Consequences of Releases (MELCOR) software to calculate the fraction of material released

from the building (i.e., the LPF). The 2011 DSA credits the safety-class building structure to

maintain its confinement integrity during a PC-3 seismic event and to mitigate releases from

seismically-induced accidents. The DSA relies on the passive confinement of PF-4 structure to

2
mitigate the material release and associated offsite dose consequence from a seismically-induced

fue scenario. The staff identified a number of issues, described below, that challenge the

technical validity and defensibility of the LPF values used in the 2011 DSA. A number of these

LPF-related issues are similar to concerns communicated by the Board in a letter to NNSA dated

May 30, 2008.

LPF Value for the Spill Contribution to the Seismically-Induced Fire-The MELCOR

analysis that generated the LPF values used in the 2011 DSA included a number of parametric

runs. For a given parametric run, a number of individual laboratory rooms were assumed to

contain seismically-induced fires and a given amount of material at risk (MAR) was allocated to

each fire. Additionally, rooms without fires (non-fire rooms) were also modeled with a given

amount of MAR which was spilled. The MELCOR analysis that generated the bounding LPF

value (18 percent) used in the 2011 DSA modeled an integrated seismic accident scenario that

involved releases due to both seismically-induced fires in two fue rooms and seismicallyinduced spills in fourteen non-fire rooms.

The LPFs generated using MELCOR are ultimately used in the DSA accident analysis to

calculate dose consequences. For the seismically-induced fIfe scenario, the DSA accident

analysis assumes that material is spilled and then becomes involved in a fire. This accident

analysis evaluates the dose contributions from the spill release and the fue release separately and

then combines the results to obtain the total mitigated offsite consequence of 23 rem TEDE.

Consequence calculations for the fire component of the release use the 18 percent LPF calculated

by the MELCOR model discussed above. However, consequence calculations for the spill

component of the release use an LPF of only 5 percent. Given that the 18 percent LPF value was

calculated in MELeOR for an integrated scenario that included both spill and fire releases, it is

not technically justifiable to use a separate, lower LPF value for the spill contribution. If the

appropriate LPF value of 18 percent were applied to the spill component of the release, the

Board's staff estimates the dose contribution of the spill would increase by a factor of 3.6, and

the overall offsite dose consequence would increase by roughly 80 percent.

Implicit Crediting ofLaboratory Walls-The walls ofPF-4's laboratory rooms consist of

gypsum board panels that are mechanically fastened to metal framing. These laboratory walls

have not been credited as safety-class or safety-significant design features in the PF-4 DSA and

have not been evaluated to maintain their integrity in a PC-3 seismic event. However, the

CFAST and MELCOR models for PF-4 rely on an assumption that laboratory walls will remain

intact after an earthquake. By assuming the laboratory walls are intact, the amount of oxygen

available to feed a room fire is constrained and the overall size and heat release rate from the fire

are limited. Additionally, assuming laboratory walls are intact significantly limits the surface

area of flow paths through which the aerosolized source term can escape from fire rooms into the

corridor and ultimately into the environment. Inappropriately relying on laboratory walls to

perform functions that they are not credited or qualified to perform is a non-conservative

assumption that potentially underestimates the LPF and overall offsite dose consequence.

Quantity ofCombustibles Assumed for Some Fire Rooms-Laboratory rooms that process

heat source plutonium-238 (HS-Pu) materials include fIXed and mobile polymethyl methacrylate

(PMMA) shielding to reduce the neutron dose to glovebox workers. The PMMA shielding is

3
combustible and represents a large potential source offuel to feed HS-Pu laboratory room fires.

Room fire characteristics calculated by CFAST and input into MELCOR are strongly influenced

by the quantity of combustible materials present to fuel the fire. The CFAST modeling of HS-Pu

laboratory room fires assumes that the amount of PMMA is limited to the fIXed PMMA shielding

on only four gloveboxes and does not account for the significant amount of mobile PMMA

shielding present. There are more than four gloveboxes in one HS-Pu room, and all have the

potential for becoming involved in a fue. Therefore, postulating an HS-Pu room fire that

involves only combustible fuel from the fixed PMMA shielding offour gloveboxes is also a nonconservative assumption that leads to an underestimation of LPF values and overall offsite dose

consequences.

Respirable Fraction for Finely Divided Heat Source Plutonium Powder. Unlike the

2008 DSA, the accident analysis for the seismically-induced fIfe scenario in the 2011 DSA

disaggregates MAR to account for the wide variability in dose conversion factors and

dispersibility represented by the diverse materials present in PF-4. Under this new approach,

finely divided HS-Pu powder is one of the most important contributors to the overall offsite dose

consequence. HS-Pu is enriched in the Pu-238 isotope, which has a high specific activity and

dose conversion factor. Mechanical processing creates a very finely divided powder with an

average particle size of approximately 1 micron geometric diameter (or about 3.5 microns

aerodynamic equivalent diameter [AED]), which makes it highly dispersible and respirable under

accident conditions. DOE Handbook 3010, Airborne Release Fractions/Rates and Respirable

Fractions for Nonreactor Nuclear Facilities, defines respirable fraction (RF) as the fraction of

material that has an AED of 10 microns or less. The DSA assumes an RF of 0.3 for finely

divided HS-Pu powder that is released in a seismically-induced spill and an RF of 0.1 for finely

divided HS-Pu that is released in a fire.

The RF value of 0.3 assumed for finely divided HS-Pu powder spilled in a seismic event

uses the bounding experimental RF value, derived from unrepresentative test materials, reported

in DOE Handbook 3010. However, this value may not be appropriate for finely divided HS-Pu

where the source material is initially all in the respirable particle size regime. This is reflected in

Section 3.4.3 of the 2011 DSA in the accident analysis for a container handling event. This

scenario analyzes the consequences of dropping and breaching a HS-Pu container. This DSA

evaluation states that if the material involved in the accident is finely divided HS-Pu powder,

then an RF of 1.0 must be assumed.

LANL analysts derived the assumed fue RF of 0.1 by taking the bounding experimental

value of 0.01 from DOE Handbook 3010, which is based on experiments using test materials that

are not representative of fmely-divided HS-Pu powder, and increasing it by an arbitrary factor of

10. The analysts indicated that the factor of 10 is intended to account for the difference between

finely divided HS-Pu powder with an average particle size of about 3.5 microns AED and the

much coarser test materials with particle sizes of 15-150 microns AED that were used in the

experiments reported in the Handbook. The DSA notes that the assumed RF for finely divided

HS-Pu powder in fires was only increased to 0.1 rather than to 1.0 as in previous versions of the

analysis because powders with small initial particle sizes tend to agglomerate into larger and less

respirable particles.

4
To support this agglomeration argument, the DSA references a white paper submitted by

an author of DOE Handbook 3010 that discusses agglomeration phenomena observed in

experiments performed using fmely divided uranium oxide. However, the Pu-238 constituent of

HS-Pu has properties and characteristics that are significantly different than uranium oxide. Pu238 is an intense alpha emitter with a relatively short half-life of 88 years. As a result of this

high specific alpha activity, Pu-238 oxide material exhibits significant self-heating (hence its use

as a heat source) that tends to drive off moisture and limit water adsorption. Self-heating of Pu238 oxide would tend to cause finely divided HS-Pu powder to resist particle agglomeration.

The white paper referenced in the DSA also assumes the presence of conditions that do not exist

in the facility, such as seismically-qualified support stands for HS-Pu gloveboxes. Since HS-Pu

behaves differently than uranium oxide and exhibits characteristics that would resist significant

particle agglomeration, the RF value of 0.1 assumed in the DSA cannot be technically justified.

Relevant experimental data using representative test materials is limited and the

information that is available in the technical literature on agglomeration phenomenology for

finely divided HS-Pu provides contradictory conclusions. There are studies and reports that refer

to agglomeration of HS-Pu in moist environments, such as deactivated gloveboxes and hot cells;

however, such conditions do not exist at PF-4 due to rigorous climate control and quality

requirements that prohibit the introduction of considerable amounts of moisture into PF-4

gloveboxes.

The staff believes that the RF values assumed in the DSA for finely divided HS-Pu

powder are non-conservative for both spill and fire releases. If the seismically-induced fire

analysis used the technically defensible RF value of 1.0 (for both spill and fIfe components of the

accident), the Board's staff estimates the overall mitigated offsite dose consequence would

increase by a factor of 3.3.

Lack ofIndependent Review for DSA Input Documents. The accident analysis for the

seismically-induced fire scenario references several supporting calculations and analyses that

supply important quantitative inputs to the DSA. The quality and fidelity of the inputs from

these supporting documents affects the quality and fidelity of the analysis in the DSA. At

LANL, procedure AP-341-605, Calculations, specifies the institutional requirements governing

the preparation and review of calculations and analyses that provide important quantitative inputs

to safety basis documents such as DSAs. AP-341-605 requires that all safety basis input

calculations and analyses be checked and independently reviewed by personnel who were not

involved with the development of the calculation or analysis. The staff identified multiple

analyses that provide quantitative inputs to the safety basis and are explicitly referenced by the

DSA that did not comply with the independent review requirement of AP-341-605. The

examples summarized below echo quality assurance issues for DSA input documents that were

communicated by the Board in a letter dated May 30, 2008:

• Reference 3-65, LA-UR-II-01857, Modeling the Number ofIgnitions Following an

Earthquake: Developing Prediction Limitsfor Overdispersed Count Data,

documents statistical analysis on historical data deriving the probability that a given

number of laboratory room fires will occur after a PC-3 seismic event. Results from

5
this analysis are used as quantitative inputs to the DSA. Site analysts did not apply

the required AP-341-605 review process to LA-UR-II-01857.

• Reference 3-112, Memo SB-PF:I0-007, Statistical Evaluation ofDamage Ratio

Data, documents statistical analysis on fire test data for two safety-class containers.

Results from this memo were used to support a credited damage ratio of 0.01 for the

safety-class containers in the DSA. Site analysts did not apply the required AP-341-

605 review process to memo SB-PF:10-007.

Credibility of a Seismically-Induced Fire in the Basement. The 2011 DSA assumes

that a seismically-induced fire is not credible in the PF-4 basement. However, the basement

houses combustible material, high voltage electrical switchgear that is not seismically qualified,

and activation of the seismic switches does not remove the source of power to the switchgear.

The analysis in the DSA does not consider these factors when concluding that a seismically

induced fire is not credible. There is a significant amount of MAR stored in the facility

basement that could provide an important contribution to the offsite consequence if it were

involved in a seismically-induced [tree Furthermore, the leak path factor for other postulated

basement fires involving flammable liquids is a relatively high value of 30 percent. The

consequences from a ftre in the basement should either be accounted for or additional technical

justification should be provided to defend the assumption that a seismically-induced fire in the

facility basement is not credible.

Probabilistic Fire Analysis. As part of the DSA development, LA..~L personnel

performed a probabilistic analysis of a fire at PF-4 following a PC-3 earthquake. Based on this

analysis, the DSA states that one random (or "probabilistic") fire will occur after a PC-3 seismic

evente The DSA also postulates three additional "deterministic" fIfes to account for operations

involving molten plutonium metal that could significantly increase the likelihood of initiating a

fire. The probabilistic analysis is based on data in Reference 3-65, LA-UR-11-01857, Modeling

the Number ofIgnitions Following an Earthquake: Developing Prediction Limitsfor

Overdispersed Count Data, related to fires following earthquakes in Alaska and California. This

data is used to derive the likelihood of a fire as a function of facility square footage and peak

ground acceleration of the seismic event. The staff identified the following issues with the use of

this probabilistic analysis:

• Site analysts did not follow the applicable LANL review procedure to validate the

probabilistic analysis.

• The source data does not account for multiple fifes in one structure.

• The source data does not reflect the seismic upgrades that may have been applied to

some structures in California to comply with building code requirements.

• The data set is limited, includes significant reports from residential areas and may not

be representative of the likelihood of a fife in a facility like PF-4.

6
• Based on the stated purpose ofthe data set (to "allow fire departments and emergency

planners to quickly estimate the number of ignitions they may be confronted with..."),

it does not appear appropriate for predicting the likelihood of a fire in an individual

unique facility like PF-4. The authors note that "there is considerable uncertainty on

estimates derived using these relations" to estimate ignitions per million square feet

of floor space.

Additionally, site analysts did not effectively use the guidance provided by the DOE Risk

Assessment Technical Expert Working Group that was established in response to the Board

Recommendation 2009-1, RiskAssessment Methodologies at DefenseNuclear Facilities, to

assist in the appropriate preparation of quantitative risk assessments.

Conclusion. Based on the Board's staffreview, the DSA utilizes several nonconservative parameters and methodologies in deriving the 23 rem TEDE mitigated off-site dose

consequence from this scenario. Use of appropriately conservative parameters and

methodologies would significantly increase the dose consequence for this postulated accident, to

100 rem TEDE or greater, and compel the application of necessary safety controls.

7