letter from nnsa to los alamos national laboratory sept. 16, 2011, regarding nuclear safety...

Attachment 1: Status of Waste Disposition Project (WDP) Nuclear Operations Primary Author: C. H. Keilers, Jr. Date: September 16, 2011 Los Alamos National Security, LLC, (LANS) recently completed a Facility Centered Assessment (FCA) of the Waste Disposition Project (WDP) nuclear facility operations. The team identified an inordinately large number of findings and observations (i.e., 167 and 136, respectively). The FCA team concluded that WDP operations were generally safe and secure but they also have performance and compliance deficiencies that represent substantial risk to mission delivery, including non-compliances within: management systems, operations, engineering, fire protection, criticality safety, emergency preparedness, quality assurance, and safety basis. WDP facility safety bases require nearly all of these programs to be implemented and maintained; this state of operational maturity does not appear to exist for WDP nuclear facilities. Many of the issues are not new. LANS and its predecessor have had several initiatives to improve the safety and efficiency of WDP operations (e.g., 2007 Disciplined Operations Project Execution Plan, 2009 Formality of Operations initiative). While some improvements have been made (e.g., conduct of operations), the FCA results call into question the effectiveness of past actions and adequacy of current practices, including but not limited to:

• Clearly defined management roles and responsibilities • Hazard-level grading of operations • Timely reporting and categorization of occurrences • Management systems for self-identifying and effectively and sustainably addressing issues • LANS contractor assurance system (CAS) to drive effective, sustainable closure of issues

Furthermore, federal staff working in conjunction with the FCA team identified a number of vital safety system issues that call into question the operability of those systems. For example:

• The influence of changes and as-found conditions on WCRR fire suppression hydraulic demand is incompletely understood.

• A WCRR quarterly combustible loading verification in March 2011 exceeded the safety basis assumed limit by about 50 percent; follow-up actions are not evident.

• Two Area G domes have non-compliant lightning protection systems; a third dome has a sagging catenary with unapproved compensatory measures in place.

The Department of Energy Facility Safety Order (DOE O 420.1B) requires ensuring operability of nuclear safety systems and developing and maintaining consistency among system requirements, documentation, and physical configuration. LANS has not been fully effective in meeting these expectations for required WDP safety systems, evaluating the nuclear safety implications, formally notifying the National Nuclear Security Administration (NNSA) of the safety of these situations, and obtaining NNSA agreement with any compensatory measures and their eventual removal. WDP transuranic waste operations are key not only to compliance with the New Mexico Consent Order but also with reducing the site’s large but distributed radioactive inventory that is close to public with few engineered barriers. The recent FCA report provides LANS the current status and an opportunity that should not be passed up to improve the safety of these operations and efficiency of executing this mission.

U.S. Department of Energy

National Nuclear Security Administration Los Alamos Site Office

LASO Safety System Oversight (SSO) Assessment Report for the

Waste Characterization, Reduction and Repackaging Facility (WCRRF) Fire Suppression System (FSS)

June 2011

WDP FCA ATTACHMENT 4.3: LASO SSO Assessment Report for WCRRF FSS PFITS 2010-1634

Table of Contents

I. Executive Summary ............................................................................................................... 4 II. Introduction ............................................................................................................................ 5 III. Scope and Methodology ........................................................................................................ 6 IV. Results .................................................................................................................................... 9 V. Specific Criteria, Observations and Evaluations ................................................................. 11 VI. Issue Summary Table ........................................................................................................... 26 VII. References ............................................................................................................................ 29


I. A Los Alamos Site Office (LASO) Safety System Oversight (SSO) assessment of the Waste Characterization, Reduction and Repackaging Facility (WCRRF) fire suppression system (FSS) was performed to provide DOE line managers with accurate objective information on the performance of safety-significant (SS) FSS with regards to WCRRF’s nuclear facility authorization basis requirements, national consensus standards and other requirements. This assessment was scheduled as part of the FY2011 Integrated Assessment Schedule (IAS) and performed in coordination with the Los Alamos National Laboratory (LANL) performed Waste Disposition Project (WDP) Facility Centered Assessment (FCA).

Executive Summary

The assessment evaluated five objectives: Safety Function Definition (SFD), Configuration Management (CM), System Maintenance (SM), System Surveillance and Testing (SST), and Cognizant System Engineer (CSE). The assessment team concluded that SFD and SST objectives were not met and that existing FSS surveillance and testing activities do not demonstrate the FSS system’s ability to perform its safety function.

This assessment identified seventeen (17) findings, ten (10) observations, and one (1) opportunity for improvement, which are listed in Section VI - Issue Summary Table. Below are six (6) representative findings that directly challenge the ability of the assessed system to perform the safety functions credited in the safety basis.

FINDING SSO F-1 WCRRF FSS The fire suppression system’s safety function, functional requirements, and performance criteria are incorrectly described in Chapter 4 of the WCRRF BIO (ABD-WFM-005, R1.3). FINDING SSO-F-4 WCRRF FSS The hydraulic demand of the FSS and the water supply capability has not been thoroughly analyzed to account for system modifications, as-found conditions, water supply degradation, and DOE-STD-1066 design margins. FINDING SSO-F-6 WCRRF FSS The fire-water supply piping feeding the WCRRF FSS is preconditioned prior to the performance of the annual hydrant flow test surveillance. (Normal valve line-up changed.) FINDING SSO-F-12 WCRRF FSS The EP-WCRR-FP-DOP-0303, Monthly FSS Valve Alignment Checklist, including its past and present implementation, does not validate monthly SR 4.2.4 - provide an unobstructed flow path from gravity tank to the BUILDING TA-50-69 sprinkler heads. (EP-WCRR-FP-DOP-0303 does not include all necessary valves specified by SR 4.2.4.) FINDING SSO F-13 WCRRF FSS EP-WCRR-FP-DOP-0303 TSR SR-specified water supply valves were closed without notification to WCRRF operations during the weekend of 05/14/11-05/15/11; WCRRF went into Operations Mode on 5/16/11 without re-validating their position as open. FINDING SSO-F-11 WCRRF FSS The last completed EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, dated 3/30/2011, reported a total quantity of combustibles as 1737.95 lbs, which exceeds the maximum safe combustible loading limit of 1163.6 lbs evaluated in the BIO hazards analysis.


II. The safety function of the Building TA-50-69 and waste characterization glovebox (WCG) safety-significant (SS) fire suppression system (FSS) is to limit the size and duration of fires in Building TA-50-69 and in the WCG. This protects the staged TRU waste containers and the building ventilation system HEPA filters from over-temperature threats and ensures that waste in process is entrained with fire water during a glovebox fire.

Introduction

The FSS performance criteria require: • an open and unobstructed flow path from the water supply tank to the Building

TA-50-69 and WCG sprinkler heads, • riser gauge static pressure of 48 psig or greater at the base of the riser, • water supply tank contains 100,000 gallons or greater, and • the temperature of Building TA-50-69 including the attic space is greater than

40ºF. (This BIO and TSR described hazard control has not yet been implemented.)

As part of this review, the assessment team reviewed and evaluatedif: • system analyses and calculations adequately predict required system performance, • configuration management is maintained such that system analyses, documentation,

and installation are consistent, • system operating, surveillance, maintenance, and test procedures maintain and

verify performance consistent with safety basis and code requirements, • combustible loading requirements are adequately implemented since this safety

management program is an essential feature of the fire suppression system’s performance requirements, and

• the Cognizant System Engineer (CSE) adequately supports system configuration management and operations.


III. The assessment criteria for this review are prescribed in LASO MP 06.02, Rev. 4, System Safety Oversight, Attachment 6, and are stated below. Each is evaluated in Section V – Specific Criteria Observations and Evaluations. This assessment was performed in coordination with the LANL-performed WDP FCA.

Scope and Methodology

Safety Function Definition (SFD) Objective: Safety basis-related technical, functional, and performance requirements for

the system are identified/defined in appropriate safety documents. Criteria:

SFD-1: Safety Basis documents identify and describe 1) the system safety functions and the safety functions of any essential supporting systems, and 2) the safety system design and functional requirements, performance criteria, or appropriate consensus standards, or other detailed requirements documents are referenced.

Configuration Management Objective: Changes to safety basis-related requirements, documents, and installed

components are controlled.

Criteria:

CM-1: Facility documentation (drawings, master equipment list, operating procedures, surveillance procedures, safety basis documents) are consistent and have been updated to reflect configuration changes due to maintenance and/or modifications.

CM-2: Limited technical walkdown of selected system components verifies that the physical configuration of these components conforms to documented design and safety basis documents for the system.

CM-3: Facility procedures ensure that changes to the system safety basis requirements, documents, and installed components are adequately integrated and coordinated with those organizations affected by the change.

CM-4: Changes to the system are designed, reviewed, approved, implemented, tested, and documented in accordance with LANL requirements and controlled procedures, including the use of the USQ process.

CM-5: Changes to the system are consistent with the system safety classification, safety basis requirements, LANL procedures, and applicable consensus standards.

CM 6: System assessments include periodic review of system operability, reliability, and material condition and assess the ability of the system to perform design and safety functions, verify physical configuration, and verify performance criteria are met.


CM 7: Software used in system instrumentation and control (I&C) components that perform functions important to safety is subject to a software quality process consistent with 10 CFR 830.120 and DOE O 414.1.

System Maintenance Objective: The system is maintained in a condition that ensures its integrity, operability

and reliability.

Criteria: SM-1: Identified preventative and predictive maintenance is consistent with the

system safety classification, safety basis requirements, LANL procedures, and applicable national consensus standards.

SM-2: Maintenance is completed in accordance with the approved work instructions. Package reviews identify deficiencies, and appropriate follow up actions are managed. System is formally turned over to Operations following completion of maintenance.

SM-3: Post maintenance testing ensures the system is left in operable condition.

SM-4 Corrective action backlog is managed to minimize impact on system readiness.

System Surveillance and Testing Objective: Surveillance and testing of the safety system demonstrates that it is capable of

accomplishing its safety functions and continues to meet applicable system requirements and performance criteria.

Criteria: SST-1: Requirements for surveillance and testing are adequate for demonstrating

overall system reliability and operability, and reflect the technical safety basis.

SST-2: Surveillance and test procedures confirm that key operating parameters for the overall system and its major components are maintained within operating limits.

SST-3: Instrumentation and measurement and test equipment for the system are calibrated and maintained.

Cognizant System Engineer Objective: A trained and qualified Cognizant System Engineer (CSE) is assigned to this

system to apply engineering expertise to maintain safety system configuration and assess system operability, reliability, and maintenance.

Criteria: CSE-1: A CSE is assigned to the system and is qualified in accordance with LANL

requirements.


CSE-2: The CSE periodically walks down the system in accordance with applicable requirements to assess its material condition, aging condition and reliability.

CSE-3: The CSE provides technical evaluations of, and concurs with, system configuration changes, including those affecting the safety basis, operations, maintenance, testing, design, and temporary modifications.

CSE-4: The CSE assists operations review of key system parameters, performs evaluations of system performance, and assists with the analysis and resolution of issues.

The approach used in conducting this assessment included: reviewing documentation that supports the design and safety basis requirements for the FSS system, conducting interviews with assigned system engineers and authorization basis personnel, performing limited facility walk-downs of the system, and observing field performance of several surveillance testing and maintenance activities.

The definitions used to categorize identified issues have been revised from the LASO management procedure (MP)-00.12, Independent Assessment Process, provided definitions to be consistent with the Facility Centered Assessment (FCA) definitions. The FCA identified issues are categorized as findings, observations, opportunities for improvement or noteworthy practices. The definitions are included in the WDP FCA report.


IV. This LASO Safety System Oversight (SSO) assessment documents the adequacy of WCRRF FSS performance requirements described in the safety basis, configuration management of the system, and system operating, surveillance, maintenance, and test performance consistent with safety basis and NFPA code requirements. CSE support of system design, maintenance and operations is evaluated in accordance with DOE Order 420.1B and laboratory requirements. The assessment included five CRADs, two of which were not met – system function definition (SFD) and system surveillance and testing (SST). The assessment team concluded that existing FSS surveillance and testing activities do not demonstrate the FSS system’s ability to perform its safety function. Findings are listed in the table in Section VI - Issue Summary Table.

Results

The WCRRF FSS’s safety function, functional requirements, and performance criteria are incorrectly described in Chapter 4 of the WCRRF BIO which complicated the assessment team’s review of the WCRRF FSS and may have contributed to the inaccurate flow down of requirements to the TSRs. Following evaluation and correction of discrepancies identified in this report, a review of the TSRs will be necessary to validate adequacy.

Of particular concern to the assessment team was that the hydraulic demand of the FSS and the water supply capability has not been thoroughly analyzed to account for system modifications, as-found conditions, water supply degradation, and DOE-STD-1066 design margins. While a FSS TSR limiting condition of operation (LCO) requires riser gauge static pressure of 48 psig or greater at the base of the riser, the assessment team was unable to validate the adequacy of this pressure requirement. ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation is used as the technical basis in determining the 48 psig requirement, but the hydraulic calculation:

− assumes a sprinkler coverage spray density of 0.19, vice 0.20, gpm/ft2 over 1,500ft2; a FSS major modification that changed the system’s configuration from a branched/tree design into a looped system design should have also required compliance with the then current Code in effect at that time, namely NFPA 13-2002 requirements (i.e., 0.20 gpm/ft2 over 1,500ft2).

− does not depict the design area within the calculation or annotate it on a priority drawing, so the calculation’s assumed number of activated sprinklers (12) cannot be validated as being conservative.

− does not include all frictional losses (e.g., the HASS hydraulic calculation shows two alarm check valves (A) instead of elbows (E) between nodes 13A and 19B, piping to the SOURCE node does not include the PIV gate valve loss, and various other missing fittings and inconsistent pipe lengths occur throughout the calculation).

− does not include the DOE-STD-1066, Fire Protection Design Criteria, described design margin of “supply pressure of at least 10% but not less than 10 psi below the supply curve.”

Further, WCRRF SR hydrant flow testing and test data was found to be not compliant with NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems, requirements. The hydrant’s water supply/valve alignment is preconditioned prior to testing by closing utility cross-connect valve #037 prior to


performing the hydrant flow test, and inconsistencies in previous hydrant flow and pressure data have not been evaluated. Therefore, the assessment team was unable to determine with any degree of assurance the expected static or residual pressure and flow from hydrant #856.

The assessment team also identified concerns with the current configuration of the temperature monitoring/FSS freeze protection system and its system interfaces that call into question the capability of the system to meet specified performance criteria when implemented. While the BIO and TSRs describe the intended operation of the FSS freeze protection equipment, the described operation does not reflect as-found conditions. Specifically, while DSA Table 4-11 – Building TA-50-69 Confinement Ventilation System Performance Criteria and TSR LCO 3.2 – Fire Suppression System require the temperature of Bldg TA-50-69 to be greater than 40 °F, with the TSR basis stating, “the Building TA-50-69 ventilation system includes a 40 °F interlock, which automatically shuts down the building’s supply air (HVA-001) and main exhaust (FE-002) while starting the attic space heaters,” the attic space heaters are not interlocked with the temperature transmitters or the Building TA-50-69 ventilation system. It is additionally noted by the assessment team that the BIO Table 4-7 – Building TA-50-69 and WCG Fire Suppression System Performance Criteria specified requirement to “confirm that the temperature of the facility has been above 40oF for at least 48 hours” should be considered an additional FSS performance criterion and TSR surveillance.

As part of the disposition of findings listed in Section VI - Issue Summary Table, the assessment team contends the following minimum activities should be successfully completed as part of restoring an operable WCRRF FSS:

• Revise ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation to address the listed concerns.

• Revise EP-WCRR-FP-DOP-0301, Hydrant Flow Test, to eliminate system preconditioning step, and subsequently re-perform the #856 hydrant flow test to establish credible static and residual pressure and flow data and validate adequate water supply for a potential fire scenario.

• Revise the BIO and TSRs to reflect the correct safety function, functional requirements, and the revised performance criteria. Note: The 100,000 gallon minimum water supply that is required by the BIO and

TSRs may be inadequate when hydraulic calculation errors are corrected.

With the completion of this work and revision to the WCRRF BIO and TSRs, designation of the FSS as operable could be considered minimally acceptable.

Finally, the assessment team recommends that future BIO and TSR changes to more accurately describe the as-found configuration of the attic space heaters and the intended operation of the temperature monitoring/FSS freeze protection system and its system interfaces be considered prior to implementing the change.


V. Specific Criteria, Observations and Evaluations Safety Function Definition (SFD) The SFD objective is not met because the safety basis documents do not correctly identify, flow down and describe the FSS safety function, functional requirements and performance criteria, and the safety basis referenced hydraulic demand of the FSS has not been determined in accordance with the technical requirements from approved consensus standards.

The FSS description in WCRRF BIO Chapter 4, Safety Systems, Structures and Components does not specify the same safety function, functional requirements, and performance criteria as referenced for the system in BIO Chapters 3 and 5 and the TSRs. In addition, the FSS’s hydraulic calculation, a FSS performance criterion, does not appropriately account for system modifications, as-found conditions, water supply degradation, and DOE-STD-1066 design margins.


FINDING SSO-F-4 WCRRF FSS The hydraulic demand of the FSS and the water supply capability has not been thoroughly analyzed to account for system modifications, as-found conditions, water supply degradation, and DOE-STD-1066 design margins.

DCP-06-TA-50-0069-016 modified the original configuration of the FSS from a branched/tree design into a looped system design to reduce the system’s hydraulic demand. DOE O 420.1B, Chapter I, paragraph 1.a.(2), and Chapter II, paragraph 3.a.(3) require that facility modifications meet current code requirements. This 2007 system re-design/re-configuration was not considered a major modification requiring compliance with NFPA 13-2002 requirements. NFPA 13-2002 requires a sprinkler coverage spray density of 0.20 gpm/ft2 over 1,500ft2 (vice the DSA-specified and current hydraulic calculation value of 0.19 gpm/ft2 over 1,500ft2 previously required by NFPA 13-1979).

ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, assumes the theoretical number of sprinklers (12) for the design area of 1,500ft2. This number could not be validated as being conservative because the design area was not marked on the hydraulic calculation reference or priority drawings.

ER-FP-07-042 does not include all frictional losses in the calculation. Fitting and pipe losses could not be validated as being conservative because not all fittings and pipe lengths are marked on the hydraulic calculation reference or priority drawings.

a) The HASS hydraulic calculation shows two alarm check valves (A) instead of elbows (E) between nodes 13A and 19B.

b) The HASS hydraulic calculation piping to the SOURCE node does not include the PIV gate valve loss.

c) Various other missing fittings and inconsistent pipe lengths occur throughout the calculation. The pipe length between nodes 13A to 19B; nodes 19B to 20; and


nodes 20 to 21 cannot be readily verified from the drawings provided. Pipe lengths on drops to sprinkler heads, such as from node 2 to 2A, are not consistent with the drawing. This is in part due to different elevations between the drawings and the HASS calculation.

ER-FP-07-042 does not include the DOE-STD-1066, Fire Protection Design Criteria margin criteria of Section 7.2 – “Hydraulically designed sprinkler systems should be designed for a supply pressure of at least 10% but not less than 10 psi below the supply curve.” Instead, ER-FP-07-042 considers only a 5% pressure margin for determining the minimum static pressure required. This exception is not described in the BIO Table 4-7: Building TA-50-69 and WCG Fire Suppression System Performance Criteria evaluation.

FINDING SSO F-1 WCRRF FSS The fire suppression system’s safety function, functional requirements, and performance criteria are incorrectly described in Chapter 4 of the WCRRF BIO (ABD-WFM-005, R1.3).

BIO Table 4-6: Functional Requirements for the Building TA-50-69 Fire Suppression System, states a different safety function than is otherwise described in the BIO.

− BIO Table 3-17: Controls Providing Significant Defense-in-Depth or Worker Safety from the Hazard Analysis Tables, Table 4-1: WCRRF Safety Structures, Systems, and Components, Table 5-1: TSR Credited Controls From Chapter 3 Hazard and Accident Analyses, and Section 4.4.1.1, Building TA-50-69 and WCG FSS Safety Function, all specify the safety function of the FSS as, “Limit the size and duration of fires in the WCG and in Building TA-50-69 which reduces radioactive material exposure to the public, worker and the environment. The fire suppression system will protect the staged TRU waste containers and the building ventilation system HEPA filters from over temperature threats and ensure that waste in process will be entrained with fire water during a glovebox fire.” However, Table 4-6 states the FSS safety function as: “Activation of the WCG portion of the FSS may compromise the containment/ confinement of the glovebox as a result of the anticipated release of fire water from the WCG to the building, and possible loss of vacuum by over-pressurization of the WCG or clogging of the WCG HEPA filters. However, rapid fire suppression should minimize consequence from airborne releases because the radioactive material released into the building is entrained with fire water.”

The BIO does not flow down the complete functional requirements of the FSS (e.g., the functional requirement of “ensure that waste in process will be entrained with fire water during a glovebox fire” is missing in Table 4-6).

BIO Table 4-7: Building TA-50-69 and WCG Fire Suppression System Performance Criteria, listed functional requirements for the FSS are:

(1) not the same as functional requirements listed in Table 4-6 (as described above), and

(2) do not “ensure that waste in process will be entrained with fire water during a glovebox fire” (as described above).

With these discrepancies, it is uncertain what functional requirements were used to derive


technical safety requirements.

FINDING SSO-F-5 WCRRF FSS A modification to the FSS piping was not appropriately identified as a major modification and, therefore, current code requirements were not incorporated into system performance criteria.

DCP-06-TA-50-0069-016 modified the original configuration of the FSS from a branched/tree design into a looped system design to reduce the system’s hydraulic demand. This 2007 system re-design/re-configuration was not considered a major modification requiring compliance with NFPA 13-2002 requirements. NFPA 13-2002 requires a sprinkler coverage spray density of 0.20 gpm/ft2 over 1,500ft2 (vice the DSA-specified and current hydraulic calculation value of 0.19 gpm/ft2 over 1,500ft2 previously required by NFPA 13-1979). A major modification of a system typically requires a change in the Code of Record (COR) to a newer code.

This discrepancy results in a lower hydraulic demand than would be calculated with the spray density of 0.20 gpm/ft2 over 1,500ft2 requirement.

FINDING SSO-F-3 WCRRF FSS Technical justification or exemption that permitted ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, to deviate from the DOE-STD-1066, Fire Protection Design Criteria, requirement of “supply pressure of at least 10% but not less than 10 psi below the supply curve,” is not documented in the BIO.

ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, does not include the DOE-STD-1066, Fire Protection Design Criteria margin criteria of Section 7.2 – “Hydraulically designed sprinkler systems should be designed for a supply pressure of at least 10% but not less than 10 psi below the supply curve.” Instead, ER-FP-07-042 considers only a 5% pressure margin for determining the minimum static pressure required. This exception is not described or documented in the BIO Table 4-7: Building TA-50-69 and WCG Fire Suppression System Performance Criteria evaluation.

This discrepancy results in a lower hydraulic demand than would be calculated with the 10% design margin requirement.

FINDING SSO F-2 WCRRF FSS BIO Table 4-7 does not discuss the risk for fires during PC-2 or lower seismic events that the FSS is credited to withstand; the capability of the FSS to withstand a PC-2 or lower seismic event is stated to be uncertain in Table 4-7.

BIO Table 4-7: Building TA-50-69 and WCG Fire Suppression System Performance Criteria specifies the FSS must be capable of controlling a fire during and after a Performance Category (PC) 2 seismic event. In the Table 4-7 evaluation of this FSS requirement, the BIO recognizes a vulnerability that “the FSS is not known to be able to withstand a PC-2 seismic event.” In the Table 4-7 discussion of this vulnerability, combustible-loading and other fire protection program controls are described for reducing the risk from fires “should a seismic event exceeding PC-2 criteria degrade the FSS”


However, the evaluation provides no discussion or compensatory measures for less than PC-2 seismic events.

OBSERVATION SSO O-5 WCRRF FSS The current configuration of the temperature monitoring/freeze protection system and its system interfaces is not consistent with the approved, but not yet implemented, BIO and TSR documents. As such, future implementation of the BIO and TSR requirements is at risk.

The performance requirement from Table 4-7: Building TA-50-69 and WCG Fire Suppression System Performance Criteria to “confirm that the temperature of the facility has been above 40oF for at least 48 hours” should be considered an additional FSS performance criterion.

BIO Table 4-11 – Building TA-50-69 Confinement Ventilation System Performance Criteria and BIO Table 4-7 specifies the FSS performance criterion: “The temperature of Building TA-50-69 including the attic space is greater than 40oF.” In the Table 4-7 evaluation of this FSS requirement, the BIO states, “The Building TA-50-69 ventilation system has a set-point of 40oF which automatically secures building supply air to minimize the introduction of cold air in the building in addition to starting the attic space heaters.” The CVS-specified performance requirement that the Building TA-50-69 ventilation system set-point of 40 °F automatically starts the attic space heaters is:

(1) not required in TSR LCO 3.3.1, Building TA-50-69 Confinement Ventilation System,

(2) is not described in the TSR basis for the CVS, and (3) is not carried forward as a CVS SR.

SR 4.2.9 annual performance of an instrument loop verification and interlock check for temperature transmitters TE/TI-001 and TE/TI-002 only requires “the ventilation PLC indicates activation of the [40 °F freeze protection] interlock and indication does not clear until Operations resets the interlock.” This “indicated activation” requirement does not functionality test the interlock that the Building TA-50-69 ventilation system automatically shuts down the building’s supply air (HVA-001) and main exhaust (FE-002) while starting the attic space heaters.

No management level determination (MLD) form was identified to support master equipment list (MEL) classification of:

• the Bldg 50-69 Attic Electric Heaters (HUE-001, -002, and -003) as ML-4 in the MEL. The DSA requires activation of the attic electric heaters if either Bldg 50-69 Freeze Protection Temperature Transmitter (TE/TI-001 or -002) reaches 40 °F. As such, these attic heaters should be considered important to safety and/or mission per AP-341-502, Management Level Determination, and designated ML-3 in accordance with AP-341-502-FM06 instructions.

• the Bldg 50-69 Freeze Protection Temperature Transmitters (TE/TI-001 and -002) as ML-3 in the MEL. Specifically, (1) the DSA describes a safety function for the SSCs, (2) SDD Appendix A: Equipment Settings describes TE/TI-001 and -002 as safety-significant, and (3) EED-10-TA50-0069-006, MINCO Temptran Temperature Transmitter/ Temperature Sensor, completed 5/19/2010, cites the temperature transmitters as being ML-2 SSCs.


Nonconforming items TE/TI-001 and TE/TI-002 are not labeled with conditional release tags, as required by P 330-6, Nonconformance Reporting. NCR EP-DIR-11-0014 was written to address the currently installed TE/TI-001 and TE/TI-002 transmitters with a setpoint of 38.4 oF, instead of the freeze protection setpoint of 40 oF.

OBSERVATION SSO O-2 WCRRF FSS The WCRRF FSS priority drawings do not depict the fire sprinkler remote area, so ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, cannot be validated to have the correct number of sprinkler heads operating to meet the minimum required design area of 1,500 ft2.

ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, assumes the theoretical number of sprinklers (12) for the design area of 1,500ft2. The theoretical method provides an approximation that has to be validated. According to NFPA 13 Automatic Sprinkler Systems Handbook:

“A quick way to identify the approximate size of the remote area and to determine the number of operating sprinklers for the system is to divide the area of operation by the area of coverage per sprinkler. The area of coverage per sprinkler is determined by the methodology addressed in 8.5.2.1. However, the person performing the calculations is also required to ensure that the sprinklers in the design area physically cover the area required by the density/area criteria.”

The number of sprinkler heads in the design area could not be validated because the design area was not marked on the hydraulic calculation reference or priority drawings.

OBSERVATION SSO O-3 WCRRF FSS The 100,000 gallon minimum water supply that is required by the BIO and TSRs may be inadequate when hydraulic calculation errors are corrected.

Once a new hydraulic calculation is performed to address the potential changes in the required sprinkler density, the number of flowing sprinkler heads in the design area, the missing fittings, and the corrected pipe lengths, an additional revision will be needed to update the BIO and TSR’s current minimum available water supply requirement of 100,000 gallons (i.e., FSS LCO Condition #3 and SR 4.2.2).

OBSERVATION SSO O-7 WCRRF FSS WCRRF BIO Table 4-27 – Combustible-Loading Control Performance Criteria is inconsistent with BIO Section 4.5 and TSR LCO 3.4.2.

WCRRF BIO Table 4-27 Combustible-Loading Control Performance Criteria, lists the following performance criteria for the combustible loading: No flammable liquids or gases and no combustible liquids with NFPA Flammability Rating greater than 1 shall be stored or used within Building TA-50-69 when TRU waste is in Building TA-50-69, except three size 1 cylinders of P-10 gas.”

The BIO Section 4.5.1.5, Item 2. states: No flammable liquids or gases, and no combustible liquids with NFPA Flammability Rating greater than 1 shall be stored or used within Building TA-50-69 when TRU waste is in Building TA-50-69, except three


size 1 cylinders of P-10 gas and flammable or combustible liquids found in the TRU WASTE CONTAINER. The LCO 3.4,2 States: No flammable liquids or gases, and no combustible liquids with NFPA Flammability Rating greater than 1 shall be stored or used within BUILDING TA-50-69 when INVENTORY is in BUILDING TA-50-69, except three size 1 cylinders of P-10 gas and flammable or combustible liquids found in the TRU WASTE CONTAINER.

OBSERVATION SSO O-6 WCRRF FSS The TSR basis for SR 4.2.2 incorrectly identifies the 500,000 fire water tank as being county owned.

The TSR basis for SR 4.2.2 incorrectly states, “The 500,000 gallon water tank that provides fire-fighting water is county-owned, and a Memorandum of Understanding (MOU) exists between the county and NNSA/DOE for the operation of this tank.” Tank 64-03 is LANL-owned, operated and maintained.

Configuration Management (CM) The CM objective is met since changes to safety basis-related requirements, documents, and installed components are adequately controlled.

Based on a review of system technical baseline documentation, a limited walkdown of the FSS, and a review of the most recent FSS modification (e.g., the addition of a sprinkler head in the WCG), the CM process is mostly effective and ensures the ability of the FSS to perform its safety function. During the assessment, several CM issues were identified, but none indicated a systematic failure of the CM processes or procedures used by the facility to make system changes. The identified CM issues were isolated findings, observations or opportunities for improvement and none of the issues challenge the ability of the FSS to perform its safety function.








CM 7: Software used in system instrumentation and control (I&C) components that perform functions important to safety is subject to a software quality process consistent with 10 CFR 830.120 and DOE O 414.1.

FINDING SSO-F-15 WCRRF FSS The WCG fire sprinkler head control valve is not supervised, as required by NFPA 13, Standard for the Installation of Sprinkler Systems, and DCF-10-TA50-0069-034.

NFPA 13, Section 8.16.1.1.2.1, requires the following: Valves on connections to water supplies, sectional control and isolation valves, and other valves in supply pipes to sprinklers and other fixed water-based fire suppression systems shall be supervised by one of the following methods: (1) Central station, proprietary, or remote station signaling service (2) Local signaling service that will cause the sounding of an audible signal at a

constantly attended point (3) Valves locked in the correct position (4) Valves located within fenced enclosures under the control of the owner, sealed in

the open position, and inspected weekly as part of an approved procedure

None of the four methods outlined above are implemented for the WCG fire sprinkler head control valve.

Additionally, the Design Change Form (DCF-10-TA50-0069-034) for the installation of the fire suppression in the WCG stated:

A valve will be provided for the water supply connection to the WCG to allow isolation when the waste process is terminated. This valve will be supervised in accordance with NFPA 13-2010, Section 8.16.1.1.2.1, Method 3 - "valves locked in the correct position".

AP-341-801 post modification testing (PMT) for DCF-10-TA50-0069-034 did not verify the fire sprinkler head control valve as supervised and locked open, as required by the design change form (DCF).

Form 50-0069-FPS-S.3, Step 2.5, used in WO #380790, does not include verification of the WCG sprinkler head control valve.

FINDING SSO-F-16 WCRRF FSS The WCG fire sprinkler head installation is inconsistent with NFPA 13, Standard for the Installation of Sprinkler Systems, and the manufacturer’s recommendations with respect to the installation of guards and head’s deflector distance from the ceiling.

There is potential for the fire sprinkler head in the WCG to be physically impacted from the glovebox activities, which could cause an unwanted water release from the fire suppression system. NFPA 13, Section 6.2.8 requires guards, specifically “Sprinklers subject to mechanical injury shall be protected with listed guards.”


The installation of the fire sprinkler head is not in accordance with the manufacturer’s recommendations. The data sheet for the Reliable Model MBEC-14 sprinkler head specifies the design criteria for deflector distance as “Deflector distance below roof/ceiling is 12” (305 mm) to 16” (406 mm).”, but the Design Change Form (DCF-10-TA50-0069-034) drawing FP2, Keyed Note 2 states:

“The sprinkler deflector shall be aligned parallel with the ceiling and shall be located not more than 6" or less than 4" from top of glovebox.”

OBSERVATION SSO O-10 WCRRF FSS SDD-TA-50-0069-FSS-R.1, FSS System Design Description (SDD), contains gaps in technical information, editorial errors, and does not contain current BIO information.

a) SDD Table 4-1 does not reflect the current information from BIO Table 4-1. b) The SDD has several erroneous references to the RANT facility on pages 13, 50,

64, and Attachment B c) The SDD does not reflect the current surveillance requirements from the TSRs,

specifically SR 4.2.8 and 4.2.9 related to temperature. d) The SDD, page 53, does not reflect the operability description from the TSRs.

OBSERVATION SSO O-8 WCRRF FSS DCF-10-TA50-0069-034 does not indicate approval, completion and closure of WCG fire sprinkler head installation.

DCF-10-TA50-0069-034, Section 11.0 - Implementation and Closure, has not been completed including the signatures.

OPPORTUNITY FOR IMPROVEMENT SSO OFI-1 WCRRF FSS As recommended by DOE-STD-1066, Fire Protection Design Criteria, WCRRF should consider adding fire screens immediately downstream of the WCG exhaust canister HEPA filters.

As recommended by DOE-STD-1066, Fire Protection Design Criteria, WCRRF should consider adding fire screens immediately downstream of the WCG exhaust canister HEPA filters (i.e., a fire screen located within the filter housing). The WCG exhaust canister HEPA filters are potentially exposed to airflow temperatures of approximately 3,000 °F; they are only rated for continuous service at 250 °F.

System Maintenance (SM) The SM objective is met because the FSS is being maintained in a condition that provides reasonable assurance of its continued integrity, operability and reliability.

Based on a review of planned and performed FSS maintenance, including a review of the last 6-months of completed preventative, predictive and corrective FSS work packages, FSS maintenance is substantially consistent with consensus standards, DOE requirements and approved work instructions, and post-maintenance testing ensures the ability of the FSS to perform its safety function. During the assessment, several SM issues were identified, but none


indicated a systematic failure of the planning, practices or procedures used to maintain the FSS. Additionally, none of the SM issues challenge the ability of the FSS to perform its safety function. There are no FSS issues in the facility’s corrective maintenance backlog.

SM-1: Identified preventative and predictive maintenance is consistent with the system safety classification, safety basis requirements, LANL procedures, and applicable national consensus standards.




FINDING SSO-F-17 WCRRF FSS FSS control valve and hydrant maintenance and tests are not compliant with NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems.

FSS control valve, including post indicating valve (PIV), maintenance and tests are not performed in accordance with NFPA 25 requirements. WO #371628 and UI-PROC-74-50-010-R1, Block Valve Testing, do not satisfy the requirements of NFPA 25, Section 13.3.3.1 or 13.3.3.2.

Section 13.3.3.1 - Each control valve shall be operated annually through its full range and returned to its normal position. Section 13.3.3.2 - Post indicator valves shall be opened until spring or torsion is felt in the rod, indicating that the rod has not become detached from the valve.

FSS hydrant maintenance and tests are not performed in accordance with NFPA 25 requirements. Section 7.3.2 and 7.4.2 requires hydrants be tested and lubricated annually to ensure proper functioning. No documentation has been found to confirm if this NFPA required testing is being performed. (Note: WO #376531 work steps do not satisfy the requirements of NFPA 25.)

Section 7.3.2 - Hydrants shall be tested annually to ensure proper functioning. Section 7.3.2.1 - Each hydrant shall be opened fully and water flowed until all foreign material has cleared. Section 7.3.2.2 - Flow shall be maintained for not less than 1 minute. Section 7.4.2:1 - Hydrants shall be lubricated annually to ensure that all stems, caps, plugs, and threads are in proper operating condition.

OBSERVATION SSO O-9 WCRRF FSS IWD steps were not followed during the performance of WO# 392396: Repair Water Bell/Gong on the WCRRF FSS, and WO# 398697: Quarterly PM for the WCRRF FSS.

WO# 398697, IWD Part 1 (Form 2100-WC) Step 2.1 requires the performance of Steps 1.1 to 1.10 of the associated PMI Checklist 40-35-075.1, upon reaching this step, the


work was performed only using the PMI checklist without referring back to the IWD. By only performing the steps in the checklist, IWD Steps 2.2 to Step 3.6 – Work Complete (18 steps), including hazards and controls associated with these steps were bypassed or done after the fact.

During the performance of WO# 398697, workers did not have a ball valve LOTO device so they improvised by removing the valve handle and installing an available LOTO control over the valve stem.

Prior to performance of either work order, the MSS craft training records were not immediately available for performing the work, resulting in inefficiency and impeding the planned performance of the work.

OBSERVATION SSO O-4 WCRRF FSS WO #376531, dated 9/23/10, specified the work hazard as moderate, but ‘moderate’ was crossed-out and initialed to be re-classified as low, without explanation.

As specified on WO #376531, dated 9/23/10, the work hazard is indicated as moderate, but crossed-out and initialed to be re-classified as low, without explanation. This is inconsistent with LANL P315, Conduct of Operations Manual, Section 16.0 – Technical Procedure requirements for pen and ink changes as well as specifying the incorrect hazard level as defined in LANL P300, Integrated Work Management, Attachment B, Hazard Grading Table

System Surveillance and Testing (SST) The SST objective is not met because the FSS surveillance and testing activities do not demonstrate the system’s ability to perform its safety function, and the facility-specific SR-implementing procedures do not confirm key system requirements and performance criteria are met.

While the TSRs currently require eight SRs for operability (SR 4.2.8 and .9 are not yet implemented), three facility-specific implementing procedures do not meet the minimum system testing criteria to adequately satisfy the SRs. See finding SSO-F-6, -12 and -11. Further, because the FSS hydraulic calculation and hydrant flow testing are not performed in accordance with approved consensus standards, the assessment team was unable to ascertain the adequacy of the SR-specified riser gauge pressure and hydrant flow requirements.

SST-1: Requirements for surveillance and testing are adequate for demonstrating overall system reliability and operability, and reflect the technical safety basis.



FINDING SSO-F-6 WCRRF FSS The fire-water supply piping feeding the WCRRF FSS is preconditioned prior to the


performance of the annual hydrant flow test surveillance. (Normal valve line-up changed.)

EP-WCRR-FP-DOP-0301, Hydrant Flow Test, Step 8.5, closes utility cross-connect valve #037 prior to performing the hydrant flow test. Closure of this valve changes the normal water supply valve line-up for a potential fire scenario and pre-conditions the hydrant flow test.

FINDING SSO-F-7 WCRRF FSS Inconsistencies in hydrant flow test data have not been evaluated for cause or FSS performance impacts as required by NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems.

Available hydrant #856 flow and pressure data (shown below) are inconsistent. These variations have not been evaluated to the results of previous flow tests. NFPA 25, Section 7.3.1.2 requires flow test results that indicate deterioration of available waterflow and pressure to be investigated to ensure that the required flow and pressure are available for fire protection.

FINDING SSO-F-12 WCRRF FSS The EP-WCRR-FP-DOP-0303, Monthly FSS Valve Alignment Checklist, including its past and present implementation, does not validate monthly SR 4.2.4 - provide an unobstructed flow path from gravity tank to the BUILDING TA-50-69 sprinkler heads. • EP-WCRR-FP-DOP-0303 does not include all necessary valves specified by SR 4.2.4. • EP-WCRR-FP-DOP-0303, Revision 1, did not visually verify monthly valve alignment

as being in the correct position as part of the SR 4.2.4 verification. • Not all TSR SR-verified valves are labeled, as observed during the May 17th performance

of the procedure.

EP-WCRR-FP-DOP-0303 only verifies alignment of the three block valves outside of the WCRRF boundary; verified alignment of control valves within the WCRRF boundary (the WCRRF post indicating valve (PIV), the WCG sprinkler head isolation valve FS-V-017, and the GBE sprinkler head isolation valve FS-V-011) is also necessary for an unobstructed path to the BUILDING TA-50-69 sprinkler heads.

Documentation for performance of SR 4.2.4 on February 10, 2011, using EP-WCRR-FP-DOP-0303, Rev. 1, only shows valve position verifications by LANL Utilities in December. The included letter to WCRRF by LANL Utilities states, “This letter serves to document that the valves were inspected within the past 12 months and were verified to be in the OPEN position. The valves were then tack welded shut and verified

Date Static Pressure (psi)

Residual Pressure (psi)

Flow (gpm)

Source

6/24/1997 51 50 735 FHA Rev 0 7/17/2005 58 57 967 Calc Old (2006) 7/17/2005 58 57 967 Calc new (2007) 6/19/2009 58 56 584 FHA Rev 6 9/20/2010 51 49.7 680 SR Flow Test


monthly.” No other documentation exists to demonstrate valve positions were verified to be in the OPEN position on February 10th.

FINDING SSO F-13 WCRRF FSS EP-WCRR-FP-DOP-0303 TSR SR-specified water supply valves were closed without notification to WCRRF operations during the weekend of 05/14/11-05/15/11; WCRRF went into Operations Mode on 5/16/11 without re-validating their position as open.

Following closing of TSR SR-specified FSS supply valves during the weekend of 05/14/11-05/15/11, WCRRF went into Operations Mode on 5/16/11 without re-validating SR 4.2.4 to validate their open position and an unobstructed flow path from gravity tank to the BUILDING TA-50-69 sprinkler heads. EP-WCRR-FP-DOP-0303, Monthly FSS Valve Alignment Checklist, was subsequently completed on 5/17/11. This event was subsequently reported as ORPS# NA--LASO-LANL-WASTEMGT-2011-0022.

FINDING SSO-F-8 WCRRF FSS The hydrant flow test data from 6/19/2009 [Ref. WCRRF FHA, R.6] did not meet the minimum acceptable flow rate (600 gpm), as specified by EP-WCRR-FP-DOP-0301, Hydrant Flow Test, Step 8.7.

It is uncertain how the hydrant flow test of 6/19/2009, with a flowrate of 584 gpm, was considered acceptable; EP-WCRR-FP-DOP-0301, Hydrant Flow Test, Step 8.7 requires the flowrate be greater than 600 gpm.

This discrepancy results in less than suggested flow “to obtain satisfactory test results … of expected flows or rated capacities” as described in NFPA 291, Recommended Practice for Fire Flow Testing and Marking of Hydrants, and required by EP-WCRR-FP-DOP-0301.

FINDING SSO-F-10 WCRRF FSS EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, used to validate SR 4.4.1, presumes a building area greater than used in the BIO evaluation thereby permitting combustible loads in the building greater than those evaluated in the BIO.

SR 4.4.1 requires a quarterly inspection of Bldg TA-50-69 combustible material inventory inspection to VERIFY that the inventory is ≤ 0.60 lb/ft2 on average, allowing for listed exclusions. WCRRF BIO, Appendix 3D - Fire, Section 3D.5.2 derives the 0.60 lb/ft2 requirement based on a maximum safe combustible loading limit of 1163.6 lbs divided by the modeled compartment area of 1,932 ft2.

Excerpt from the BIO Appendix 3D.5.2: Therefore, based on this analysis, the maximum safe combustible loading that, if burned, will maintain the ULGT below the criteria of 500°C, is 527.8 kg (1,163.6 lb). Using Compartment 1’s dimensions of 38.3 ft by 50.5 ft results in a floor area of 1,932 ft2, and the resulting combustible loading per square foot is therefore 0.60 lb/ft2. This limit is applicable to the entire building and is the recommended safe combustible loading based on this analysis. EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, Step 8.5


presumes a larger compartment area (2,989 ft2) and multiplies it by 0.60 lb/ft2, to determine a combustible loading limit; the procedure’s calculated combustible loading limit is greater than the BIO maximum safe combustible loading limit of 1163.6 lbs.

FINDING SSO-F-11 WCRRF FSS The last completed EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, dated 3/30/2011, reported a total quantity of combustibles as 1737.95 lbs, which exceeds the maximum safe combustible loading limit of 1163.6 lbs evaluated in the BIO hazards analysis.

The completed EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, dated 3/30/2011, showed a density of 0.58 lbs/ft2, which is under the 0.60 lbs/ft2. However, since the procedure-presumed compartment area was 2,989 ft2 vice 1,932 ft2, the maximum safe combustible loading combustible load of 1163.6 lbs was exceed.

FINDING SSO-F-9 WCRRF FSS EP-WCRR-FP-DOP-0301, Rev. 5, Hydrant Flow Test, did not receive required reviews, has not been revised to correct identified performance concerns, inappropriately changes system configuration prior to testing (i.e., system preconditioning), and does not record data necessary to perform required calculations.

Issues with, EP-WCRR-FP-DOP-0301, used to validate SR 4.2.5, include: a) Steps 8.1 and 8.14 open and close FS-V-016, the fire riser supply pressure gauge

snubber bypass valve; the reason for these steps is not technically justified, especially since this manipulation changes the FSS’ normal configuration.

b) Step 8.3 erroneously refers to Step 8.1, vice 8.2. c) Step 8.5 closes utility cross-connect valve #037 prior to performing the hydrant

flow test. Closure of this valve changes the normal water supply valve line-up for a potential fire scenario and pre-conditions the hydrant flow test. See SSO-F-6-WCRRF FSS for additional discussion.

d) Step 8.6 does not include a data entry point for recording the venturi pressure at hydrant #856; this data is required for converting read venturi pressure differential to gpm.

e) The procedure has not been reviewed by a qualified fire protection engineer, as required by DOE O 420.1B, Facility Safety, Ch. 2-Fire Protection, Section 3.b.(4). This issue is also applicable to other procedures (e.g., EP-WCRR-FP-DOP-0302, Main Drain and Full Flow (Inspector's Valve) Tests).

f) Previously identified post job review and lesson learned comments have not been incorporated, as specified in WO #376531, Post Job Review – Suggested Improvements, dated 9/29/10, WO #376531, IWD Part 4, Post Job Review – Lessons Learned, dated 9/29/10, and PFITS No. 2010-5133 issues.

FINDING SSO F-14 WCRRF FSS Fire Water Supply Tank 64-03 is not operated and managed with the rigor commensurate with its safety function (e.g., no emergency operating procedure exists for tank low level


alarms, its TSR SR-specified components are ML-4 designated and missing required calibration and testing).

Issues with the operation and management of Tank 64-03, include: a) There is no standard procedure or emergency operating procedure to alert

WCRRF personnel of a Tank 64-03 low-level alarm or low-low level alarm. − LANL Utilities indicates that “If the water level drops to the low alarm

level, the system activates an automated call list of Utility personnel. If the water level drops to the low-low alarm level, the system again activates the call list.” LANL Utilities personnel state that “there is no notification of WCRRF personnel.”

b) Uncalibrated measurement and test equipment (M&TE) was used to satisfy SR 4.2.2 - VERIFY that the water supply tank contains a minimum of 100,000 gal. of firewater available.

− Data received from LANL Utilities indicates that Tank 64-3 pressure transmitter calibration, used to measure tank level, expired in May 2007. LANL Utilities performed a Tank 64-3 pressure transmitter calibration on May 13, 2011 following identification of this deficiency.

c) No data has been provided for NFPA 72 required performance testing of the various Tank 64-3 level alarms (e.g., low level, low-low level alarm); NFPA 72, Table 14.4.5 requires water level supervisory indicating device be operationally tested on a quarterly frequency.

d) LANL P 1040, Software Quality Management, and P 1041, Safety Software Quality Management, requirements with regards to the Tank 64-3 pressure transducer to web interface (SCADA) have not been meet.

− WCRRF Operators verify the Tank 64-03 level per WCRRF Round Sheet - Item 73, by web or phone call.

e) The Tank 64-03 pressure transducer is designated management level (ML)-4. Cognizant System Engineering (CSE) The CSE objective is met because the primary CSE assigned to the WCRRF FSS is interim qualified and progressing towards a qualified status in accordance with LANL requirements. While the interim qualified CSE is not fully cognizant of all key system parameters and requirements, he recognizes his weaknesses and consults with LANL Fire Protection (FP-DO) when problems are encountered. The CSE’s lack of experience is a vulnerability that will improve as LANS continues to mature its site-wide CSE Program.

CSE-1: A CSE is assigned to the system and is qualified in accordance with LANL requirements.





The primary CSE assigned to the WCRRF FSS is interim qualified and progressing towards a qualified status in accordance with LANL requirements. As evidenced during several walkdowns and interviews, the CSE periodically walks down the system in accordance with applicable requirements to assess its material condition, aging condition and reliability.

An inherent weakness in not having a fully qualified CSE is that the CSE assigned to the WCRRF FSS is not fully cognizant of key system parameters and requirements – including safety basis requirements, is not fully evaluating system performance, and is not sufficiently proactive or effective in the analysis and resolution of system issues (i.e., the assessment team identified at least six findings that directly challenge the ability of the assessed system to perform the safety functions credited in the safety basis). However, the CSE recognizes his weaknesses and consults with LANL Fire Protection (FP-DO) when problems are encountered.


VI. FINDING SSO F-1 WCRRF FSS Issue Summary Table

The fire suppression system’s safety function, functional requirements, and performance criteria are incorrectly described in Chapter 4 of the WCRRF BIO (ABD-WFM-005, R1.3).

FINDING SSO F-2 WCRRF FSS BIO Table 4-7 does not discuss the risk for fires during PC-2 or lower seismic events that the FSS is credited to withstand; the capability of the FSS to withstand a PC-2 or lower seismic event is stated to be uncertain in Table 4-7.

FINDING SSO-F-3 WCRRF FSS Technical justification or exemption that permitted ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, to deviate from the DOE-STD-1066, Fire Protection Design Criteria, requirement of “supply pressure of at least 10% but not less than 10 psi below the supply curve,” is not documented in the BIO.

FINDING SSO-F-4 WCRRF FSS The hydraulic demand of the FSS and the water supply capability has not been thoroughly analyzed to account for system modifications, as-found conditions, water supply degradation, and DOE-STD-1066 design margins.

FINDING SSO-F-5 WCRRF FSS A modification to the FSS piping was not appropriately identified as a major modification and, therefore, current code requirements were not incorporated into system performance criteria.

FINDING SSO-F-6 WCRRF FSS The fire-water supply piping feeding the WCRRF FSS is preconditioned prior to the performance of the annual hydrant flow test surveillance. (Normal valve line-up changed.)

FINDING SSO-F-7 WCRRF FSS Inconsistencies in hydrant flow test data have not been evaluated for cause or FSS performance impacts as required by NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems.

FINDING SSO-F-8 WCRRF FSS The hydrant flow test data from 6/19/2009 [Ref. WCRRF FHA, R.6] did not meet the minimum acceptable flow rate (600 gpm), as specified by EP-WCRR-FP-DOP-0301, Hydrant Flow Test, Step 8.7.

FINDING SSO-F-9 WCRRF FSS EP-WCRR-FP-DOP-0301, Rev. 5, Hydrant Flow Test, did not receive required reviews, has not been revised to correct identified performance concerns, inappropriately changes system configuration prior to testing (i.e., system preconditioning), and does not record data necessary to perform required calculations.

FINDING SSO-F-10 WCRRF FSS EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, used to validate SR 4.4.1, presumes a building area greater than used in the BIO evaluation thereby permitting combustible loads in the building greater than those evaluated in the BIO.


FINDING SSO-F-11 WCRRF FSS The last completed EP-WCRR-FP-DOP-0304, Quarterly Combustible Loading Verification, dated 3/30/2011, reported a total quantity of combustibles as 1737.95 lbs, which exceeds the maximum safe combustible loading limit of 1163.6 lbs evaluated in the BIO hazards analysis.

FINDING SSO-F-12 WCRRF FSS The EP-WCRR-FP-DOP-0303, Monthly FSS Valve Alignment Checklist, including its past and present implementation, does not validate monthly SR 4.2.4 - provide an unobstructed flow path from gravity tank to the BUILDING TA-50-69 sprinkler heads. • EP-WCRR-FP-DOP-0303 does not include all necessary valves specified by SR 4.2.4. • EP-WCRR-FP-DOP-0303, Revision 1, did not visually verify monthly valve alignment

as being in the correct position as part of the SR 4.2.4 verification. • Not all TSR SR-verified valves are labeled, as observed during the May 17th

performance of the procedure.

FINDING SSO F-13 WCRRF FSS EP-WCRR-FP-DOP-0303 TSR SR-specified water supply valves were closed without notification to WCRRF operations during the weekend of 05/14/11-05/15/11; WCRRF went into Operations Mode on 5/16/11 without re-validating their position as open.

FINDING SSO F-14 WCRRF FSS Fire Water Supply Tank 64-03 is not operated and managed with the rigor commensurate with its safety function (e.g., no emergency operating procedure exists for tank low level alarms, its TSR SR-specified components are ML-4 designated and missing required calibration and testing).

FINDING SSO-F-15 WCRRF FSS The WCG fire sprinkler head control valve is not supervised, as required by NFPA 13, Standard for the Installation of Sprinkler Systems, and DCF-10-TA50-0069-034.

FINDING SSO-F-16 WCRRF FSS The WCG fire sprinkler head installation is inconsistent with NFPA 13, Standard for the Installation of Sprinkler Systems, and the manufacturer’s recommendations with respect to the installation of guards and head’s deflector distance from the ceiling.

FINDING SSO-F-17 WCRRF FSS FSS control valve and hydrant maintenance and tests are not compliant with NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems.

OBSERVATION SSO O-1 WCRRF FSS - deleted

OBSERVATION SSO O-2 WCRRF FSS The WCRRF FSS priority drawings do not depict the fire sprinkler remote area, so ER-FP-07-042, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, cannot be validated to have the correct number of sprinkler heads operating to meet the minimum required design area of 1,500 ft2.

OBSERVATION SSO O-3 WCRRF FSS The 100,000 gallon minimum water supply that is required by the BIO and TSRs may be


inadequate when hydraulic calculation errors are corrected.

OBSERVATION SSO O-4 WCRRF FSS WO #376531, dated 9/23/10, specified the work hazard as moderate, but ‘moderate’ was crossed-out and initialed to be re-classified as low, without explanation.

OBSERVATION SSO O-5 WCRRF FSS The current configuration of the temperature monitoring/freeze protection system and its system interfaces is not consistent with the approved, but not yet implemented, BIO and TSR documents. As such, future implementation of the BIO and TSR requirements is at risk.

OBSERVATION SSO O-6 WCRRF FSS The TSR basis for SR 4.2.2 incorrectly identifies the 500,000 fire water tank as being county owned.

OBSERVATION SSO O-7 WCRRF FSS WCRRF BIO Table 4-27 – Combustible-Loading Control Performance Criteria is inconsistent with BIO Section 4.5 and TSR LCO 3.4.2.

OBSERVATION SSO O-8 WCRRF FSS DCF-10-TA50-0069-034 does not indicate approval, completion and closure of WCG fire sprinkler head installation.

OBSERVATION SSO O-9 WCRRF FSS IWD steps were not followed during the performance of WO# 392396: Repair Water Bell/Gong on the WCRRF FSS, and WO# 398697: Quarterly PM for the WCRRF FSS.

OBSERVATION SSO O-10 WCRRF FSS SDD-TA-50-0069-FSS-R.1, FSS System Design Description (SDD), contains gaps in technical information, editorial errors, and does not contain current BIO information.

OPPORTUNITY FOR IMPROVEMENT SSO OFI-1 WCRRF FSS As recommended by DOE-STD-1066, Fire Protection Design Criteria, WCRRF should consider adding fire screens immediately downstream of the WCG exhaust canister HEPA filters.


VII. (A) DOE O 420.1B, Facility Safety References

(B) DOE-STD-1066, Fire Protection Design Criteria (C) DOE-STD-1073, Guide for Operational Configuration Management Program (D) DOE Interim Guidance on the Design and Operation of Wet Pipe Sprinkler Systems

and Supporting Water Supplies, Dec. 9, 2009 (E) LASO Memo FO/SET: 26FB-343324, Assessment Plan for the Safety System

Oversight Assessment in coordination with Waste Disposition Project Facility Centered Assessment, Apr. 27, 2011.

(F) SDD-TA-50-0069-FSS-R.1, Waste Characterization, Reduction, and Repackaging Facility (WCRRF) Fire Suppression System (FSS) System Design Description.

(G) ABD-WFM-005, R. 1.3, Basis for Interim Operation for Waste Characterization, Reduction, and Repackaging Facility (WCRRF).

(H) ABD-V/FM-006, R. 1.3, Technical Safety Requirements (TSRs) for Waste Characterization, Reduction, and Repackaging Facility (WCRRF).

(I) EO-FP-10-125, Revision 6, WCRR Facility Fire Hazards Analysis, June 8, 2010. (J) EP-WCRR-FO-DOP-0203, R.23, WCRRF Round Sheet, March 16, 2011. (K) EP-WCRR-FO-DOP-0203, R.25, WCRRF Round Sheet, May 4, 2011. (L) EP-WCRR-FP-DOP-0301, R.5, Hydrant flow Test, July 2, 2008. (M) EP-WCRR-FP-DOP-0302, R.5, Main Drain and Full Flow (Inspector's Valve) Tests,

July 23, 2010. (N) EP-WCRR-FP-DOP-0303, R.2, Monthly Fire Suppression Supply Valve Alignment

Check, March 8, 2011. (O) EP-WCRR-FP-DOP-0304, R.4, Quarterly Combustible Loading Verification.

November 21, 2007. (P) EP-WCRR-FP-DOP-0401, R.3, Fire Suppression System Alignment Checklist,

October 26, 2010. (Q) EP-WCRR-RM-EOP-0301, R.2, Fire at WCRRF, September 21, 2009. (R) EP-WCRR-RM-ARP-0406, R.2, Fire Alarm, October 28, 2010. (S) EP-WCRR-RM-AOP-0211, R.4, Glovebox Fire, October 28, 2010. (T) ERD-FIRE-06-211, R.0, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation,

October 23, 2006. (U) ER-FP-07-042, R.0, TA-50-69 (WCRRF) Sprinkler Hydraulic Calculation, April 13,

2007. (V) EP-WCRR-FO-ADM-0302, Rev 2, WCRRF Fire Protection Program, January 14,

2011. (W) DCF-10-TA50-0069-034-R.0, Install Fire Suppression in WCG, April 28, 2010. (X) Drwg. No. DCF-10-TA50-0069-034, R.0, WCRRF Fire Suppression Waste

Characterization Glovebox, dated 8/13/10. (Y) Drwg. Nos. EP-WCRR-ED-FP-001 and -002, Rev. 2, WCRRF FSS Essential

Drawing, dated 8/28/08. (Z) WO #394004, TA-55 Water Block Valve/Hydrant Block Valve Inspection, performed

12/23/10. (AA) WO #394005, TA-64 Water Block Valve/Hydrant Block Valve Inspection, performed

12/6/10. (BB) WO #394006, TA-48 Water Block Valve/Hydrant Block Valve Inspection, performed


12/6/10. (CC) WO# 376531, WCRRF TSR 1-Yr Hydrant Flow Test, performed 9/23/10.

Interviews (A) WCRRF FSS CSE (B) WCRRF Fire Protection Engineer (C) Design Engineer for WCRRF WCG FSS Design Modification (D) 2 WCRRF Operators – Complete WCRRF Daily Rounds Worksheets (E) LANL Utilities SME

Activities − Limited walkdown of the LPS at WCRRF, RANT and five representative domes (48,

283, 229, 230, 231) at TA-54 Area G. − Performance of WO# 392396: Repair Water Bell/Gong on the WCRRF FSS − Performance of WO# 398697: Quarterly PM for the WCRRF FSS − Performance of EP-WCRR-FP-DOP-0303, Monthly FSS Valve Alignment Checklist


U.S. Department of Energy National Nuclear Security Administration

Los Alamos Site Office

LASO Safety System Oversight (SSO)Assessment Report for the

WCRRF, RANT and Area GLightning Protection Systems (LPS)

June 2011

WDP FCA ATTACHMENT 4.4: LASO SSO Assessment Report for WCRRD, RANT, and Area G LPS PFITS 2010-1634

LASO SSO Assessment Report – WCRRF, RANT and Area G LPS June 2011

Table of Contents

I. Executive Summary ............................................................................................................... 4II. Introduction ............................................................................................................................ 5III. Scope and Methodology ........................................................................................................ 6IV. Results .................................................................................................................................... 9V. Specific Criteria, Observations and Evaluations ................................................................. 11VI. Issue Summary Table ........................................................................................................... 20VII. References ............................................................................................................................ 22



Page 4 of 23

I.A Los Alamos Site Office (LASO) Safety System Oversight (SSO) assessment of the Waste Characterization, Reduction and Repackaging Facility (WCRRF), Radioassay and Nondestructive Testing (RANT) Facility, and the Area G lightning protection systems (LPSs) was performed to provide DOE line managers with accurate objective information on the performance of safety-significant (SS) systems with regards to nuclear facility authorization basis requirements, national consensus standards and other requirements. This assessment was scheduled as part of the FY2011 Integrated Assessment Schedule (IAS) and performed in coordination with the Los Alamos National Laboratory (LANL) performed Waste Disposition Project (WDP) Facility Centered Assessment (FCA).

Executive Summary

The assessment evaluated five objectives: Safety Function Definition (SFD), Configuration Management (CM), System Maintenance (SM), System Surveillance and Testing (SST),and Cognizant System Engineer (CSE). This assessment identified eleven (11) findings, nine (9) observations, and one (1) opportunity for improvement, which are listed in Section VI - Issue Summary Table. Of particular concern to the assessment team was the continued use of several Area G catenary LPSs that are not in compliance with the design requirements. Below are three (3) findings that directly challenge safety basis requirements and the ability of the assessed system to perform the safety functions credited in the safety basis.

FINDING SSO F-1 WDP LPThere is no evidence of completion of the RANT lightning strike frequency analysis required by the DOE Safety Evaluation Report for the currently implemented safety basis, Condition of Approval #5.

FINDING SSO F-6 WDP LPDomes 48 and 283 LPS are not in compliance with design requirements and non-compliances have not been evaluated for effects on system operability in accordance with AP-341-516.

FINDING SSO F-7 WDP LP System Operability Determination POD-11-TA54-0049-004, dated 2/25/2011, for Area G Dome 49 LPS sagging catenary wire was performed incorrectly by including administratively controlled compensatory measures as part of the system evaluation thereby reaching an incorrect conclusion and allowing continued operations with an inoperable credited safety system.



Page 5 of 23

II.The safety function of the WCRRF, RANT, and Area G safety-significant (SS) lightning protection systems (LPSs) is to reduce the likelihood of a fire from a lightning strike on or near the building.

Introduction

The WCRRF, RANT, and Area G safety basis LPS performance criteria require:a NFPA-780 compliant installation; an annual visual inspection by a qualified NFPA-780 inspector, as well as an inspection following a known lightning strike on the structure; a three-year electrical resistance testing by a qualified NFPA-780 inspector

As part of this review, the assessment team reviewed and evaluated if: system analyses and calculations adequately predict required system performanceconfiguration management is maintained such that system analyses, documentation, and installation are consistent, andsystem operating, surveillance, maintenance, and test procedures maintain and verify performance consistent with safety basis and code requirements, andthe Cognizant System Engineer (CSE) adequately supports system configuration management and operations.



Page 6 of 23

III.The assessment criteria for this review are prescribed in LASO MP 06.02, Rev. 4, System Safety Oversight, Attachment 6, and are stated below. Each is evaluated in Section V – Specific Criteria Observations and Evaluations. This assessment was performed in coordination with the LANL-performed WDP FCA.


Safety Function Definition (SFD)Objective: Safety basis-related technical, functional, and performance requirements for

the system are identified/defined in appropriate safety documents. Criteria:


Configuration Management Objective: Changes to safety basis-related requirements, documents, and installed

components are controlled.

Criteria:









Page 7 of 23

System MaintenanceObjective: The system is maintained in a condition that ensures its integrity, operability

and reliability.

Criteria:SM-1: Identified preventative and predictive maintenance is consistent with the

system safety classification, safety basis requirements, LANL procedures, and applicable national consensus standards.




System Surveillance and TestingObjective: Surveillance and testing of the safety system demonstrates that it is capable of

accomplishing its safety functions and continues to meet applicable system requirements and performance criteria.

Criteria:SST-1: Requirements for surveillance and testing are adequate for demonstrating

overall system reliability and operability, and reflect the technical safety basis.



Cognizant System EngineerObjective: A trained and qualified Cognizant System Engineer (CSE) is assigned to this

system to apply engineering expertise to maintain safety system configuration and assess system operability, reliability, and maintenance.

Criteria:CSE-1: A CSE is assigned to the system and is qualified in accordance with LANL

requirements.





Page 8 of 23


The approach used in conducting this assessment included: reviewing documentation that supports the design and safety basis requirements for the LPSs, conducting interviews with assigned system engineers and authorization basis personnel, performing limited facility walk-downs of the system, and observing field performance of several surveillance testing and maintenance activities.

The definitions used to categorize identified issues have been revised from the LASO management procedure (MP)-00.12, Independent Assessment Process, provided definitions to be consistent with the Facility Centered Assessment (FCA) definitions. The FCA identified issues are categorized as findings, observations, opportunities for improvement or noteworthy practices. The definitions are included in the WDP FCA report.



Page 9 of 23

IV.This LASO Safety System Oversight (SSO) assessment documents the adequacy of the WCRRF, RANT, and Area G LPS safety basis described performance requirementimplementation, system configuration management, and system operating, surveillance, maintenance, and test performance consistent with safety basis and NFPA code requirements. CSE support of system design, maintenance and operations is evaluated in accordance with DOE Order 420.1B and laboratory requirements. Four of the 5 objectives were met; CM was not met. The assessment team concluded that existing Area G catenary-type systems for Domes 48, 49, and 283 are not installed or maintained in accordance with design requirements, and that the facility did not address known deficiencies in accordance with laboratory procedures. With these deficiencies, there is no assurance that the LPSs can perform their SS-credited safety function. Findings are listed in the table in Section VI - Issue Summary Table.

Results

Of particular concern to the assessment team was the continued use of several Area G catenary LPSs that are not in compliance with the design requirements. AP-341-516, Operability Determination, requires performing an Immediate Operability Determination (IOD) upon discovery of degraded or nonconforming condition in safety Systems, Structures and Components (SSC). Examples of nonconformance include:

(1) WDP personnel are aware that the Dome 48 structure is within the minimum required bonding distance from the catenary LPS down conductors. However, no operability determination has been performed and Dome 48 remains in service.

(2) WDP personnel are aware that a) one of the Dome 283 LPS catenary poles is significantly leaning, resulting

in additional sag in the overhead catenary lines, and b) the Dome 283 structure may be within the minimum required bonding

distance from the catenary LPS down conductors. However, no operability determination has been performed and Dome 283 remains in service.

(3) POD-11-TA54-0049-004 determined the Dome 49 LPS could be considered operable contingent upon a compensatory measure that “the facility ensures that all metal objects within six feet are either moved or bonded to the dome's steel structural members." However, Dome 49 operations continue with implemented compensatory measures that were not approved by DOE. (EP-SO-2128, R.0, TA-54 Dome 49 Inoperable Lightning Protection System (LPS) Compensatory Measures.)

As previously identified in LASO SSO Assessment Report for the TA-54 Lightning Protection System, the assessment team has continuing concern with LANL’s installation, maintenance and testing of installed LPSs. [Issue VSS-TA54-LPS-NC-08-08] For example, the Engineering Standards Manual requires a LPS for all structures protected by an automatic sprinkler system, and structures using, processing or storing radioactive materials. However, several Area G structures that meet these criteria do not have LPS installed. Further, the Operations and Maintenance (O&M) Criterion 507 – Lightning Protection Systems, provides insufficient direction to ensure NFPA 780 inspections and testing for installed LPSs resulting in preventative maintenance not being scheduled, budgeted or performed that is required to ensure the reliable performance of LANL’s lightning protection systems. Since O&M Criterion 507 states that there are no maintenance or regular periodic inspections requirements, WDP has proposed the



Page 10 of 23

cancellation of all annual and 5-year visual and electrical LPS inspections and testing for TA-46-326, TA-50-54, TA-54,32, TA-54-39, TA-54-62, TA-54-70, TA-54-282 and TA-54-299. The justification states, “There is no requirement to perform inspections per O&M.” This concern is exacerbated with the near-term removal of safety-significant (SS) designation for the Area G LPS Dome structures in the approved, but not yet implemented, Area G safety basis.



Page 11 of 23

V. Specific Criteria, Observations and Evaluations

Safety Function Definition (SFD)The SFD objective is met since the LPS safety function, functional requirements and performance criteria are appropriately identified, flowed down and defined in the safety documents.

Based on a review of all safety basis documents, the documents correctly identify and describe the LPS design and functional requirements, performance criteria, and appropriate consensus standards for the installed system. While two SFD issues were identified, neither affects the safety basis described safety function, functional requirements or performance criteria of the LPS.


FINDING SSO F-1 WDP LPThere is no evidence of completion of the RANT lightning strike frequency analysis required by the DOE Safety Evaluation Report for the currently implemented safety basis, Condition of Approval #5.

The DOE Safety Evaluation Report (SER), Basis for Interim Operation (BIO) and Technical Safety Requirements (TSRs) for Radioassay and Nondestructive Testing (RANT) Facility, dated May 30, 2003, approving the current RANT safety basis included COA #5. SER COA #5 states “As a condition of approval, within 60 days, LANL shall provide the NNSA a rigorous technical analysis of the lightning strike frequency for the RANT building, TA-54-38, performed by a recognized expert in the field with further recommendations for cost effective risk reduction in a formal report. Appendix 3A, to Chapter 3 of the BIO reports the lightning strike frequency as: ‘… The frequency of a lightning strike on a smaller structure, such as Building TA-54-38, would be at least an order of magnitude less (approximately 3.6E-3 per yr, or once every 280 yrs). …’

NNSA performed independent analysis using the methodology developed by E. T. Pierce for determining the effective strike area. NNSA calculated that the frequency for lightning strikes to the RANT building is greater than what was calculated in the RANT BIO, Appendix 3A by a factor of 30. NNSA determined the frequency to be 1.16E-1 as opposed to 3.6E-3. The frequency category assumed in the BIO for lightning strikes is therefore in question and must be evaluated within 30 days.”

LANL Vital Safety System (VSS) Assessment for the RANT Facility Lightning Protection System, dated September 30, 2008, identifies that this COA was addressed by BIO page change 1. Based on the posted safety basis document list, this change was never implemented.

OBSERVATION SSO O-4 WDP LPThe WCRRF BIO contains editorial errors that were not identified and corrected during document reviews.



Page 12 of 23

The WCRRF BIO references two different versions of the NFPA 780 code. Specifically, Section 2.10 – References, refers to version 2004, while Sections 4.6 and 5.8 – References refer to version 2002; there is not NFPA 780-2002 version.

While WCRRF BIO Appendix 3C, Lightning-Initiated Fire Frequency, Section 3C.3 – References, correctly lists four references, all of the references in the analysis are incorrectly identified as ‘(Ref. 0)’.

Configuration Management (CM)The CM objective is not met because identified system non-compliances with design requirements are not adequately controlled.

Based on a review of system technical baseline documentation, a limited walkdown of the LPS at WCRRF, RANT and five representative domes at Area G, LPS non-compliances on Area G Domes 48 and 283 have not been evaluated for effects on system operability in accordance with AP-341-516, Operability Determination, and the system operability determination for a sagging LPS catenary wire on Dome 49 LPS was performed incorrectly. These non-compliances challenge the ability of the LPS to perform its safety function.







FINDING SSO F-3 WDP LPWDP LPS changes are implemented without adequate documented technical justification and/or required approvals.

DCF-09-TA50-0069-011, LP Bonding of Metallic Fall Protection on Roof, drawing WCRRF Lightning Protection for Safety Rails – Details for Bonding, incorrectly specified cast bronze pressure ‘tee’ splicers to connect the rail copper conductor to the existing building’s aluminum main conductors; NFPA 780, Section 4.5.3.2, requires bimetallic connectors and fittings for splicing or bonding dissimilar metals.



Page 13 of 23

IDED-08-TA54-007, Area G LPS Ground Clamp Assemblies Item Dedication, specified an acceptance criterion of 5.0 ohms resistance for each REB 2960 Static Grounding Clamp. It is uncertain how the acceptance criteria was determined and how use of these 5-ohms clamps permits continuity testing of lightning protection components with a maximum reading of 1.0 ohms [Ref: EP-AREAG-FO-DOP-0210, Rev. 2, WCRRF LPS Annual/Triennial In-Service Inspection , Step 14].

FINDING SSO F-4 WDP LPNot all WDP calculations receive independent reviews and approvals as required by AP-341-605, Engineering Calculations.

CALC-09-TA54-AREAG-002, R.0, Dome Catenary Lightning Protection System Arc Flash Distance, CALC 08-54-048-000-0001-E-R-0, R.0, (Dome 48) Arc Flash, and others, were not independently reviewed, as required by AP-341-605, Engineering Calculations. AP-341-605, Engineering Calculations, requires independent technical review of ML-1, ML-2 and ML-3 calculations. The Area G dome catenary LPS’ are designated ML-2.

CALC-08-54-375-000-0002-E-R-0, Lightning Protection Bonding Distance, was not signed by the Responsible Manager in Section 5.2, as required by AP-341-605, Engineering Calculations.

FINDING SSO F-5 WDP LPThe TA-54-215 LPS was recently removed to avoid future maintenance on the system contrary to the LANL ESM requirement for a LPS for all structures protected by an automatic sprinkler system; TA-54-215 has an installed automatic sprinkler system.


AP-341-516, Operability Determination, requires performing an Immediate Operability Determination (IOD) upon discovery of degraded or nonconforming condition in safety Systems, Structures and Components (SSC). As-found conditions of the Dome 48 and 283 LPS are not in compliance with the design requirements as identified by dome specific arc flash distance requirements calculations. No IOD has been completed.

During walkdown of the Dome 48 LPS, it was identified that: the building structure is within the minimum required bonding distance from the catenary system down conductors. For Dome 48, the minimum required bonding distance calculated to prevent arcing from lightning protection down conductors is 30 inches; several down conductors are less than 16 inches from metal door canopies connected to the dome structure; the TA-54-48 surge protection device indicator lights were off.

During walkdown of the Dome 283 LPS, it was identified that:



Page 14 of 23

one of the lightning protection catenary poles is significantly leaning, resulting in additional sag in the overhead LPS lines. This condition has not been evaluated for continued operability; the dome structure may be within the minimum required bonding distance from the lightning protection’s catenary system down conductors. CALC-09-TA54-AREAG-002, R.0, Dome Catenary Lightning Protection System Arc Flash Distance, determined a 37 inch bonding distance is required to prevent arcing from lightning protection down conductors at Dome 283 for all poles.

During walkdown of the Dome 229 LPS, it was identified that: the Rib 14 arc flash boundary had drums within the minimum clearance area. the Rib 19 bonding conductor (at base of the rib) was corroded because of an unknown substance. In addition, the Rib 14 arc flash boundary had a drip pan within the minimum clearance area.

FINDING SSO F-7 WDP LP System Operability Determination POD-11-TA54-0049-004, dated 2/25/2011, for Area G Dome 49 LPS sagging catenary wire was performed incorrectly by including administratively controlled compensatory measures as part of the system evaluation thereby reaching an incorrect conclusion and allowing continued operations with an inoperable credited safety system.

FINDING SSO F-8 WDP LP WDP implemented compensatory measures for Area G Dome 49 LPS deficiencies without utilizing LANS’ New Information (NI) process for determining required approval authorities for changes to a credited safety system.

The Area G TSRs require the IN-SERVICE INSPECTION Program to ensure that passive design features are inspected and maintained to satisfy the intended safety function. The annual in-service inspection (ISI) of the safety-significant Area G Dome 49 LPS identified a sagging LPS overhead catenary line too close to the dome structure (i.e., less than 6’). POD-11-TA54-0049-004 determined the Dome 49 LPS could be considered operable contingent upon a compensatory measure that “the facility ensures that all metal objects within six feet are either moved or bonded to the dome's steel structural members." Though this evaluation may be technically correct, it was implemented without utilizing the New Information Process that would have identified this as a positive USQ requiring DOE approval for continued operation using the compensatory measures.

Subsequently, without formally notifying NNSA/LASO of a failed ISI, WDP wrote standing order EP-SO-2128, R.0, TA-54 Dome 49 Inoperable Lightning Protection System (LPS) Compensatory Measures. It permits continued activities associated with operations conducted inside of Dome 49 or within 6 ft of the exterior of the dome with the following condition: ''All un-bonded objects within 6-ft of the metal portions of the dome must be moved to comply with AC S.6.4.10.f” so as to permit continued activities associated with operations conducted inside of Dome 49 or within 6 ft of the exterior of the dome.



Page 15 of 23

FINDING SSO F-9 WDP LPThe Area G waste characterization and verification (i.e., CCP) temporary drum storage area is not located within a LPS zone of protection.

FINDING SSO F-10 WDP LPThe Area G waste characterization and verification radiography trailers do not have installed LPS contrary to the LANL ESM requirement for a LPS for all structures that use, process or store radioactive materials.

FINDING SSO F-11 WDP LPThe ENG-DECS-06-026, The Use of Dissimilar Metals in Lightning Protection, approved exemption to NFPA 780 requirements for all LANL facilities is not described in the WDP safety bases and was not evaluated per LANL SBP112-3, Unreviewed Safety Question (USQ) Process, for compliance with the safety bases.

OBSERVATION SSO O-1 WDP LPThe WDP Master Document List (MDL) has not been updated to reflect closure of WCRRF LPS temporary modification TM-TA50-0069-10-001.

TM-TA50-0069-10-001 installed bonding cables and clamps on all metallic roof fall protection at WCRRF because it extended above the LPS air terminals. TM-TA50-0069-10-001 was closed, but it continues to appear on the WDP Master Document List (MDL).

OBSERVATION SSO O-2 WDP LPNot all WDP LPS priority drawings are correctly labeled or scanned into the WDP MDL.

a) Priority drawing EP-TA54-ED-E-1067,R.0, TA-54-0283 Electrical Power Equipment Layout, is mislabeled; the structure shown is not Dome 283.

b) Priority drawing EP-TA54-ED-E-2020, R.0, TA-54-0232 Lightning Protection Exterior Elevations, was not properly scanned; it is a duplicate of -2021.

OBSERVATION SSO O-3 WDP LPWhile the RANT DSA lists the LPS code of record (COR) as NFPA 780-2000, the facility is considering the removal of LPS components that are no longer required per NFPA 780-2011 (e.g., air terminals located on roof ancillary equipment – HVAC units). Removal of these LPS components is inconsistent with the COR.

OPPORTUNITY FOR IMPROVEMENT SSO OFI-1 WDP LPWDP should consider adding installed surge arrestors onto the LPS priority drawings because this equipment (e.g., surge arrestors installed on fire alarm control panels, communication lines, etc.) is required to be inspected as part of NFPA 780 requirements and others codes (e.g., NFPA 72, National Fire Alarm Code).



Page 16 of 23

System Maintenance (SM)The SM objective is met because the WCRRF, RANT and Area G LPS are being maintained in a condition that provides reasonable assurance of their continued integrity, operability and reliability.

Based on a review of planned and performed LPS maintenance, including a review of the last completed inspection and testing of the LPS at WCRRF, RANT and five representative domes at Area G, LPS maintenance is substantially consistent with consensus standards, DOE requirements and approved work instructions, and post-maintenance testing ensures the ability of the LPS to perform its safety function. During the assessment, several SM issues were identified, but none indicated a systematic failure of the planning, practices or procedures used to maintain the safety-credited LPS. Additionally, none of the SM issues challenge the ability of the LPS to perform its safety function.





FINDING SSO F-2 WDP LPTriennial LPS ground resistance testing test points are not documented as required by WDP LPS testing procedures to allow for validation of test results.

LPS inspection, maintenance and testing requires 3-yr electrical ground resistance testing of installed systems; the testing measures, records and evaluates resistance between test points (i.e., X, Y, and Z) on and around the installed system. Test point locations are not documented during testing or in any technical baseline documentation (e.g., LPS priority drawings, SDD, etc). As such, the measurements’ acceptability of test point placement with ground testing methodology is uncertain.

EP-RANT-FOE-DOP-0508, R.0, RANT Lightning Protection System (LPS) Triennial Ground Resistance Checks, and EP-WCRR-FO-DOP-0406, WCRRF LPS Triennial Ground Resistance Checks, Step 9.2 – Triennial LPS 3-point Ground Resistance Test require either the use of pre-engineered ground test points (i.e., test points specified in technical baseline documents) or, if pre-engineered test points have not been identified, the marking of the test points used on the illustrations in the applicable attachments, for reference.

OBSERVATION SSO O-5 WDP LPLANL Operations and Maintenance Criterion 507 – Lightning Protection Systems, provides insufficient direction to ensure NFPA 780 inspections and testing for installed-LPSs. As such, not all preventative maintenance is scheduled, budgeted or performed to ensure the reliable performance of LANL’s LPSs. (Previously identified as VSS-TA54-LPS-NC-08-08



Page 17 of 23

in LASO SSO Assessment Report for the TA-54 Lightning Protection System, 9/2008.)

Per O&M Criterion 507, Section 6.2 - Maintenance Requirements, there are no specific maintenance requirements identified for regular periodic inspections for LPS. Based on this information, AP-MNT-006, Preventive and Predictive Maintenance, Att. B – PM/PdM Deferral/Cancellation request was prepared on 3/21/2011 by WDP Maintenance to cancel all annual and 5-year visual and electrical LPS inspections and testing for TA-46-326, TA-50-54, TA-54,32, TA-54-39, TA-54-62, TA-54-70, TA-54-282 and TA-54-299. The justification states, “There is no requirement to perform inspections per O&M.”

AP-341-516, Operability Determination and Functionality Assessment, and O&M Criterion 507 provide conflicting requirements. Examples include:

O&M Criterion 507, Sections 4.1.3 and 4.7.1 assign the FM-MSE and the Fire Protection Engineer, respectively, the responsibility of performing LPS operability determinations. AP-341-516 assigns these responsibilities to the System Engineer, with approval by the Engineering and Operations Manager. O&M Criterion 507, Section 6.2.4 – LPS Operability Determination, does not have the same requirements as AP-341-516 or EP-DIV-REPORT-08, Technical Basis Document for EWMO Lightning Protection Systems, for determining LPS OPERABILITY. The O&M manual bases operability on the material condition and code requirements of the system instead of the system’s continued capability of performing its credited safety function, as identified in the more recently issued AP-341-516. EP-DIV-REPORT-08 includes specific criteria for EWMO LPS operability, along with technical evaluation and determination guidance.

O&M Criterion 507 has not been reviewed or revised in 5 years.

OBSERVATION SSO O-6 WDP LP Contrary to best management practices, WDP has requested to cancel all annual and 5-year electrical LPS inspections and testing for non-nuclear buildings because the LANL O&M Manual does not “require” testing of these systems.

OBSERVATION SSO O-8 WDP LP WDP could provide no evidence that procedure validation was completed prior to issuance and use of EP-RANT-FOE-DOP-0509, R.0, RANT Lightning Protection System (LPS) Annual/Triennial In-Service Inspection (ISI), as required by the procedure change request. Further, contrary to best management practices for a new (initial) procedure, no training was required prior to performance of the procedure and completion of the ISI.

OBSERVATION SSO O-9 WDP LP AP-MNT-012, Lightning Protection System Inspections, contains out-of-date references and directs the use of obsolete forms and attachments.

a. Section 1.6 - Requirements and Section 3.0 – References list out of date references: 1) UCRL-AM-208565, DOE Explosives Safety Manual LLNL (Work Smart

Standards Version), is a 2004 version; the current version is DOE M 440.1-1A –PANTEX/LLNL, Revision 9H, as of 10/21/2009

2) DOE M 440.1-1, DOE Explosives Safety Manual (Mar 29, 1996), the current version is DOE M 440.1-1A, DOE Explosives Safety Manual (Jan 09, 2006)



Page 18 of 23

b. Section 2.2 - Inspection Process, Step 4(i) states, “complete the inspection report (Attachment A)”. Attachment A is a form that is no longer in use.

c. Section 2.6 - Operability Determination, Step 1(b) states, “complete Section 4, System Status Determination of…Attachment A”. Attachment A is a form that is no longer used.

System Surveillance and Testing (SST)The SST objective is met since the LPS surveillance and testing activities demonstrate the system’s ability to perform its safety function, and the facility-specific surveillance requirement implementing procedures confirm system performance criteria are met in accordance with the technical requirements from approved consensus standards.

Based on review of the last completed LPS in-service-inspection (ISI) results of the LPS at WCRRF, RANT and five representative domes at Area G, LPS ISI inspection and testing ensures the ability of the LPS to perform its safety function.




OBSERVATION SSO O-7 WDP LP EP-RANT-FOE-DOP-0508, R.0, RANT Lightning Protection System (LPS) Triennial Ground Resistance Checks, Section 5.2 - Safety Basis Requirements, incorrectly states that LPSs shall be inspected and tested annually. While LPS inspection is required annually, testing is only required triennially.

Cognizant System Engineering (CSE)The CSE objective is met because the primary CSE assigned to the LPS at WCRRF, RANT and Area G is interim qualified and progressing towards a qualified status in accordance with LANL requirements. While the interim qualified CSE is not a key person in the evaluation of key system parameters, evaluations of system performance, and the analysis and resolution of system issues, his abilities to assume this role will improve as LANS continues to mature its site-wide CSE Program.



CSE-3: The CSE provides technical evaluations of, and concurs with, system configuration changes, including those affecting the safety basis, operations, maintenance, testing,



Page 19 of 23

design, and temporary modifications.


The primary CSE assigned to the WCRRF, RANT, and Area G LPS is interim qualified and progressing towards a qualified status in accordance with LANL requirements. As evidenced during several walkdowns and interviews, the CSE periodically walks down the system in accordance with applicable requirements to assess its material condition, aging condition and reliability.

An inherent weakness in not having a fully qualified CSE is that the CSE assigned to the WCRRF, RANT, and Area G LPS is not a key person in the evaluation of key system parameters, evaluations of system performance, and the analysis and resolution of system issues (e.g., system operability determinations have not been completed for several LPS deficiencies, Dome 49 is in use despite its LPS being inoperable, and the CSE is not qualified to perform USQs relating to LPS changes).



Page 20 of 23

VI. FINDING SSO F-1 WDP LPIssue Summary Table

There is no evidence of completion of the RANT lightning strike frequency analysis required by the DOE Safety Evaluation Report for the currently implemented safety basis, Condition of Approval #5.

FINDING SSO F-2 WDP LPTriennial LPS ground resistance testing test points are not documented as required by WDP LPS testing procedures to allow for validation of test results.

FINDING SSO F-3 WDP LPWDP LPS changes are implemented without adequate documented technical justification and/or required approvals.

FINDING SSO F-4 WDP LPNot all WDP calculations receive independent reviews and approvals as required by AP-341-605, Engineering Calculations.

FINDING SSO F-5 WDP LPThe TA-54-215 LPS was recently removed to avoid future maintenance on the system contrary to the LANL ESM requirement for a LPS for all structures protected by an automatic sprinkler system; TA-54-215 has an installed automatic sprinkler system.


FINDING SSO F-7 WDP LP System Operability Determination POD-11-TA54-0049-004, dated 2/25/2011, for Area GDome 49 LPS sagging catenary wire was performed incorrectly by including administratively controlled compensatory measures as part of the system evaluation thereby reaching an incorrect conclusion and allowing continued operations with an inoperable credited safety system.

FINDING SSO F-8 WDP LP WDP implemented compensatory measures for Area G Dome 49 LPS deficiencies without utilizing LANS’ New Information (NI) process for determining required approval authorities for changes to a credited safety system.

FINDING SSO F-9 WDP LPThe Area G waste characterization and verification (i.e., CCP) temporary drum storage area is not located within a LPS zone of protection.

FINDING SSO F-10 WDP LPThe Area G waste characterization and verification radiography trailers do not have installed LPS contrary to the LANL ESM requirement for a LPS for all structures that use, process or store radioactive materials.

FINDING SSO F-11 WDP LPThe ENG-DECS-06-026, The Use of Dissimilar Metals in Lightning Protection, approved exemption to NFPA 780 requirements for all LANL facilities is not described in the WDP safety bases and was not evaluated per LANL SBP112-3, Unreviewed Safety Question



Page 21 of 23

(USQ) Process, for compliance with the safety bases.

OBSERVATION SSO O-1 WDP LPThe WDP Master Document List (MDL) has not been updated to reflect closure of WCRRF LPS temporary modification TM-TA50-0069-10-001.

OBSERVATION SSO O-2 WDP LPNot all WDP LPS priority drawings are correctly labeled or scanned into the WDP MDL.

OBSERVATION SSO O-3 WDP LPWhile the RANT DSA lists the LPS code of record (COR) as NFPA 780-2000, the facility is considering the removal of LPS components that are no longer required per NFPA 780-2011 (e.g., air terminals located on roof ancillary equipment – HVAC units). Removal of these LPS components is inconsistent with the COR.

OBSERVATION SSO O-4 WDP LPThe WCRRF BIO contains editorial errors that were not identified and corrected during document reviews.

OBSERVATION SSO O-5 WDP LPLANL Operations and Maintenance Criterion 507 – Lightning Protection Systems,provides insufficient direction to ensure NFPA 780 inspections and testing for installed-LPSs. As such, not all preventative maintenance is scheduled, budgeted or performed to ensure the reliable performance of LANL’s LPSs.

OBSERVATION SSO O-6 WDP LP Contrary to best management practices, WDP has requested to cancel all annual and 5-year electrical LPS inspections and testing for non-nuclear buildings because the LANL O&M Manual does not “require” testing of these systems.

OBSERVATION SSO O-7 WDP LP EP-RANT-FOE-DOP-0508, R.0, RANT Lightning Protection System (LPS) Triennial Ground Resistance Checks, Section 5.2 - Safety Basis Requirements, incorrectly states that LPSs shall be inspected and tested annually. While LPS inspection is required annually, testing is only required triennially.

OBSERVATION SSO O-8 WDP LP WDP could provide no evidence that procedure validation was completed prior to issuance and use of EP-RANT-FOE-DOP-0509, R.0, RANT Lightning Protection System (LPS) Annual/Triennial In-Service Inspection (ISI), as required by the procedure change request. Further, contrary to best management practices for a new (initial) procedure, no training was required prior to performance of the procedure and completion of the ISI.

OBSERVATION SSO O-9 WDP LP AP-MNT-012, Lightning Protection System Inspections, contains out-of-date references and directs the use of obsolete forms and attachments.

OPPORTUNITY FOR IMPROVEMENT SSO OFI-1 WDP LP WDP should consider adding installed surge arrestors onto the LPS priority drawings because this equipment (e.g., surge arrestors installed on fire alarm control panels, communication lines, etc.) is required to be inspected as part of NFPA 780 requirements and others codes (e.g., NFPA 72, National Fire Alarm Code).



Page 22 of 23

VII. (A) DOE O 420.1B, Facility SafetyReferences

(B) DOE-STD-1073, Guide for Operational Configuration Management Program(C) LASO Memo FO/SET: 26FB-343324, Assessment Plan for the Safety System

Oversight Assessment in coordination with Waste Disposition Project Facility Centered Assessment, Apr. 27, 2011.

(D) AP-MNT-012, Lightning Protection System Inspections(E) NFPA 780, Standard for the Installation of Lightning Protection System, National

Fire Protection Association, Quincy, Massachusetts, 2008. (F) Operations and Maintenance Criterion 507 – Lightning Protection Systems, Rev. 5. (G) EP-DIV-REPORT-08, R.0, Technical Basis Document for the LPS in the EWMO

Division, dated 11/26/08. (H) EP-REPORT-2108, LANL VSS Assessment for the TA-54 Area G LPS, dated 9/10/08. (I) POD-11-TA54-0049-004, TA54 Dome 49 Sagging LPS Catenary Wire, dated

2/25/11. (J) EP-DIR-NCR-11-0035, 54-49 LPS Non-compliance, and its associated Conditional

Release Request (CRR), dated 3/2/11. (K) USQ Determination AREAG-11-119-D, Conditional Release for 54-49 LPS NCR,

dated 3/3/11. (L) EP-SO-2128, R.0, TA-54 Dome 49 Inoperable Lightning Protection System (LPS)

Compensatory Measures, written 2/25/11, approved 3/1/11, and effective 3/3/11. (M) USQ Determination AREAG-11-108-D, EP-SO-2128, R.0, TA-54 Dome 49

Inoperable Lightning Protection System (LPS) Compensatory Measures, dated 2/25/11.

(N) CALC-09-TA-54-AREAG-002, R.0, Dome [49, 153, 283] Catenary LPS Arc Flash Distance, dated 11/23/08.

(O) CALC-08-54-048-000-0001-E, R.0, [Dome 48] Arc Flash Bonding Distance, dated 11/5/08.

(P) Item Dedication IDED-08-TA54-007, Area G Ground Clamp Assemblies, dated 1/14/08.

(Q) WCRRF DCF-09-TA50-69-011, WCRRF LPS Fall Protection Bonding Modifications, dated 6/15/09.

(R) Dwg EP-WCRR-ED-LP-01, WCRRF LPS Essential Drawing, Shts 9 & 10, dated 5/14/07.

(S) EP-WCRR-FO-DOP-0403, R.03, WCRRF LPS Annual/Triennial In-Service Inspection (ISI), dated 1/6/2010.

(T) EP-WCRR-FO-DOP-0406, R.0, WCRRF LPS Triennial Ground Resistance Checks,dated 1/8/10.

(U) EP-RANT-FOE-DOP-0508, RANT LPS Triennial Ground Resistance Checks, dated 1/22/10.

(V) EP-RANT-FOE-DOP-0509, RANT LPS Annual/Triennial In-Service Inspection (ISI),dated 5/3/10.

(W) EP-AREAG-FO-DOP-0210, R.2, TA-54 Area G LPS Annual/Triennial In-Service Inspections (ISI), dated 4/16/10.

(X) WO 368582 - WCRRF LPS 3-yr Elec Insp (with EP-WCRR-FO-DOP-0403), performed 4/2/10.

(Y) WO 383194 - RANT LPS 3-yr Elec Insp (with EP-RANT-FOE-DOP-0508),



Page 23 of 23

performed 8/6/10. (Z) WO 397675 - WCRRF LPS ISI: Visual Inspection (with EP-WCRR-FO-DOP-0403),

performed 11/4/10. (AA) WO 376669 - RANT LPS ISI: Visual Inspection (with EP-RANT-FOE-DOP-0509),

performed 8/6/10. (BB) WO 401332 - Area G LPS ISI: Visual Inspection (with EP-AREAG-FO-DOP-0210),

performed 2/28/11

Interviews(A) WCRRF, RANT and TA-54 Area G LPS CSE(B) Qualified LPS Maintenance Technician (C) Qualified LPS Inspector

ActivitiesLimited walkdown of the LPS at WCRRF, RANT and five representative domes (48, 283, 229, 230, 231) at TA-54 Area G.


U.S. Department of Energy National Nuclear Security Administration

Los Alamos Site Office

LASO Safety System OversightIndependent Assessment Report for theWCRRF Uninterruptible Power Supply

System

June 2011

WDP FCA ATTACHMENT 4.5: LASO SSO Assessment Report for WCRRF UPS System PFITS 2010-1634

LASO SSO Independent Assessment Report – WCRRF UPS June 2011

Table of Contents

I. Executive Summary ............................................................................................................... 1II. Introduction ............................................................................................................................ 2III. Scope and Methodology ......................................................................................................... 3IV. Results .................................................................................................................................... 3V. Specific Criteria, Observations and Evaluations.................................................................... 4VI. References ............................................................................................................................ 16Interviews Conducted ................................................................................................................... 16System Walkdowns and configuration items observed ................................................................ 16Documents Reviewed ................................................................................................................... 16



1

I.

The purpose of this assessment is to provide NNSA managers with accurate, objective information on the performance of safety systems and their ability to perform as required by safety bases and other applicable requirements. This assessment was scheduled as part of the FY2011 Master Assessment Schedule.

Executive Summary

This report documents seven findings and one observation regarding the WCRRF UPS system. The cognizant system engineer objective was the only objective met of five objectives assessed. While not posing an imminent danger, the UPS system management does not demonstrate adequate protection of the safety basis. There are two conditions that are potential safety basis violations regarding the use of the UPS to support operations that have not been adequately evaluated and approved for continued operations.

UPS maintenance and testing is not compliant with LANL engineering and maintenance requirements for UPS systems. The LANL requirements have not been revised to incorporate several important updates to consensus codes. Implementation of current code requirements may make compliance more efficient and achievable. There were no documented approvals allowing exemptions to the LANL UPS requirements.

FINDINGS

SSO-F-1-WCRRF-UPS. The BIO for WCRRF does not properly identify seismic performance criteria for the UPS. The UPS supports the Programmable Logic Controllers for the CVS that are expected to function during and after a PC-2 seismic event, however the UPS is not required to meet this seismic criterion.

SSO-F-2- WCRRF -UPS. Priority drawings affected by the UPS replacement have not been updated to capture facility changes as required by AP-341-405 thereby preventing timely closure of the design change documentation.

SSO-F-3- WCRRF -UPS. The UPS replacement project specifications in the DCF properly identified that the UPS requires seismic bracing to the PC-2 level. However, installation of this bracing was not planned, nor executed as part of the project scope. This design change was not evaluated using the USQ process, nor was an exemption approved.

SSO-F-4- WCRRF -UPS. Contrary to the requirements of Design Change Form DCF-10-TA50-0069-0035, Administrative Procedure AP-341-516, Operability Determination and AP-350-420, R0, Project Turnover and Acceptance, the Waste Characterization Reduction and Repackaging Facility (WCRRF) Uninterruptable Power Supply (UPS) has been declared operable and put into service when it has not been demonstrated capable of performing its credited safety function.

SSO-F-5-WCRRF-UPS. Maintenance of the UPS system and components has not been conducted in accordance with NFPA 110 and 111, as implemented through O&M Manual Criteria 505 and 511. No variance from these requirements has been approved and no compensatory measures have been implemented.



2

SSO-F-6-WCRRF-UPS. There is no positive control of all UPS supported loads as assumed in WCRRF UPS Load Calculation CALC-11-TA50-0069-008. Therefore the performance criteria of a one hour continuous load stated in the WCRRF BIO ABD-WFM-005-R1.3 cannot be assured.

SSO-F-7-WCRRF-UPS. The CSEs assigned to the UPS system did not properly recognize two nonconforming conditions as requiring USQ Determinations as required by 10 CFR 830, Nuclear Safety Management and the LANL USQ Procedure, SBP112-3 R0, Unreviewed Safety Question (USQ) Process, Sections 3.8.1, Discrepant As-Found Condition, or 3.8.3 Receipt of New Information.

OBSERVATIONS

SSO-O-1-WCRRF-UPS. The LANL engineering design and operations standards are outdated. Engineering Standards Manual, Chapter 7, and the Operations and Maintenance Manual, Criterion 505, are written based on earlier versions of NFPA-111.

II. Introduction

This assessment was performed to provide Department of Energy (DOE) line managers with accurate objective information on the performance of the WCRRF UPS, an active safety-significant system, and the associated effectiveness of contractor work performance and practices, including the contractor's Cognizant System Engineer (CSE) Program. This review also serves as one data point in the overall evaluation of the Contractor’s Assurance System.

The function of this UPS is to ensure that the WCRRF Confinement Ventilation System (CVS) distributed controls maintain power in the event of off-site power loss. The UPS does not support the CVS fans, however the facility does have an auto-start diesel generator that backs up key systems and recharges the UPS battery bank. The Basis of Interim Operations (BIO) does not credit the generator and does not permit operations unless there is commercial power supplied to the main transformer.

The WCRRF UPS is subject to the requirements of the LANL Engineering Standards Manual (ESM), Chapter 7, Electrical, and the Operations and Maintenance Manual (O&MM), Criteria 505, UPS Systems and 511, Stationary Battery Systems. The UPS equipment was fully replaced in the fall of 2010 and the Design Change Form package is open, pending completion of commissioning tests and updates to Priority Drawings. There are two Nonconformance Reports (NCR) open that apply to the UPS. Specifically, the first NCR is a conditional release for operations that addresses the lack of complete commissioning tests and the second NCR is a conditional release to address the lack of seismic bracing as required by the BIO and the ESM. The UPS has been placed into service based on successful completion of the annual load test, per In-Service Inspection Requirement 6.2.2.



3

III. Scope and Methodology

The scope of this assessment is based on the assessment criteria prescribed in LASO MP06.02, Revision 4, System Safety Oversight, Attachment 1. This assessment did not include the criterion for safety software because there is no applicability. The assessment included review of design and operating requirements, safety basis, system design drawings and documents and maintenance records, field walk down of system components and interviews of system engineers, technicians and operations managers as needed.

IV. Assessment Results

This assessment documents the current status of maintenance and operations of the WCRRF UPS, a credited safety-significant system in the Basis of Interim Operation (BIO). The assessment included all five objectives of the LASO System Safety Oversight Procedure, MP 06.02, Revision 4. One of the five objectives was met, the Cognizant System Engineer (CSE) objective. Though there was one finding in this objective regarding the CSE’s role in initiating Unreviewed Safety Question Determination (USQ) screens.

Requirements for managing the UPS as a credited system, in compliance with DOE O420.1B, Facility Safety, and associated codes and standards, are unclear in the LANL Operations and Maintenance Manual (OM&M). The LANL O&MM is outdated and misapplies the National Fire Protection Association (NFPA) codes to this system. This UPS does not meet the intent statements in NFPA 110 or 111, yet because of the O&MM requirements, it must be managed with the maximum rigor to remain compliant. WCRRF is not managing the UPS in accordance with the OM&M but has no approval to deviate from those requirements.

The UPS equipment was replaced in late 2010, however the installation was not done in full compliance with DOE and LANL requirements. The UPS is required to be seismically braced to ensure it will operate during and after a PC-2 seismic event, yet there was no seismic bracing designed or installed. Further, there is no USQ or NNSA variance to support continued operations outside of this safety basis requirement.

As part of this replacement, in compliance with the LANL O&MM, the system was required to be tested to national codes before being commissioned to support operations. All required tests did not occur before the system was placed into service. This issue was recognized by the Engineering and Operations managers, however was inappropriately addressed using the Nonconformance Reporting (NCR) process to grant a conditional release based on a successful load test. This approach assumed that the system was OPERABLE and that the tests were strictly a reliability issue, in contrast to the intent of the tests which demonstrate required output performance parameters.

As of the completion of this assessment, the UPS does not meet current maintenance requirements, and is being operated with two deficiencies that don’t appear to implement



4

the intent of the safety basis. No NNSA approved compensatory measures have been implemented.

V.

The assessment team evaluated the system and management processes using the criteria below. These criteria are a subset of the safety system assessment criteria identified in reference (j); the numbering remains consistent with the parent document.

Criteria, Observations and Evaluations

Safety Function Definition

Objective: Safety basis-related technical, functional, and performance requirements for the system are identified/defined in appropriate safety documents.

Criteria:


Results:

This objective is not met. The BIO, ABD-WFM-005, does not identify that the UPS must function during and after a PC-2 seismic event. This is necessary in order to maintain the Confinement Ventilation System (CVS) performance criteria. The CVS is credited in Table 4-11 of the BIO with maintaining confinement during and after a PC-2 event, yet the UPS is not PC-2 credited and is a support system to the CVS.

SFD-1

The WCRRF Basis for Interim Operation (BIO) ABD-WFM-005, dated August 2010 has been implemented. The UPS is credited as a safety-significant support system to the confinement ventilation system (CVS) that provides continuous power to the programmable logic controller (PLC) and associated pressure transducers of the CVS. The UPS does not power the ventilation fans. It is credited only with maintaining power to the PLC, Operator Interface Terminal and Pressure Transducers. The safety function and functional requirements for the UPS are defined in Table 4-23 of the BIO, as shown below.

Safety Function Functional RequirementsThe safety function of the UPS is to provide continuous, conditioned power to the control system for the confinement ventilation system.

Provide continuous, conditioned power to the programmable logic controllers, the differential pressure sensors, the Operator Interface Terminal (OIT), and the alarms of the confinement ventilation control system.

Table 4-23. Functional Requirements for the Uninterruptible Power Supply



5

The BIO identifies one TSR control for the UPS, as a Limiting Condition for Operation/Surveillance Requirement (LCO/SR), stating:

The UPS shall provide power to required loads for at least 1 hour.

Loss of power to these systems will result in a shutdown of the CVS, which is covered by the LCOs for the CVS. In the TSR ACTION statements for the CVS, statement (E) identifies in that if the UPS is INOPERABLE, the Inventory is to be placed in a safe configuration IMMEDIATELY and the UPS is to be restored to OPERABLE status in 7 days.

Table 4-1 in the BIO identifies the credited Safety Structures, Systems and Components (SSC) and the associated accidents they are designed to mitigate or prevent. The UPS is credited with mitigation of a seismic event with fire. The SSC function identified is consistent with Table 4-23 above, Provide continuous, conditioned power to the control system for the CVS.

The CVS is credited in Table 4-11 of the BIO with the performance criteria of maintaining confinement during and following a PC-2 seismic event. Support systems required for credited systems to achieve their performance criteria must also be capable of functioning under the analyzed scenarios in accordance with 10CFR.830.204 and DOE G 423.1-1A, section 4.10.3. Thus the performance criteria in Table 4.1 for the UPS should identify that the UPS is required to also provide continuous power during and following a PC-2 seismic event. This information is not contained in the table. See related discussion and Finding 4 under criterion CM-4 below.

Finding: SSO-F-1-WCRRF-UPS. The BIO for WCRRF does not properly identify seismic performance criteria for the UPS. The UPS supports the Programmable Logic Controllers for the CVS that are expected to function during and after a PC-2 seismic event, however the UPS is not required to meet this seismic criterion.

Configuration Management

Objective: Changes to safety basis-related requirements, documents, and installed components are controlled.

Criteria:





6





Results:

This objective is not met. Priority drawings for the UPS do not reflect the current configuration, therefore cannot be used as intended to support operations or provide accurate configuration data for procedures, design changes and safety analyses. Recent changes made to the UPS are not fully compliant with design requirements and do not support credited performance criteria. There are no compensatory measures or variances granted to permit this nonconformance and continued UPS operations. The UPS was placed into service before it was operationally tested to verify that it met all consensus code requirements in accordance with DOE O 420.1B Facility Safety. It appears the system is being used to support operations without meeting operability requirements.

CM-1:

The priority one-line drawing for the WCRRF UPS system, EP-WCRR-EO-E-010/Rev.2, WCRR Electrical-LP-2 & UPS Panel One-line, has not been updated to reflect the new UPS panel six months after physical modifications were completed. AP-341-405, Identification and Control of Technical Baseline in Operating Facilities, Appendix A states that Priority Documents are updated after the fieldwork is complete and before release to Operations. The incorporation of pending changes may be extended for 30 calendar days with documented approval of the system Design Authority Representative and concurrence of the Facility Operations Director, which was not completed. The DCF is open, pending functional testing, document changes and closeout review.

Configuration actions that have been completed include updating the WCRRF Master Equipment List to capture the equipment, the annual preventative maintenance procedure required by surveillance requirement 4.3.1.6 , and Operations procedure for the UPS, EP-WCRR-FO-DOP-0407, R0, WCRRF Uninterruptible Power Supply (UPS) Operation, dated 10/28/10. Pending actions include new procedures being written to conduct code driven preventative maintenance that was not previously conducted. See Finding 4 below.

Finding : SSO-F-2-WCRRF-UPS. Drawings affected by the UPS replacement have not been updated in a timely manner to capture facility changes, in accordance with AP-341-405, preventing closure of the design change documentation.



7

CM-2:

A walk down of the UPS system was conducted with the primary and backup CSEs. During the walk down, the one-line drawing of the system was compared to the physical configuration. The drawing has not been updated to reflect the new UPS installation, which includes a new switchgear panel near the UPS. The design change form is still open, pending the updated drawing and final testing. This modification was made eight months ago, yet there is no red-lined drawing depicting these changes. As noted in CM-1 above, this drawing update should be completed within 30-60 days after physical changes are complete. The one-line drawing is the only priority drawing applicable to the UPS.

CM-3:

The LANL Conduct of Engineering program and its associated administrative procedures have been verified as implemented at the WCRRF. These procedures implement the necessary controls for configuration management, design and change control. The UPS was recently replaced, as documented in design change form DCF-10-TA-50-0069-0035, dated 5/13/2010 by the Design Authority Representative. The DCF was initiated in accordance with AP-341-517, R0, Design Change Form. The DCF properly identifies the National Electrical Code (NFPA 70) and the LANL Engineering Standards Manual (ESM), Chapter 7, Electrical as the applicable design documents.

LANL Engineering Standards Manual, Chapter 7, Section D5090 addresses UPS Systems. Table D5090-2: UPS Classifications states that Safety-Significant Systems are classified as Level-1 systems, which are required to be seismically braced in accordance with section 3.3 of the chapter. The procurement specifications in the DCF also identify seismic performance requirements and requires that all hardware and accessories required to meet these specifications is provided. The new UPS was installed and placed into operation with no seismic bracing, no compensatory measures and no documented exemption. This non-conformance was not screened using the USQ process, and because the UPS is required to survive a PC-2 event, this may represent a safety basis violation. When this condition was discovered by the CSE and Engineering Manager, it was not properly analyzed using the Prompt Operability Determination and USQ processes. Instead, an NCR was written to allow conditional release of the equipment for operational use for six months.

Finding: SSO-F-3- WCRRF -UPS. The UPS replacement project specifications in the DCF properly identified that the UPS requires seismic bracing to the PC-2 level. However, installation of this bracing was not planned, nor executed as part of the project scope. This design change was not evaluated using the USQ process, nor was an exemption approved.

CM-4:

The WCRRF Basis for Interim Operation (BIO) identifies the UPS as Safety Significant with the safety credited function to provide power to the Confinement Ventilation System Programmable Logic Controller (PLC). As discussed above in CM-3, a facility modification was initiated to replace the old UPS in accordance with DCF-10-TA50-0069-0035. The DCF requires testing in accordance with the Engineering Standards Manual and ANSI/IEEE Standard 944 requirements to demonstrate functional output specifications.



8

The required testing to demonstrate specified output requirements for voltage, frequency, and waveform was not completed prior to declaring the UPS operational. Without completion of testing, the UPS has not been demonstrated capable of performing its credited safety function of providing in-specification backup power to the PLC. Administrative Procedure AP-341-516 identifies a system as inoperable when it is not capable of performing its credited safety function. An NCR was issued to document the failure to complete the “burn-in” testing, however the NCR was inappropriately dispositioned by stating the test was to demonstrate reliability only and the UPS was acceptable for operations. Contrary to the NCR conditional release reasoning, the test demonstrates ANSI/IEEE Standard 944 specified performance criteria.

The LANL engineering design and operations standards are outdated. The consensus standard Stored Electrical Energy Emergency and Standby Power Systems, NFPA 111, is invoked by both the Engineering Standards Manual, Chapter 7 and the Operations and Maintenance Manual, Criterion 505. These two documents were written based on earlier versions of NFPA-111 which require the UPS to be classified as a Level 1 system (translated to be ML-2 in criterion 505) and managed accordingly because it is designated as safety-significant in the safety basis. This may be beyond the intent of the 2011 edition of NFPA 111. Since the WCRRF UPS is supported by an automatic start diesel generator, the requirements of NFPA-111-2011 may not be applicable. In the Origin and Development section at the front of the 2011 version, it is stated that there is revisions to the document scope which clarifies that a UPS supplied through an emergency power supply such as a generator is not a stored emergency power supply system and is not subject to the requirements of the Standard.

Finding: SSO-F-4-WCRRF-UPS. Contrary to the requirements of Design Change Form DCF-10-TA50-0069-0035, Administrative Procedure AP-341-516, Operability Determination and AP-350-420, R0, Project Turnover and Acceptance, the Waste Characterization Reduction and Repackaging Facility (WCRRF) Uninterruptable Power Supply (UPS) has been declared operable and put into service when it has not been demonstrated capable of performing its credited safety function.

Observation: SSO-O-1-WCRRF-UPS. SSO-O-1-WCRRF-UPS. The LANL engineering design and operations standards are outdated. Chapter 7 of the Engineering Standards Manual and the Operations and Maintenance Manual, Criterion 505 were written based on earlier versions of NFPA-111.

CM-5:

Replacement of the UPS system was recently completed using the DCF process. However this process did not ensure that the UPS replacement project resulted in a fully compliant design and installation. See the discussion above in criterion CM-3. There is currently an open Non Conformance Report (NCR) regarding the lack of seismic bracing for the new UPS. This non conformance was self identified during a limited-scope system assessment conducted by the engineering manager and cognizant system engineer. Subsequently, NCR-EP-DIR-NCR-11-0049 was issued on 5/4/2011.



9

The DCF Specifications, section 1.8, Service Conditions, requires “that all hardware and accessories required are to be provided in the procurement to meet the operating conditions, including seismic performance parameters cited”. This was not achieved. When the discrepancy was discovered, the Design Authority Representative (DAR) intended to pursue a variance for the requirement based on issues discussed above in Observation 1. Instead, it is now being addressed using a NCR as a conditional release, granting six months to design and install the bracing. As identified in the SFD discussion above, the UPS is required to survive a PC-2 seismic event. Thus the lack of seismic bracing is contrary to the safety basis requirements. The NCR allows operation of the UPS up to six months with no further compensatory measure or justification of continued operation.

CM-6:

A LANL-conducted Vital Safety System Assessment (VSSA) was completed on the old UPS equipment in July of 2009. This assessment identified several opportunities for improvement regarding configuration management and surveillance & maintenance of the UPS, including that most of the required system tests in O&M Criteria 505 and 511are not conducted. Based upon the issues identified by this assessment, the engineering manager conducted a Prompt Operability Determination (POD) for the UPS. The result of the POD was that the system was declared OPERABLE. The issues identified in the LANL VSSA were properly entered into the LANL issues tracking database and are also reflected in the System Health Report, dated 1/27/2010.

The WCRRF UPS hardware has been recently replaced in its entirety. The design package is still open, pending completion of required commissioning tests and updating priority drawings. There are four tests required in the commissioning portion of the DCF package, Acceptance Test (field test), Load Test, Continuous Full Load Burn In Test and Battery Discharge Test. Though all four of these tests were identified in the post modification testing portion of the design package, only two were completed. The Load Test and full load burn in test require the connection of a load bank. The load bank that was intended for these tests was found to have incompatible connection lugs for the installed system. This technical oversight caused a delay in turnover of the equipment to operations. In order to allow WCRRF to resume operations, an NCR was written to allow for conditional release of the system for use.

The basis for conditional release, documented in NCR EP-DIR-NCR-11-0011, is that the required tests, per ANSI/IEEE-944, NFPA-111 and O&M Criterion 505 are reliability tests, versus validation of operability. There is no documented review of this interpretation by a qualified subject matter expert. In order to comply with the BIO, the engineering manager and operations manager conducted the annual full-load test for the new UPS prior to declaring the system operational. See the associated finding in criterion CM-4.



10

System Maintenance

Objective: The system is maintained in a condition that ensures its integrity, operability and reliability.

Criteria:




SM-4: Corrective action backlog is managed to minimize impact on system readiness.

Results:

This objective is not met. Procedures do not exist and maintenance activities are not planned to support code driven requirements. Currently, the surveillance and maintenance for the UPS consists only of the annual load test required by the safety basis. This does not comply with several critical requirements for UPS systems contained in both NFPA 110 and 111. These requirements are promulgated at LANL by the Operations and Maintenance Manual. There is no exemption is in place that allows deviation from these requirements.

Though issues regarding the UPS are recognized and tracked, institutional processes for nuclear safety issues are not followed in a manner that ensures operations at WCRRF are maintained compliant with the safety basis and DOE Orders. Deficiencies regarding testing and seismic bracing of the UPS appear to be violations of the safety basis, however neither has been screened using the USQD process, reported to DOE formally as required or been granted an exemption. A third issue regarding positive control of UPS loads is nearly two years old and could impact the performance criteria of the system, yet the issue remains unaddressed.

SM-1:

Procedures in place for maintaining the UPS do not comply with requirements set forth in LANL O&M Manual, Criterion 505 Uninterruptible Power Supply Systems and Criterion 511 Stationary System Batteries. Criterion 511 identifies specific battery maintenance inspection requirements and schedule for stationary battery banks based upon the classification of the system, per NFPA-110 and NFPA-111. These inspections range from annual to weekly, as enumerated in Appendix B of the Criteria. There is no surveillance procedure or round sheet in use for WCRRF that implements these requirements. There is



11

also no DOE-granted exemption to these requirements; therefore WCRRF operations are not compliant with DOE O 420.1B, Facility Safety. The only system maintenance relatedprocedure in place for the UPS is EP-WCRR-VS-DOP-0312, R.4. This procedure is an annual full-load test that is designed to ensure compliance with the TSR requirement to conduct the annual surveillance, as discussed in criterion SFD-1 above.

Action is being taken by the system engineer to modify an existing LANL-wide preventative maintenance instruction, PMI-40-10-003, Battery Bank Preventative Maintenance and Inspection. This procedure was transferred to Maintenance and Site Services (MSS) when the subcontractor KSL was hired into MSS. The system engineer has a planned action to first see if the battery testing equipment used by MSS is physically compatible with the new UPS. If the equipment is compatible, then he will write the procedure. If not, he will evaluate whether to procure equipment, or subcontract the work. This deficiency was self-identified during a LANL Vital Safety System Assessment of the old UPS, and was captured in the subsequent Prompt Operability Determination, System Health Report and in PFITS record 2009-2858. Since this tracking was initiated, a new UPS has been installed and placed into service that also requires these surveillances.

Finding: SSO-F-5-WCRRF-UPS. Maintenance of the UPS system and components has not been conducted in accordance with NFPA 110 and 111, as implemented through O&M Manual Criteria 505 and 511. No variance has been granted and no compensatory measures have been implemented.

SM-2:

The annual full-load test was completed on the new UPS equipment in order to demonstrate compliance with Surveillance Requirement SR 4.3.1.6 of the BIO. This test was conducted using procedure EP-WCRR-VS-DOP-0312, R.3. After this test, the UPS was placed into operational status and relied upon for facility operations. Subsequent to operations at WCRRF, it was discovered that the load test procedure did not adequately demonstrate that the UPS performance criteria were met. The procedure did not account for the PLC loads while alarms were actuated. This condition was reported as a TSR violation on 3/10/2011. As an immediate corrective action, the procedure and testing protocol were modified and the test was repeated using revision 4 of the procedure. During the annual load test, the facility is required to be in warm standby. Upon successful completion, the system is returned to normal operation and turned over to operations by closure of the activity. The annual TSR driven surveillance is adequate to demonstrate compliance to the BIO, however as discussed in SM-1 above, additional maintenance procedures are needed.

SM-3:

Review of the latest completed annual full-load test, EP-WCRR-VS-DOP-0312, R.4, dated 3/16/2011, indicates that the system is properly returned to service. Steps 18 – 20 ensure that commercial power is restored to the UPS after the load test data has been gathered. Step 20 ensures that the UPS status indicators are verified after power to the UPS is restored. Each step contains appropriate notes and precautions to the workers and identifies who is to execute each of the steps. In the event an unexpected UPS status is witnessed, the



12

procedure gives clear instructions to terminate the test and notify the Operations Center.

SM-4:

Corrective actions arising from system assessment and operations are managed through the NCR process, Operability Determination process, System Health Monitoring and the LANL issues tracking system. The list of open corrective actions is currently between five and ten items, depending on how they are grouped. Two of the newer issues caused by replacing the UPS equipment are being tracked by NCRs, one regarding seismic bracing and the other regarding required commissioning tests. See finding 4 in Criterion CM-3. The second NCR has been extended to allow operations for six months without full acceptance testing. See finding 4 in CM-4.

The System Health Report for the UPS dated 1/27/2011 documents open issues in the LANL tracking database. Item 2009-2855 identifies an issue discovered during the LANL VSSA, completed in July 2009, regarding the possible use of the UPS supported outlets being used for non-credited loads. The issue documents that if this were to occur, the credited performance criteria in the BIO of a one-hour supported load would be at risk. This issue clearly impacts the nuclear safety envelope of WCRRF, yet has been open nearly two years. See Finding 6 in Criterion CM-1.

Another issue identified in the 2009 VSSA by LANL is the lack of compliance to code driven surveillance and maintenance for the UPS, as documented in the LANL tracking system under record 2009-2858. This issue is also nearly two years old. Assuming the LANL MSS load bank is found to have compatible connectors with the new UPS, testing procedures will be initiated to close this issue by the end of FY11.

Based on the significance of the open issues, the back log, though small in number, is not managed in a timely manner. Potential safety basis violations linger for months and non-safety basis related issues take nearly two years to close.

System Surveillance and Testing

Objective: Surveillance and testing of the safety system demonstrates that it is capable of accomplishing its safety functions and continues to meet applicable system requirements and performance criteria.

Criteria:



SST-3: Instrumentation and measurement and test equipment for the system arecalibrated and maintained.



13

Results:

This objective is not met. The current surveillance and testing procedures for the UPS are not compliant with LANL or national consensus standards and there are no variances granted by NNSA. This condition is exacerbated by the fact that the LANL O&M Manualis outdated and does not reflect the intent of updated codes and standards. The procedures in place for system surveillances are intended to comply only with the safety basis. This situation is recognized by both the Engineering Manager and the CSE, with plans to address by developing procedures in FY2011.

SST-1: The requirements for surveillance and testing are currently adequate to meet the safety basis requirements, however do not fulfill the code requirements. This issue is being addressed by the cognizant system engineer by preparing new procedures expected to be issued by the end of FY11. The UPS was fully replaced in the fall of 2010 and placed in operations immediately afterward, with final testing and acceptance pending. See Finding 4 above in criterion CM-4 and discussion in criterion SM-1 for additional details.

SST-2:

Review of the latest completed annual full-load test, EP-WCRR-VS-DOP-0312, R.4, dated 3/16/2011 indicates that the system is operating within expected performance parameters. As identified in Finding 4, under criterion CM-4 above, not all required commissioning tests have been completed on the new UPS equipment. Until the final commissioning test is conducted in early June 2011, the system performance cannot be fully validated. The first two of four required commissioning tests were completed in October 2010 with satisfactory results. Additionally, as discussed above in criterion SM-1, most code required surveillance and testing of the UPS is not conducted.

EP-WCRR-VS-DOP-0312, Rev. 4, WCRRF Uninterruptible Power Supply Load Test, is used to validate WCRRF surveillance requirement SR 4.3.1.6. This SR requires the uninterruptible power supply (UPS) to provide power to loads for at least one hour, including the programmable logic controllers, the differential pressure sensors, and the Operator Interface Terminal (OIT) and alarms of the confinement ventilation control system. NFPA 111, Standard on Stored Electrical Energy Emergency and Standby Power Systems, describes performance and testing requirements for stored electrical energy systems and is invoked by LANL O&M Manual Criteria 505 and 511.

Procedure EP-WCRR-VS-DOP-0312 is performed using the identified loads in UPS Load Calculation CALC-11-TA-50-0069-008. However, based on field Walkdowns, circuits 2, 3 and 4 are terminated at multi-receptacle outlet boxes that power the Continuous Air Monitors (CAMs) and CAM managers, leaving several receptacles available for use. There are no formal controls, training requirements or postings to ensure that only loads reflected in the UPS load calculation are connected to the UPS via these outlets.

Within the UPS Panel, Room 104, there are additional circuits that do have positive controls. Circuit 6 feeds a 4-plex outlet box beneath the UPS and is administratively locked at the breaker, Circuit 1 is dedicated to the Ventilation Controls and Circuit 5 is an



14

unutilized spare that has no connected load. Circuit 8/10/12 is a three phase breaker for CAM vacuum pumps, not yet installed.

Finding: SSO-F-6-WCRRF-UPS. There is no positive control of all UPS supported loads as assumed in WCRRF UPS Load Calculation CALC-11-TA50-0069-008. Therefore the performance criteria of a one hour continuous load stated in the WCRRF BIO ABD-WFM-005-R1.3 cannot be assured.

SST-3:

Measurement and test equipment (M&TE) is utilized in the performance of the annual surveillance for the UPS system. Review of the latest completed annual full-load test, EP-WCRR-VS-DOP-0312, R.4, dated 3/16/2011 indicates in section 5.2.2, Measurement and Test Equipment, that the calibrated equipment required includes a stopwatch and clamp-on multi-meter capable of measuring 20 amps of current. The data recording sheet, Attachment 1, contains both the calibration file numbers and expiration dates for both items.

Cognizant System Engineer

Objective: A trained and qualified Cognizant System Engineer (CSE) is assigned to this system to apply engineering expertise to maintain safety system configuration and assess system operability, reliability, and maintenance.

Criteria:





Results:

This objective is met with one finding regarding the initiation of USQ screens to ensure compliance with the safety basis. The CSEs assigned are qualified and effectively support the operations at WCRRF regarding the UPS. However, the UPS is operating with two significant deficiencies, which the CSEs are responsible to address, as required by DOE O 420.1B, Facility Safety, Chapter V, System Engineering.

CSE-1:



15

The primary CSE assigned to the UPS has completed all qualification requirements except the final oral board examination. Oral board exams for many CSEs have been deferred at waste management facilities as well as other nuclear facilities at LANL due to emergent priorities. The backup CSE assigned to the UPS is a mechanical engineer by training, though he possesses adequate overall knowledge of the UPS to support operations. He also has an effective level of knowledge of the CSE role, the engineering processes and operations procedures as a whole. He is also complete with all qualification requirements and awaiting a final oral board exam.

CSE-2:

The primary CSE for the UPS has been involved in the installation and test of the new UPS hardware, as evidenced by review and approval of work documents, testing procedures, POD forms and NCRs. He is also assigned to the Electrical Distribution System and serves as an electrical engineering resource to operations at WCRRF. He is stationed at the facility and routinely walks down the system. Recently, the Engineering Manager for WCRRF initiated “vertical slice” assessments of credited systems and components to ensure that CSEs understand the safety basis and relative technical aspects of their assigned systems. This practice resulted in the self-identification of the design aspect of Finding 3, discussed in criterion CM-5 above. The CSE did not recognize this as a potential safety basis violation.

Finding: SSO-F-7-WCRRF-UPS. The CSE’s assigned to the UPS system did not properly recognize two nonconforming conditions as requiring USQ Determinations as required by 10 CFR 830, Nuclear Safety Management and the LANL USQ Procedure, SBP112-3 R0, Unreviewed Safety Question (USQ) Process, Sections 3.8.1, Discrepant As-Found Condition, or 3.8.3 Receipt of New Information.

CSE-3:

The CSEs offices are located within the WCRRF facility, and the CSEs routinely interact with facility management, operations, and maintenance personnel regarding the UPS. The CSEs are engaged with the commissioning team and project manager for the UPS replacement effort, working to complete the final commissioning tests, coordinating access and reviewing work documents. As discussed above, review of UPS related documents, including Operability Determinations, System Health Reports, NCRs, USQ screens, procedures and design change form information indicates CSE involvement in managing the UPS.

CSE-4:

The CSE reviewed the results of the first two of four required commissioning tests of the UPS, supported the first and second operational load test of the new UPS and reviewed the results. The CSE did not identify the inadequate testing requirements in the first load test prior to resuming WCRRF operations. This oversight led to a TSR violation and the need to repeat the test with a corrected procedure. The CSE is engaged in the development and processing of NCRs, system related issues and performance evaluations of the UPS.



16

VI.

The following references contain core requirements that pertain to managing nuclear facilities and affect the criteria cited in this assessment.

References

(a) 10CFR 830 Nuclear Safety Management(b) DOE Order 420.1B, Facility Safety (c) DOE O 5480.19, Conduct of Operation Requirements for DOE Facilities (d) DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities(e) DOE O 5480.20A, Personnel Selection, Qualification, and Training Requirements

for DOE Nuclear Facilities(f) DOE-STD-1073-2003, Guide for Operational Configuration Management Program (g) LANL P340-1, Conduct of Engineering (h) LANL PD341, Engineering Process Manual (i) LANL AP-341-405, R1, Identifiecation and Control of Techical Baseline in

Operating Facilities.(j) LASO MP 06.02, Safety System Oversight(k) Authorization Basis documents

a. WCRRF BIO ABD-WFM-005 b. ABD-WFM-006 R1.3 TSRs

(l) LANL Operations and Maintenance (O&M) Manual, Criterion 505, Uninterruptible Power Supply Systems and Criterion 511, Stationary System Batteries.

(m) LANL Engineering Standards Manual, Chapter 7, Electrical.(n) NFPA 111, Standard on Stored Electrical Energy Emergency and Standby Power

Systems.(o) ANSI/IEEE Std 944-1986, IEEE Recommended Practice for the Application and

Testing of Uninterruptible Power Supplies for Power Generating Stations.

Interviews ConductedCognizant System Engineers (2) Engineering Manager (1)Facility Operator (1)

System Walkdowns and configuration items observed The UPS hardware, associated switchgear and some of the accessible receptacle outlets in

the WCRRF building.

Documents Reviewed(a) Design Change Form DCF-10-TA50-0069-0035, WCRRF UPS Upgrade and

Modifications (b) NCR documents: EP-DIR-NCR-11-0049, EP-DIR-NCR-11-0011 (c) Prompt Operability Determination, POD-09-TA-54-0069-022 (d) System Health Reports dated 01/27/10 and 06/17/10 (e) Calculation for UPS loads: CALC-11-TA-50-0069-008, dated 03/10/11 (f) System One-line drawing EP-WCRR-ED-E-010, R2, dated 11/18/07 (g) UPS Load Test, Work Order 00407522, Dated 3/10/11 (h) UPS Operations Procedure, EP-WCRR-FO-DOP-0407, R.0


U.S. Department of Energy

National Nuclear Security Administration Los Alamos Site Office

LASO Safety System Oversight Independent Assessment Report for the

RANT Bridge Crane and Rigging System

June 2011

WDP FCA ATTACHMENT 4.6: LASO SSO Assessment Report for RANT Bridge Crane & Rigging System PFITS 2010-1634

LASO SSO Independent Assessment Report – RANT Bridge Crane and Rigging June 2011

Table of Contents I. Executive Summary ............................................................................................................... 1 II. Introduction ............................................................................................................................ 2 III. Scope and Methodology ......................................................................................................... 2 IV. Assessment Results ................................................................................................................ 3 V. Criteria, Observations and Evaluations .................................................................................. 3 VI. References ............................................................................................................................ 13 Interviews Conducted ................................................................................................................... 13 System Walkdowns and configuration items observed ................................................................ 13 Documents Reviewed ................................................................................................................... 13



1

I.

The purpose of this assessment is to provide NNSA managers with accurate, objective information on the performance of the RANT Bridge Crane and Rigging (BCR) system and its ability to perform as required by safety bases and other applicable requirements. This assessment was scheduled as part of the FY2011 Master Assessment Schedule.

Executive Summary

All five objectives in LASO Safety System Oversight procedure MP 06.02, R4 were assessed. Configuration Management was not met, while the Safety Function Definition System Maintenance, System Surveillance and Test and Cognizant System Engineering were met. The critical lift plans in place at RANT do not adequately implement requirements of the DOE Hoisting and Rigging Manual, a credited safety management program. Combined, crane maintenance and critical lift controls ensure that crane operations meet the safety basis objective of avoiding a spill during operations.

The technical baseline is adequate to manage the system, with only minor inconsistencies noted. The crane receives frequent inspection and maintenance due to accelerated wear caused by constant use at or near its design capacity. The crane service classification is Normal-Use, based on LANL calculations. However, according to the LANL Stationary Equipment Program, the loads and frequency of use this crane is subjected to would categorize it as Heavy-Use. Mechanical and electrical inspections over the past two years have been increased twice, first from annual to bi-annual and then to quarterly. The Vital Safety System Assessments, Prompt Operability Determinations and System Health Reporting processes are being utilized; however issues identified are not being entered into the LANL institutional issues management process and are not being addressed on a timely and consistent basis. The new BIO ABD-WFM-007 R1.0, dated 9/10/2010 removes the BCR from the safety significant systems at RANT. This new BIO requires that the BCR be maintained according to the DOE Hoisting and Rigging Manual criteria as part of the In-Service Inspections. Removal of the BCR from the credited safety system list is based on analysis of the worst case scenario exposure to a facility worker caused by dropping a payload assembly, which results in a moderate consequence to the collocated worker. The TRUPACT payload drop analysis indicated a public dose of ~2 Rem and a Co-located worker dose of ~40 rem. DOE-STD-1189, states that a 100 Rem Evaluation Guideline should be used for co-located workers to identify Safety Significant controls. This event does not constitute a need for a safety significant control, so as defense in depth RANT has identified the critical lift program as a Specific Administrative Control (SAC) to prevent the accident from occurring. This analysis is captured in DOE-STD-5506-2007 Preparation of Safety Basis Documents for Transuranic (TRU) Waste Facilities.

FINDINGS SSO-F-1-RANT-BCR.The RANT Critical Lift operating procedures do not adequately implement DOE-STD-1090 requirements. DOE-STD-1090, Hoisting and Rigging Manual



2

is invoked as a credited safety management program in the facility BIO, ABD-WFM-007, R0. SSO-F-2-RANT-BCR. The System Health Monitoring program, AP-341-802, R2 is not being applied to the BCR system as required. The SHR frequency has not been changed to ensure system performance issues are identified in a timely manner.

SSO-F-3-RANT-BCR. The RANT BCR is not maintained using procedures that are current and approved in accordance with P340-1, Conduct of Operations and the LANL Policy System requirements for review and approval of documents.

OBSERVATIONS SSO-O-1-RANT-BCR. The ML Determination worksheet does not match the SDD for all components of the BCR system. The Festoon is not listed in the SDD, Section 2.2, Table 7. SSO-O-2-RANT-BCR. All PM documents for the BCR do not contain the calibration record and expiration date for the instruments, thus calibration of instruments used to conduct these PMs could not be verified.

II.

Introduction

The Radioassay and Nondestructive Testing Facility (RANT), TA-54-38, was constructed in 1989-1990 to house nondestructive assay and examination (NDA/NDE) operations and for loading transuranic waste shipments. Assay and examination of containers is now done at another LANL facility. Waste is staged and loaded into the TRUPACT-II shipping containers in the high bay using the Overhead Bridge Crane and Rigging (BCR) system.

The RANT BCR system is credited as a safety-significant control and is the primary active safety system for preventing a spill event caused by dropping waste containers. The rigging portion of the system is classified as a passive design feature in the Basis for Interim Operation (BIO). The waste containers are a safety-class control and are the only system credited for confinement of radioactive materials. In order to limit the possibility of containment loss, waste container lifts are limited to four feet in height, except as allowed under the critical lift plans for payload lifts into the TRUPACT-II shipping containers. The BIO credits the DOE Hoisting and Rigging Manual, DOE-STD-1090-2007 as a TSR safety management program to provide requirements for these lift operations.

III.


The scope of this assessment is based on the assessment criteria prescribed in LASO MP06.02 Rev. 4, System Safety Oversight, Attachment 1. This assessment did not include the criterion for safety software because there is no applicability. The assessment included: • review of design and operating requirements, the safety basis, system design drawings

and documents and maintenance records, • field walk down of system components, and



3

• interviews of system engineers, technicians and operations managers.

IV.

Assessment Results

This assessment documents the current status of maintenance and operations of the RANT BCR system, a credited safety-significant system in the Basis for Interim Operation. The assessment included all five objectives of the LASO System Safety Oversight Procedure, MP 06.02, R4. The Configuration Management objective was not met. The other four objectives were met. The critical lift plans, do not demonstrate compliance with DOE-STD-1090-2007, Hoisting and Rigging Manual, a credited safety management program in the BIO. Maintenance procedures used for the BCR system are several years past their required review date and have not been revised since being adopted by LANL from the former site services subcontractor. As such, it is difficult to determine if these procedures fully comply with current requirements. The BCR is being effectively maintained due to its importance for in waste handling operations, in accordance with the DOE Hoisting and Rigging Manual. The equipment is showing signs of increasing wear, which is addressed by more frequent maintenance, test and inspection activities. However, the system status and trending have not been altered to ensure predictive data is identified and acted upon in a timely manner.

V.

The assessment team evaluated the system and management processes using the criteria below. These criteria are a subset of the safety system assessment criteria identified in reference (h); the numbering remains consistent with the parent document.

Criteria, Observations and Evaluations

Safety Function Definition

Objective: Safety basis-related technical, functional, and performance requirements for the

system are identified/defined in appropriate safety documents.

Criteria:


Results: This objective is met. The current Basis for Interim Operation (BIO) dated 5/29/2003, ABD-WFM-007, R.0, and associated TSRs, ABD-WFM-008, R1.0 dated 9/21/2010 ensure



4

the bridge crane is maintained in accordance with the DOE Hoisting and Rigging Manual, DOE-STD-1090-2007, a credited control. SFD-1 The RANT Basis of Interim Operations (BIO) defines the safety function and functional requirements of the Bridge Crane and Rigging (BCR) in Table 4-14, as follows:

Safety Function Functional Requirements Prevents failure that results in a spill and release of radioactive material.

Maintain lifting integrity of the crane and rigging.

The Bridge Crane has one supporting system, the Facility Structure (FS). The BIO and system design description (SDD) both identify that the FS is not seismically qualified to PC-2 performance criteria, with a collapse avoidance of 5x10-4 per year. According to RANT Calculation D-5-06-185, Probability of Seismically Induced Failure, the probability of failure is on the order of 1.0 - 1.2x10-3. Thus, the BCR cannot be assured to fulfill its credited function. However DOE-STD-1020 recognizes the performance goal for existing PC-2 facilities is about 1.0x10-3 per year. So the RANT facility, as an existing structure for TRU waste loading operations, meets the credited performance criteria by utilizing the exception allowed by the DOE Natural Phenomenon Hazards standard 1020. This issue is discussed in the BIO and recognized by NNSA. Section 4.4.2.4 of the BIO defines the associated performance criteria to ensure the Functional Requirements above are met. In Table 4-15, Performance Criteria of Bridge Crane and Rigging, The Functional Requirements are mapped to performance criteria and evaluated as follows:

Functional Requirements

Performance Criteria

Evaluation

Maintain lifting integrity of the crane and rigging

Per DOE-STD-1090-2001, Chapter 7, Overhead and Gantry Cranes

Bridge crane meets DOE-STD- 1090-2001 requirements. Tests and inspections per DOE-STD-1090- 2001. ACGLF and special TRUPACT-II and HalfPACT rigging remain with the TRUPACT-II and HalfPACT and not a testable load path per DOE-STD-1090-2001 by RANT Facility operators.

Section 4.4.2.5, TSR Controls, makes no mention of maintaining the bridge crane, only the rigging portion of the overall Bridge Crane and Rigging system, though the bridge crane must be maintained in accordance with the DOE Hoisting and Rigging Manual in order to assure the crane will perform as credited in the safety basis. Chapter 5, Derivation of TSRs, section 5.5.5.11, Hoisting and Rigging, identifies that the hoisting and rigging program must be implemented to ensure that both the crane and lifting devices used for loading waste containers meet the load rating required for the bridge crane



5

and load path. Implementing the hoisting and rigging program as a credited control requires that the crane be maintained at Maintenance Level-2 (ML-2). DOE-STD-1090-2007, Chapter 3, Preventative Maintenance, and Chapter 7, Overhead and Gantry Cranes both identify explicit maintenance, test and inspection frequencies applicable to the RANT bridge crane. Formal implementation of these required activities is necessary in order to maintain compliance with the Hoisting and Rigging Manual. These activities are scheduled and executed using the Computerized Maintenance Management System (CMMS). Configuration Management

Objective: Changes to safety basis-related requirements, documents, and installed components are controlled.

Criteria:







Results:

This objective is not met. A key aspect of compliance to DOE-STD-1090-2007, as required by the BIO, is that all payload lifts at RANT are managed as Critical Lifts. Chapter 2, Critical Lifts, of Standard 1090 identifies the required contents of a Critical Lift Plan (CLP). Compliance with the required contents for CLPs is not demonstrated by EP-RANT-FOB-DOP-0205, the critical lift plans currently in use.



6

System Health Reporting is being completed on an annual basis for the BCR, however the system maintenance has been increased from annual, to quarterly. The need to increase the SHR frequency was self identified, however no action has been taken. CM-1: The critical lift plan, EP-RANT-FOB-DOP-0205, which covers both forklift operations and crane lifts, does not contain all necessary information to comply with Chapter 2, Critical Lifts, of the Hoisting and Rigging Manual, as required. Specifically, this procedure contains only a diagram for lifting a Standard Waste Box, when TRUPACT loading operations is also executed with 14-drum, over pack drums, and 7-drum payloads. The diagram in the procedure is also unreadable, due to labeling text being double-typed or crossed out. The procedure does not discuss the load path configuration for any lift with adequate detail to understand the required configuration(s). The procedure does not discuss critical steps in moving payloads to/from the floor into/out of the TRUPACT shipping containers, such as low clearance over the hand rails of the loading platforms. Further, this procedure does not reference other detailed loading procedures, such as those provided by the disposal facility, to ensure the use of all required information during payload operations. Finding: SSO-F-1-RANT-BCR. The RANT Critical Lift operating procedures do not adequately implement DOE-STD-1090 requirements. DOE-STD-1090, Hoisting and Rigging Manual is invoked as a credited safety management program in the facility BIO, ABD-WFM-007, R0.

The Preventative Maintenance Instruction (PMI) documents reviewed were found to be consistent with the equipment in the facility. These documents are generic in nature, so that they may be used to conduct maintenance on other overhead cranes. The former site service subcontractor KSL instructions have not been updated, converted to LANL documents or reapproved for use in several years. The BCR is credited as a safety-significant system in the RANT BIO. The BCR has not been modified since it was installed, however it is demonstrating accelerated wear due to nearly constant use, requiring the annual electrical and mechanical inspections to be completed quarterly. Outdated procedures and accelerated maintenance using these procedures does not demonstrate implementation of Conduct of Operations, a key management system intended to ensure effective maintenance and operation of facilities and equipment. See discussion and finding 2 under criterion SM-2.

The SDD for the BCR system is complete and accurate, with exceptions as follows. The SDD does not accurately reflect the current operations and maintenance procedures. The SDD, section 3.4.1, page 4, also does not accurately identify TSR related controls, specifically that the BCR and lifting operations must be incompliance with DOE-STD-1090. Last, the ML Determination Worksheet for the BCR and the SDD accurately crosswalk, with the exception of the SDD missing the Festoon in Section 2.2, Table 7.

Observation: SSO-O-1-RANT-BCR.The ML Determination worksheet does not match the SDD for all components of the BCR system. The Festoon is not listed in the SDD, Section 2.2, Table 7.

CM-2:



7

A walk down of the RANT BCR was conducted with the primary system engineer. The crane and load path components, including the load cell, Automatic Center of Gravity Lifting Fixture (ACGLF) and Standard Waste Box (SWB) adapter were all found to match drawings, SDD contents and BIO description of the equipment. The electrical configuration of the BCR was traced in detail and found to match the BIO description, drawings and procedures. The initial revision of SDD-TA-54-0038-BCR-R0 was approved 10/06/10 by the engineering manager. This document is fully compliant with AP-341-611, System Design Descriptions. With the exceptions noted in CM-1 above, the SDD contains or references all necessary configuration management information for the BCR.

CM-3:

The LANL Conduct of Engineering program, its associated administrative procedures and the LANL Safety Basis procedures have been verified implemented at RANT. These procedures implement the necessary controls for configuration management, design and change control. The BCR system has not been altered in design since installation in 1990. The last corrective maintenance package done on the BCR was completed on 4/6/10. This work package was reviewed for compliance to nuclear facility maintenance requirements. The completed work package contained sparse information regarding what corrective maintenance was actually conducted. The Work Order Documentation form, initiated 3/30/2010 documents that the crane trolley was serviced at the TA3-38 shop facility, including new bearings being pressed and the motor being mounted. It is not clear if it was a new motor. The trolley was then transported and reinstalled at RANT. The form states that on 3/31/2010 the trolley would not run, and on 4/1/2010 it was further inspected and tested, including the voltage and variable frequency drive, but diagnostics would have to be continued. No progress or disposition is documented after this entry.

Later in the package, the load test documentation states that the system was load tested on 4/6/2010 using 10,902 pounds of weights. The test was successful, as documented in a separate PMT form for the test. The PMT form states that the BCR passed at 100%, however the weight documented is 109%. These results demonstrate that the BCR was repaired and returned to service, however documentation accuracy is inadequate for credited safety systems. This work package, including the numerous review and approval sheets, as well as the USQ screen, demonstrate that work on the BCR is coordinated with affected organizations.

CM-4:

The BCR system has not been altered in design since installation. The last corrective maintenance package done on the BCR was completed on 4/6/10. This work package demonstrates that actions affecting the BCR are thoroughly reviewed and approved including the use of Unreviewed Safety Question Determinations, though work documentation is lacking detail.

CM-5:

The BCR has not been changed since its installation. There is a project under consideration by the Waste Disposition Program to replace the crane with more robust equipment. This project has not been entered into any formal design process.



8

CM-6:

Three Prompt Operability Determinations (PODs) and three System Health Reports (SHR) were reviewed for the BCR. These documents contain detailed issues regarding the operability and material condition of the BCR. In the POD dated April 30, 2009, Issue number 6, Tracking and Trending Data, states that the response time is too long to trend and track data from past inspections, repairs or modifications. It also states that this condition limits system trending effectiveness, making it more difficult to evaluate current equipment condition or predict potential future activities. In the SHR dated 6/30/2010, section 2.1.2, Action Items, action 2 states that the SHR Basis document is to be updated to reflect changes in the ISI and PM schedule. The planned completion date was also 6/30/2010, yet the SHR Basis document dated 6/30/2010 does not reflect these changes.

Finding: SSO-F-2-RANT-BCR. The System Health Monitoring program, AP-341-802, R2 is not being applied to the BCR system as required. The SHR frequency has not been changed to ensure system performance issues are identified in a timely manner.

System Maintenance

Objective: The system is maintained in a condition that ensures its integrity, operability and reliability.

Criteria:




SM-4: Corrective action backlog is managed to minimize impact on system readiness.

Results: This objective is met. The BCR is given close attention by the operations and engineering staff at RANT. When the BCR exhibits issues that could impact operability or reliability, the system is assessed and appropriate actions are taken. SM-1: The RANT BCR is identified as a safety significant system in the BIO and managed as ML-2 equipment, in accordance with LANL AP-341-502 R, ML Determination for Equipment/Components. The RANT crane is showing ongoing signs of accelerated wear. This issue has been



9

addressed by increasing the required annual inspections to a quarterly basis for both electrical and mechanical condition. Preventative Maintenance Instructions for both the ACGLF units and the BCR were reviewed. The documents demonstrate that the key components of the system are being maintained in accordance with LANL requirements and national standards. As discussed in CM-1, the PMIs used have not been incorporated into the LANL document system and have not been updated in several years. Without timely review of maintenance procedures, compliance with requirements for nuclear facility maintenance cannot be assured. SM-2: The BCR is managed using outdated procedures that require formal review and/or revision to become compliant with Chapter 16 of the Conduct of Operations Program, P315. Table 16.1, of P315 states that technical procedures need to be revised every three years. Preventative Maintenance Instruction (PMI) 40-25-013 is used to conduct both the electrical and mechanical inspections. This document was required to be revised and/or reissued September 27, 2004. A second example is PMI 40-25-034. This document has a revision date of 1/23/10. Additionally, conducting the PMIs requires the use of forms that come from other LANL procedures that are not cross referenced, creating the potential for errors. The completed ISI for ACGLF-01, dated 4/22/2010 was labeled as an “Information Only” copy, contrary to P315, section 16.9.2.1 Procedure Validity, which requires the use of only controlled copies for execution of work. Also, the procedures used to conduct preventative maintenance are intended to be annual in frequency, however, due to increasingly frequent component failures, were accelerated to quarterly, yet there is no procedure change to notate the new frequency. Post Maintenance Testing (PMT) is identified as a requirement in the completed PMs and the PMT work package review forms are completed, with approvals by the operations manager. Finding: SSO-F-3-RANT-BCR. The RANT BCR is not maintained using procedures that are current and approved in accordance with P315, Conduct of Operations and the LANL Policy System requirements for review and approval of documents. SM-3: PMT forms are completed for each PM work package and for the corrective maintenance work order reviewed for ACGLF-02, completed 11/17/2010. The PMT form identifies all necessary checks, hold points and reviews, including the CSE and operations manager, to ensure the results and issues are acknowledged by the operations staff. SM-4: Completed maintenance packages identify deficiencies using Form EP-RANT-FOE-DOP-0506, which appear to be addressed based upon their relative urgency. The System Health Reports (SHR) documents show that there are ongoing issues with replacing aging or worn components, though the BCR is being maintained to operable. The Prompt Operability Determinations (POD) and SHRs for the BCR system show that



10

issues are assessed using the POD process and are tracked by the CSE, however these processes are not the institutional processes designated for deficiency tracking and closure. The issues identified in these documents can be categorized into two groups, those that have immediate impact on operability and those that do not. The issues that could cause the BCR to become inoperable, such as the loud squeaking of trolley wheels and failure of the trolley motor are addressed in a timely manner. Issues that do not immediately impact operability, such as maintenance procedure updates, are not completed in a timely manner. The LANL VSSA was completed March of 2009, in accordance with AP-341-901, R0, Performing Vital Safety System Assessments. The resulting issues in this report are analyzed in POD-09-TA54-0038-0016, dated April 30, 2009. There were eight Opportunities for Improvement (OFI) identified. Less than half of these issues have been addressed. Items that have been addressed include the need for an accurate Master Document List (MDL) and the need for a SDD. Issue number 8 identifies the the maintenance organization uses their own PMT form for documenting completion of inspections. Specifically it states that the deficiencies identified in an inspection are not tracked to ensure that the corrective maintenance is performed. Thus there are no formal records documenting closeout of the deficiencies. The associated LANL tracking database record numbers are not identified in the VSSA Report or POD, so tracking and closure of the other issues could not be verified. Overall, these assessment processes, in conjunction with efforts by the CSE, are ensuring that system issues are being identified, tracked and addressed, though not in accordance with LANL procedural requirements. System Surveillance and Testing

Objective: Surveillance and testing of the safety system demonstrates that it is capable of accomplishing its safety functions and continues to meet applicable system requirements and performance criteria.

Criteria:




Results:

This objective is met, though the procedures used by LANL to conduct surveillances on the BCR are not current and have not been revised to the LANL Policy requirements. These procedures are effective in maintaining the crane in operable status, as demonstrated in the system availability data in the SHRs. In addition to the need for updating the procedures, they would be improved by modification to document calibration and test records for the



11

testing equipment used.

SST-1: In accordance with the BIO, the BCR is required to be maintained according the DOE Hoisting and Rigging Manual. The BCR is subjected to routine electrical, mechanical and OSHA-based inspection and maintenance, though these activities are not tied to the BIO/TSRs, a best management practice.

SST-2:

The surveillance and testing procedures for the BCR verify key operating parameters, including the annual load test, travel limit test, cable travel limit switches, controller and crane break. The procedures identify all key performance requirements and ensure that the system components are inspected and tested to document that the crane is compliant with national standards and the DOE Hoisting and Rigging requirements. Without a thorough crosswalk of the outdated procedures to current codes and standards, it is difficult to determine if the PMs are executed in full compliance with the Conduct of Maintenance program, DOE-STD-1090-2007 and OSHA inspection criteria. See related discussion in CM-1 and SM-2 above.

SST-3:

The BCR system PMTs require a calibrated electrical meter and calibration of the load cell, which is used for both loading operations and the annual load test. The electrical meters used by craft electricians at LANL must be calibrated to be checked out of the tool room. The electrical PM is completed using a calibrated meter to ensure proper crane electrical load parameters. The load cell used is required to be calibrated by the annual load test procedure and the WIPP TRUPACT Loading procedure. The ACGLF leveling calibration test also requires a calibrated digital level. There are two digital levels used, each is calibrated on an annual basis, about six months apart from the other. With the exception of the ACGLF leveling calibration, the PM documents for the BCR do not contain the calibration record and expiration date for the instruments, thus calibration of instruments used to conduct these PMs cannot be verified in all cases. Observation: SSO-O-2-RANT-BCR. All PM documents for the BCR do not contain the calibration record and expiration date for the instruments, thus calibration of instruments used to conduct these PMs could not be verified. Cognizant System Engineer

Objective: A trained and qualified Cognizant System Engineer (CSE) is assigned to this system to apply engineering expertise to maintain safety system configuration and assess system operability, reliability, and maintenance.



12

Criteria:





Results: This objective is met. There are two CSEs assigned to the BCR system, both are fully qualified to the LANL CSE program requirements. By review of several maintenance packages, operability determinations and system health reports, it is evident that the CSEs maintain a high level of awareness and involvement in managing this system. CSE-1: The primary CSE assigned to the UPS has completed all qualification requirements, including the final oral board examination. His requalification requirement is coming due this calendar year. There is also a back up CSE assigned to this system, and he has recently become fully qualified.

CSE-2:

Due to access limitations of the overhead crane, the CSE primarily conducts his inspections to determine material condition, aging and reliability when the quarterly mechanical, electrical and annual inspections are conducted. The CSE’s are closely coupled to the operations team and are promptly engaged anytime malfunction of the BCR is experienced.

CSE-3:

The primary CSE reviews all work packages both before and after they are conducted on the BCR. The completed work packages, in addition to his first hand inspection during the work provide the data needed to complete the System Health Reports. The CSE provides key input into maintenance packages, observes maintenance and use of the BCR. He is knowledgeable of the safety basis requirements for the BCR and supports the completion of USQ screens associated with procedure changes, maintenance and any proposed modifications. The PMs for this system have been accelerated, however the SHR Basis has not been updated. See related discussion in CM-6 above.



13

CSE-4: The CSE is in close communication with the RANT operations team and engages promptly on emerging issues regarding the overhead crane or rigging equipment. He is fully aware of the operational status of the equipment, pending maintenance and any evolving issues. He is identified on both the approval and closeout of the maintenance packages, approves Post Maintenance Test forms and reviews USQ screens. By review of the Prompt Operability Determination and System Health Reports, it is also evident that the CSEs are engaged in the determination of actions to resolve emergent issues.

VI.

The following references contain core requirements that pertain to managing nuclear facilities and affect the criteria cited in this assessment.

References

(a) DOE Order 420.1B, Facility Safety (b) DOE O 5480.19, Conduct of Operation Requirements for DOE Facilities (c) DOE O 433.1, Maintenance Management Program for DOE Nuclear Facilities (d) DOE O 5480.20A, Personnel Selection, Qualification, and Training Requirements

for DOE Nuclear Facilities (e) DOE-STD-1073-2003, Guide for Operational Configuration Management Program (f) DOE-STD-1090-2007, Hoisting and Rigging Manual (g) LANL P340-1, Conduct of Engineering (h) LANL PD341, Engineering Process Manual (i) LANL P340-1, Conduct of Operations (j) LASO MP 06.02, Safety System Oversight (k) Authorization Basis documents

a) ABD-WFM-007-R0 b) ABD-WFM-007-R1.0 BIO c) ABD-WFM-008-R1.0 TSR d) ABD-WFM-008 R0.13 TSRs

(l) LANL Operations and Maintenance (O&M) Manual Interviews Conducted

• Cognizant System Engineers (1) • Engineering Manager (1) • Facility Operator (1)

System Walkdowns and configuration items observed

• Overhead crane, associated rigging, ACGLF, controls, crane electrical disconnect and breakers.

• Documents Reviewed

• SDD-TA-54-0038-BCR-R0, BCR System Design Description • Prompt Operability Determinations POD-09-TA54-0038-0016, POD-10-TA-54-0038-

010, POD-10-TA54-0038-005, • System Health Monitoring Basis, SHB-10-023, 6/30/10



14

• System Health Reports, SHR-10-036, 3/31/10 and SHR-10-036, 6/30/10 • ML Determination for Equipment/Components, 3/31/10 • Training records for all MSS Crane Maintenance craftsmen • Load Test Results checklist dated 03/09/10 for the BCR • Manual for the remote control system installed on the BCR • CTO-01 mechanical inspection report 2/12/11 • CTO-01 electrical inspection report, 2/3/11 • CTO-01annual (OSHA) inspection report, 2/4/11 • Corrective Maintenance Package for ACGLF-02, 9/9/10 • Mechanical PM for ACGLF-02, 9/29/10 • Electrical PM for ACGLF-02, 9/29/10 • Mechanical PM for ACGLF-01, 12/9/10 • Electrical PM for ACGLF-01, 12/7/10 • ISI for ACGLF-01, 4/22/10 • Calibration PM for ACGLF-01, 4/26/10 • DOE/WIPP-02-3184, May 2011


letter from nnsa to los alamos national laboratory sept. 16, 2011, regarding nuclear safety...

Documents

wdp safety systems

wdp fca attachment

efficiency of wdp operations

wdp facility safety

assessment fca

criticality safety

nuclear safety implications

wdp nuclear facilities