[Federal Register Volume 84, Number 53 (Tuesday, March 19, 2019)] [Notices] [Pages 10196-10222] From the Federal Register Online via the Government Publishing Office [www.gpo.gov] [FR Doc No: 2019-04941] [[Page 10195]] Vol. 84 Tuesday, No. 53 March 19, 2019 Part II Defense Nuclear Facilities Safety Board ----------------------------------------------------------------------- Recommendation 2019-01; Notice Federal Register / Vol. 84 , No. 53 / Tuesday, March 19, 2019 / Notices [[Page 10196]] ----------------------------------------------------------------------- DEFENSE NUCLEAR FACILITIES SAFETY BOARD Recommendation 2019-01 AGENCY: Defense Nuclear Facilities Safety Board. ACTION: Notice; Recommendation. ----------------------------------------------------------------------- SUMMARY: The Defense Nuclear Facilities Safety Board has made a Recommendation to the Secretary of Energy concerning implementation of Nuclear Safety Management requirements and the need to address specific hazards at the National Nuclear Security Administration's Pantex Plant. Pursuant to the requirements of the Atomic Energy Act of 1954, as amended, the Defense Nuclear Facilities Safety Board is publishing the Recommendation and associated correspondence with the Department of Energy and requesting comments from interested members of the public. DATES: Comments, data, views, or arguments concerning the recommendation are due on or by April 18, 2019. ADDRESSES: Send comments concerning this notice to: Defense Nuclear Facilities Safety Board, 625 Indiana Avenue NW, Suite 700, Washington, DC 20004-2001. Comments may also be submitted by e-mail to [email protected]. FOR FURTHER INFORMATION CONTACT: Glenn Sklar at the address above or telephone number (202) 694-7000. To review the figures referred to in Recommendation 2019-01, please visit http://www.dnfsb.gov. SUPPLEMENTARY INFORMATION: Recommendation 2019-1 to the Secretary of Energy Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex Plant Pursuant to 42 U.S.C. 2286a(b)(5) Atomic Energy Act of 1954, as Amended Dated: February 20, 2019. Introduction. The Defense Nuclear Facilities Safety Board (Board) has evaluated the adequacy of safety controls for nuclear explosive operations at the Pantex Plant and the processes that ensure those operations have a robust safety basis. Based on this evaluation, we conclude the following:Portions of the safety basis for nuclear explosive operations at Pantex do not meet Title 10, Code of Federal Regulations, Part 830, Nuclear Safety Management (10 CFR 830). There are high consequence hazards that (1) are not adequately controlled; (2) may have controls, but lack documentation linking the controls to the hazards; or (3) have controls that are not sufficiently robust or that lack sufficient pedigree to reliably prevent or mitigate the event. Multiple components of the process for maintaining and verifying implementation of the safety basis at Pantex are deficient, including (1) completion of annual updates as required by 10 CFR 830, (2) processes for handling Unreviewed Safety Questions (USQ) and Justifications for Continued Operations (JCO), and (3) processes for performing Implementation Verification Reviews of credited safety controls. To date, the National Nuclear Security Administration (NNSA) Production Office (NPO) and the Pantex contractor have been unable to resolve known safety basis deficiencies. The Board initially identified similar issues and communicated them to NNSA in a letter dated July 6, 2010. Specifically, the letter found that the use of combined probabilities (i.e., initiating event probability multiplied by the weapon response) to determine scenario credibility and the treatment of falling technician scenarios were inappropriate. NNSA and the Pantex contractor have made little progress resolving these deficiencies despite the development of multiple corrective action plans. Analysis. The enclosed Findings, Supporting Data, and Analysis document provides reports that support the Board's conclusions in this Recommendation.A19MR3. The first report concludes there are deficiencies in the safety basis and control strategy for B61, W76, W78, W87, and W88 operations, which are designed to prevent or mitigate high consequence hazards. Pantex dispositioned a subset of the issues in the report via the USQ process in January 2018. Subsequently, the Pantex contractor submitted a JCO \1\ to NPO in June 2018 to continue operations on weapon programs with known legacy safety basis deficiencies. The Pantex contractor subsequently withdrew the JCO and instead submitted a safety basis supplement (SBS) \2\ that NPO approved in September 2018. The SBS had content similar to the previously submitted JCO, but identified certain compensatory measures to be treated as specific administrative controls for falling technician scenarios (e.g., safety requirements identifying appropriate approach paths to the unit and removing tripping hazards at the beginning of work shifts). However, neither the JCO nor the SBS is based on a comprehensive analysis of the approved safety basis documents to identify areas requiring further enhancement and in need of additional controls. The SBS provides the Pantex contractor relief for safety basis deficiencies in advance of comprehensive evaluations to determine the extent of these issues. In addition, neither the JCO nor the SBS address the suite of hazard scenarios that the enclosed supporting technical analysis identified as deficient. The Pantex contractor has developed a corrective action plan \3\ to address safety basis quality issues. This corrective action plan includes efforts to review the safety analysis documents for hazard scenarios with no controls and high order consequences caused by production technician trips. --------------------------------------------------------------------------- \1\ Consolidated Nuclear Security, LLC, Justification for Continued Operations for Legacy Issues Associated with Documented Safety Analyses at Pantex, June 29, 2018. \2\ Consolidated Nuclear Security, LLC, Safety Basis Supplement for Legacy Issues Associated with Documented Safety Analyses at Pantex, September 18, 2018. \3\ Consolidated Nuclear Security, LLC, Corrective Action Plan for DSA Quality Issues, September 27, 2018. --------------------------------------------------------------------------- The second report describes the results of a safety investigation (preliminary safety inquiry) regarding the implementation of 10 CFR 830 at Pantex. It identifies examples of lack of compliance that support all the above conclusions. For example, contrary to 10 CFR 830.202(c), the Pantex contractor has failed to update annually the hazard and safety analysis reports. In addition, contrary to 10 CFR 830.203(g), the Pantex USQ procedures allow three days to correct discrepant-as- found conditions--or safety basis implementation and execution errors-- without stopping operations, notifying the Department of Energy (DOE), or initiating the Pantex process for addressing a potential inadequacy of the safety analysis. The third report describes deficiencies identified within the special tooling program at Pantex and was sent to the Secretary of Energy from the Board on October 17, 2018. Based on this analysis, the Board finds that deficiencies exist within the processes used to ensure operations at Pantex have a robust safety control strategy--the safety basis is inadequate and credible accident scenarios with high consequences exist with insufficient or no controls. Hazard scenarios of concern include those with high explosive violent reaction and/or inadvertent nuclear detonation consequences, which significantly exceed the DOE Evaluation Guideline [[Page 10197]] dose consequence of 25 rem total effective dose to the maximally exposed offsite individual. As a result, the Board finds that DOE and NNSA need to take actions to ensure that adequate protection from hazards associated with nuclear operations at Pantex is sustained. Recommendations. The Board recommends that DOE and NNSA take the following actions at Pantex: 1. Implement compensatory measures to address all the deficiencies described in Appendix 1 and Appendix 2. 2. Perform an extent-of-condition evaluation of the Pantex safety basis (including the procedures for development and configuration control of the safety basis documents) and implement subsequent corrective actions to ensure compliance with DOE regulations and directives. 3. Implement actions to ensure process design and engineering controls (including the use of special tooling) eliminate or protect a unit from impact and falling technician scenarios, including those scenarios identified in Enclosure 1. 4. Ensure the design, procurement, manufacturing, and maintenance of special tooling is commensurate with its safety function (see Enclosure 1). 5. Train safety basis personnel to ensure future revisions to the safety basis comply with 10 CFR 830 requirements. ----------------------------------------------------------------------- Bruce Hamilton, Chairman Risk Assessment for Recommendation 2019-1 Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex Plant Recommendation 2019-1 addresses uncontrolled hazard scenarios and Title 10, Code of Federal Regulations, Part 830, Nuclear Safety Management (10 CFR 830), implementation at the Pantex Plant. In accordance with the Defense Nuclear Facilities Safety Board's (Board) enabling statute and Policy Statement 5, Policy Statement on Assessing Risk, this risk assessment considers initiating event frequencies, adequacy of preventive and/or mitigative controls, and consequences from the hazards. As detailed in the Recommendation and supporting technical analysis, deficiencies exist within processes used to ensure operations at Pantex have a robust safety basis. Furthermore, accident scenarios exist at Pantex with inadequate control strategies, including scenarios without any preventive or mitigative controls. As specified within the Pantex safety analysis and hazard analysis reports, these scenarios of concern--including those without any applied controls--have high explosive violent reaction and/or inadvertent nuclear detonation consequences. These consequences have the potential for significant special nuclear material aerosolized dispersal and therefore significantly exceed the Department of Energy (DOE) Evaluation Guideline dose consequence of 25 rem total effective dose to the maximally exposed offsite individual. For the identified inadequately controlled scenarios, the initiating events primarily involve operational incidents, such as impacts, drops, gouges, and personnel trips. Following nomenclature outlined in DOE Standard 3009-1994, Change Notice 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, initiating event frequencies for the scenarios include Anticipated (probability between 10-1 and 10-2) and Unlikely (probability between 10-2 and 10-4) events. Coupled with the significant consequences to the public, DOE Standard 3009 ranks the risk associated with these events as Unacceptable. Furthermore, in accordance with DOE Standard 3016-2016, Hazard Analysis Reports for Nuclear Explosive Operations, the design agencies provided unscreened (i.e., conditional probability of greater than 10-9 per insult) weapon responses for these scenarios. Based on the weapon response, there is sufficient probability that the consequence could occur given the postulated insult and therefore controls are required to prevent the accident. In accordance with DOE Standard 3009 and Standard 3016--safe harbors for compliance with 10 CFR 830--safety class controls are required to provide adequate protection. Using the deterministic process outlined in DOE Standard 3009 demonstrates that Pantex needs safety class controls to maintain adequate protection. A quantitative risk assessment is not practicable because the data does not exist. However, there is a qualitative risk as scenarios currently exist without any applied controls, or with insufficient control strategies. As a result, the Board finds that DOE and NNSA need to take actions to ensure that adequate protection from hazards associated with nuclear operations at Pantex is sustained. Findings, Supporting Data, and Analysis Appendix 1 Nuclear Explosive Operations With Uncontrolled Hazards at the Pantex Plant 4 --------------------------------------------------------------------------- \4\ This report updated on July 27, 2018, to incorporate issuance of the Justification for Continued Operations (JCO), Justification for Continued Operations for Legacy Issues Associated with Documented Safety Analyses at Pantex, dated June 29, 2018. Report does not reflect issuance of the subsequent Safety Basis Supplement, Safety Basis Supplement for Legacy Issues Associated with Documented Safety Analyses at Pantex, dated September 18, 2018. --------------------------------------------------------------------------- Members of the Defense Nuclear Facilities Safety Board's (Board) staff reviewed the hazard analysis reports (HAR) for B61, W76, W78, W87, and W88 nuclear explosive operations at the Pantex Plant (Pantex). The staff team held multiple interactions between November 2017 and March 2018 with personnel from the National Nuclear Security Administration (NNSA) Production Office (NPO) and the Pantex contractor, Consolidated Nuclear Security, LLC (CNS), responsible for development and maintenance of the Pantex documented safety analysis (DSA) \5\ to discuss specific scenarios identified in the safety basis documents. --------------------------------------------------------------------------- \5\ DSA refers to the full framework of safety analysis documents comprising the safety basis for conducting nuclear operations at Pantex. This includes HARs, safety analysis reports (SAR), the technical safety requirements (TSR) document, JCOs, and Evaluations of the Safety of the Situation. --------------------------------------------------------------------------- The Board's staff team identified credible hazard scenarios that lack documented evidence that Pantex has identified and implemented credited safety controls to prevent high order consequences, i.e., inadvertent nuclear detonation (IND) and/or high explosive violent reaction (HEVR). High order consequences have the potential to significantly exceed the Evaluation Guideline to the maximally exposed offsite individual. Through evaluation of the Pantex safety basis, the staff team identified additional deficiencies related to (1) the design and classification of administrative controls relied upon for specific risk reduction, (2) the processing of new information through the approved unreviewed safety question (USQ) process, and (3) quality issues in the safety basis documentation. Following the multiple interactions conducted during this review, the staff team concluded that CNS and NPO have not demonstrated how the current suite of credited controls--i.e., safety class and safety significant structures, systems, and components (SSC); specific administrative controls (SAC); [[Page 10198]] and safety management programs--effectively prevent the identified hazard scenarios from resulting in high order consequences. Background. In July 2010, the Board transmitted a letter to the NNSA Administrator communicating issues with HARs for several nuclear explosive operations at Pantex [1]. The issues included concerns that the Pantex contractor \6\ inappropriately used initiating event probabilities to exclude credible hazards from further consideration. In some instances, this resulted in hazard scenarios where the responsible design agency provided a credible weapon response but the Pantex contractor did not identify or implement controls to address these hazards. In its 2010 letter, the Board concluded that this practice was inconsistent with the safety basis safe harbor methodologies in use at the time, i.e., DOE-NA-STD-3016-2006, Hazard Analysis Reports for Nuclear Explosive Operations [2], and DOE-STD- 3009-1994, Change Notice 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses [3]. --------------------------------------------------------------------------- \6\ At the time of the 2010 Board letter, Babcock & Wilcox Technical Services Pantex, LLC, was the management and operating (M&O) contractor. Following a contract transition in July 2014, CNS became the M&O contractor. --------------------------------------------------------------------------- NNSA \7\ and the former Pantex contractor, Babcock & Wilcox Technical Services Pantex, LLC (B&W), developed a DSA Upgrade Initiative (DSAUGI), in part, to address the concerns communicated in the Board's 2010 letter. DSAUGI included goals to (1) develop accident analyses for all hazardous events that do not have screened responses for IND and HEVR, and (2) update the safety management programs to ensure that the key provisions of the programs, as they relate to operational and facility safety, are adequately described and translated into TSRs [4]. As indicated in initial revisions of the upgrade initiative, B&W and NNSA intended DSAUGI to be a multi-year effort, \8\ with detailed schedules of deliverables maintained to ensure that its goals were accomplished in a timely and complete manner. Completion of DSAUGI, as it was initially described, would have entailed significant revisions to the W76, W78, W87, and W88 HARs to address deficient legacy conditions such as those identified in the 2010 Board letter [4]. --------------------------------------------------------------------------- \7\ At the time of the 2010 Board letter, the local NNSA office was referred to as the Pantex Site Office (PXSO). In 2012, PXSO merged functions with the Y-12 Site Office to form NPO. \8\ The original plan, issued in 2011, was to complete DSAUGI by the end of fiscal year 2015. --------------------------------------------------------------------------- In 2013, B&W developed the DSA Improvement Plan (DSAIP) to ``improve the Pantex DSA to achieve consistency and simplification, and to address legacy issues'' [5]. DSAIP superseded DSAUGI. DSAIP had a stated goal to ``achieve continuous improvement through incremental change,'' as realized by incorporation of its core principles in DSA change package development and during the DSA annual update process [5]. The original revision of DSAIP specified 15 core principles, including the following principles relevant to the issues presented in this report: Core Principle 4--``Evaluate important to safety controls for either elimination or for elevation to a [credited safety-related] control'' [5]. Core Principle 10--``Evaluate key elements for either elimination or for re-categorization as a [credited safety-related] control'' [5]. Core Principle 11--``Ensure Specific Administrative Controls (SACs) are appropriately classified per DOE-STD-1186'' [5]. Additionally, DSAIP stipulated specific initiatives necessary to address legacy issues in the safety basis and to accomplish the plan's goals. These initiatives, developed in part to address the issues identified by the Board, included an effort to resolve ``screening of high consequence/low probability events (in both Hazard and Accident Analyses)'' [5]. The original issue of DSAIP included a notional schedule to complete this effort through proposed safety basis change packages, scheduled for submittal to NPO in February 2014 [5]. B&W and CNS updated DSAIP annually from 2014 to 2017. The 2015 and 2016 DSAIP revisions listed the status of ``Resolving High Consequence/ Low Probability Events in the Accident Analysis'' as ``Ongoing,'' and no longer provided an explicit path to closure [6, 7]. The 2017 revision of DSAIP represented a significant change to the plan--CNS retained the core principles and higher-level objectives, but no longer provided the status of the specific initiatives, including the initiative related to resolving high consequence, low probability events [8]. Based on feedback and concerns from NPO related to the quality of DSA change package submittals, CNS plans to revise DSAIP in 2018 ``to identify `Core Principle' efforts as discrete projects'' [9]. In November 2017, the staff team performed a focused review of the W88 HAR to determine if actions NNSA and CNS had taken, including those accomplished through DSAUGI and DSAIP, effectively addressed the concerns presented in the 2010 Board letter. Based on the issues the staff team identified in the W88 HAR, the team expanded the review scope to include additional HARs. The issues and conclusions described in this report stem from that focused review and the staff team's additional follow-on activities. The remainder of this report will explore four types of deficiencies the staff team identified: (1) Credible hazard scenarios that lack documented evidence that Pantex has identified and implemented credited safety controls to prevent high order consequences, (2) the design and classification of administrative controls relied upon for specific risk reduction, (3) the processing of new information through CNS's approved USQ process, and (4) quality issues in the safety basis documentation. Identification of Credited Safety Controls for Credible Hazards. The Board's staff team reviewed the hazard disposition tables and related hazard and accident analyses located in the approved HARs for B61, W76, W78, W87, and W88 operations to identify the controls relied upon to prevent hazard scenarios from resulting in high order consequences. While the safety bases identify adequate controls for the vast majority of credible hazard scenarios, the Board's staff team identified credible hazard scenarios with unscreened weapon responses for IND and HEVR for which the safety bases either do not define credited safety controls or for which the credited safety controls are not sufficient. Of note, the staff team's review of applicable safety basis documents was thorough but not exhaustive--additional problematic scenarios may exist. DOE Expectations for the Identification of Credited Safety Controls--Title 10, Code of Federal Regulations, Part 830, Nuclear Safety Management (10 CFR 830), requires that the contractor responsible for DOE nonreactor nuclear facilities establish and maintain the safety basis for the facility. In doing so, the DSA for the facility must ``[d]erive the hazard controls necessary to ensure adequate protection of workers, the public, and the environment, demonstrate the adequacy of these controls to eliminate, limit, or mitigate identified hazards, and define the process for maintaining the hazard controls current at all times and controlling their use'' [10]. The Pantex DSA is intended to implement the safety [[Page 10199]] basis requirements specified in 10 CFR 830 through adherence to the following two safe-harbor methodologies: DOE-NA-STD-3016 for nuclear explosive operations and DOE-STD-3009 for the facilities in which nuclear explosive and nuclear material operations are performed. The guidance and requirements specified in these documents describe DOE's expectations for identification of necessary hazard controls. Per DOE-NA-STD-3016-2016, ``[h]azard scenarios that are not screened for IND or HEVR consequences . . . are designated as Design Basis Accidents (DBAs), and are retained for consideration in the accident analysis section per DOE-STD-3009 . . . . With the exception of [natural phenomena hazards], initiating event probability information must not be used to dismiss the need to apply controls for plausible accident scenarios resulting in IND or HEVR'' [11]. In this context, ``screened'' is defined as ``[t]he weapon response likelihood provided for given hazards and associated nuclear weapon configuration combinations that the responsible DA(s) [design agency] asserts will not result in a specific weapon response consequence. The assignment of an IND or HEVR numerical likelihood [weapon response] will be treated as screened if the likelihood were <= 10-9'' [11]. The 2016 revision of DOE-NA-STD-3016 was accepted into the Pantex M&O contract in 2016, but has not yet been fully implemented. The previous revision to this standard, DOE-NA-STD-3016-2006, does not include a numerical screening threshold, and simply describes screened weapon responses as ``[h]azards and associated weapon configuration combinations that cannot result in a weapon response'' [2]. The HAR development approach specified in DOE-NA-STD-3016 is built around an assumption and acknowledgement that consequences from HEVR and IND accidents will challenge the Evaluation Guideline in the absence of any rigorous analysis. With this in mind, DOE-NA-STD-3016-2016 specifies that ``[t]he approach to the identification and classification of controls in the hazard analysis is the same as the process described in DOE-STD-3009'' [11]. The Pantex M&O contract applies the requirements of DOE-STD-3009- 1994, Change Notice 3, to existing facilities. This standard specifies that ``[i]n order to comply with 10 CFR 830, specific safety controls are to be developed in the DSA'' [3]. It clarifies this expectation by stating that 10 CFR 830 ``defines safety class designation for SSCs that are established on the basis of application of the Evaluation Guidelines. This designation carries with it the most stringent requirements (e.g., enhanced inspection, testing and maintenance, and special instrumentation and control systems)'' [3]. When applied in the context of nuclear explosive operations, the standard stipulates that compliance with 10 CFR 830 requires application of safety class controls to prevent or mitigate unscreened hazards with HEVR or IND consequences. W88 Hazards with Insufficient Safety Controls--In November 2017, the Board's staff team provided NPO and CNS with an initial list of hazard scenarios from the DSA with weapon responses that were unscreened for IND and HEVR consequences, and where safety class controls were not clearly applied. Each of these scenarios potentially is encountered during W88 operations in nuclear explosive cells. The scenarios included postulated hazards related to mechanical impacts caused by falling technicians; mechanical impacts due to dropped tooling and components; and scrapes, pinches, and gouges of critical weapon components. The Addendum to this report identifies the specific scenarios in greater detail. Each identified hazard scenario applies a weapon response rule where the likelihood of high order consequences is listed as ``sufficiently unlikely.'' This frequency bin generally corresponds to conditional response likelihoods of 10-7 or 10-8 depending on the weapon program and consequence, given a particular stimulus or insult. In the framework of weapon response and HAR development, sufficiently unlikely is not equivalent to ``screened.'' While the likelihood of high order consequences for any of these scenarios is extremely low, credited safety controls are still necessary. Mitigative controls such as the specialized nuclear explosive cell structure may be credited to reduce the consequences from HEVR accidents, but such controls are not effective for IND scenarios. Control sets for scenarios with a credible risk of IND must be preventive in nature. Additionally, while the nuclear explosive cell structure could be credited as a mitigative control to provide protection from HEVR consequences, this control would not prevent high order consequences in the immediate vicinity of the accident, requiring the consideration of additional preventive controls. Control sets for scenarios that occur in nuclear explosive bays with a credible risk of HEVR or IND must also be preventive in nature because the bay structure does not mitigate the consequence of such events. During an initial interaction with CNS safety analysis engineering (SAE) and NPO nuclear safety and engineering personnel in November 2017, CNS presented its initial analysis of the identified scenarios to the Board's staff review team. This initial analysis noted that, while not currently and explicitly documented in the safety basis, the cell structure is an in-place, safety class control that CNS could apply to mitigate the consequences from HEVR accidents in the identified scenarios. In addition, CNS noted that currently it had addressed other scenarios by compensatory measures implemented via a JCO approved by NPO in May 2017 [12]. However, CNS acknowledged that the remaining scenarios did not have readily apparent controls. During subsequent discussions with the Board's staff team, CNS personnel also indicated that they had identified the potential for similarly treated hazard scenarios on the W76 program. Based on these initial concerns, the staff team decided to expand the scope of its review to include other HARs that CNS had not updated recently. This included the B61, W76, W78, and W87 programs. Treatment of New Information for W88 Hazard Scenarios--The approved CNS procedure for USQ determinations defines a process whereby CNS captures new information and evaluates whether it represents a potential inadequacy of the safety analysis (PISA).\9\ At Pantex, this is termed the problem identification and evaluation (PIE) process. Soon after the initial meeting where the Board's staff team presented the W88 hazard scenarios of concern, CNS SAE personnel captured the identified scenarios as new information and initiated the PIE process. Although CNS personnel indicated to the staff review team that other programs might contain additional similar scenarios, it did not formally evaluate other weapon programs via the PIE process. --------------------------------------------------------------------------- \9\ CNS has submitted, and NPO has approved, separate USQ procedures at Pantex and Y-12; there may be inconsistencies with 10 CFR 830 that occur at both sites. CNS plans to consolidate the USQ processes across both sites. --------------------------------------------------------------------------- After approximately one month of evaluation, CNS determined that the identified new information did not represent a PISA. Specifically, in response to the question ``Does the situation indicate an unanalyzed hazard exists or a potential new credited control is needed?'', the PIE process disposition form states that ``[a]lthough there are hazards that identify no controls are selected, these hazards have [[Page 10200]] been dispositioned'' [13] with one or more specified disposition pathways. The specified pathways are as follows: (1) Controls are identified, (2) scenario is covered in the May 2017 JCO, (3) scenario is not credible, (4) scenario identifies ``Facility Structure'' as a mitigating design feature, and (5) scenario identifies ``Procedures and Training'' as a safety management program key element. The Board's staff team independently evaluated CNS's disposition of the identified hazard scenarios. The staff team agrees that the scenarios dispositioned through the first two pathways, i.e., controls are identified in the HAR or in the May 2017 JCO, are adequately controlled. Per the CNS evaluation, these pathways apply to only seven of the twenty-five identified hazard scenarios.\10\ The staff team concluded that the three remaining disposition pathways--which CNS applied for 18 hazard scenarios--are either not technically justified or insufficient with regards to established expectations for control reliability and efficacy. --------------------------------------------------------------------------- \10\ CNS performed its PIE response for 25 scenarios. The Board's staff team identified additional scenarios during its independent evaluation. --------------------------------------------------------------------------- CNS concluded through its PIE evaluation that a specific gouge scenario, in a configuration with bare high explosives, is not credible. The conclusion that this specific scenario is not credible contradicts the Hazard Analysis Summary Table in the approved HAR, which concludes that the hazard is credible. The staff team further evaluated the scenario by reviewing the associated operating procedures and could not identify any controls that would preclude the event. With the current information provided by CNS, the staff team is unable to independently reach the same conclusion as the Pantex contractor. The staff review team further notes that CNS would need to request approval from NPO to reverse a conclusion presented in the approved safety basis. CNS concluded that the remaining 17 scenarios were controlled through the use of the facility structure or through key elements of safety management programs. However, as discussed above, the facility structure is incapable of mitigating the consequences of IND scenarios or preventing high order consequences in the immediate vicinity of the accident, requiring consideration of additional preventive controls. For the remaining scenarios that have credible IND consequences, the only preventive features are key elements of safety management programs, such as ``procedures and training'' or the ``falling man awareness protocol.'' In some instances, these key elements are ill- defined and are not developed for the specific context for which they are currently relied upon. In the case of the W88, the ``procedures and training'' key element is not carried into the TSR document for application at the floor level; attributes of the key element are not defined to allow operators, supervisors, or oversight personnel to verify their implementation; and the key elements cited by CNS are not implemented via step-by-step operating procedures that would ensure they are performed properly. Key elements alone cannot reliably prevent these accident scenarios and do not meet DOE's established expectations for controls relied upon to protect the public (this is discussed further in the Administrative Controls Credited for Specific Risk Reduction section). Extent of Condition Review for Hazards without Identified Safety Controls--Based on the initial concerns noted on the W88 program, the Board's staff team conducted an independent extent of condition review. Specifically, the Board's staff team reviewed the B61, W76, W78, and W87 HARs, associated nuclear explosive operating procedures, and sections of applicable SARs. Through this review, the staff team identified similar scenarios on each of the analyzed programs with the exception of B61. After a preliminary review of the B61 HAR, the staff team identified discrepancies in the identification of controls for scenarios with sufficiently unlikely weapon response but did not find any instances of a sufficiently unlikely weapon response without appropriately implemented safety controls. For the remaining programs, the staff team communicated hazard scenarios of concern to NPO and CNS as it identified the scenarios. The specific scenarios are identified in greater detail in the Addendum to this report. At the time of this report, CNS had not reviewed these scenarios via its PIE process as actionable new information, with the exception of those identified for the W88 program. W76 Hazards without Identified Safety Controls--The staff team identified five weapon configurations during W76 cell operations where the HAR identifies a falling production technician hazard and applies a sufficiently unlikely weapon response for a high order consequence. For these hazard scenarios, there is no credited control. During discussions with NPO and CNS personnel, CNS noted that the ``falling man awareness protocol'' is an applicable control, albeit currently uncredited in the HAR. The protocol includes specific training to ensure the area of approach to a unit is clear of any objects that could lead to a tripping hazard, to ensure approaches to the unit by production technicians are minimized and only performed as needed to support the process, and to ensure that production technicians approach slowly and cautiously. The falling man awareness protocol was developed as a best practice when it was implemented in 2014 [14], in part, to address Board concerns and nuclear explosive safety evaluation findings [1, 15, 16]. However, CNS has since credited the protocol with performing a safety class function as a compensatory measure in B83 and W88 JCOs.\11\ CNS also credited the protocol as an operational restriction following a PISA on the W76. The development of the protocol was not intended to meet DOE requirements and guidance for designation as a safety class control. It is not appropriate to credit the falling man awareness protocol as an operational restriction or compensatory measure in lieu of developing engineered controls and/or SACs and process improvements to prevent the hazard. --------------------------------------------------------------------------- \11\ The B83 JCO that includes the falling man awareness protocol as a compensatory measure expired on May 16, 2018. CNS administratively paused B83 operations upon its expiration. The W88 JCO remains in effect. --------------------------------------------------------------------------- W78 Hazards without Identified Safety Controls--The staff team identified that the W78 HAR treats sufficiently unlikely weapon responses as screened--an approach that could result in high order consequence scenarios existing in the safety basis without safety class preventive controls. The staff team did not find deficiencies in the W78 HAR similar to those found for the other weapon programs, but this could be due to the lack of clarity in assignment of controls to process steps. Specifically, in the accident analysis, the W78 HAR inappropriately credits controls that are not applicable in all of the process steps for which they are credited to perform a safety function. As a result, the applicable control suite for hazards in each process step is not explicitly defined. Additionally, W78 program cell operations recently implemented a transfer cart, mitigating some falling technician concerns. However, the staff team did identify the following deficiencies in the identification of safety controls for the W78 program in the Sitewide and Transportation SARs. [[Page 10201]] For a lightning insult scenario, a single control, i.e., a transportation cart, is applied that only decreases the potential for weapon response from the hazard to sufficiently unlikely. Although CNS has additional controls available that could address this gap--e.g., use of a lightning detection and warning system and prohibiting transport (e.g., movement of transportation cart containing unit within the ramps that connect the bays and cells at Pantex) during lightning warnings--W78 transport is currently authorized during lightning warnings. NPO formally has accepted the risk presented by these operations. During the movement of the unit in other facilities, the unit is at risk from a hydraulic fluid fire (see Addendum). The hazard analysis states that based on the weapon response to this threat, there is no credible response because the frequency is sufficiently unlikely. As a result, Pantex did not identify any safety class controls to prevent the high order consequences from this scenario. W87 Hazards without Identified Safety Controls--During W87 disassembly operations, the mechanical safe and arm detonator (MSAD) becomes exposed to mechanical impacts prior to its removal. The HAR documents mechanical impact scenarios, including dropped tooling or weapon components, seismic hazards causing an impact, and falling technicians. The identified hazard scenarios of concern apply a sufficiently unlikely weapon response for a high order consequence. Special tooling is installed and the process is defined to minimize hazards; however, the HAR does not identify any credited engineered or administrative controls to prevent the accident. Additionally, due to the older design of the process, the special tooling itself is the drop hazard in several cases. The W87 program does not have an integrated workstand and does not use process carts to introduce tooling and remove weapon components. These techniques are standard practice for Seamless Safety for the 21st Century (SS-21) \12\ tooling and process design and have been used successfully to control similar hazards on other weapon programs. The staff team focused on W87 disassembly operations; similar issues likely exist in assembly operations. --------------------------------------------------------------------------- \12\ An SS-21 compliant process is one that incorporates the principles outlined in the Design and Production Manual, Chapter 11.3, Seamless Safety (SS-21) For Assembly and Disassembly of Nuclear Weapons at the Pantex Plant. Such a process prevents the application of unauthorized or unanalyzed energy from sources external to the nuclear weapon, contains no single-point failures in the operation, and minimizes radiation exposure to personnel. NNSA and the Pantex M&O contractors implemented SS-21 from 2004-2012; however, the W87 was one of the earlier programs to be evaluated. Subsequent to its implementation on the W87, SS-21 matured substantially. In 2017, NNSA directed CNS to evaluate the potential for undertaking an ``SS-21 refresh'' to implement tooling and processes that would reflect current SS-21 concepts. --------------------------------------------------------------------------- During certain operations, the MSAD is intentionally operated in a controlled manner. The weapon response summary document supporting the HAR includes separate response values applicable to both configurations--where the MSAD is not operated and where it is operated. The likelihood of high order weapon response for scenarios involving mechanical insult to the sensitive area of an operated MSAD is higher than for the un-operated configuration. However, the HAR assumes that it is not credible to impact the sensitive area of the MSAD. The staff team reviewed both the HAR and applicable discussion in the design agencies' weapon response summary document and concluded that CNS has not adequately described the technical basis or referenced supporting documentation to support the HAR's assertion that the scenario is not credible. Safety Implications--For the weapon programs discussed in the above sections, the staff team identified credible scenarios with potential high order consequences without applied controls. Safety class controls, meeting DOE expectations for such, are necessary to prevent scenarios with IND consequences and prevent or mitigate scenarios with potential HEVR consequences. Without adequate, reliable controls identified in the Pantex DSA, NNSA has not demonstrated that these hazards are prevented or mitigated. NNSA, CNS, and the design agencies are currently pursuing safety basis updates on the B61 and W88 programs. The updates will improve the overall quality of the HARs by using current practices and methodologies that were not included when the original HARs were developed--e.g., meeting DOE-NA-STD-3016-2016 expectations, including additional implementation guidance. As part of the development process for upcoming modernization of the B61 and W88, both programs' operations are being overhauled, including making special tooling and process improvements and upgrading the hazard analysis with the use of Collaborative Authorization for the Safety-Basis Total Lifecycle Environment-Pantex (CASTLE-PX). CASTLE-PX is a software tool used to organize, maintain, and track hazards, weapon responses, and controls as Pantex and the design agencies support hazard analysis development and maintenance. Given that the W88 HAR currently is being updated, there would be a limited period where compensatory measures would be needed to allow W88 operations to continue with a compliant and reliable control set. Given the limited time until the new HAR is approved, a near-term JCO that identifies controls to address hazard scenarios with unscreened weapon responses without currently identified controls would be an appropriate vehicle to implement these necessary compensatory measures. With respect to the W76, W78, and W87 HARs, these programs do not fully use CASTLE-PX, nor have the HARs received a full upgrade since their implementation. With the W76, a subset of bay operations was upgraded via CASTLE-PX in 2013; however, the hazard scenarios of concern identified by the staff team occur during cell operations, which do not have a related HAR upgrade. With no near-term, comprehensive safety basis upgrades planned for the W76, W78, and W87 programs, the staff team believes that timely action is needed to identify controls and make any necessary procedure changes. Administrative Controls Credited for Specific Risk Reduction. CNS has identified key elements of safety management programs, or the falling man awareness protocol, as the controls relied upon for preventing high order consequences for some of the hazard scenarios that the staff review team identified as lacking credited controls. However, relying on key elements of safety management programs does not provide a level of protection equivalent to an engineered SSC or a properly implemented SAC, and does not comply with codified expectations in DOE directives. DOE Expectations for Administrative Controls Identified to Prevent or Mitigate Accident Scenarios--When a contractor responsible for operation of a nuclear facility develops the hazard analysis in accordance with DOE-STD-3009, the contractor is required to put in place controls to prevent or mitigate the consequence of hazards that challenge the Evaluation Guideline to an acceptable level. As discussed above, because the consequences from HEVR and IND are so grave, these accidents are assumed to exceed the Evaluation Guideline and therefore require safety class controls. [[Page 10202]] If a contractor cannot design engineered controls for an accident scenario, it has the option of developing an administrative control. DOE-STD-1186-2016, Specific Administrative Controls, states, ``SACs shall be designated where an administrative control performs [a safety class (SC)] or [safety significant (SS)] safety function to prevent or mitigate a postulated hazard or accident scenario'' [17]. As such, any administrative control selected to prevent postulated accident scenarios where the consequence is HEVR or IND should be designated in the TSRs as a SAC. Due to the safety importance of SACs (i.e., fulfilling the role of a safety class or safety significant engineered control), these controls require an enhanced pedigree and reliability compared to other administrative controls to ensure their dependability. For example, a human reliability assessment is recommended when developing SACs to ensure their dependability, and a SAC should be written so that it is verifiable through testing, examination, and assessment that it is performing its safety function [17]. Application of Safety Management Program Key Elements for Specific Risk Reduction--Key elements might be identified as part of an administrative control; however, when the administrative control is relied upon to prevent high order hazard scenarios, the critical elements of the control should be designated as SACs, not simply noted as key elements of the administrative control. The following discussion from DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, is relevant: The criteria for designating an [administrative control (AC)] as a SAC include two conditions that need to be met: (1) ACs are identified in the safety analysis as a control needed to prevent or mitigate an accident scenario and (2) ACs have a safety function that would be SS or SC if the function were provided by an SSC. These . . . may serve as the most important control or only control, and may be selected where existing engineered controls are not feasible to designate as SS SSCs. Therefore, when ACs are selected over engineering controls, and the AC meets the criteria for an SAC, the AC is designated as a SAC. Controls identified as part of a safety management program may or may not be SACs, based on the designations derived from the hazards and accident analyses in the DSA. Programmatic ACs are not intended to be used to provide specific or mitigative functions for accident scenarios identified in DSAs where the safety function has importance similar to, or the same as, the safety function of SC or SS SSCs--the classification of SAC was specifically created for this safety function--this generally applies to the key element of the safety management program that provides the specific preventive or mitigative safety function. [emphasis added] [18]. DOE-STD-3009 identifies several safety management programs that an M&O contractor might want to consider for inclusion in a potential DSA. The examples include criticality safety, fire protection, and other programs. The standard also discusses key elements of these programs that are critical for ensuring that the program can perform its credited safety function: Key elements are those that: (1) are specifically assumed to function for mitigated scenarios in the hazard evaluation, but not designated an SAC; or, (2) are not specifically assumed to function for mitigated scenarios, but are recognized by facility management as an important capability warranting special emphasis. It is not appropriate for a key element to be identified in lieu of a SAC. The basis for selection as a key element is specified, including detail on how the program element: (1) manages or controls a hazard or hazardous condition evaluated in the hazard evaluation; (2) affects or interrupts accident progression as analyzed in the accident analysis; and (3) provides a broad-based capability affecting multiple scenarios. [emphasis added] [18]. Application of the Falling Man Awareness Protocol--Recently, CNS has credited the falling man awareness protocol to perform a safety class preventive function as a compensatory measure in B83 and W88 JCOs, as well as an operational restriction for the W76 program. This protocol includes the provisions that specific training will be provided to ensure that: Approaches to nuclear explosives are clear of any objects that could lead to a tripping hazard. Approaches to nuclear explosives by production technicians are minimized and only occur as needed to support the process. Production technicians approach the nuclear explosive slowly and cautiously. DOE's nuclear safety directives establish a hierarchy of controls that specifies a preference for engineered controls over administrative controls. In instances where engineered controls are not available to prevent the falling technician hazard, CNS should formalize this protocol as a SAC during the next annual safety basis update. This is necessary to meet the intent of DOE directives, as discussed above. Moreover, CNS should consider application of this SAC across the remaining weapon programs and evaluate the application of additional measures (e.g., tooling handoffs, transfer carts, work tables closer to the unit) to increase the reliability of the control. Of note, on the W78 program, a SAC is currently implemented to remove any potential tripping hazards at the beginning of the production technicians' shift. This SAC does not provide the same level of control as the W88 JCO, which seeks to control the falling technician concern throughout the entire shift; however, CNS recently implemented transfer carts for W78 operations, mitigating some falling technician concerns. Adoption of the falling man awareness protocol SAC on the W78 program should also be considered to fully control these scenarios. Safety Implications--Reliance on procedures and training and other safety management program key elements as controls for specific risk reduction in lieu of designation as a SAC is not appropriate in the Pantex safety basis. There is no reliability assessment or appropriate pedigree associated with the key elements, and reliance on procedures and training has inherent weaknesses. Safety management programs do not have the requisite reliability to assure appropriate prevention or mitigation of hazards with potential consequences that exceed the Evaluation Guideline. A recent report from the Board's Pantex resident inspectors identified multiple breakdowns in the falling man awareness protocol, a compensatory measure that lacks the required pedigree of a SAC [19]. The falling man awareness protocol, if used for specific risk reduction, should be formally codified as a SAC across weapon programs, and application of additional measures, as noted above, should be considered to increase the reliability of the control. In instances where safety management programs are the only measures implemented in the Pantex DSA to control high order consequences, NNSA has not demonstrated that the hazards identified in this report are prevented or mitigated. Processing of New Information. The USQ process as implemented at Pantex includes a PIE process to evaluate new information, operational events, and discrepant as-found conditions to determine whether they represent a PISA. As part of the PIE process, CNS safety analysts answer the following questions to determine if the problem will be addressed as a PISA: 1. Does the situation indicate that an unanalyzed hazard exists or a potential new credited control is needed? 2. Does the situation indicate that the parameters used or assumed in the DSA, or in calculations used or referenced in [[Page 10203]] the DSA, may not be bounding or are otherwise inadequate with respect to consequences or frequency? 3. Does the situation indicate that a directive action SAC may not provide the safety function assigned to it within the DSA? CNS determined that the unscreened hazard scenarios with high order consequences and without credited safety class preventive controls for the W88 program did not warrant a PISA designation. As discussed in detail earlier in this report, the staff team disagrees with CNS's evaluation. Moreover, the staff team does not believe that CNS has met the relevant DOE expectations for processing new information. DOE Expectations for Evaluating New Information--DOE Guide 424.1- 1B, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements, states the following for timeliness of evaluating new information: 10 CFR 830. 203(g) requires certain actions for a PISA. A PISA may result from situations that indicate that the safety basis may not be bounding or may be otherwise inadequate; for example, discrepant as-found conditions, operational events, or the discovery of new information. It is appropriate to allow a short period of time (hours or days but not weeks) to investigate the conditions to confirm that a safety analysis is potentially inadequate before declaring a PISA. The main consideration is that the safety analysis does not match the current physical configuration, or the safety analysis is inappropriate or contains errors. If it is immediately clear that a PISA exists, then the PISA should be declared immediately. [20] CNS flows down this guidance into its local implementing procedure, CD-3014, Pantex Plant Unreviewed Safety Questions Procedure, as follows: If the determination can be readily made that a PISA does not exist within 3 business days from when [new information] is determined to be mature, or an operational event occurs, the decision will be documented. If the determination cannot be readily made in this timeframe, a PISA is declared and documented. [21] Evaluation of New Information Identifying Credible Hazards without Credited Safety Controls--CNS dispositioned the W88-focused PIE entry after approximately one month, concluding there was no PISA. This lack of timeliness in processing the new information is inconsistent with the expectations of relevant DOE directives and the NPO-approved site implementing procedure. Based on its evaluation of the W88 PIE entry, CNS has not entered the PIE process for the corresponding new information for the other weapon programs discussed above. Furthermore, NPO and CNS informed the staff review team that the DSA will be further improved under the current DSAIP, so more immediate actions are not needed. However, the staff team identified significant problems with relying on DSAIP to address the handling of unscreened ``sufficiently unlikely'' scenarios: DSAIP included a core principle to discontinue the use of key elements of safety management programs as a control for specific risk reduction. However, CNS has not defined a timeline or included specific tasks (e.g., individual SARs and HARs) to eliminate this use of key elements. Additionally, although the core principle has been present since the original DSAIP was developed in 2013, the use of key elements as controls for specific risk reduction remains prevalent throughout the DSA. DSAIP included an initiative to meet DSA requirements to address high consequence, low probability events. DSAIP revisions 1 and 2 included this initiative with explicit tasks and schedules. However, revisions 3 and 4 included it as a general initiative with an ``ongoing'' schedule status. CNS removed any discussion of high consequence, low probability events from the current DSAIP (revision 5). In a February 2018 interaction with the Board's staff team and a Board member, NPO and CNS discussed the development of a safety evaluation report to justify the current safety posture [22]. Additionally, NPO and CNS discussed the concept of separating DSAIP into an improvement plan and a ``compliance'' directed plan, the latter of which might be included in support of the safety evaluation report. NPO and CNS are developing the documents to support the proposed safety evaluation report. CNS submitted a JCO \13\ to NPO for review and approval on June 29, 2018, to justify the current safety posture and continue operations. However, the submitted JCO does not formalize safety controls for a number of the credible accident scenarios detailed in this report. As of July 27, 2018, NPO was still reviewing the JCO. CNS has not taken any immediate actions in the interim, e.g., identifying and implementing compensatory measures for the applicable scenarios. --------------------------------------------------------------------------- \13\ Consolidated Nuclear Security, LLC, Justification for Continued Operations for Legacy Issues Associated with Documented Safety Analyses at Pantex, June 29, 2018. --------------------------------------------------------------------------- Safety Implications--The staff team finds CNS's evaluation of this new information to be inadequate. CNS has continued nuclear explosive operations on all applicable programs without applying compensatory measures or operational restrictions to address the deficiencies identified by the staff team. Furthermore, CNS's disposition of the PIE entry for W88 hazard scenarios failed to meet the timeliness expectations of relevant DOE directives and the NPO-approved site implementing procedure. Overall Challenges with DSA Quality. Throughout the independent extent of condition review, the staff team encountered numerous DSA quality concerns, including the following: Poor documentation of how hazard scenarios are dispositioned. Unscreened hazard scenarios not carried forward for control selection. Multiple, duplicate scenarios existing in the safety basis document with different control suites selected. Unclear documentation of control selection. Inappropriate use of safety management program key elements. Assumptions in safety basis not protected in the TSRs to show that a hazard is not credible. Inconsistencies between HARs on what hazard scenarios require a control. Inconsistencies and conflicting statements between different sections of the safety basis document. Errors in mapping weapon response rule probabilities from the design agency document to the HAR. Unreferenced supporting documentation. Additionally, while not within Pantex's control, the quantity of different design agency-provided weapon response summary documents for each program can be cumbersome. It is not clear how and when the design agencies update their weapon response summary documents or which weapon response rule version is being implemented. Each of these quality concerns on its own might not represent a safety issue; however, it is clear that Pantex DSAs are not consistently maintained with appropriate rigor. One way DSAs are maintained and improved is through annual updates, as required by 10 CFR 830. Specifically, 10 CFR 830 requires the M&O contractor to ``[a]nnually submit to DOE either the updated documented safety analysis for approval or a letter stating that there have been no changes in the documented safety analysis since the prior submission . . .'' [10]. In recent years, CNS has had issues with submitting annual updates on a timely basis. For example, in a December 22, 2016, memorandum NPO identified to CNS the concern with safety basis annual [[Page 10204]] update timeliness, as well as quality concerns. The memorandum identified specific examples, including the annual updates for the W80 and W78 HARs being overdue for more than four and six months, respectively [23]. Additionally, the majority of improvement activities have been de-scoped from Pantex annual updates, leaving little value- added in the update efforts besides incorporating negative USQs into HARs and SARs. CNS recently started taking actions to address issues with the quality of DSA change package submittals [9]. Throughout 2017, NPO rejected or CNS withdrew numerous DSA change package submittals due to technical and quality issues. While CNS has instituted recent actions intended to improve submittal quality, these actions will not necessarily address the types of DSA quality deficiencies encountered by the staff review team. Appendix 1 Addendum Specific Hazard Scenarios with Uncontrolled Hazards. The Board's staff team reviewed Hazard Analysis Reports (HAR) and select portions of the Safety Analysis Reports (SAR) for five weapon programs--B61, W76, W78, W87, and W88. The staff team reviewed the hazard disposition tables and related hazard and accident analyses located in the approved HARs and SARs, and found that they contained hazard scenarios with unscreened weapon responses for inadvertent nuclear detonation (IND) and high explosive violent reaction (HEVR) consequences where safety class controls were not clearly applied. The tables below identify the specific scenarios of concern. The tables include the hazard identification number referenced in each corresponding HAR or SAR, a description of the insult type, the credited controls (if any) for high order consequences, and additional staff comments. Of note, while thorough, the staff team's review of applicable safety basis documents is not exhaustive. Additional scenarios with similar concerns may exist. W88. The Board's staff team reviewed the W88 HAR. The HAR categorizes certain unscreened scenarios as ``sufficiently unlikely'' to result in weapon response with a high order consequence. In several such scenarios, although the HAR identified a control, the staff team identified an issue with the documentation of the control. For the remaining such scenarios, the HAR did not identify an appropriately documented control. In the table below, superscript numerals within each row associate applied controls to the hazard scenarios (if no superscript exists, the control applies to all listed hazards). ---------------------------------------------------------------------------------------------------------------- Currently applied Hazard ID Insult type controls Board's staff team comments ---------------------------------------------------------------------------------------------------------------- C.DI.6.I.06........................ Drop.................. Personnel Evacuation No safety class controls (Specific applied to mitigate/ Administrative prevent high order Control [SAC]). consequences. Control of Equipment (SAC) could be applied as preventive control. C.ADI.I.20,\1\ C.A.22.I.11,\1\ Falling Technician.... Safety Management Facility Structure credited C.A.23.I.02,\1\ C.A.24a.I.06,\1\ Program (SMP) Key to mitigate some HEVR C.A.19.I.15,\1\ C.DI.6.I.02,\1\ Element (Procedures consequences, but no C.ADI.I.21 \2\. and Training).* sufficient controls Nuclear Explosive applied to prevent IND or Cells Facility to protect immediate Structure.\1\ vicinity from HEVR. SMP Personnel Evacuation Key Element (SAC) \2\. inappropriately used for risk reduction. C.DI.7.I.04, C.ADI.I.22............ General Falling Use of Process Two example scenarios Technician. Transfer Cart (SAC). listed are not all inclusive. Use of Process Transfer Cart (SAC) applies for production technician manipulating special tooling, but does not apply for second technician without special tooling approaching unit. C.ADI.I.29......................... Falling Technician.... Personnel Evacuation No safety class controls (SAC). Procedures and applied to prevent/ Training SMP.* mitigate high order Conduct of Operations consequences. SMPs SMP *. inappropriately used for risk reduction. C.DI.6.G.02........................ Scrape................ No controls applied... In response to the 11/16/ 2017 problem identification and evaluation entry, Consolidated Nuclear Security, LLC (CNS) concluded this event is not credible. The basis for this determination is unclear given the probability of insult specified in the approved HAR. As a result, no safety class controls applied to prevent/ mitigate high order consequences. C.DI.7.G.01........................ Scrape................ Procedures and No safety class controls Training SMP *. applied to prevent/ mitigate high order consequences. SMP Key Element inappropriately used for risk reduction. C.DI.9.I.04,1 2 C.DI.9.I.08,3 4 Drop, falling Personnel Evacuation The Nuclear Explosive Cells C.DI.10.I.09,3 4 C.DI.10.I.10,\1\ technician, and gouge (SAC).\1\ SMP Key Facility Structure could C.DI.11.I.08,\3\ C.DI.12.I.06,3 4 scenarios resulting Element (Procedures be credited to C.DI.14.G.02,\3\ C.A.1.I.01,3 4 in HEVR consequences and Training),\2\ * mitigateHEVR consequences C.A.3.G.02,\3\ C.A.12.I.01,3 4 only (no IND). Procedures and but would not protect the C.A.12.I.02,3 4 C.A.14.I.04,3 4 Training SMP.\3\ * immediate vicinity. C.A.16.I.02,\3\ C.A.17.I.16,\3\ Conduct of Operations C.ADI.I.41,\1\ C.ADI.I.70\3\. SMP.\4\ *. [[Page 10205]] C.DI.12.I.03, C.DI.15.I.02, Drop and falling No controls applied... The Nuclear Explosive Cells C.A.2.I.03, C.A.3.I.04, technician scenarios Facility Structure could C.A.4.I.06, C.A.10.I.02. resulting in HEVR be credited to mitigate consequences only (no HEVR consequences but IND). would not protect the immediate vicinity. ---------------------------------------------------------------------------------------------------------------- * SMP Key Element (Procedures and Training) or SMPs (Procedures and Training or Conduct of Operations) are discussed in the HAR as a reason to accept the risk without applied safety class controls. It is not clear where attributes of the Procedures and Training Key Element are developed for specific application to W88 operations (i.e., neither in W88 HAR nor Sitewide SAR). Source: (U) W88 Disassembly & Inspection and Assembly Hazard Analysis Report, AB-HAR-941335, Issue 28, January 31, 2018. Extent of Condition Review for Hazards without Identified Safety Controls--Based on the concerns identified in the W88 HAR, the Board's staff team conducted an independent extent of condition review. Members of the Board's staff reviewed the B61, W76, W78, and W87 HARs, associated nuclear explosive operating procedures, and sections of applicable SARs. Through this review, the staff team identified similar scenarios on each of the analyzed programs with the exception of the B61. B61. After a preliminary review of the B61 HAR, the staff team identified discrepancies in the identification of controls for scenarios with sufficiently unlikely weapon response but did not identify concerns related to the application of a sufficiently unlikely weapon response without appropriately identified implemented safety controls. The hazard scenarios below include safety basis quality issues. ---------------------------------------------------------------------------------------------------------------- Currently applied Hazard ID Insult type controls Board's staff team comments ---------------------------------------------------------------------------------------------------------------- 5324, 5325, 5329, 5342, 5526, 5529, Drop/Pressure of Force Special tooling....... Special tooling has safety 5557, 5558, 5571, 5572, 5799, significant functional 12716. requirements to address low order consequences but is not designated safety class because the HAR asserts that high order consequences are sufficiently unlikely. Based on the specifications of the special tooling program, there are limited differences between analysis activities required to meet safety significant functional requirements and safety class functional requirements. Additionally, each of the tools relied upon to prevent the accident have other safety class functional requirements applied for other hazard scenarios. 5333............................... Impact or Crush by an Safety Cable, Tyrap, This scenario, as listed in Object (hose whip). Filament Tape, the HAR, is controlled for Material Access Area several other weapon Operations configurations. Requirement (Sitewide Authorization Basis Change SAR). Packages 18-06 and 17-62 implement a new control suite to require air hose restraints to be used, including step-by-step implementation with two technician verification. Per the new control description, as specified in B61 HAR section 4.3.1 and Sitewide SAR section 4.3.50, the controls do not explicitly apply to the ultimate user configuration; however, Hazard ID 5333 applies to the ultimate user configuration and lists HEVR and IND consequences as sufficiently unlikely. Rule 2.7.1 in GE1A4947, (U) General Engineering, Weapon Response Summary, B61, Issue C, indicates that this hazard screens in this configuration. ---------------------------------------------------------------------------------------------------------------- Source: (U) B61 SS-21 Hazard Analysis Report, AB-HAR-940572, Issue 44, January 18, 2018. W76. The staff team identified the following hazard scenarios during W76 operations that have inadequate controls assigned. [[Page 10206]] ---------------------------------------------------------------------------------------------------------------- Currently applied Hazard ID Insult type controls Board's staff team comments ---------------------------------------------------------------------------------------------------------------- 2.1.16.3, 2.1.17.3, 2.1.18.3....... Mechanical Impact..... Facility Structure.... Section 3.4.2.2.6 of the HAR states: ``Given the nature of these operations and the actions that would be required to produce a weapon response, no additional Task Exhaust or Pump Fixture controls are assigned to further reduce the potential for an impact from these items. The event contributors for Rules 2.1.16.3, 2.1.17.3, 2.1.18.3, 2.1.20.3, and 2.1.21.3, which are all uncased [high explosive] configurations, are dominated by an impact from a Production Technician that trips and falls into the uncased HE [high explosive] configuration. No controls were identified that could further reduce the potential for a trip.'' Facility Structure is credited to mitigate HEVR consequences, but no sufficient controls are applied to prevent IND or protect immediate vicinity from HEVR. 2.1.13.8, 2.1.14.11, 2.1.14.16, Mechanical Impacts to Personnel Evacuation The referenced scenarios 2.1.14.2, 2.1.14.4, 2.1.23.16, the CSA. (SAC). list a Burning Dispersal 2.1.23.18, 2.2.2.21, 2.2.2.24, response of sufficiently 2.2.5.8. unlikely; however, the applicable weapon response summary document lists the burning dispersal response as screened. The prior revision of the weapon response summary document lists the burning dispersal response as sufficiently unlikely, so the HAR appears to present outdated information. 2.2.2.22........................... Mechanical Drop/Topple/ Personnel Evacuation The referenced rule is not Swing/Push. (SAC). listed in the referenced weapon response summary document. The prior revision of the weapon response document contained a rule that was formerly applicable. Based on the current weapon response summary document, the staff team concluded there is no control deficiency in this instance. ---------------------------------------------------------------------------------------------------------------- Source: (U) W76-0/1 SS-21 Assembly, Disassembly & Inspection, and Disassembly for Life Extension Program Operations Hazard Analysis Report, RPT-HAR-255023, Issue 71, November 30, 2017. W78. The staff team identified the following hazard scenarios during W78 operations that have inadequate controls assigned. ---------------------------------------------------------------------------------------------------------------- Currently applied Hazard ID Insult type controls Board's staff team comments ---------------------------------------------------------------------------------------------------------------- B.2.H.1, B.3.H.1, B.4.H.1.......... Exothermic Reaction... Sufficient control set The HAR inappropriately for HEVR. uses combined frequency (i.e., initiating event frequency with weapon response) to remove IND from further consideration. However, sufficient controls applied for HEVR consequences. Sitewide SAR, (Rule 4.4.3)......... Lightning............. W78 Transportation The HAR asserts that the Configuration. mitigated weapon response, with the applied control, is sufficiently unlikely, so no additional controls were applied. Similar concerns apply to other weapon programs. Transportation SAR, (Rule 3.1.3)... Hydraulic Fluid Fire.. No controls applied... No controls applied for high order consequences. According to the Transportation SAR, ``Based on weapon response, no credible response as frequency is Sufficiently Unlikely.'' Similar concerns apply to other weapon programs. ---------------------------------------------------------------------------------------------------------------- Source: (U) W78 Step II Disassembly & Inspection and Repair Hazard Analysis Report, AB-HAR-319393, Issue 63, September 22, 2017; (U) Transportation SAR, AB-SAR-940317, Issue 81, September 19, 2017; (U) Sitewide SAR, AB- SAR-314353, Issue 288, January 31, 2018. W87. The Board's staff team reviewed the disassembly portion of the W87 HAR. Although not reviewed, similar concerns likely exist with the assembly portion of the W87 HAR. The identified hazard scenarios of concern apply a sufficiently unlikely weapon response for a high order consequence. In several instances, the control set is adequate; however, there is a safety basis quality issue with the documentation of the control. With the remaining instances, a sufficiently unlikely weapon response for a high order consequence exists without an appropriately documented control. [[Page 10207]] ---------------------------------------------------------------------------------------------------------------- Currently applied Hazard ID Insult type controls Board's staff team comments ---------------------------------------------------------------------------------------------------------------- B.ISMO.14.D.02, B.ISMO.16.D.02..... Drop of unit.......... Special Tooling. While the staff team Verification of believes the control set Proper Installation to be adequate, the of the Nuclear documentation of the Explosive/Tooling hazard scenario does not Interface (SAC). appear to be fully developed. Tables 3.4.2.2.3-5 and -6 of the HAR state that the particular high order consequence related to the sufficiently unlikely weapon response is not carried forward for further evaluation, i.e., control selection. D32WS-48, D32WS-52, D32WS-86, D32WS- Drop of weapon No controls applied... Table 3.4.2.1.3-3 of the 100, D32WS-129. component and/or HAR states that the tooling onto particular high order configuration, consequence related to the Falling technician. sufficiently unlikely weapon response is not carried forward for further evaluation, i.e., control selection. B.ISMO.24.I.03, (3rd instance, Rule Drop of weapon No controls applied... Table 3.4.2.1.3-4 of the 2.1.4.26a), B.ISMO.24.I.09, (1st component and/or HAR states that the instance, Rule 2.1.4.25a), tooling onto particular high order B.ISMO.24.I.09, (2nd instance, configuration, consequence related to the Rule 2.1.4.25a), B.ISMO.24.I.09, Falling Technician. sufficiently unlikely (3rd instance, Rule 2.1.4.25a). weapon response is not carried forward for further evaluation, i.e., control selection. An example of special tooling that could be dropped and result in an impact to the sensitive area of the component (per CODT-2004- 0295 Rev. 6, the Lawrence Livermore National Laboratory weapon response summary document) is any of the three guide bearings during their removal. The removal of the guide bearings occurs after a protective cover (Skull Cap) has been removed, but before the component is removed. Note that the Skull Cap is not a credited safety class control. The Skull Cap is analyzed for a particular force but has not been evaluated to ensure it could perform a safety requirement if needed. For a falling technician, the impact location is not controlled to prevent impact to the sensitive area. N/A................................ Drop of hand tool onto No controls applied... HAR does not include this sensitive area of scenario for the unique component. operation and configuration analogous to Hazard ID D32WS-86 above. D32WS-70........................... Drop of flashlight Approved Equipment Section 3.3.2.1 of the HAR with electrical Program. states that the electrical coupling. hazard is sufficiently unlikely, and therefore, not carried forward for further evaluation. CODT- 2004-0295 Rev. 6 states that the weapon response does not screen. However, CODT-2004-0295 Vol. 2 Rev. 3 clarifies that the weapon response screens. The staff team concluded that the scenario does screen, but the discussion in Section 3.3.2.1 is inappropriate, and lack of a singular weapon response summary document makes for unclear documentation. D33WSa-18, D34WS-12, D34WS-14...... Drop of weapon No controls applied... Table 3.4.2.1.3-3 in the component and/or HAR states that the high tooling onto order consequence is configuration. sufficiently unlikely and the hazard is not carried forward for further evaluation. D34WS-41........................... Falling technician No controls applied... Table 3.4.2.1.3-3 in the while carrying HAR states that the high special tooling order consequence is (metal with hard sufficiently unlikely and corners/edge). the hazard is not carried forward for further evaluation. N/A................................ Falling technician No controls applied... The HAR's Appendix does not resulting in an include this scenario for impact to the the unique operation and sensitive area of more sensitive orientation component. (after rotating) of configuration analogous to Hazard ID D34WS-41 above. Similar hazard scenarios (D34WS-43, D34WS-50, D34WS- 60) assume the technician will only impact the side of the unit. The staff team believes a direct impact from a falling technician to the sensitive area is a credible hazard. B.ISMO.26.I.01..................... Drop of Hand Tool onto No controls applied... The HAR's Appendix states configuration. that the orange stick is the only tool used during this configuration and that weapon response ``a'' applies. The staff team notes that the selected weapon response (2.1.5.15) does not relate to the discussion in the HAR's Appendix. The more sensitive orientation (after rotating) is not considered. The staff team believes that given the postulated energies, weapon response 2.1.5.11b would be applicable. That response is applicable because any postulated impact could occur over the sensitive area. However, if the orange stick is the only tool that can be used in this task, then this hazard scenario would not be credible. [[Page 10208]] B.ISMO.26.I.03..................... Drop of special No controls applied... The HAR's Appendix states tooling onto that the design of the configuration. tool prevents a direct impact to the sensitive area of the component; therefore, weapon response ``a'' is applied. There is not an adequate basis for this assertion. While the weapon response summary document provides a probe size example, it also states the ``b'' weapon response applies if the insult is over the sensitive area. The staff team believes the special tooling could impact the sensitive area; therefore, weapon response ``b'' should be applied. Additionally, the tooling has sharp (i.e., 90 degree) corners. N/A................................ Technician trips No controls applied... The HAR's Appendix does not resulting in an include this scenario for impact to the the same configuration and sensitive area of orientation analogous to component. Hazard ID B.ISMO.26.I.03 above. N/A................................ Mechanical impact due No controls applied... Rule 2.1.5.24a is not to hand tool drop. referenced in the HAR's Appendix. However, the ``a'' weapon response is used to develop the impact scenario frequencies in Table 3.4.2.1.3-2. There is not an adequate basis for the selection of the ``a'' weapon response usage. The reviewers believe the special tooling could impact the sensitive area; therefore, weapon response ``b'' should be applied. Additionally, most articles of tooling have sharp (i.e., 90 degree) corners. ---------------------------------------------------------------------------------------------------------------- Source: (U) W87 Step II Assembly and Disassembly & Inspection Hazard Analysis Report, AB-HAR-940626, Issue 41. Appendix 1 References [1] Defense Nuclear Facilities Safety Board, Review of Hazard Analysis Reports, Pantex Plant, Washington, DC, July 6, 2010. [2] Department of Energy, Hazard Analysis Reports for Nuclear Explosive Operations, DOE-NA-STD-3016-2006, Washington, DC, 2006. [3] Department of Energy, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, DOE-STD-3009-1994 Chg Notice 3, Washington, DC, 2006. [4] Tifany Wyatt, Babcock & Wilcox Technical Services Pantex, LLC, Documented Safety Analysis Upgrade Initiative Project Plan, Issue 3, Pantex Plant, May 17, 2011. [5] Authorization Basis Department, Babcock & Wilcox Technical Services Pantex, LLC, The Documented Safety Analysis Improvement Plan (DSAIP), Revision 1, Pantex Plant, July 25, 2013. [6] Safety Analysis Engineering Department, Consolidated Nuclear Security, LLC, The Documented Safety Analysis Improvement Plan (DSAIP), Revision 3, Pantex Plant, February 16, 2015. [7] Safety Analysis Engineering Department, Consolidated Nuclear Security, LLC, The Documented Safety Analysis Improvement Plan (DSAIP), Revision 4, Pantex Plant, February 29, 2016. [8] Safety Analysis Engineering Department, Consolidated Nuclear Security, LLC, The Documented Safety Analysis Improvement Plan (DSAIP), Revision 5, Pantex Plant, September 21, 2017. [9] Memorandum from M.S. Beck to K.D. Ivey, Quality of Pantex Safety Basis Submittals, Pantex Plant, February 20, 2018. [10] Title 10, Code of Federal Regulations, Part 830, Nuclear Safety Management, January 1, 2011. [11] Department of Energy, Hazard Analysis Reports for Nuclear Explosive Operations, DOE-NA-STD-3016-2016, Washington, DC, 2016. [12] NNSA Production Office, Justification for Continued Operations for W88 Uncased HE Operations, PX-JCO-17-09, Pantex Plant, May 2017. [13] Consolidated Nuclear Security, LLC, Problem Identification and Evaluation Processing Form, Review ID 20392, Pantex Plant, January 16, 2018. [14] Consolidated Nuclear Security, LLC, Falling Man Awareness Training, PX-3864, Pantex Plant, 2014. [15] Defense Nuclear Facilities Safety Board, Letter from Peter S. Winokur to Frank G. Klotz, Washington, DC, June 2, 2014. [16] NNSA Nuclear Explosive Safety Study Group, Nuclear Explosive Safety Master Study of the Approved Equipment Program at the Pantex Plant Volume II--Special Tooling, Pantex Plant, May 31, 2013. [17] Department of Energy, Specific Administrative Controls, DOE-STD-1186-2016, Washington, DC, December 2016. [18] Department of Energy, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, DOE-STD-3009-2014, Washington, DC, 2014. [19] Defense Nuclear Facilities Safety Board, Pantex Plant Activity Report for Week Ending April 20, 2018, Pantex Plant, April 2018. [20] Department of Energy, Implementation Guide for Use In Addresssing Unreviewed Safety Question Requirements, DOE-G-424.1-1B, Chg. Notice 2, Washington, DC, 2013. [21] Consolidated Nuclear Security, LLC, Pantex Plant Unreviewed Safety Questions Procedure, CD-3014, Pantex Plant, July 2017. [22] Consolidated Nuclear Security, LLC, DNFSB Member Visit to Pantex--Joyce Connery, Pantex Plant, February 2018. [23] Memorandum from K.A. Hoar to J. Papp, NNSA Production Office Expectations for Pantex Documented Safety Analysis (DSA) Annual Updates, Pantex Plant, December 22, 2016. Findings, Supporting Data, and Analysis Appendix 2 Nuclear Safety Management at the Pantex Plant 14 --------------------------------------------------------------------------- \14\ Report published on July 13, 2018, and subsequently modified to incorporate issuance of the JCO, Justification for Continued Operations for Legacy Issues Associated with Documented Safety Analyses at Pantex, dated June 29, 2018. Report does not reflect retraction of the JCO and issuance of the Safety Basis Supplement, Safety Basis Supplement for Legacy Issues Associated with Documented Safety Analyses at Pantex, dated September 18, 2018. --------------------------------------------------------------------------- The Defense Nuclear Facilities Safety Board's (Board) conducted a safety investigation (preliminary safety inquiry) [1] of the implementation of Title 10, Code of Federal Regulations, Part 830 (10 CFR 830), Nuclear Safety Management, for nuclear explosive operations at the Pantex Plant located near Amarillo, Texas [2]. Overall, the inquiry team found that (1) portions of Pantex safety bases are deficient; (2) multiple components of the safety basis process are deficient; and (3) the National Nuclear Security Administration (NNSA) Production Office (NPO) and the contractor, Consolidated Nuclear Security, LLC (CNS), have been unable to resolve known safety basis deficiencies. Pantex Safety Basis Requirements. Table 2 of 10 CFR 830, Subpart B, Safety Basis Requirements, prescribes the methodologies and requirements for preparation of safety analysis reports [[Page 10209]] (SAR) and hazard analysis reports (HAR) for nuclear explosive facilities and operations. SARs are required for the facilities associated with nuclear explosive operations. These SARs include the Sitewide SAR, Bays and Cells SAR, and various special purpose nuclear facility SARs. An approved method of meeting the requirements of 10 CFR 830 for SARs is described in Department of Energy (DOE) Standard 3009, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports [3]. HARs are required for specific nuclear explosive operations. Hazard analysis teams prepare HARs using weapon response inputs from the associated weapon design agencies. An approved method of meeting the requirements of 10 CFR 830 for HARs is described in Department of Energy (DOE) Standard 3016, Hazard Analysis Reports for Nuclear Explosive Operations [4]. Review Scope. The staff team reviewed the following areas in assessing compliance with 10 CFR 830: Controls to Prevent/Mitigate Unscreened Weapon Hazard Scenarios. The staff team selected two HARs (i.e., W76 and W78) for review [5, 6]. It evaluated the hazard analyses in the HARs for events that result in inadvertent nuclear detonation (IND) and/or high explosive violent reaction (HEVR). For each event that was not screened as physically incredible by the weapon design agency, the staff team evaluated the adequacy of the safety control set to prevent or mitigate the event. Identification of hazard controls to ensure adequate protection is required by 10 CFR Sec. 830.204. Implementation of USQ Process. An unreviewed safety question (USQ) process is required by 10 CFR Sec. 830.203 to ensure that operations are conducted within the DOEapproved safety basis. The staff team evaluated the USQ process implemented at Pantex. It reviewed USQ procedures, specific deficiencies identified in a potential inadequacy of the safety analysis (PISA), and justifications for continued operations (JCO). Safety Basis Maintenance. SARs and HARs are required to be updated and maintained in accordance with 10 CFR Sec. 830.202. These requirements obligate the contractor annually to submit updates or a letter stating no changes have been made since the last submittal. The staff team reviewed safety basis maintenance to include annual updates and improvement plans. The staff team reviewed the pertinent documents, prepared agendas, and held onsite discussions with representatives from NPO and CNS. It conducted the onsite visits during the weeks of May 28 and June 11, 2018. The onsite visits included observing nuclear explosive operations involving the W76 and W78 programs. Conclusions. The staff team found that (l) portions of Pantex safety bases are deficient; (2) multiple components of the safety basis process are deficient; and (3) NPO and CNS have been unable to resolve known safety basis deficiencies. The conclusions are summarized below with the detailed evidence to follow: Portions of the safety bases are deficient in meeting 10 CFR Sec. 830.204(b). There are high consequence hazards that (1) are not adequately controlled; (2) may have controls, but the controls are not clearly linked to the hazards; or (3) have controls that are not sufficiently robust or that lack sufficient pedigree to reliably prevent or mitigate the event. This conclusion is supported by observations 1 through 6 below. Multiple components of the safety basis process are deficient. (1) Contrary to 10 CFR Sec. 830.202(c), CNS has failed to update annually the HARs and SARs. (2) Contrary to 10 CFR Sec. 830.203(g), Pantex USQ procedures allow three days to correct discrepant-as-found conditions or implementation/execution errors without stopping operations, notifying DOE, or issuing a PISA. (3) Contrary to DOE G 424.1-1B, NPO and CNS revise existing JCOs instead of issuing new ones, thereby extending the expiration date and reliance on the compensatory measures beyond a year. (4) Contrary to DOE Guide 423.1-1B, CNS does not re-assess procedural controls via implementation verification reviews (IVR) every three years. This conclusion is supported by observations 7 through 10 below. NPO and CNS have been unable to resolve known safety basis deficiencies. (1) NPO and CNS have been unable to resolve several legacy conditions of approval (COA). (2) CNS has a Documented Safety Analysis Improvement Plan (DSAIP) that lacks sufficient information and resource loading required for the process to be successful, and is behind schedule. (3) Despite the fact that issues related to falling technician accident scenarios were identified in 2010, there is no timeline for improvements to be incorporated into the safety basis. This conclusion is supported by observation 11 below. The staff team noted 11 observations over the course of its review that support these conclusions: 1. Missing Specific Administrative Control (SAC) for Operators Applying Brakes on Testers--The W76 HAR identifies multiple events with credible IND and HEVR consequences that require safety class controls but are prevented by an initial condition. The initial condition is a safety management program (SMP) (i.e., Electrical Equipment Program for Testers). The SMP ensures that the design of electrical testers (e.g., PT3746 Preset Tester) precludes mechanical and electrical insults to the weapon. The initial condition in the HAR references Section 18.2.3 of the Sitewide SAR. The Sitewide SAR, page 18-16, states that testers are ``[d]esigned to withstand the forces of a 95th percentile person falling into the tester without the tester tipping or moving the target'' [7]. However, this analysis relies on the operator engaging a wheel locking device. Therefore, the design requirements contained in the SMP are insufficient as the lone control for this event. The operator action of engaging the wheel locking device is not protected by a SAC and is not marked as a critical step in the procedures. Additionally, the tester is not credited as a safety class design feature in the hazard analysis tables. The review team concludes the safety control set for these events does not meet DOE requirements. CNS generated a problem identification and evaluation (PIE) form (PIE-18- 537) and issued a PISA following the onsite discussions. The PISA was followed by a positive USQ determination. 2. Analysis Supporting Adequacy of Safety Class Carts not Bounding--The W78 HAR includes events involving toppling of a preparation cart while carrying various items. The weight of the cart and items on top of it are assumed to impact a weapon configuration. This event results in the need for safety class controls since IND and HEVR are not screened by the design agency. The preventive control for this event is the design of the preparation cart. The HAR, Section 4.3.l.l.2, credits the preparation cart with the functional requirement to ``. . . withstand the forces imparted by a 95th percentile Production Technician as well as the forces due to a PC-3 [performance category-3] seismic event without toppling into the unit.'' However, the assumed weight of the items on the cart in the HAR event exceeds the assumed weight in the supporting engineering analysis [8]. Therefore, the engineering analysis does not adequately demonstrate that the preparation cart is capable of fulfilling its safety functional requirements. CNS generated a PIE form (PIE-18-539) and [[Page 10210]] issued a PISA following the staff team's onsite discussions. CNS followed the PISA with a positive USQ determination. 3. Missing Safety Class Controls for Impact and Electrostatic Discharge (ESD) Events--The W76 HAR identifies rolling impact and ESD events involving a weapon configuration that represents a general bin of 16 separate configurations. The rolling impact is caused by production technicians pushing ``freestanding equipment'' into the 16 different weapon configurations. Freestanding equipment is defined as equipment or tooling not attached to the facility and not hand carried. The rolling impact events require safety class controls since the design agency did not screen them for IND and HEVR. The ESD events are postulated from production technicians being in contact with freestanding equipment or the wrist strap checker. The documented safety analysis currently requires safety significant controls for these ESD events. The preventive control for the rolling impact and ESD events is a SAC (i.e., W76 Operations--Control of Equipment and Tooling). Among other requirements, this SAC prohibits freestanding equipment not required by the W76 process from being placed within 6.5 feet of any W76 configuration installed in the assembly stand, insertion cart, or assembly carts. Designating this SAC for these events as a preventive control results in several errors: The SAC does not include all freestanding equipment that could cause a rolling impact or ESD event (e.g., a tool box) to the weapon configurations. Therefore, this freestanding equipment excluded from the SAC represents an uncontrolled hazard. The ESD event involving a wrist strap checker credits the SAC as a preventive control, but the SAC does not include the wrist strap checker in the list of included equipment. Therefore, the wrist strap checker needs to be added to the SAC. The Nuclear Explosive Operating Procedures (NEOPs) and other technical procedures do include a safety requirement for production technicians to not bring the wrist strap checker near the weapon. However, this requirement does not flow down from this SAC. The SAC states that the 6.5-foot exclusion zone applies to W76 configurations installed in the assembly stand, insertion cart, or assembly carts. Although the majority of the 16 weapon configurations are processed in an assembly cart, the components that make up these configurations are processed on a bench or table. The SAC does not apply to operations on a bench or table. Some tools included in the list of freestanding equipment do not have wheels. Therefore, it is inappropriate to include these pieces of equipment in rolling impact events. CNS generated a PIE form (PIE-18-536) and issued a PISA following the onsite discussions. The PIE form states: ``A PISA was declared on 5/31/18, which resulted in pausing W76-0/1 Mechanical Assembly and Disassembly bay operations until operational restrictions were implemented.'' CNS followed the PISA with a positive USQ determination. 4. Non-Credited Administrative Controls/Training Used in Place of Safety Class Controls for ESD Hazards--The W76 HAR identifies multiple events with credible IND and HEVR consequences that are dispositioned by a ``Category 2 Equipment Evaluation.'' These events require safety class controls since the design agency did not screen them for IND and HEVR. The hazard analysis tables contain a note that refers to equipment evaluations for the Overhoff monitor/hose and wrist strap checkers (i.e., EEE-06-0030 and EEE-06-0037, respectively) [9, 10]: EEE-06-0030 provides ``General Requirements'' that prescribe keeping the Overhoff more than 6.5 feet away from a nuclear explosive during ``Radiation Safety Usage.'' During ``Manufacturing Usage'' the Overhoff may make contact with a nuclear explosive using a short hose, which has a credited insulator. CNS personnel explained that during ``Manufacturing Usage'' the production technicians hold the Overhoff in one hand while guiding the hose to the nuclear explosive with the other hand (within \1/4\ inch of the nuclear explosive). The NEOPs do not include safety requirements, critical steps, warnings, cautions, or general notes that alert the production technicians to potential hazards associated with dropping the Overhoff onto the nuclear explosive. CNS personnel stated in onsite discussions that hazards involving the Overhoff are not credible due to its intended use and production technicians' ``normal behavior'' via training; thus no control is identified for this hazard. EEE-06-0037 prescribes a 6.5-foot standoff distance for the wrist strap checker from all explosives and nuclear explosives and references P7-2003, Weapon Assembly/Disassembly Operations Requirements (U) [11], as the implementing procedure. P7-2003 is a general use level procedure that implements the standoff distance requirement for the wrist strap checker via a boxed note. The staff team also reviewed the NEOPs that are critical-use-level procedures (higher level than general use). The staff team found that the NEOPs include a safety requirement to not carry the wrist strap checker to the unit. The production technicians are required to be familiar with the NEOP safety requirements, but they are not required to read them prior to performing NEOP steps. The NEOPs also do not specify a specific standoff distance (i.e., 6.5 feet). The wrist strap checker is secured to the wall in a bracket but may need to be removed for calibration. CNS personnel stated that production technicians and calibration technicians are trained to not bring the wrist strap checker within 6.5 feet of a nuclear explosive, referencing TABLE- 0068, Safety Checklist, which contains additional requirements for maintaining a 6.5-foot standoff distance to a nuclear explosive [12]. TABLE-0068, however, is not part of the technical safety requirements (TSR) for nuclear explosive operations. The staff team finds that Pantex personnel ultimately rely on non- credited administrative controls and production technician training to implement safety class functional requirements for HAR events involving the Overhoff monitor/hose and wrist strap checkers. There are no credited safety class controls for these events. The review team concludes that this situation does not meet DOE requirements for identification of safety class controls for high consequence events, and as such represents a PISA. CNS has not declared a PISA regarding its controls for these hazards. 5. Missing Safety Class Controls for Production Technician Tripping Hazards--The W78 HAR identifies multiple events involving a production technician who trips and impacts the unit in various configurations. This event results in the need for safety class controls since IND and HEVR are not screened by the design agency. The hazard analysis tables do not identify controls specific to these events. Instead, the hazard analysis tables refer to Section 3.4.2.4 of the HAR, dedicated to evaluating impact hazards. Section 3.4.2.4 lists the identified controls for this hazard. After reviewing the list of controls, the most applicable control is a SAC (i.e., W78 Process--Tripping Hazards), designated in the HAR to perform functions equivalent to a safety- significant control. This SAC requires production technicians to check for tripping hazards once per shift. The staff team traced the SAC requirement to NEOPs. The NEOPs do contain critical steps in their setups that [[Page 10211]] require signature for ensuring tripping hazards have been removed. However, if this SAC is implemented to prevent the event (i.e., production technician trip), it would be an inadequate safety class preventive measure because it does not prevent the tripping hazards from accumulating during operations. As a result, the review team concludes that the events involving a production technician trip are uncontrolled. During onsite discussions, Pantex personnel agreed that they do not have adequate controls in place for tripping events identified in the HAR. However, CNS personnel stated that this is a known deficiency and CNS is developing a JCO.\15\ Per 10 CFR Sec. 830.203(g), CNS is required to enter the PISA process and implement operational restrictions prior to issuing a JCO. The review team concludes that this situation does not meet DOE requirements and as such represents a PISA. CNS has not declared a PISA regarding its controls for these hazards. --------------------------------------------------------------------------- \15\ CNS issued the JCO titled, Justification for Continued Operations for Legacy Issues Associated with Documented Safety Analyses at Pantex, on June 29, 2018. --------------------------------------------------------------------------- 6. Drop Hazards--The W78 HAR identifies several drop events involving a shielded apron or various pieces of equipment, tooling, or materials impacting weapon configurations from a height of two or four feet. These events result in the need for safety class controls since the design agency did not screen them for high order consequences. A SAC (i.e., W78 Process--Hand Lifts) is one of the credited controls to prevent this event. The SAC flows down to safety requirements at the beginning of the NEOPs. The SAC justifies reliance on production technician training by stating: With the training to the technicians on not lifting hand tools, tooling, and materials over the unit unless required for the process and to only lift the object as high as required for the operation, both the frequency of a drop that would impact the units [is] reduced, and the possible impact energy is reduced if a drop were to occur. . . . Based on the height of the unit being worked on, there would be no reason to lift the hand tooling 2 feet over the unit and it would be an unnatural act to do so. It is not considered credible that the tooling would be lifted more than 2 feet over the unit and dropped. Similarly, although not explicitly stated in the SAC, the NEOPs also cite a specific safety requirement for the shielded aprons to be relocated to staging cubicles or corridors out of direct line of sight of the cells when not in use. However, contrary to MNL-293084, Pantex Writer's Manual for Technical Procedures, the NEOPS do not provide critical steps or warnings when handling the specific equipment or materials, that when dropped, could initiate a high order consequence [13]. The staff team discussed the shielded apron and six different individual pieces of equipment considered in the HAR during the site visit. CNS stated that production technicians are sufficiently trained to not lift items more than 2 feet over the weapon. Given the high consequences, the SAC would be strengthened by adding additional specificity (e.g., do not lift equipment higher than a set height above the weapon). In addition, consistent with MNL[dash]293084, the NEOPs should include critical steps or warnings when handling specific equipment or materials that could initiate a high order consequence if dropped. 7. Process for Discrepant As-Found Conditions--The site USQ procedure, approved by NPO, does not comply with the requirements of 10 CFR 830 or recommendations of DOE Guide 424.1-1B, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements [14].\16\ In situations when a ``discrepant as-found condition'' is observed for a TSR-related control, the procedure allows returning the system to the original condition as described in the documented safety analysis (DSA) within three days without having to declare a PISA, formally notifying DOE, performing an extent of condition review, or implementing any compensatory measures. --------------------------------------------------------------------------- \16\ CNS has prepared, and NNSA has approved, a USQ procedure for the Y-12 National Security Complex that contains the same deficiency and inconsistency with the requirements of 10 CFR 830. --------------------------------------------------------------------------- 10 CFR Sec. 830.203, Unreviewed Safety Question Process, requires the contractors to ``establish, implement, and take action consistent with a USQ process that meets the requirements of this section.'' Paragraph (g) of this section states: ``If a contractor responsible for a hazard category 1, 2, or 3 DOE nuclear facility discovers or is made aware of a potential inadequacy of the documented safety analysis, it must: 1. Take action, as appropriate, to place or maintain the facility in a safe condition until an evaluation of the safety of the situation is completed; 2. Notify DOE of the situation; 3. Perform a USQ determination and notify DOE promptly of the results; and 4. Submit the evaluation of the safety of the situation to DOE prior to removing any operational restrictions. . . . '' CNS has prepared a USQ procedure, CD-3014, Pantex Plant Unreviewed Safety Question Procedure [15], approved by NPO, that does not comply with the requirements of 10 CFR 830. More specifically, Procedure CD- 3014 allows the following: If the discrepant as-found condition can be restored to be within the DSA in a matter of hours, not to exceed three business days, a PISA does not exist [emphasis added]. This is limited to conditions where 1) an SSC [structure, system, or component] does not conform to the documented design description and specifications, or 2) implementation/execution errors, for which any immediate actions taken would be to return the facility to conditions described in the DSA. When the determination is made that the discrepant as-found condition can be fixed in three business days or less, the affected operations are restricted until actions are completed to restore compliance. This contractor procedure and its NPO approval do not comply with the four fundamental elements of the USQ process as established by 10 CFR 830: The Pantex procedure restricts operations whereas 10 CFR 830 requires the contractor to place or maintain the facility in a safe condition. The Pantex procedure does not require DOE to be notified of the discrepancy and actions taken. As a result, CNS may operate the facility up to three days outside the DOE approved safety basis without DOE's formal knowledge of the situation. The Pantex procedure states that a PISA does not exist when a discrepant as-found condition can be resolved within three business days, whereas following 10 CFR 830 would result in a PISA followed by a USQ determination. The Pantex procedure does not require an evaluation of the safety of situation for submittal to DOE prior to removing the self- established operational restrictions, whereas 10 CFR 830 requires DOE's acknowledgement of the safety of the situation prior to the contractor removal of the operational restrictions. During the discussions at the site, CNS and NPO personnel referred to an approval memorandum received from the NNSA Chief of Defense Nuclear Safety (CDNS) for application of the three-day grace period for not issuing a PISA. The CDNS memorandum [16], however, refers to conditions that involve defense in depth or other non-safety SSCs because those SSCs ``wouldn't have LCOs [limiting condition for operations] associated with them but will normally wear out, or may be non-conforming for some other reason.'' While the CDNS's concurrence with a situation that involves non-safety related controls may be justified, its extension by Pantex to [[Page 10212]] safety-related and TSR controls is not permitted by DOE requirements of 10 CFR 830. Additionally, Appendix C to CNS's USQ procedure, CD-3014, describes the PIE process that is a precursor to identification and declaration of a PISA. As part of the PIE process an inquiry is made [17]: ``Does the situation indicate a directive action Specific Administrative Control (SAC) may not provide the safety function assigned to it within the DSA?'' If the answer is ``yes,'' a PISA is declared. The staff review team concludes that, consistent with DOE requirements, SACs perform a safety class or safety-significant function and are part of the TSRs of the facility. SACs should not be subject to the USQ or PISA process; however, the analysis that led to the derivation of the SAC may be subject to the USQ/PISA process if the analysis is found to be incorrect. Any change to a SAC in order to perform its intended safety function should be considered a TSR change, and DOE must approve it. 10 CFR 830.205, Technical Safety Requirements, mandates contractors to ``(2) Prior to use, obtain DOE approval of technical safety requirements and any change to technical safety requirements; and (3) Notify DOE of any violation of a technical safety requirement.'' This section of 10 CFR 830 is stand-alone and specific to the TSRs; it stands apart from the USQ process (i.e., Section 203 of 10 CFR 830). As such, the staff team concludes that 10 CFR 830 requires a TSR violation to be directly reportable to DOE, and outside the USQ process. An example of mishandling safety-related controls by using the USQ procedure CD-3014 occurred when a piece of safety-related electrical equipment failed testing in accordance with the in service inspection (ISI) requirement of the TSR for its commercial grade dedication. CNS issued a PISA on March 10, 2017, followed by a USQ determination [18], which CNS determined was negative and did not submit for DOE approval. The USQ determination stated that the piece of equipment credited was ``redundant'' and that CNS at a later date would provide DOE ``a change to Chapter 4 of the Sitewide SAR to delete [this piece], add [another piece of equipment] as a reference, and delete the ISI to inspect from the TSRs. . . . '' DOE Guide 424.1-1B identifies that a failure of a safety-related control, identified in Chapter 4 of the DSA and part of the TSRs, would be reportable to DOE upon verification under a positive USQ determination. Revision of the associated TSR for the failed equipment and replacement by the new piece are required to be completed and approved by DOE before lifting operational restrictions, and not at some later date when the DSA or the Sitewide SAR is revised. The staff review team notes that CNS has not successfully revised the Pantex Sitewide SAR via an annual update since 2014, and DOE has not approved the changes CNS has proposed in the last three years (including the change described above). Consequently, discrepancies exist between the approved Sitewide SAR and its associated set of controls (i.e., the failed equipment) and the contractor's set of controls relied on to support ongoing operations (i.e., the redundant equipment). 8. Long Term JCOs--Some JCOs last for several years without updating the relevant safety basis document, relying on compensatory measures without implementing rigorous controls (i.e., engineered design features). Section 7 of CD-3014 states that ``[t]he purpose of a JCO is to make a temporary (i.e., less than one year) change to the facility safety basis that would allow the facility to continue operating. . . . '' This statement, however, is not codified to lead to closure of the JCOs within a certain period of time (i.e., less than one year) or incorporate the open JCOs into the next annual update of the safety basis documents, as required by DOE. Per 10 CFR 830.202, Safety Basis, the contractors are required to ``(1) [u]pdate the safety basis to keep it current, and to reflect changes to the facility, the work and the hazards as they are analyzed in the documented safety analysis. (2) Annually submit to DOE either the updated documented safety analysis for approval or a letter stating that there has been no change in the documented safety analysis since the prior submission.'' These requirements of 10 CFR 830 serve two purposes: (1) Consolidate all positive USQs and JCOs prepared during the year into one safety basis document for DOE approval and (2) ensure that compensatory measures, and thus less reliable controls, implemented for temporary changes resulting from the JCOs do not become the permanent control for hazards. CNS applies the JCO process to temporary changes as reflected in CD-3014, and to allow deviations from approved safety basis documents. The latter application has resulted in JCOs extending over several years for multiple Pantex operations without CNS integrating them into the annual update of the safety bases. Consequently, CNS has relied heavily on compensatory measures for long periods of time while the JCOs are in effect [19-21]. 9. Maintenance of the DSA--CNS has struggled to complete and obtain NPO approval of the yearly updates required by 10 CFR 830.202. Starting in 2015, NPO has not approved the annual updates CNS has submitted for the Sitewide SAR. In 2016, CNS was unable to meet the annual DSA update requirements for the Sitewide and Transportation SARs and the W76 and W78 HARs. As NPO rejected CNS's submittals, a backlog developed. This process culminated in three rejected submittals and five approvals total in 2017. Overall, this resulted in 11 of 16 SARs and HARs not being approved for annual updates in 2017. In particular, the Sitewide SAR has not been successfully updated and approved via the annual update process since 2014. In lieu of completing the 2017 annual updates, CNS submitted, and NPO approved, a schedule to ``rework'' three previously submitted annual updates and catch up on the remainder with calendar year 2018 annual updates. If CNS successfully executes its plan to submit and obtain NPO approval of a full slate of 2018 annual updates, it will be back on course to meeting the DSA maintenance requirements. 10. Safety Basis Assessments--CNS has processes and procedures for performing management assessments and IVRs. The review team found sufficient evidence that management assessments of safety controls are being performed on a five-year schedule (i.e., 20 percent per year). While a few assessments have been missed, the review team's analysis indicates that CNS is generally holding to that schedule. However, CNS performs IVRs when there is a new TSR or a change to an existing TSR. DOE Guide 423.1-lB, Implementation Guide for Use in Developing Technical Safety Requirements, specifies that IVRs should be conducted every three years for controls susceptible to the degradation of human knowledge (e.g., procedural controls) [22]. Therefore, CNS is not meeting the three-year guidance for re-verification of SACs. Furthermore, the review team's evaluation of the management assessments for SACs for the W76 and W78 indicated that these assessments rarely identify any strengths, weaknesses, findings, or observations. The Pantex DSAIP includes an effectiveness review for the management assessments, but CNS does not have a path forward to improve management assessments. 11. Action on Known Deficiencies--CNS currently is implementing a DSAIP to address several longstanding issues [[Page 10213]] with the Pantex safety bases [23]. The DSAIP has existed since 2013 and is currently in its fifth revision. CNS personnel informed the staff review team that there has been steady progress on a number of items contained in the fifth revision of the DSAIP. Of the three items scheduled for completion in calendar year 2017, CNS completed two. Seventeen items are scheduled for completion in 2018. In addition, the DSAIP lacks detail. The plan is only a list of titles of activities with a targeted year for completion. It does not provide any detail of the scope and objectives for each task, the criteria that should be met for satisfactory execution, or the resources required for completion. While CNS representatives informed the staff review team that they understand the items listed and the tasks involved, the DSAIP does not include detail sufficient to allow verification of the accomplishments. Consequently, the staff team cannot independently verify that the plan is comprehensive, achievable, and on-track to meet the schedule for 2018 and beyond. Over several iterations of the DSAIP, CNS has committed to working down a set of ``legacy'' COAs that existed prior to the creation of NPO. Originally, there were 40 COAs in this category, and 5 currently remain open. The current iteration of the DSAIP includes a task in fiscal year 2018 to develop metrics for tracking progress in resolving the remaining five COAs. Actual closure dates for the five remaining COAs currently are not identified in the schedule. Appendix 2--References 1. DNFSB, Board Notational Vote #Doc#2018-300-098, RFBA by Board Member Roberson to Publicly Release Documents Associated with the Pantex Inquiry, September 2018. 2. Code of Federal Regulations, Title 10, Part 830, Nuclear Safety Management, January 10, 2001. 3. Department of Energy, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, Change Notice 3, DOE Standard 3009-94, March 2006. 4. Department of Energy, Hazard Analysis Reports for Nuclear Explosive Operations, DOE Standard 3016, September 2016. 5. Consolidated Nuclear Security, LLC, (U) W76-0/1 SS-21 Assembly, Disassembly & Inspection, and Disassembly for Life Extension Program Operations Hazard Analysis Report, Revision 71, RPT-HAR-255023, November 2017. 6. Consolidated Nuclear Security, LLC, (U) W78 Step II Disassembly & Inspection and Repair Hazard Analysis Report, Revision 63, AB-HAR- 319393, September 2017. 7. Consolidated Nuclear Security, LLC, (U) Sitewide Safety Analysis Report (SAR), Revision 288, AB-SAR-314353, January 2018. 8. Pantex Plant, (U) Preparation Cart, Revision 3, Engineering Analysis 000-2-0836-ANL-03, June 2007. 9. Pantex Plant, (U) System Engineering Category 2 Electrical Equipment Evaluations, EEE-06-0030, Issue No. 010, March 2014. 10. Pantex Plant, (U) Category 2 Electrical Equipment Evaluation, EEE-06-0037, Issue No. 010, October 2013. 11. Pantex Plant, (U) Weapon Assembly/Disassembly Operations Requirements, Issue P7-2003, AT, March 2013. 12. Pantex Plant, Safety Checklist, TABLE-0068, Issue No. 033. 13. Consolidated Nuclear Security, LLC, Pantex Writer's Manual for Technical Procedures, MNL-293084, Issue No. 12. 14. Department of Energy, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements, Change Notice 1, DOE Guide 424.1-1 B, April 12, 2013. 15. Consolidated Nuclear Security, LLC, Pantex Plant Unreviewed Safety Question Procedure, CD-3014, Issue No. 18. 16. Don Nichols (NNSA Chief of Defense Nuclear Safety) to James Goss (NNSA Y-12 Site Office), memorandum dated February 2, 2010. 17. Consolidated Nuclear Security, LLC, Problem Identification and Evaluation Processing Form, PX-4633, Issue No. 14. 18. Consolidated Nuclear Security, LLC, Commercial Grade Dedication Testing of Delta Arresters, PIE-18750, USQD-17-3434-A, February 24, 2017. 19. Consolidated Nuclear Security, LLC, Justification for Continued Operation for W80 ESD, PX-JCO-14-04, Revision 5, February 27, 2017. 20. Consolidated Nuclear Security, LLC, Justification for Continued Operation for B61 ESD, PX-JCO-14-05, Revision 5, October 4, 2016. 21. Consolidated Nuclear Security, LLC, Justification for Continued Operation for W88 Uncased HE Operations, PX-JCO-17-09, Revision 2, January 11, 2018. 22. Department of Energy, Implementation Guide for Use in Developing Technical Safety Requirements, DOE Guide 423.1-lB, March 18, 2015. 23. Consolidated Nuclear Security, LLC, The Documented Safety Analysis Improvement Plan, Revision 5, SB-MIS-941949, September 21, 2017. Enclosure 1 Board Letter to the Secretary of Energy Dated October 17, 2018, Titled ``Pantex Plant Special Tooling Program Review'' The Honorable James Richard Perry Secretary of Energy U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585-1000 Dear Secretary Perry: In September 2017, the Defense Nuclear Facilities Safety Board reviewed the special tooling program at the Pantex Plant. We identified five deficiencies within the special tooling program: (1) application of the Special Tooling Design Manual, (2) weld quality and application of non-destructive evaluation techniques, (3) pedigree of preventive maintenance and in-service inspection programs, (4) performance criteria within safety basis documentation, and (5) special tooling loading conditions. These deficiencies continue to exist within the special tooling program. Further information on each is provided in the enclosure. Yours truly, Bruce Hamilton Acting Chairman Enclosure c: Mr. Joe Olencz Enclosure Pantex Plant Special Tooling Program Review This report details the deficiencies that the Defense Nuclear Facilities Safety Board's (Board) staff review team found within the special tooling program. Deficiencies exist in the application of the Pantex Plant (Pantex) Special Tooling Design Manual [1], assurance of weld quality and application of non-destructive evaluation (NDE) techniques, pedigree of preventive maintenance and in-service inspection (ISI) programs, utilization of performance criteria within safety basis documentation, and special tooling loading conditions. Based on these deficiencies, the National Nuclear Security Administration (NNSA) Production Office (NPO) and Consolidated Nuclear Security, LLC (CNS), have not demonstrated that the currently implemented process for design, fabrication, production usage, and maintenance of special tooling at Pantex assures that all special tooling can meet its required safety-related functions. Background. Pantex utilizes special tooling to support and manipulate nuclear explosive components during operations at the plant. Special tooling functions as a passive design feature managed through the special tooling program, and is credited within the Pantex safety basis to meet minimum factors of safety. Adherence to these design criteria assures special tooling does not fail during normal and abnormal loading conditions. Failure of special tooling to meet its credited safety functions could lead to impacts to sensitive components of the nuclear explosive (e.g., dropping of unit or [[Page 10214]] equipment impacts onto the unit), potentially resulting in high order consequence events. The requirements for the special tooling program are identified in the NPO-approved Pantex Sitewide Safety Analysis Report [2], and specifics are flowed down into the contractor- established Special Tooling Design Manual, the General Requirements for Tooling Fabrication & Inspection [3], and the Special Tooling Operations [4] manual. During the onsite review and follow-up teleconference, the staff review team evaluated various aspects of the Pantex special tooling program, including safety basis integration; flow down of functional requirements; technical support documentation and analyses; preventive maintenance and ISI of special tooling; quality assurance requirements and processes; and corrective actions resulting from nuclear explosive safety (NES) evaluations, the CNS Special Tooling Top-Down Review [5], and the 2015 NPO Special Tooling Assessment [6]. The staff review team evaluated the special tooling program and its ability to ensure that credited pieces of special tooling are adequately designed, fabricated, and inspected, ensuring their ability to perform safety significant and/or safety class functions. During this review, the staff review team evaluated more than 75 special tooling designs, including a vertical slice of special tooling for the B61 program and a horizontal slice of common special tooling designs across weapon programs (e.g., vacuum lifting fixtures, lifting and rotating fixtures, and workstands). Evaluation of the B61 special tooling allowed the staff review team to examine some of the oldest and newest tooling designs that are currently authorized for use. The staff review team noted deficiencies, opportunities for improvement, and noteworthy practices, which will be described in further detail in the remainder of this report. Content and Application of Special Tooling Design Manual. No consensus or industry standards currently govern the design, fabrication, inspection, and maintenance of special tooling, including factors of safety, weld inspections, and quality assurance practices. Because there are no standards specifically applicable to these aspects of special tooling, the guidance and requirements provided in the Special Tooling Design Manual frequently do not have documented or cited bases. Deviations from Manual Guidance--The staff review team identified multiple instances where Pantex did not meet the requirements and guidance in the Special Tooling Design Manual. For example, Pantex currently does not perform NDE for special tooling welds with low factors of safety, which appears to be in direct conflict with the Special Tooling Design Manual (see following sections). In addition, the Special Tooling Design Manual specifies a minimum of 3:1 factor of safety to yield or 5:1 factor of safety to ultimate strength, as well as the 1.25:1 factor of safety to yield for rare events (i.e., seismic or falling man loads). The staff review team noted instances in which tooling does not meet the minimum factors of safety specified in the Special Tooling Design Manual: Workstand (061-2-0815) pieces 64 and 65 did not meet the 1.25:1 factor of safety at yield for rare events. Penetrator case sleeve (061-2-0738) did not meet the 3:1 factor of safety at yield. Assembly press (061-2-0841) did not meet the 3:1 factor of safety at yield. Pantex personnel stated that designs that deviate from the Special Tooling Design Manual only require the same approval process as those designs adhering to the manual. As the Special Tooling Design Manual provides the means to satisfy the programmatic requirements set forth in the Sitewide Safety Analysis Report, the staff review team suggests elevating deviations for additional review and approval beyond the typical process. Ambiguous Guidance--The Special Tooling Design Manual contains imprecise guidance and requirements allowing for multiple interpretations of certain sections. This has the unintended consequence of allowing deviations when implementing the manual. For instance, the section on weld inspection requirements recommends NDE for welds with a factor of safety less than 10:1 [1]. However, the manual does not clarify whether this is a factor of safety to ultimate or yield strength, and does not specify whether this stress analysis must be done for both yield and ultimate strength. The staff review noted instances in which Pantex personnel did not implement special tooling NDE because there was no analysis of the factor of safety to ultimate strength. Similarly, the special tooling engineer has latitude to evaluate for either 3:1 at yield or 5:1 at ultimate strength for normal loads at his or her discretion. Basis for Rare Events Factors of Safety--The staff review team identified a concern with the minimum factors of safety for rare events, as recommended in the Special Tooling Design Manual. The choice of factors of safety for rare events (1.25:1 at yield strength and 1.5:1 at ultimate strength) does not represent the level of uncertainty in the tooling construction and abnormal loading parameters. For instance, welds in special tooling are currently not subject to NDE beyond visual inspection. The lack of NDE of welds introduces uncertainty regarding the material properties of special tooling. Moreover, as discussed in the 2013 Approved Equipment Program Volume II NES Master Study (AEP Vol. II NESMS) [7], factors of safety from 1.25 to 1.5 are typically used in weight-sensitive applications and are appropriate only if there is a strong degree of certainty in the material properties, loads, and resultant stresses. The special tooling program does not include measures to provide additional assurance for the performance of tooling with low factors of safety, such as load testing to failure or higher maintenance frequency. The closure package that Pantex submitted for the 2013 AEP Vol. II NESMS finding ``Factor of Safety for Special Tooling Rare Event Analysis'' discusses the level of uncertainty present in design and materials for special tooling. However, the closure package focuses on several key areas where uncertainty may be present without comprehensively analyzing all sources of uncertainty and variability in design, fabrication, and operation of special tooling [8]. For instance, weld quality, lack of in-house material certification, and damage (including material fatigue, wear, and handling damage) during operations may all introduce uncertainty and variability in performance. Moreover, the closure package provides only a qualitative assessment of uncertainty in the determination of factors of safety, and does not present a quantitative uncertainty analysis to demonstrate that the safety margins for rare event loading are appropriate. Special Tooling Design-Ductile Versus Non-Ductile Systems--Due in part to the perceived low frequency of seismic events and falling man events--assumed to be analogous to seismic events in the Special Tooling Design Manual--Pantex employs less conservative factors of safety for rare event loads. Factors of safety for rare event loading are developed in the Technical Basis for Safety Factors [9], which supports the Special Tooling Design Manual and Special Tooling Seismic Analysis [10]. This technical basis document states that ``criteria for tooling design packages are equivalent or more conservative'' [9] than DOE Standard 1020-2002, Natural Phenomena Hazards Design and [[Page 10215]] Evaluation Criteria for Department of Energy Facilities [11]. Part of this justification specifically focuses on not crediting the ability to use energy absorption factors to reduce seismic loads for ductile structural systems similar to building structures. While the justification for rare event load paths states that ductile systems will use the factor of safety of 1.25:1 to yield, and non-ductile systems will use a 1.5:1 factor of safety to ultimate strength, there is no guidance in the Special Tooling Design Manual for what is classified as ductile behavior or materials to avoid in the design of ductile systems. The manual also does not incorporate the principles of capacity-based design or overstrength of critical elements of a load path that consensus seismic standards use. Furthermore, the Special Tooling Materials Database [12] employed by special tooling engineers contains examples of permitted materials with little or no ductility, such as plastics and high-performance alloys (where yield and ultimate strength can be within a few percent of each other). Without guidance for determining when systems can be considered ductile, special tooling engineers determine independently which safety factor should be used as an acceptance criterion and which materials are suitable for tooling subject to rare event loads. This use of engineering judgement could lead to variability in selected factors of safety and potentially result in a non-conservative special tooling design. Special Tooling Design-Failure Probability--The ultimate goal of seismic design methods that meet DOE Standard 1020 is to achieve a certain probabilistic performance for structures, systems, and components (SSC). An SSC designed for PC-3 design loads using this standard has an input ground motion with an annual probability of exceedance of 4x10-4 but is designed with enough margin to have an annual probability of failure of less than 10-4. In order to meet this performance, consensus standards such as American Society of Civil Engineers Standard 43-05, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities [13], restrict certain types of materials, designs, or analysis techniques to ensure adequate ductility and quality. Lower performance SSCs, in turn, have smaller input forces and higher annual probabilities of failure, and are permitted to use less rigorous design methods and employ a wider variety of materials or structural types. The Special Tooling Design Manual, however, does not incorporate these principles, relying entirely on its rare event loading factors of safety. Neither the Special Tooling Design Manual nor the Special Tooling Seismic Analysis address how the 10-4 annual probability of failure expected of PC-3 SSCs is ensured through their selection of safety factors. DOE Standard 1020 ensures this performance through the use of consensus standards built around estimates of SSCs' statistical margin to failure. Because special tooling is a class of custom-made design features, there is not the same statistical basis for their beyond design basis performance like other SSCs that DOE Standard 1020 was meant to address. Typically for seismic design, the approach to non-standard designs or structures is to not credit ductility and use the most conservative design factors to bound the uncertainty in a structure's beyond design basis performance, or to use overstrength factors to ensure the controlling failure modes are well-understood, ductile failures [14]. During the 2013 AEP Vol. II NESMS, a NES Study Group evaluated Pantex's special tooling program and noted this issue in a statistical analysis of performance for special tooling under rare-event loads. As described in section 3.3.2 of the Master Study report, the NES Study Group highlighted that probabilistic margin requires understanding not just the deterministic safety factors of the special tooling, but the hazard curves that determine the probability of exceedance for various intensities of ground motion [7]. In order to have sufficient design margin, the overstrength of special tooling (defined in this case by its factor of safety) has to be combined with the probability of both design basis and beyond design basis ground motions, as well as uncertainties in these two values. The NES Study Group also observed that factors of safety this low are normally associated with designs with high degrees of certainty in not just design and fabrication, but operating environment, rather than abnormal conditions such as a falling man or seismic event. Pantex developed a white paper justifying its rare event loading approach that was formalized into the submitted closure package for the 2013 AEP Vol. II NESMS finding ``Factor of Safety for Special Tooling Rare Event Analysis,'' and documented within the Special Tooling Design Manual [8]. The closure package qualitatively states that the conservative design practices, low probability of earthquakes, known material properties and operational environment for tooling, and the maintenance of special tooling create a conservative framework for use of these safety factors. In addition, this closure package states that ``loads and resultant stresses are known with a high degree of certainty'' [8] citing the Special Tooling Seismic Analysis. However, this document provides only a high-level discussion and does not cite a probabilistic goal for tooling performance, relying instead on the tooling program as a whole to provide sufficient performance. The high degree of certainty in the demands to which tools are evaluated does not translate to low variability of potential seismic demands. There is no quantitative basis that the safety factors and other aspects of the special tooling program provide seismic margins comparable to equivalent safety SSCs. Weld Quality and NDE of Welds. The Special Tooling Design Manual requires NDE of welds for the fabrication or modification of tooling in high-stress applications with factors of safety less than 10:1. Pantex personnel do not implement NDE beyond visual inspections done by a qualified weld inspector. However, per the Metals Handbook Volume 10, Failure Analysis and Prevention [15], while visual inspection can identify visible features such as cracks, weld mismatch, and bead convexity or concavity, the following subsurface features would not be identified through visual inspection, but may be identified through additional NDE: Underbead crack, gas porosity, inclusions (slags, oxides, or tungsten impurities), incomplete fusion, and inadequate penetration. These subsurface features can result in a weld with lower strength or ductility. During the review, the staff review team identified three concerns: Weld Performance--As discussed previously and shown in Table 1 of Appendix A, the Special Tooling Design Manual specifies a minimum factor of safety to yield strength of 1.25:1 and a factor of safety to ultimate strength of 1.5:1 for rare event loadings, such as seismic and falling man loads. Special tooling engineers do not consider any reduction of weld performance due to poor weld quality through either joint efficiency factors (per American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code Section VIII [16] and American Petroleum Institute Standard 653 [17]) or more conservative safety factors (such as phi-factors used for American Institute of Steel Constructors (AISC) 360-10, Specification for Structural Steel Buildings [18]). Due to the low minimum factors of safety allowed by the Special Tooling Design Manual for rare event scenarios, a reduction in weld [[Page 10216]] performance may challenge the special tooling's ability to perform its credited safety function. For example, ASME Boiler and Pressure Vessel Code Section VIII assumes a joint efficiency factor of 0.7 for a double welded butt joint without radiography or equivalent NDE. Applying the 0.7 joint efficiency factor to tooling designed to the minimum 1.25:1 factor of safety to yield strength (for rare event loading) results in a factor of safety of 0.875:1. Thus the tooling would be expected to yield during rare event loading. Plastic Deformation--There are instances where special tooling is anticipated to deform plastically in the course of meeting its design function during abnormal events (i.e., a deflection limit for dynamic load), rather than meeting more conservative factors of safety specified in the Special Tooling Design Manual. In cases of plastically deforming structures, higher weld quality and performance are necessary to ensure the structure performs as expected, as exemplified by demand-critical welds defined in AISC 341-10, Seismic Provisions for Structural Steel Buildings [14]. However, Pantex personnel do not perform NDE of welds subject to plastic deformation, such as the W76 swing arm (000-2-0831). Upon a dynamic impact, the W76 swing arm is credited to deform no more than a certain distance vertically, such that the unit underneath will not be impacted. Without NDE verification of weld integrity, Pantex cannot ensure that such special tooling will meet its safety critical design function. Vendor Quality Issues--Pantex personnel provided the staff review team with vendor performance reports for past and present special tooling vendors [19]. The staff review team noted that several of these reports included instances of receipt refusal of procured tooling due to weld quality issues. Pantex personnel identified these quality issues during receipt quality control visual inspections. The staff review team noted that due to the nature of weld quality issues (e.g., weld penetration depth, heat-affected areas, pores, cracks, inclusions), visually identified weld quality issues could indicate the presence of additional weld quality concerns that cannot be identified through visual inspection alone, and may go undetected. As part of the submitted closure package for the 2013 AEP Vol. II NESMS finding ``Preventative Maintenance,'' Pantex personnel included additional information in the Special Tooling Design Manual detailing different types of NDE [20]. While this information includes the advantages and limitations of different techniques, it does not specify any NDE requirements, and thus does not address the concerns noted above. Pedigree of Special Tooling Preventive Maintenance and ISIs. The staff review team noted three methods that Pantex used to ensure that special tooling--credited design features in the safety basis--can continue to meet its safety functions throughout its time in service: (1) As-built designs (e.g., inherently conductive special tooling fabricated out of stainless steel), (2) production technician inspections for damage prior to use, and (3) special tooling preventive maintenance and ISIs. Based on observed preventive maintenance activities and subsequent discussions, the special tooling preventive maintenance and ISI programs lack the rigor expected for maintenance on and inspection of equipment with safety class and/or safety significant functions. For instance, in contrast to other safety-related SSCs, preventive maintenance and ISIs on special tooling are not performed per detailed written procedures. As a specific example of maintenance performed with sufficient rigor, during review of the maintenance and cognizant system engineering programs at Pantex in December 2017, the Board's staff observed preventive maintenance of ESD flooring--a design feature--in two nuclear explosive facilities. Workers conducted the preventive maintenance according to a detailed, written procedure (i.e., Technical Procedure TP-MN-06291, ESD Flooring Resistance Measurements, Annual, Plant [21]) and with an appropriate level-of-use (e.g., reader-worker practices). In contrast, the staff review team observed that for special tooling maintenance, Pantex relies heavily on worker knowledge and the skill of the craft to meet specifications that the special tooling engineer provides in the supporting data sheets. This practice could compromise the reproducibility of test results and prevent reliable testing of important features, given the potential variability in results. Performance Criteria Assurance. The performance criteria for meeting the functional requirements for safety class and/or safety significant special tooling are absent from the safety basis and reside in supporting documents (i.e., design requirements documents, supporting data sheets, and analyses). Although the requirements for the special tooling program are governed by the NPO-approved Sitewide Safety Analysis Report, the performance criteria for program-specific special tooling are neither within Pantex safety basis documentation nor reviewed and approved by NPO. DOE Standard 3009-1994, Change Notice 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, delineates expectations that the safety basis chapter on SSCs include ``[i]dentification of the performance criteria necessary to provide reasonable assurance that the functional requirements will be met'' [22]. The lack of NPO approval of the specific performance criteria conflicts with DOE Standard 3009-1994 expectations. Special Tooling Loading Conditions. During its review, the staff review team noted the following deficiencies regarding special tooling loading conditions: W76 Swing Arm--Pantex relies on the test results of a single (prototype) W76 swing arm [23] to validate that it will perform its safety basis function under analyzed loads. The staff review team identified several concerns with this testing, including the following: The test assessed whether the swing arm would perform its safety function in the case of dynamic loading (i.e., the special tooling would vertically deflect less than a certain distance during an impact scenario). However, Pantex performed only a single test, and Pantex personnel informed the staff review team that it was not performed with a high quality pedigree, such as in accordance with the quality assurance requirements of ASME NQA-1, Quality Assurance Requirements for Nuclear Facility Applications [24]. When coupled with the weld quality concerns and weld manufacturing variances noted above, it is unclear to the staff review team how Pantex can ensure that all swing arm copies will be able to perform their safety functions during an impact scenario (i.e., they will not deflect beyond the specified limit and potentially impact the unit). The staff review team identified an additional falling man scenario with the W76 swing arm that Pantex had not previously analyzed. As this impact scenario applies a load on a longer lever arm, there exists the possibility for a larger deflection of the swing arm than previously postulated, which would potentially defeat its safety function. Pantex personnel stated that they do not consider the scenario to be credible. However, the staff review team contends that during transient movements of the swing arm, production technicians have a direct pathway to apply load on the longer lever arm. [[Page 10217]] Falling Man Rare Event Loading--The staff review team noted non- conservative assumptions regarding placement and distribution of falling man rare event loading. Per the reviewed analyses, special tooling engineers typically apply the falling man loading to the center of gravity of the components supported by special tooling. This usually results in a symmetric distribution of loads. The staff review team questioned the appropriateness of this approach, postulating that it may be more conservative and bounding to assume an uneven distribution of loads, such as primarily loading one beam of a two-beam system rather than applying equal loading across both beams. Specifically, for the B61 program, the staff review team identified non-conservative assumptions with the placement and distribution of falling man rare event loads involving a configuration between the support beam (061-2-0730) and support and alignment fixture (061-2- 0860). In this configuration, the staff review team noted that falling man horizontal loads could impart a torsional load component to the support beam that Pantex had not analyzed. While this may be a robust piece of special tooling with respect to vertical loading, Pantex did not evaluate the factor of safety for torsional load. As justification, special tooling engineers noted that the angles from which production technicians can approach this configuration preclude this torsional loading. However, nuclear explosive operating procedures do not restrict approach angles to protect this assumption, and subsequent staff review team observations of B61 nuclear explosive operations revealed that a falling production technician could approach at the angles of concern and could impact this configuration to generate out- of-plane loadings not currently evaluated. Loss of Special Tooling Design Function during Impacts--Functional requirements for special tooling include factors of safety based on static loading conditions. However, as observed during falling man studies performed at Virginia Polytechnic Institute and State University [25], special tooling, such as tooling employing a banjo plate configuration, had considerable elastic deformation during certain dynamic impact scenarios. Pantex does not typically consider how deformations under loading could render the special tooling incapable of performing its safety function throughout the loading cycle (e.g., a holding fixture deforming under impact and allowing a held component to be dropped). Opportunities for Improvement. The staff review team identified several opportunities for improvement in the special tooling program. Periodic Reevaluation of Analyses--The staff review team noted that there currently is no requirement or guidance to Pantex personnel that requires the periodic reevaluation of special tooling engineering analyses. Such a program would allow opportunities for Pantex to self-identify incomplete or deficient conclusions, bolster the analysis methodology to include modern methods (e.g., finite element analysis software), and provide additional assurance in the conclusions of the special tooling analysis. NES Study Concerns--NNSA does not currently have near-term plans to redesign or upgrade B61, W76, and W87 special tooling to address outstanding NES Study concerns, including reducing the size of gas cylinder carts to eliminate/minimize hazards and discontinuing an electrical tester cart (i.e., for the PT3746) that is susceptible to toppling. NES Study Groups have identified aspects of special tooling associated with these weapon programs that do not meet the intent of Seamless Safety for the 21st Century, including the W76 program's continued use of a swing arm and the absence of an engineered control for potentially cracked high explosive and unnecessary unit lifts on the W87 program. Furthermore, the staff review team noted that when a NES Study Group identifies potential deficiencies in the special tooling design or implementation on one weapon program (e.g., elimination of a similar swing arm on the W78 program by introduction of a transfer cart), NNSA and the Pantex contractor do not consistently address the deficiency on other applicable weapon programs. Validation Testing--The staff review team identified that Pantex only performs limited testing of special tooling to validate engineering calculations. For example, the first destructive test of a piece of special tooling (i.e., the B61 support beam) was conducted in July 2017. This destructive test was used to confirm the conclusions of the associated engineering analysis. In case of special tooling with factors of safety lower than required by the Special Tooling Design Manual, additional testing would be valuable to eliminate uncertainty regarding whether the tooling will perform its design function. Safety Catches--The staff review team evaluated the use of W76 vacuum lifting fixtures and the 2015 issue in which cracks were identified in vacuum lifting fixture safety catches (see Figure 1). The safety catches are a secondary feature to prevent a drop of high explosive charges should vacuum fail on the lifting fixture. The staff review team is concerned that actions taken to-date may not prevent recurrence of cracking of safety catches. Pantex continues to rely on production technicians to identify cracking during routine prior-to-use inspections. The staff review team believes that application of an ISI or introduction of a specific step within the nuclear explosive operating procedure to check for safety catch damage prior to use would bolster the reliability of this check. Alternatively, the safety catches could be redesigned, substituting a material with a lower likelihood of cracking (e.g., appropriately coated metal). Figure 1. Cracked Safety Catches in the W76 Aft Disassembly Fixture, 076-2-0382 [26]. Special Tooling Acceptance Process--As discussed onsite, in one instance, Pantex delivered an incorrectly fabricated W88 lifting and rotating fixture (088-2-0377) to production for use, and technicians subsequently installed it in the facility and began operations. On this specific piece of special tooling, a component used to mate the tooling to the stand was out-of-tolerance. The component is designed with a slight bend; however, the bend angle was out-of- tolerance by approximately 10 degrees, preventing the component from interfacing properly with other special tooling during the operation. The bend angle is neither part of the receipt inspection for subcontracted tooling (as a recordable feature), nor part of the quality assurance inspections required before the tooling is released for production use. A NES Change Evaluation was ultimately required to authorize the use of a temporary procedure to remove the special tooling and continue operations. In light of this occurrence and other instances of special tooling used without all necessary reviews and approvals [27], the staff review team encourages improvements to the special tooling acceptance process. Noteworthy Practices and Updates. The staff review team identified a number of noteworthy practices that Pantex has implemented that contribute to the improvement of the overall safety posture of special tooling program. In addition, the staff review team noted several ongoing initiatives. Noteworthy Practices--The staff review team noted several practices that contribute to the safety posture of the special tooling program. [[Page 10218]] Sharing Lessons Learned. Pantex has established methods for sharing lessons learned among special tooling engineers (e.g., use of ``Design Tips'' documentation). The staff review team specifically noted an example with the B61 presray plate (061-2-0761). Given incidents with this special tooling (e.g., loss of air pressure due to intrusion of foreign material through the supply air), Pantex took appropriate actions to apply in-line air filters to all special tooling requiring air pressure to perform its required functions. Quality Assurance Consensus Standard Implementation. As part of its 2016 approval of the combined Y-12 and Pantex Quality Assurance Program Description [28], NPO required Pantex to apply the quality assurance requirements of NQA-1 to the special tooling program [24, 29]. Historically, special tooling quality assurance has been governed by the NNSA Weapon Quality Policy (i.e., NAP-24), which establishes specific weapon and weapon-related product-focused quality requirements for designing, producing, and surveilling weapon products. As part of its extent of condition review, Pantex identified a large number (between 5,000 and 10,000) of special tooling designs that will require additional evidence to meet the commercial grade dedication requirements of NQA-1. Pantex is conducting a pilot study on six pieces of special tooling in order to inform NPO of the potential cost and timeframe for complete implementation of NQA-1 for special tooling. The tooling selected for the pilot study includes an assembly cart (000-2-1230), W76 lifting & rotating fixture (076-2-0365), assembly stand (000-2-0832), and a B83 vacuum fixture (083-2-0460). Supplier Quality Control Improvements. The staff review team identified some noteworthy practices by Pantex Supplier Quality. First, Pantex uses a risk-informed process to determine whether a given supplier requires additional Pantex oversight to ensure that the special tooling received from the supplier meets Pantex quality requirements. The staff review team notes that these risk-based surveillances occur in addition to the triennial Pantex re-evaluation. Second, Pantex has developed a Supplier Quality Handbook for Special Tooling Suppliers [30] that will help inform special tooling suppliers of many of the pitfalls encountered by Supplier Quality. Third, Pantex has demonstrated its willingness to remove suppliers who are routinely at risk from the Qualified and Approved Suppliers List until the supplier demonstrates compliance with Pantex Supplier Quality requirements. Ongoing Initiatives--Pantex plans to make improvements to the Special Tooling Design Manual, as well as special tooling engineering analyses, including the following: Clarification of Design Manual. Pantex has revised the Special Tooling Design Manual to include clarifications and additional language to provide guidance on factors-of-safety requirements for special tooling and the use of backup features with friction-based special tooling. However, Pantex has not provided sufficient additional guidance for factors of safety for press assemblies. Pantex has clarified that either the factor of safety of 3:1 at yield or 5:1 at ultimate strength can be used in analysis, but does not provide guidance on the appropriateness of one value or the other. Guidance for Deviations from Design Manual. Pantex has updated the Special Tooling Design Manual to provide additional guidance regarding the approval process for special tooling designs that deviate from manual requirements. However, the approval process for deviations from the design manual does not require elevation beyond the normal approval chain. Engineering Mentors. Pantex has updated the Special Tooling Design Manual to implement a mentor system, in which senior special tooling engineers will be tasked with providing clarification and improvements to the design manual. Updates to Special Tooling Analyses. Pantex is updating several special tooling engineering analyses that were discussed during the staff review team's onsite review (e.g., the W76 swing arm (000-2- 0831), B83 belly band (083-2-0476), W87 primary lifting fixture (087-2- 0400), and B61 penetrator case sleeve (061-2-0738) analyses). Specifically for the W76 swing arm, the staff review team questioned whether the single dynamic loading test would bound the impact of a falling man scenario, as was indicated in the W76 Hazard Analysis Report [31]. Pantex personnel have updated the tooling analysis to defend its safety basis assumption that dynamic testing bounds the falling man scenario. Pantex personnel have updated their swing arm calculation to demonstrate that forces from the test exceed the current falling man load. Appendix A Special Tooling Safety Factors The Special Tooling Design Manual presents factors of safety for custom special tooling within the anticipated load paths. These values do not apply to off-the-shelf components, such as casters or pressurized tubing. Non-pressurized off-the-shelf components are held to a factor of safety of 1:1 to working load or 5:1 to vendor-stated failure load. Pressurized off-the-shelf components are held to a factor of safety of 1:1 to working load or 4:1 to vendor-stated burst pressure. In addition, the Special Tooling Design Manual includes minimum factors of safety for several other types of special tooling, such as systems relying on vacuum or acting to restrain compressed air hoses; however, these are not discussed further in this report. The factors of safety most relevant to this report are stated below: Table A-1--Factor of Safety Requirements for Custom Special Tooling Components [1] ---------------------------------------------------------------------------------------------------------------- To yield To ultimate Design case strength strength ---------------------------------------------------------------------------------------------------------------- Minimum allowable design factors of safety for normal loading 3:1 or 5:1 (e.g., weight of components, anticipated pressures) \17\....... Minimum allowable design factors of safety for rare events 1.25:1 or 1.5:1 (falling man and seismic)...................................... Minimum factor of safety that does not require non-destructive N/A .............. 10:1 \18\ evaluation of welds............................................ ---------------------------------------------------------------------------------------------------------------- [[Page 10219]] Of note, special tooling does not require redundancy of load path elements in design [1]. As noted in the report, based on analyses reviewed by the staff review team, special tooling engineers typically apply the loading to the center of gravity of the components supported by special tooling. This usually results in a symmetric distribution of loads. --------------------------------------------------------------------------- \17\ Pantex personnel do not currently apply these minimum factor of safety requirements to special tooling that includes high- pressure press components; Pantex personnel plan to update the Special Tooling Design Manual to reflect slightly less conservative factor of safety requirements for this special tooling type. \18\ The current revision of the Special Tooling Design Manual does not state whether this factor of safety requirement is to yield strength or to ultimate strength; Pantex personnel indicated that it is intended to be to ultimate strength. --------------------------------------------------------------------------- References [1] Consolidated Nuclear Security, LLC, Tooling & Machine Design, Special Tooling Design Manual, MNL-293130, Issue 8, January 18, 2016. [2] Consolidated Nuclear Security, LLC, Sitewide Safety Analysis Report (U), AB-SAR-314353, Revisions 263 and 277. [3] B.L. Ames, Consolidated Nuclear Security, LLC, Special Tooling & Tester Design, General Requirements for Tooling Fabrication & Inspection, Issue 14, May 15, 2014. [4] Pantex Production Tooling Department, Special Tooling Operations, MNL-352164, Issue 11. [5] Consolidated Nuclear Security, LLC, Special Tooling Top-Down System Review System Improvement Project (SIP), Revision 2, January 21, 2015. [6] National Nuclear Security Administration Production Office, Assessment Results for the Independent Assessment of the Special Tooling Program, December 22, 2015. [7] Department of Energy Nuclear Explosive Safety Study Group, Nuclear Explosive Safety Master Study of the Approved Equipment Program at the Pantex Plant, Volume II--Special Tooling (U), May 31, 2013. [8] Consolidated Nuclear Security, LLC, Closure Package, Finding 3.3.1: Factor of Safety for Special Tooling Rare Event Analysis, From the Nuclear Explosive Safety Master Study of the Approved Equipment Program at the Pantex Plant Volume II Special Tooling, April 6, 2018. [9] Pantex Engineering Analysis, Technical Basis for Safety Factors, ANL-13802, Issue 1, August 15, 2005. [10] Pantex Tooling & Machine Design, Seismic Analysis, ANL-13468, Issue 1, March 26, 2004. [11] Department of Energy Standard 1020, Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy Facilities, January 2002. [12] Pantex Tooling & Machine Design, Materials Database, November 3, 2016. [13] American Society of Civil Engineers (ASCE) 43-05, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities, 2005. [14] American Institute of Steel Constructors (AISC) 341-10, Seismic Provisions for Structural Steel Buildings, June 22, 2010. [15] ASM Committee on Failure Analysis of Weldments, ``Failure of Weldments.'' Metals Handbook Volume 10, Failure Analysis and Prevention, Ed 8, 1975, p. 333. [16] American Society of Mechanical Engineers Boiler and Pressure Vessel Code Section VIII, Rules for Construction of Pressure Vessels, 2017. [17] American Petroleum Institute Standard 653, Tank Inspection, Repair, Alteration, and Reconstruction, Edition 5, November 2014. [18] American Institute of Steel Constructors (AISC) 360-10, Specification for Structural Steel Buildings, June 22, 2010. [19] Consolidated Nuclear Security, LLC, Vendor Performance Report for Date Range 7/10/2016 to 7/10/2017, July 11, 2017. [20] Consolidated Nuclear Security, LLC, Closure Package, Finding 3.4.1: Preventive Maintenance, From the Nuclear Explosive Safety Master Study of the Approved Equipment Program at the Pantex Plant Volume II Special Tooling, April 9, 2018. [21] Pantex Technical Procedure, ESD Flooring Resistance Measurements, Annual, Plant, TP-MN-06291, Issue 10, October 20, 2015. [22] Department of Energy Standard 3009-1994, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, Change Notice 3, March 2006. [23] Pantex Engineering Analysis, Swing Arm, ANL-000-2-831, Issue 5, April 3, 2009. [24] American Society of Mechanical Engineers, NQA-1, Quality Assurance Requirements for Nuclear Facility Applications, March 14, 2008. [25] A.R. Kemper, S.M. Beeman, and D. Albert, Evaluation of the Falling Man Scenario Part III: Crash Test Dummy Forward Fall Experiments, Virginia Tech--Wake Forest University Center for Injury Biomechanics, May 31, 2015. [26] Pantex Tooling & Machine Design, Engineering Evaluation 15-EE- 0010, Issue 001, May 5, 2015. [27] ``Unanalyzed Special Tooling approved for Production Use,'' Department of Energy Occurrence Reporting and Processing System, NA--NPO-CNS-PANTEX-2017-0087, November 30, 2017. [28] Consolidated Nuclear Security, LLC, Quality Assurance Program Description, June 21, 2016. [29] L.R. Bauer, Consolidated Nuclear Security, LLC, Response to NPO Comments on Quality Assurance Program Description, May 9, 2017. [30] Consolidated Nuclear Security, LLC, Supplier Quality Handbook for Special Tooling Suppliers, Issue 1. [31] Consolidated Nuclear Security, LLC, W76 Hazard Analysis Report (U), RPT-HAR-255023, Revisions 67 and 70. Correspondence With the Secretary of Energy December 27, 2018 The Honorable Bruce Hamilton Chairman Defense Nuclear Facilities Safety Board 625 Indiana Avenue NW, Suite 700 Washington, DC 20004 Dear Chairman Hamilton: The Department of Energy (Department) received the Defense Nuclear Facilities Safety Board (DNFSB or Board) Draft Recommendation 2018-1, Uncontrolled Hazard Scenarios and JO CFR 830 Implementation at the Pantex Plant, on November 29, 2018. In accordance with 42 U.S.C. Sec. 2286d(a)(2), the Department requests a 30-day extension to provide comments. Lisa E. Gordon-Hagerty, the Department's Under Secretary for Nuclear Security, will provide the response to the DNFSB by January 28, 2019. The Department is committed to addressing safety basis deficiencies at the Pantex Plant. As you may be awai[middot]e, the Department has already taken action and continues to monitor closely the completion of actions to address identified concerns. As pait of its efforts, the Department has also taken into consideration information from the two DNFSB Staff Issue reports regarding these safety basis deficiencies. Since the Draft Recommendation presents a complex and extensive discussion of safety documents at Pantex, a 30-day extension is necessary to afford the Department sufficient time to assess the Draft Recommendation's findings, suppo1ting data, and analyses. If you have any questions, please contact Mr. Geoffrey Beausoleil, Manager of the National Nuclear Security Administration Production Office, at (806) 573-3148 or (865) 576-0752. Sincerely, Rick Perry December 28, 2018 The Honorable James Richard Perry Secretary of Energy U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585-1000 Dear Secretary Perry: The Defense Nuclear Facilities Safety Board (Board) is in receipt of your December 27, 2018, letter requesting a 30-day extension to provide comments on the Board's Draft Recommendation 2018-1, Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex Plant. In accordance with 42 U.S.C. 2286d(a)(2), the Board is granting the extension for an additional 30 days. [[Page 10220]] Yours truly, Bruce Hamilton January 28, 2019 The Honorable Bruce Hamilton Chairman Defense Nuclear Facilities Safety Board 625 Indiana Avenue NW, Suite 700 Washington, DC 20004 Dear Chairman Hamilton: On behalf of the Secretary, thank you for the opportunity to review Defense Nuclear Facilities Safety Board (Board) Draft Recommendation 2018-1, Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pan/ex Plan/. We appreciate the Board's perspective and look forward to continued positive interactions with you and your staff on this important matter. The Department of Energy's National Nuclear Security Administration (DOE/NNSA) agrees that continuing actions are needed to further improve the content, configuration management, and implementation of the safety basis for nuclear explosive operations at the Pantex Plant (Pantex). While there are opportunities for improvement, DOE/NNSA believes that the current safety controls implemented at Pantex provide adequate protection of public health and safety. DOE/NNSA acknowledges that legacy issues exist within the current Pantex documented safety analyses. The enclosed summary outlines a number of actions initiated by DOE/1\TNSA during the past year to scope and prioritize the identified and necessary improvements. We believe these actions address the primary concerns raised in the Board's Draft Recommendation. Given the importance of these efforts, I have also requested DOE[middot]s Office of Enterprise Assessments periodically assess the progress DOE/NNSA is making in this area. The first two assessments have been scheduled for the third and fourth quaiters of fiscal year 2019. In addition, DOE/NNSA would appreciate the opportunity to provide the Board with a detailed briefing on the improvement actions taken in 2018 and planned for 2019. If you have ai1y questions, please contact me or Mr. Geoffrey Beausoleil, Manager of the NNSA Production Office, at 865-576-0752. Sincerely, Lisa E. Gordon-Hagerty Enclosure - Comments on Draft DNFSB Recommendation 2018-1, Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex Plant General Comments Throughout last year, and more intensely during the second half of the year, the Department of Energy's National Nuclear Security Administration (DOE/NNSA and CNS (Pantex)) have taken numerous actions aimed at improving the quality, configuration management, and implementation of the Pantex Plant (Pantex) safety basis. Key actions during this period include the following: In September 2018, DOE/NNSA approved a Safety Basis Supplement (SBS) by CNS that fulfilled two primary objectives. First, the SBS provides a framework for analyzing and addressing legacy issues in the Pantex safety basis associated with scenarios previously determined not to require application of safety controls because they were evaluated to be ``sufficiently unlikely.'' Requirements have been established to assure ``sufficiently unlikely'' scenarios are identified and resolved. Second, the SBS included significant improvements in safety protocols through the identification of compensatory measures for preventing events that could result from ``Falling Man'' scenarios. As of December 20, 2018, CNS has implemented the new `Falling Man' compensatory measures in all active nuclear explosive cells. Implementation of the new `Falling Man' compensatory measures in active nuclear explosive bays is expected to be completed by February 28, 2019. In October 2018, DOE/NNSA initiated a project to identify options for ``redesigning'' the Pantex safety basis, with the goal of reducing the complexity of the safety basis documents, simplifying development and maintenance of the documents, and correspondingly improving implementation of the identified safety controls. Members of this project team include representatives from DOE/NNSA, the production plants, the national laboratories, and the Nevada National Security Site. This initiative will take substantial effort to achieve, but is essential for ensuring the long-term success of the Pantex national security mission. In November 2018, DOE/NNSA approved a comprehensive Corrective Action Plan by CNS that includes numerous actions for improving the Pantex safety basis development process and addressing legacy weaknesses in the current documents. Execution of this plan will drive significant improvement in the overall quality of the Pantex safety basis within the next two years. To date, CNS has completed all actions on schedule. Several elements of the DNFSB's Draft Recommendation arise from inconsistencies between long-standing Pantex practices and DOE guidance documents. Examples include DNFSB concerns related to the structure of the Pantex Unreviewed Safety Question (USQ) procedure, the longevity of some Justifications for Continued Operations, and the frequency within which safety control implementation is re-verified. By definition, the referenced DOE Guides (e.g., DOE Guide 423.1-lB, Implementation Guide for Use in Developing Technical Safety Requirements and DOE Guide 424.1-1B, Implementation Guide for Use in Addressing Unreviewed Safety Question Requirements) provide supplemental information that DOE/NNSA uses to encourage performance of operations and activities across the complex with a focus on best practices. Similarly, several of the concerns in the DNFSB's Draft Recommendation related to Special Tooling are understood to be suggestions to adopt industry best practices rather than reflecting deficiencies against DOE regulations or requirements. DOE/NNSA identified similar issues with the Special Tooling program as part of our oversight activities. DOE/NNSA will ensure the DNFSB suggestions are evaluated as it continues to develop additional improvement actions, but do not believe the issues result in challenging adequate protection of public health or safety. Safety Controls Associated With Low-Probability/High-Consequent Events The DNFSB raised concerns that some scenarios determined to be `sufficiently unlikely' (i.e., expected to occur between once-in-a- million and once-in-a-billion years) in the applicable Pantex safety basis documents did not have clearly identified safety controls for preventing or mitigating the potentially high consequences (e.g., worker fatality or public radiological exposure). The DOE/NNSA provides the following perspective regarding these concerns: As noted in the DNFSB's Draft Recommendation, questions associated with `new information' related to potential accident scenarios are evaluated via the Pantex Problem Identification and Evaluation process. This process ensures that appropriate operational restrictions or compensatory measures are implemented while resolving any potential safety issues associated with the adequacy of safety controls. During the past year, DOE/NNSA has verified this process has been effectively executed by CNS, and has driven improvements to the process as warranted. One of the concerns raised by the DNFSB, associated with the adequacy of safety controls for `sufficiently unlikely' scenarios, was reliance on Key Elements [[Page 10221]] of Safety Management Programs to prevent high-consequences during potential `Falling Man' scenarios. In September 2018, the DOE/NNSA approved a Safety Basis Supplement that identified additional `Falling Man' controls, which are structured, credited, and protected as Specific Administrative Controls (SACs) rather than programmatic Key Elements. As noted above, CNS implemented these `Falling Man' SACs in all active nuclear explosive cells as of December 20, 2018, and will implement them in active nuclear explosive bays by February 28, 2019. Other than the control adequacy issues discussed above, the remaining control adequacy concerns generally relate to weaknesses in the safety basis documentation. The two most common examples are (a) controls that are already implemented in the field but are not specifically linked to and credited for scenarios in the safety basis that were dispositioned as `sufficiently unlikely' and (b) scenarios that were inappropriately deemed as `sufficiently unlikely' in the safety basis where in reality they are not credible (e.g., the scenario would require deliberate or malicious procedural violations). The aforementioned Safety Basis Supplement provides a framework for evaluating and categorizing these documentation-related issues. CNS developed a Corrective Action Plan that DOE/NNSA approved in November 2018 that includes commitments to perform extent-of-condition reviews of all Pantex Safety Basis Documents by the end of 2019, with the objective of identifying and correcting all instances of these documentation-related issues. To date, CNS has executed on schedule the actions captured in this Corrective Action Plan. Configuration Management of the Pantex Safety Basis The DNFSB raised concerns related to the processes used to maintain configuration management of the Pantex safety basis. Specifically, the DNFSB expressed concern that: (a) Updates to Pantex safety basis documents are not always completed on an annual basis; (b) the Pantex USQ procedure allows discrepant-as-found conditions to be corrected without suspending impacted operations or making necessary notifications; and (c) some Justifications for Continued Operations (JCOs) are extended beyond a year. DOE/NNSA provides the following perspectives regarding these concerns: The DNFSB's concern related to the timeliness of updating safety basis documents appears to be based on data collected during 2017. The vast majority of Pantex safety basis documents were updated on-time in 2018, the lone exception being the update associated with the Site-wide Safety Analysis Report. CNS is committed to updating this document by March 2019. The aforementioned Corrective Action Plan, approved by DOE/NNSA in November 2018, includes actions to revise the administrative procedures for developing and revising Pantex safety basis documents. These actions specifically identify improving configuration management of safety basis documents as an objective, which, when executed effectively, should preclude similar issues from occurring in the future. The DNFSB's Draft Recommendation states that ``the Pantex USQ procedures allow three days to correct discrepant-as-found conditions . . . without stopping operations, notifying the Department of Energy (DOE), or initiating the Pantex process for addressing a potential inadequacy of the safety analysis.'' While the Pantex USQ procedure does allow three days to correct a discrepant-as-found condition prior to declaring a Potential Inadequacy of the Safety Analysis (PISA), Pantex procedures require: (a) Suspending operations whenever a safety question is raised (e.g., discovery of discrepant-as- found conditions); (b) making appropriate notifications to the DOE/NNSA Production Office (NPO); and (c) initiating the DOE-Approved Pantex USQ process. Therefore, we believe the proper safety control is in place. The DNFSB's Draft Recommendation includes a concern with the processes for handling JCOs and the extension of some for an extended period of time. The goal in the Pantex USQ procedure of addressing JCOs in less than a year is derived from guidance in DOE Guide 424.1-lB. The intent is to ensure JCOs and their compensatory measures are used to address temporary changes to the safety basis until permanent solutions can be identified and incorporated. While one year is a viable goal for limiting use of a JCO, it is not always practical to resolve issues in nuclear or nuclear explosive operations in that time frame. Many of the issues identified in JCOs involve complex operations or hazard scenarios where a permanent solution cannot be developed without extensive analysis or physical changes to facilities, systems, or equipment. Several JCO extensions were to allow additional time to develop permanent solutions, instead of incorporating compensatory measures into the safety basis only to revise the documents again once the permanent solution was developed. Each extension was approved by the Safety Basis Approval Authority after NPO fully evaluated the JCO conditions and compensatory measures, and concluded operations could be continued safely with the JCO compensatory measures. Special Tooling Program The DNFSB expressed concerns that deficiencies exist within the Pantex Special Tooling Program. Examples of the identified deficiencies include: (a) Inconsistencies between Pantex tooling procedures and site practices; (b) additional Non-Destructive Evaluation techniques being used to inspect welds on tooling; (c) reliance on worker knowledge and skill-of-the-craft during tooling inspection, maintenance, and testing activities; (d) tool-specific performance criteria not being listed in the Pantex safety basis; and (e) weaknesses in analysis and testing for mechanical impact scenarios involving tooling. DOE/NNSA provides the following perspectives regarding these concerns: Subsequent to the DNFSB's September 2017 review, tooling- specific deviations from Pantex procedures were reviewed and confirmed that continued use of the subject tools meets applicable requirements. Additional corrective actions have been taken to prevent recurrence of the inconsistencies. Subsequent to the DNFSB's September 2017 review, CNS engaged an outside expert to review the Pantex welding program, who concluded that Pantex processes meet expectations. That is, welds are performed and inspected by qualified welders in accordance with applicable industry standards. Pantex tools are maintained and tested by trained and qualified journeymen mechanics in accordance with programmatic and tool-specific requirements. Conclusion DOE/NNSA appreciates the perspective provided by the DNFSB. DOE/ NNSA has thoroughly reviewed the DNFSB input provided in the Draft Recommendation 2018-1, Uncontrolled Hazard Scenarios and 10 CFR 830 Implementation at the Pantex Plant, and looks forward to continued positive interactions with the DNFSB on this and other matters. DOE/ NNSA is eager to discuss the Corrective Action Plan in place at Pantex with the Board so that the DNFSB can see the many actions underway to address areas known to need improvement. [[Page 10222]] In the interim, DOE/NNSA's efforts continue to focus on our shared goal of meeting the nation's weapons program needs in a manner that ensures adequate protection of public health and safety. Through the comments presented in response to Draft Recommendation 2018-1, DOE/NNSA takes this opportunity to provide key additional information and stress its understanding of the importance of the steps it takes to continuously improve the Pantex safety basis and its implementation. Authority: 42 U.S.C. 2286d(b)(2). Dated: March 12, 2019. Bruce Hamilton, Chairman. [FR Doc. 2019-04941 Filed 3-18-19; 8:45 am] BILLING CODE 3670-01-P