Peter S. Winokur, Chaim1an 

Jessie H. Roberson, Vice Chai1man 

John E. Mansfield 

DEFENSE NUCLEAR FACILITIES 

SAFETY BOARD 

Washington, DC 20004-2901 

Joseph F. Bader 

Sean Sullivan 

The Honorable Neile L. Miller 

Acting Administrator 

National Nuclear Security Administration 

U.S. Department of Energy 

1000 Independence Avenue, SW 

Washington, DC 20585-0701 

Dear Ms. Miller: 

February 25, 2013 

The Defense Nuclear Facilities Safety Board (Board) reviewed the fire protection 

program at the Pantex Plant and is concerned about the number of deficiencies and the high rates 

of failure for fire protection systems in recent years. Continued failures, if not addressed, could 

lead to non-availability of the fire protection systems during normal operations and accident 

conditions involving nuclear explosives and special nuclear material. Thus, failures of the fire 

protection systems pose a risk to worker and public health and safety. More can be done to 

assess known deficiencies, place greater emphasis on timely correction of the problems, and 

ensure proper operability and reliability of fire protection systems at the Pantex Plant. 

The review conducted by the Board revealed a number of significant issues including less 

than adequate operability of the fire suppression systems; poor practices relative to the 

inspection, testing, and maintenance of fire protection systems; errors in application of the 

Unreviewed Safety Question process during the replacement of the High Pressure Fire Loop; and 

areas lacking automatic sprinkler protection. Of particular concern is an apparent lack of 

urgency in addressing impairments to components of the High Pressure Fire Loop despite the 

fact that it is a credited safety-class system. 

The issues discussed above and detailed in the enclosed report need to be resolved to 

ensure safe and reliable operations at the Pantex Plant. Pursuant to 42 U.S.C. § 2286b(d), the 

Board requests a report and briefing within 90 days of receipt of this letter by the National 

Nuclear Security Administration regarding plans and schedules for actions to ensure the proper 

operability and reliability of fire protection systems at the Pantex Plant. 

Enclosure 

c: Mr. Steven C. Erhart 

Mrs. Mari-Jo Campagnone 

t:~W,./)- PeterS. Winokur, Ph.D. 

Chairman 
DEFENSE NUCLEAR FACILITIES SAFETY BOARD

Staff Issue Report

December 17, 2012

MEMORANDUM FOR: T. J. Dwyer, Technical Director

COPIES: Board Members

FROM: W. Futrell

SUBJECT: Fire Protection Systems, Pantex Plant

Introduction. The staff of the Defense Nuclear Facilities Safety Board (Board) 

performed a review of elements of the Pantex Plant’s fire protection program during July 24–26, 

2012, a follow-on review of additional documents provided during and subsequent to the review, 

and a teleconference on September 13, 2012. Representatives of the National Nuclear Security 

Administration’s (NNSA) Production Office (NPO) and the site contractor, Babcock & Wilcox 

Pantex, LLC (B&W), participated in the review. The Board’s staff focused this review on the 

upgrade, maintenance, and impairment of fire protection systems. While the B&W fire 

protection program for the Pantex Plant showed excellence in many areas, the staff noted that 

other areas reflected the need for significant improvement. 

The fire protection systems at Pantex are key safety-class systems that help protect the 

workers and the public. The Sitewide Safety Analysis Report notes that the safety-class High 

Pressure Fire Loop (HPFL) is designed to provide a continuous water supply to facilities where 

nuclear explosive operations and associated activities involving special nuclear material are 

conducted. The HPFL in combination with other fire protection features and systems is relied on 

to address a variety of fire scenarios that could impact thermally sensitive components of nuclear 

weapons. These fire scenarios might result in large explosions (high explosive violent reactions) 

with consequences that challenge Evaluation Guidelines. 

Fire Protection System Operability. B&W has experienced an increasing number of 

failures of the HPFL and the ultraviolet flame detection systems. The staff reviewed B&W’s 

plans to address ongoing reliability and system replacement. 

High Pressure Fire Loop Upgrades—B&W personnel have nearly completed the lineitem-funded HPFL project to replace approximately 17,850 feet of underground ductile iron 

piping (approximately 33 percent of the total HPFL) with high density polyethylene piping. The 

project also included replacement of post indicator valves, fire hydrants, and the addition of three 

diesel-driven fire pumps, which are safety-related, and two safety-related fire water tanks. Only 
one sprinkler lead-in was replaced under the HPFL replacement project. B&W management will 

maintain one of the two existing fire water supplies, thus increasing the number of water supplies 

that would normally be available to three. 

Fire Protection System Upgrades—B&W management is coordinating the upgrade of 

fire protection systems with other upgrades of the bays and cells in an effort to minimize downtime for the facilities. The sprinkler lead-in upgrade effort is replacing the degraded piping 

between the HPFL piping and each building’s fire suppression systems. This piping has 

experienced the bulk of the underground failures (22 events) since 1995. The flame detection 

upgrades include replacement of the existing 1980s-vintage ultraviolet detection systems that

operate the deluge systems in the nuclear explosive bays and cells. The manufacturer will stop 

supporting the existing detection system in the near future when the current stock of repair parts 

is exhausted. In addition, B&W personnel have identified single point failures in the safety-class 

fire protection systems that are being addressed, such as the solenoid valves that operate the 

deluge valves. 

An extended replacement schedule for HPFL and lead-ins will require reliance on the 

existing older piping that continues to fail. Spare parts for the existing fire detection system are

projected to be exhausted in 2017. Beyond this, reliance on salvaged parts will void the 

equipment’s Underwriters Laboratory listing and result in questionable reliability. National Fire 

Protection Association (NFPA) 72, National Fire Alarm and Signaling Code, requires that fire 

alarm equipment be “listed” for its intended purpose. Other consequences of an extended 

replacement schedule may include the need to coordinate the installation of new equipment with 

continued operation of existing obsolete equipment pending its replacement, the need to 

accommodate the installation of a multiplicity of equipment models due to changes in 

technology over an extended replacement project, the need to maintain a greater variety of spare 

parts, and the need to train maintenance technicians on each of the various types and models of 

equipment in use. 

These projects are ongoing and will take years to complete at the anticipated rate under 

the Capability Based Facilities and Infrastructure (CBFI) program. The staff is concerned that 

use of the CBFI funding source may result in a replacement schedule extending 10 or more years 

and may result in diminished fire safety. These concerns would be mitigated by more timely 

replacement of aging fire protection systems and associated components. 

Fire Protection System Inspection, Testing, and Maintenance (IT&M). The staff 

identified the following concerns with the IT&M of fire protection systems and the actions taken 

during recent system impairments: 

Maintenance of Fire Protection EquipmentOn November 11, 2011, in support of 

contractor work on a new explosives facility, maintenance personnel closed two isolation control 

valves on the safety-class HPFL piping that provides fire water for nuclear facilities. The two 

closures, in combination with two other previously closed valves, led to the total loss of fire 

protection water to 10 non-nuclear facilities in Zone 11, and loss of outside fire hydrant service. 

Maintenance personnel did not notify the affected facility managers that the fire suppression 

systems were impaired so appropriate compensatory measures could be implemented. The 

2 
condition went undetected until the system was returned to service later that day. One of the 

previously closed valves was broken in the closed position for more than 16 months.

As a result of this failure, B&W personnel conducted a causal factors analysis. Based 

upon the results of the analysis, B&W maintenance personnel are revising post-maintenance 

testing requirements and ensuring more rigorous adherence to maintenance procedures. B&W 

management appears to be working to address all of the corrective actions identified in the causal 

factors analysis, as well as additional concerns related to safety systems.

Recent Fire Water Supply Impairments—Two safety-class fire water supply systems 

currently supply water to fire suppression systems and fire hydrants. Each of the current systems 

consists of a safety-class diesel-driven fire pump rated at 2,500 gallons per minute (gpm) and a 

general-service electrically-driven fire pump rated at 1,500 gpm, supplied by a common suction 

tank. Each set of pumps and tank can provide an independent supply of firefighting water, 

although the electric pumps are not designated as safety-related and will not meet the maximum 

site demand. The redundant supply ensures that fire water is available should one of the two 

systems fail to operate on demand. The fire water supply arrangement meets the requirements 

for redundancy specified by Department of Energy (DOE) Order 420.1B, Facility Safety.

On July 10, 2012, after maintenance on one fire pump, the discharge valve failed,

requiring one of the two redundant water supplies to be taken out of service. Operators entered 

the associated Limiting Condition for Operation (LCO), which requires that the safety-class 

pump be restored to service within 14 days. The LCO required no compensatory actions even 

though the safety-class water supply was reduced to a single fire water supply (redundancy was 

lost). B&W failed to return the pump to service within the 14-day time period. As required by 

the LCO, B&W submitted a recovery plan to the NPO, requesting extension of the LCO for an 

additional 14 days. NPO approved the extension without identifying or requiring any 

compensatory measures to manage the additional risk due to loss of redundancy and potential for 

equipment failure on demand associated with the extended outage.

In a subsequent event, on August 13, 2012, B&W personnel impaired the safety-class fire 

pump located in Building 15-25 for repairs. This impairment again resulted in the site operating 

with a single safety-class water supply without compensatory measures. The lack of spare parts 

to complete the repair in combination with delays in ordering repair parts resulted in a 10-day 

outage.

This series of events indicates that B&W may not be treating the operation and 

maintenance of safety-class fire protection systems with an appropriate level of priority, and in 

accordance with the requirements of NFPA 25, Standard for the Inspection, Testing, and 

Maintenance of Water-Based Fire Protection Systems, Chapter 15, Impairments. Chapter 15 of 

NFPA 25 requires that increased risks during an impairment be minimized, that the duration of 

the impairment be limited, and that for emergency (unplanned) impairments, emergency action 

be taken to minimize potential injury and damage. Actions taken by B&W to address the 

impairment of safety-class fire water supplies in July and August 2012 did not meet the intent of 

NFPA 25. B&W did not take emergency action to limit the duration of the impairments or limit 

the risks associated with the impairments. These concerns indicate that the LCO may not be 

adequate to manage the safety-class fire protection system in an appropriate manner.

3
The staff discussed the apparent lack of urgency in repairing the water supplies, the 

potential for extended outages, the loss of water supply redundancy, and the lack of 

compensatory measures with NPO and B&W personnel. Neither organization acknowledged the 

additional risk that existed during the impairments due to the potential failure on demand of the 

remaining single supply. The Board’s staff is evaluating these incidents as part of a complexwide review of how technical safety requirements and LCOs address impairments to fire 

protection and other credited safety systems.

Unreviewed Safety Question (USQ) Process for HPFL Design. B&W personnel 

completed the USQ process as required by Title 10 of the Code of Federal Regulations, Part 830, 

Subpart B, Nuclear Safety Management, for the design and replacement of key components of 

the HPFL. B&W found the project did not represent a positive USQ. The staff reviewed the 

USQ process used by B&W personnel and identified a number of serious issues, including:

1. The negative USQ determination was based, in part, on the use of components 

“equivalent” to the existing components. This may be inappropriate because:

• The two new suction tanks for fire water are taller than the existing tanks, which 

will result in higher tank suction head pressure, which in turn may result in higher 

pump discharge pressure. In addition, the new fire pumps are capable of 

producing higher discharge pressures than the existing pumps. Both of these 

conditions could potentially subject the existing older HPFL and lead-in piping to 

higher water pressure than they can withstand.

• The relief valve for each of the new diesel-driven fire pumps releases water to a 

drain instead of returning water to the tank. Thus, should the relief valve open for 

an extended period of time, water normally available for fire control would be 

lost. This condition could result in the volume of water available for fire control 

being less than that required for successful fire suppression.

2. B&W designers did not perform hydraulic calculations to ensure that modifications to 

the system (elbows, tees, new piping) did not negatively affect hydraulic 

performance. Instead they made the unsubstantiated assumption that hydraulic 

performance must improve since the high density polyethylene replacement piping 

has less friction loss than the existing ductile iron piping.

3. The USQ process did not address the potential for single-point failures. The B&W 

USQ author listed all questions in the USQ analysis regarding single-point failure as 

not applicable. The Board’s staff identified two cases in the design and piping layout 

where single-point failures could result in degradation of the fire water system’s 

performance. First, failure of the relief valve to operate properly on the diesel-driven 

fire pump could result in either system overpressure or loss of water. Second, failure 

of the discharge check valve for any non-operating pump could result in system 

pressure loss (i.e., water would backflow through the failed check valve into the fire 

water tank). In discussions with the Board’s staff, B&W and NPO personnel 

4
indicated that these potential failures are not a concern; however, B&W has not 

performed or documented an analysis of these or any other potential single-point 

failures.

B&W personnel are preparing a transition plan for bringing the new fire pumps on-line

that will include testing and hydraulic calculations to show the capabilities of the new water 

supplies and develop operating set points. As transition begins, at least one issue has already 

been identified. The diesel-driven fire pumps that have been delivered were found to have an 

operating pressure higher than that specified in design documents. Their actual operating 

pressure in fact exceeds the existing HPFL’s safe operating pressure. While this problem was 

identified and fixed, any design deficiencies that are identified after installation may affect the 

operability and reliability of credited fire protection systems.

Areas Lacking Automatic Sprinkler Protection. DOE Order 420.1B, Facility Safety, 

requires the installation of automatic fire extinguishing systems in all significant facilities. 

During field observations, the Board’s staff identified a ramp area that lacked automatic fire 

sprinklers. B&W personnel subsequently provided documentation that identified seven 

unsprinklered ramps, at least three of which are open to a sprinklered ramp that is used to 

transport nuclear explosives. Since all ramps are interconnected without fire rated separations, 

all ramps must be considered part of the same fire area and be protected by an automatic fire 

extinguishing system. 

5