- Email: [email protected]
Investigation of criticality safety control infraction data at a nuclear facility
RESEARCH ARTICLE
Investigation of criticality safety control infraction data at a nuclear facility [3_TD$IF]Chemical and metallurgical operations involving plutonium and other nuclear materials account for most activities performed at the Los Alamos National Laboratory’s Plutonium Facility (PF-4). The presence of large quantities of fissile materials in numerous forms at PF-4 makes it necessary to maintain an active criticality safety program. The LANL Nuclear Criticality Safety (NCS) Program provides guidance to enable efficient operations while ensuring prevention of criticality accidents in the handling, storing, processing and transportation of fissionable material at PF-4. In order to achieve and sustain lower criticality safety control infraction (CSCI) rates, PF-4 operations are continuously improved, through the use of Lean Manufacturing and Six Sigma (LSS) business practices. Employing LSS, statistically significant variations (trends) can be identified in PF-4 CSCI reports. In this study, trends have been identified in the NCS Program using the NCS Database. An output metric has been developed that measures ADPSM Management progress toward [4_TD$IF]meeting its NCS objectives and goals. Using a Pareto Chart, the primary CSCI attributes have been determined in order of those requiring the most management support. Data generated from analysis of CSCI data help identify and reduce number of corresponding attributes. In-field monitoring of CSCI’s contribute to an organization’s scientific and technological excellence by providing information that can be used to improve criticality safety operation safety. This increases technical knowledge and augments operational safety.
By Michael E. Cournoyer, [2_TD$IF]James F. Merhege, David A. Costa, Blair M. Art, David C. Gubernatis
Michael E. Cournoyer is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA (Tel.: +505 665 7616; e-mail: [email protected]). James F. Merhege is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. David A. Costa is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. Blair M. Art is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. David C. Gubernatis is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA.
8
[5_TD$IF]INTRODUCTION
The critical mass of a fissile material is the amount needed to sustain a nuclear chain reaction.[6_TD$IF]1 Self-sustaining chain reactions that occur at a time and place of our choosing are known as: nuclear reactors, critical assemblies, and nuclear weapons.2F]I$DT_[7 Self-sustaining chain reactions that occur during the handling (transport, processing, storage) of fissionable materials are known as criticality accidents. When a criticality accident occurs, it does not result normally in a loud noise or violent explosion. In a criticality accident approximately 1016– F]I$D_T[8 1018 fissions are instantaneously. A typical accident begins with a sudden intense burst of ionizing radiation (neutrons and gamma rays). Ionizing radiation is the most dangerous characteristic of an accidental criticality. Following the initial burst, the radiation level slowly decays over the next several minutes. To emphasize the seriousness of criticality accidents, two examples are presented. The SL-1 reactor (originally known as the Argonne Low Power reactor) was a direct[-]FDI$_T9 cycle, boiling water reactor of
ß Division of Chemical Health and Safety of the American Chemical Society Elsevier Inc. All rights reserved.
3M F]I$DT0_[1 W gross thermal power using enriched uranium fuel plates clad in aluminum, moderated, and cooled by water. The SL-1 was shut down December 23, 1960 for routine maintenance; on January 4, 1961, it was again to be brought to power.3F]I$DT1_[ The three man crew on duty that night of was assigned the task of reassembling the control rod drives and preparing the reactor for startup. Apparently, they were engaged in this task when the excursion occurred. The best available evidence suggests that the central rod was manually pulled out as rapidly as the operator was able to do so. This rapid increase of reactivity placed the reactor on about a 4m F]I$DT2_[1 s period; the power continued to rise until thermal expansion and steam void formation quenched the excursion. The peak power was about 2 104]FDI$_T3[1 MW, and the total energy release was 133 M F]I$DT4_[1 J. The subsequent steam explosion destroyed the reactor and killed 2 men instantly; the third died 2 hours later as a result of a head injury. The reactor building and especially the reactor room were very seriously contaminated by the reactor
1871-5532 http://dx.doi.org/10.1016/j.jchas.2014.09.012
water, which carried fission products with it. In spite of the large radioactivity release from the core, very little escaped from the building, which was not designed to be airtight. Another criticality accident occurred in the Fuel Conversion Test Building at the JCO company site in Toki-mura, Ibarakin prefecture, Japan on September 30, 1999.[1_TD$IF]3 The operation required the preparation of about 16.8 kg of U-235 as 370 g/[15_TD$IF]L uranyl nitrate. Three operators had begun the task on 29 September 29, 1999. The next day, the three operators began dissolving the final three batches that would be required to complete the job. After transferring batches five and six, the pouring of the seventh batch was begun around 10:35. Almost at the end of the pour the gamma alarms sounded in this building and in the two nearby commercial fuel buildings. The two workers involved in the actual pouring operation were severely overexposed, with estimated doses of [16_TD$IF]16– 20 and 6–10 GyEq respectively. The third operator was a few meters away at a desk when the accident occurred and received an estimated [17_TD$IF]1–4.5 GyEq dose. All three operators were placed under special medical care. The operator standing on the floor holding the funnel at the time of the accident died 82 days later. The operator pouring the solution into the funnel died 210 days after the accident. The least exposed operator left the hospital almost three months after the accident. During the fabrication and processing of nuclear materials, there may be several steps involved.4]FDI$T8_[1 Examples include machining of metallic forms and dissolving radioactive materials in acids for chemical separation. During these steps, it is possible for the fissionable materials to accumulate in glove boxes, piping, or filters. Criticality accidents may occur if enough fissile material to produce a chain reaction event, either critical or supercritical, is accidentally accumulated in one place. At Los Alamos National Laboratory (LANL), there are several nuclear facilities.4]FDI$T8_[1 The Plutonium Science and Manufacturing Directorate (ADPSM) provides special nuclear material research, process development, technology demonstration, and manufacturing
capabilities. ADPSM manages the LANL Plutonium Facility (PF-4) at Technical Area 55. PF-4 is a Radiological Control Area, where chemical and metallurgical operations with plutonium and other hazardous materials are performed. The presence of large quantities of fissile materials in numerous forms at PF-4 makes it necessary to maintain an active criticality safety program. The LANL Nuclear Criticality Safety (NCS) Program provides guidance to enable efficient operations while ensuring prevention of criticality accidents in the handling, storing, processing and transportation of fissionable material at PF-4. Operations with fissionable material at PF-4 have a defensible, documented, and implemented criticality safety basis commensurate with facility criticality hazards. Criticality is dependent on several interrelated parameters that combine to affect neutrons in one of three ways: Increase absorption and therefore fission in fissionable material[19_TD$IF]. Increase absorption in other materials thereby decreasing fission[20_TD$IF]. Increase or decrease the likelihood that a neutron will find the system surface and escape before causing fission[21_TD$IF]. The NCS Program is designed to protect personnel, the public, and the environment from the consequences of a criticality accident, though the use of the following controls: formality of operations, written operating procedures, criticality safety evaluations, criticality safety controls (engineered features & administrative features), and training. Deviation from one of these controls that leads to an increased likelihood of a criticality accident results in a criticality safety control infraction (CSCI). Not every violation of a safety limit would produce a nuclear accident. Most only intrude upon a portion of the safety margin. In order to achieve and sustain lower CSCI rates, PF-4 operations are continuously improved, through the use of Lean Manufacturing and Six Sigma business practices (LSS).[2_TD$IF]5 This
Journal of Chemical Health & Safety, March/April 2015
approach to PF-4 glovebox, radiological, Air Purifying Respirator, and Health and Safety operations has been report previously in this journal.[23_TD$IF]5–9 Employing LSS, statistically significant variations (trends) can be identified in PF-4 CSCI reports. The LSS program is a customer-focused, systemic approach that is based on utilizing data to manage and improve process performance quality, cost, and schedule. The LSS approach is a composite of two powerful improvement methods–Lean (focused on waste reduction) and Six Sigma (focused on defect reduction) and is applicable to both manufacturing and transactional processes. The following report concentrates on the latter, i.e., using the Six Sigma methodology to design a NCS process. Using the LSS approach results in the NCS events, increased customer satisfaction, reduced costs and decreased cycle time. The goal of process management is to understand how the process operates and to collect metrics that allow the process parameters to be adjusted (managed) to ensure customer satisfaction. This is accomplished through the use of a Process Management System, which is used to analyze, optimize, and manage process performance based on meaningful data. This includes identifying process scope and ownership and measuring performance. The Process Management System typically includes process performance data charts (metrics). The data is focused on both customer (output) metrics and process (input) metrics. After each CSCI a review process is triggered. Information on the CSCI is obtained from personal statements and critique notes and documented as a report. The cause or causes of the CSCI (attribute) are determined and corrective actions to eliminate or to mitigate the impact of the CSCI and to prevent their recurrence are developed, using a graded approach based on the severity of the event. ADPSM management expectations are that all CSCI’s be reported as soon as possible and the number of all CSCI’s approaches zero. In this study, trends have been identified in the NCS Program using the NCS Database. An output metric has been developed that measures ADPSM 9
Management progress toward [4_TD$IF]meeting its NCS objectives and goals. Using a Pareto Chart, the primary CSCI attributes have been determined in order of those requiring the most management support.
[24_TD$IF]DEFINITIONS
Criticality Safety Controls[25_TD$IF]. Controls, administrative requirements or engineered features designed to constrain the parameters within acceptable limits. Criticality Safety Evaluation[26_TD$IF] (CSE). A set of administrative requirements and engineered features that constrain the relevant criticality safety parameters to provide the required safety margin. Criticality Safety Limit Approval[27_TD$IF] (CSLA). The CSLA is a complete listing of all the criticality safety requirements required to establish the required criticality safety margin. The CSLA contains a complete process description. Criticality Safety Posting[25_TD$IF]. Criticality safety posting (CSP) is a posting that is a conveniently available reminder of those criticality safety requirements for which the operator has implementation responsibilities. It should be noted that the limits incorporate safety margins. A CSP is posted on the glovebox showing how much fissile material for a particular form is allowed. The criticality limit is based on an analysis of the conditions at that workstation. Altering those conditions with the potential to affect criticality safety requires a reassessment. Criticality Safety Control Infraction[25_TD$IF]. The compromise of an administrative control and/or engineered feature that may affect the criticality safety margin. For example, if a mass limit is exceeded or a solution tank fails, an infraction has occurred. Fissile Material[25_TD$IF]. A subset of fissionable material capable of sustaining a nuclear fission chain reaction with low-energy thermal (slow) neutrons. Examples of fissile materials include Pu-239, U-233, and U-235. Fissionable Material[25_TD$IF]. A nuclide that is capable of undergoing fission after 10
capturing either high-energy (fast) neutrons or low-energy thermal (slow) neutrons. Examples of fissionable material that are not fissile include: U-238, Pu-238, Pu-240, and Cf-252. Fissionable Material Handler[28_TD$IF] (FMH). A person who is certified by contractor management to manipulate or handle significant quantities of fissionable materials, or manipulates the controls of equipment used to produce, process, transfer, store or package significant quantities of such material. [29_TD$IF]Formality of Operations[25_TD$IF]. A program that includes conduct of operations and training elements that are sufficiently robust and monitored to provide a foundation on which Criticality Safety Evaluations (CSEs) and controls may be performed and established. Safety Margin[25_TD$IF]. Process designs that incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible.
[30_TD$IF]METHODOLOGY
Criticality Safety Control Infraction Output Metric[25_TD$IF]. The NCS database, supported by the NCS Division, is the primary repository for CSCI information at LANL, including investigation report, and primary attributes. Starting from January 2007 until July 2014, all CSCI that have occurred at LANL have been compiled. An output metric for LANL CSCI data has been developed using three sets of data: Recordable outcomes are represented by light blue bars[31_TD$IF]. Sub-recordable outcomes are represented by light yellow bars[31_TD$IF]. Linear Trendlines[32_TD$IF]. The sub-recordable outcomes include those that were determined to be ‘‘Not an Infraction’’ (N/A). The linear trendline is a best-fit straight line. A linear trendline is created by using the following equation to calculate the least squares fit for a line: y = mx + b[3_TD$IF].
where m is the slope and [34_TD$IF]b is the intercept. The linear trendline shows whether something is increasing or decreasing since the time that data had been first collected. The linear trendline represents long-term trends and gives a good indication of past years performance in the output metric. An ideal output metric shows both recordable and sub-recordable CSCI data steadily decreasing in long-term. The number of subrecordable CSCI’s should be an order of magnitude higher than reportable ones.[35_TD$IF]10 Severity Index[25_TD$IF]. As discussed above, after each criticality safety control infraction, a review process is triggered. The infraction is assessed against the Severity Index Criteria of Table 1. For the purposes of accuracy, objectivity, and consistency, the actual ‘‘as found’’ conditions must be assessed in determining the severity index. Ordinarily, from a criticality safety perspective, only Level 2, Level 1, and Level 1, NonCompliance infractions are reportable ([h ]FI$DT6_3 ighlighted in light yellow). These CSCIs are entered as reportable events into the U.S. Department of Energy (DOE) Occurrence Reporting Processing System (ORPS).1F]I$DT7_[3 1 A timeline was plotted of the CSCI severity level over the January 2006 and July 2014 time period. Criticality Safety Control Infraction Attributes[25_TD$IF]. Attributes of CSCI include the following: Administrative Requirement, Engineered Requirement, Equipment Failure, and Human and System Errors. Attributes result in an increase in the mass of fissionable material in a location as the result of Administrative Requirement[25_TD$IF], e.g., less than adequate uses of operating procedures, CSLAs, or CSPs[38_TD$IF]. Limits on items such as mass, volume, the number of containers, number of parts, etc., in place for the purposes of providing the required criticality safety margin. Compliance with these requirements is usually dependent upon operator actions. Engineered Requirements[25_TD$IF], e.g., less than adequate uses of equipment or design features that are
Journal of Chemical Health & Safety, March/April 2015
Table 1. Criticality Safety Control Infraction Severity Index.
Infraction Description
Severity Index
Not an Infraction. No loss of control of any of the criticality safety parameters, however, implementation was not as intended by the process and applicable criticality safety basis. Partial loss of control of a single parameter with two or more parameters providing criticality safety margin. Total loss of control of a single parameter or partial loss of control of more than one parameter with two or more parameters providing criticality safety margin. Total or partial loss of control of one or more parameters with only one FULLY intact parameter providing criticality safety margin. Total or partial loss of control of one or more parameters with no parameters remaining to provide criticality safety margin such that a criticality accident is possible or has occurred. Operations are being conducted with fissionable materials above the thresholds values without criticality safety guidance.
[(Figure_1)TD$IG]
credited and required for the purpose of providing criticality safety margin. Examples of equipment and design features include 6-inch pencil solution tanks, 4-inch slab tanks, and fixed shelf spacing storage racks. Equipment Failure[25_TD$IF], e.g., water leaking from a heating, ventilation, and air conditioning unit. Human Error[39_TD$IF]12 Skill Based Errors, Inattention or over-attention to performance of work affected the event. B2 Rule Based Error – ]FI$DT0_4[ a misapplication of a good rule for behavior or application of a bad rule applied for behavior during the work process impacted the event. Knowledge Based Error
– ]FDI$T1_4[ the problem was solved without using stored rules for behavior. The involved personnel were in a problem solving/troubleshooting mode. System Error[25_TD$IF], e.g., changes in system mass, shape, volume, moderation, interaction, neutron absorption, reflection, and density. Using a Pareto Chart, the primary attributes were determined. [42_TD$IF]RESULTS
From Jan 1, 2007 to July 2014, there were 209 CSCIs reported. Of those reported, 16 of them were reportable and 193 of them were sub-reportable. See Figure 1.
N/A Level 5 Level 4 Level 3 Level 2 Level 1 Level 1 Non-Compliance
There were 186 CSCIs reported at PF-4. Of those reported at PF-4, 11 of them were reportable and 169 of them were sub-reportable. The number of reportable CSCIs peaked in 2010 with 6. The number of sub-reportable CSCIs peaked in 2013 with 61. The ratio of sub-reportable to reportable CSCIs was 12. The long-term trend for reportable CSCIs was flat. The long-term trend for sub-reportable CSCIs was significantly rising. The variations of CSCI Severity Levels between January 2007 and July 2014 are shown in Figure 2. J- on the [43_TD$IF]X-axis means January. Between July and August 2010, six Level 1 Non-Compliance CSCIs occurred. Between January 2007 and July
Figure 1. LANL Criticality Safety Control Infraction Metric.
Journal of Chemical Health & Safety, March/April 2015
11
[(Figure_2)TD$IG]
Figure 2. LANL Criticality Safety Control Infraction Severity Level Timeline.
2014, no Level 1 or 2 CSCIs were observed. The Level 1 Non-Compliance CSCI’s that occurred in July 2014 did not occur at PF-4. Between August 2011 and 2013, three Level 3 CSCIs occurred. With Level 4 criticality safety infractions, no significant trends were seen. Starting in August 2012, Level 5 CSCIs began to accelerate. Starting in March 2010, N/A CSCIs began to accelerate. Between February and June 2009, there was a significant increase in CSCIs due to form limits and lack of verification issues. Between February and March 2010, there was a significant increase in CSCIs due to mass limit issues. Between July 2010 and January 2011, there was a significant increase in CSCIs due to procedure violation issues. There was a significant increase
in CSCIs in August 2010 due to operations performed in pass-through dropbox without CSLA. In June 2011, there was a significant increase in CSCIs, due to pass[-]FDI$T4_ through limit in the trunk line was being used for punching samples out of hemishells. The number of CSCI attributes between January 2007 and July 2013 can be directly compared to the number of CSCI attributes documented between August 2013 and July 2014 by dividing the values of the former by 6.58 (years). See Figure 3. Fifty-nine CSCIs had no attributes recorded. Sixty CSCIs had more than one attribute listed. Since August 2013, the number of attributes per year has significantly increased for Administrative and Engineered Requirements, and Human Error.
[(Figure_3)TD$IG]
Figure 3. Criticality Safety Infractions Attribute Pareto Chart, July 2007–July 2014.
12
[45_TD$IF]DISCUSSION
As 76% of the reportable and 92% of sub-reportable CSCIs are caused at PF4, the observations and corrective actions presented below are limited to those of ADPSM management. The long-term trend for reportable CSCIs at LANL was neutral, as shown in Figure 1 ]FI$DT6_[4 . The long-term trend for subreportable CSCIs appeared to be unfavorable. However, starting in 2009, the ratio of sub-[47_TD$IF ]reportable to reportable CSCIs increased significantly. Thus, the long-term trend for subreportable CSCIs is favorable. This demonstrates that workers were reporting CSCIs before they became serious. This lends validity that ADPSM management expectations are being implemented. Between July and August 2010, there was an unfavorable increase in Level 1 Non-Compliance criticality safety infractions, as shown in Figure 2. ADPSM management addressed this negative trend by implementing Conduct of Operations Mentor Support and Annual Process Walkdowns. Mentoring is a method of training for persons entering the field of criticality safety. This allows the candidate to work closely with a qualified criticality safety analyst as they complete the training program. Annual Process Walkdowns are conducted to discuss material flow; demonstrate understanding of types and quantities of material in each room,
Journal of Chemical Health & Safety, March/April 2015
and how material flows from area to area; describe the normal operating conditions and credible abnormal conditions for each room: discuss typical chemical, physico-chemical, electrochemical and metallurgical processes used in fissile material operations and typical offnormal conditions of such processes that can potentially impact the safety basis of a NCS evaluation. The contribution that Process Walkdowns (previously called Management Walk-Arounds) bring to operational safety has been reported in this journal.13 Between August 2011 and 2013, there was an unfavorable cluster in Level 3 CSCIs. ADPSM management addressed this negative trend by implementing Fissile Material Handling training and Conduct of Operations training. The increase in Level 5 and N/A CSCIs also demonstrate that workers were reporting CSCIs before they became serious. This also lends further validity that ADPSM management expectations are being implemented. With the use of the Pareto Chart, CSCI attributes were prioritized in relation to the number of infractions between January 2007 and July 2013, as shown in Figure 3. ADPSM management should concentrate on reducing Administrative and Engineered Requirements, and Human Error attributes. Nuclear criticality safety can be defined as practices associated with avoiding an accidental nuclear criticality event, i.e., an uncontrolled spontaneous nuclear fission chain reaction.[49_TD$IF]14 A variety of interacting parameters affect criticality safety, including mass, volume, shape and geometry, moderation, density, reflection, concentration, poisons, enrichment, and interaction. Ensuring criticality safety involves all of these parameters at the same time, which can be extremely complicated. PF-4 defense-in-depth is the facility’s built-in capacity to detect or prevent errors without suffering undesirable consequences, i.e., PF-4 ‘‘safety
envelope.’’[50_TD$IF]15 Redundant defenses improve safety margins, but also increase complexity. Flawed defenses and criticality safety hazards become more difficult to detect. Redundant defenses make program improvements more difficult to detect as well. Without quality trending, defenses can degrade or be eliminated over time. Positive trends that reflect ADPSM management commitment to nuclear criticality safety may be overlooked. Collecting CSCI data gives management information they need to concentrate on vulnerabilities that require management support. As CSCI data deviate from the optimum, PF-4 criticality safety operations can be improved to bring them back into control. Weaknesses in the NCS Program are corrected by informing workers what to look for and by establishing processes that methodically search for, document, and eliminate the causes of flawed defenses and error precursors. Continuous improvement through feedback is a primary means of identifying these weaknesses in work practices and NCS processes. This in turn improves the efficiency, cost-effectiveness, and formality of the NCS Program, which contributes to the LANL Continuous Improvement Program.
[51_TD$IF]CONCLUSIONS
The LANL NCS database documents and records CSCIs accurately and objectively. Data generated from analysis of CSCI data help identify and reduce number of corresponding CSCI attributes. A significant drop in Level 1 Non-Compliance CSCIs is due to ADPSM management implementation of Conduct of Operations Mentor Support and Annual Process Walkdowns. Resources should be concentrated on minimizing Administrative and Engineered Requirements and Human Error attributes. In-field monitoring of CSCI’s contribute to an organization’s
Journal of Chemical Health & Safety, March/April 2015
scientific and technological excellence by providing information that can be used to improve criticality safety operation safety. This increases technical knowledge and augments operational safety. ACKNOWLEDGEMENTS The authors would like to acknowledge the U.S. Department of Energy and LANL’s Plutonium Science & Manufacturing and Nuclear and High Hazard Operations directorates for support of this work.
REFERENCES 1. Monahan, S. Criticality safety and MOX. Actin. Res. Q., 1st/2nd Quart. 2007. 2. Mitchell, M.V.; et al. LA-UR-14-24428. June 2014. 3. McLaughlin, T.P.; et al. A review of criticality accidents. May 2000, LA13638. 4. http://t2.lanl.gov/nis/tour/sch007.html, link verified on October 18, 2014. 5. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 13–21. 6. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 22–30. 7. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 31–40. 8. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2012, 20(2), 20–24. 9. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2013, 20(2), 34–39. 10. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(5), 43–55. 11. http://energy.gov/ehss/policy-guidancereports/databases/occurrence-reporting-and-processing-system, link verified on October 18, 2014. 12. DOE-1197, DOE STANDARD. Occurrence Reporting Causal Analysis; U.S. Department of Energy: Washington, DC, September 2011. 13. Cournoyer, M. E.; Maestas, M. M. J. Chem. Health Saf. 2004, 11(6), 12–16. 14. Rothe, R.E. Los Alamos National Laboratory: Los Alamos, New Mexico, April 2005, LA-UR-05-3247. 15. Human Performance Fundamentals Course Reference. Institute of Nuclear Power Operations, 2002.
13
Investigation of criticality safety control infraction data at a nuclear facility [3_TD$IF]Chemical and metallurgical operations involving plutonium and other nuclear materials account for most activities performed at the Los Alamos National Laboratory’s Plutonium Facility (PF-4). The presence of large quantities of fissile materials in numerous forms at PF-4 makes it necessary to maintain an active criticality safety program. The LANL Nuclear Criticality Safety (NCS) Program provides guidance to enable efficient operations while ensuring prevention of criticality accidents in the handling, storing, processing and transportation of fissionable material at PF-4. In order to achieve and sustain lower criticality safety control infraction (CSCI) rates, PF-4 operations are continuously improved, through the use of Lean Manufacturing and Six Sigma (LSS) business practices. Employing LSS, statistically significant variations (trends) can be identified in PF-4 CSCI reports. In this study, trends have been identified in the NCS Program using the NCS Database. An output metric has been developed that measures ADPSM Management progress toward [4_TD$IF]meeting its NCS objectives and goals. Using a Pareto Chart, the primary CSCI attributes have been determined in order of those requiring the most management support. Data generated from analysis of CSCI data help identify and reduce number of corresponding attributes. In-field monitoring of CSCI’s contribute to an organization’s scientific and technological excellence by providing information that can be used to improve criticality safety operation safety. This increases technical knowledge and augments operational safety.
By Michael E. Cournoyer, [2_TD$IF]James F. Merhege, David A. Costa, Blair M. Art, David C. Gubernatis
Michael E. Cournoyer is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA (Tel.: +505 665 7616; e-mail: [email protected]). James F. Merhege is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. David A. Costa is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. Blair M. Art is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA. David C. Gubernatis is affiliated with Los Alamos National Laboratory, Los Alamos, NM 87545, USA.
8
[5_TD$IF]INTRODUCTION
The critical mass of a fissile material is the amount needed to sustain a nuclear chain reaction.[6_TD$IF]1 Self-sustaining chain reactions that occur at a time and place of our choosing are known as: nuclear reactors, critical assemblies, and nuclear weapons.2F]I$DT_[7 Self-sustaining chain reactions that occur during the handling (transport, processing, storage) of fissionable materials are known as criticality accidents. When a criticality accident occurs, it does not result normally in a loud noise or violent explosion. In a criticality accident approximately 1016– F]I$D_T[8 1018 fissions are instantaneously. A typical accident begins with a sudden intense burst of ionizing radiation (neutrons and gamma rays). Ionizing radiation is the most dangerous characteristic of an accidental criticality. Following the initial burst, the radiation level slowly decays over the next several minutes. To emphasize the seriousness of criticality accidents, two examples are presented. The SL-1 reactor (originally known as the Argonne Low Power reactor) was a direct[-]FDI$_T9 cycle, boiling water reactor of
ß Division of Chemical Health and Safety of the American Chemical Society Elsevier Inc. All rights reserved.
3M F]I$DT0_[1 W gross thermal power using enriched uranium fuel plates clad in aluminum, moderated, and cooled by water. The SL-1 was shut down December 23, 1960 for routine maintenance; on January 4, 1961, it was again to be brought to power.3F]I$DT1_[ The three man crew on duty that night of was assigned the task of reassembling the control rod drives and preparing the reactor for startup. Apparently, they were engaged in this task when the excursion occurred. The best available evidence suggests that the central rod was manually pulled out as rapidly as the operator was able to do so. This rapid increase of reactivity placed the reactor on about a 4m F]I$DT2_[1 s period; the power continued to rise until thermal expansion and steam void formation quenched the excursion. The peak power was about 2 104]FDI$_T3[1 MW, and the total energy release was 133 M F]I$DT4_[1 J. The subsequent steam explosion destroyed the reactor and killed 2 men instantly; the third died 2 hours later as a result of a head injury. The reactor building and especially the reactor room were very seriously contaminated by the reactor
1871-5532 http://dx.doi.org/10.1016/j.jchas.2014.09.012
water, which carried fission products with it. In spite of the large radioactivity release from the core, very little escaped from the building, which was not designed to be airtight. Another criticality accident occurred in the Fuel Conversion Test Building at the JCO company site in Toki-mura, Ibarakin prefecture, Japan on September 30, 1999.[1_TD$IF]3 The operation required the preparation of about 16.8 kg of U-235 as 370 g/[15_TD$IF]L uranyl nitrate. Three operators had begun the task on 29 September 29, 1999. The next day, the three operators began dissolving the final three batches that would be required to complete the job. After transferring batches five and six, the pouring of the seventh batch was begun around 10:35. Almost at the end of the pour the gamma alarms sounded in this building and in the two nearby commercial fuel buildings. The two workers involved in the actual pouring operation were severely overexposed, with estimated doses of [16_TD$IF]16– 20 and 6–10 GyEq respectively. The third operator was a few meters away at a desk when the accident occurred and received an estimated [17_TD$IF]1–4.5 GyEq dose. All three operators were placed under special medical care. The operator standing on the floor holding the funnel at the time of the accident died 82 days later. The operator pouring the solution into the funnel died 210 days after the accident. The least exposed operator left the hospital almost three months after the accident. During the fabrication and processing of nuclear materials, there may be several steps involved.4]FDI$T8_[1 Examples include machining of metallic forms and dissolving radioactive materials in acids for chemical separation. During these steps, it is possible for the fissionable materials to accumulate in glove boxes, piping, or filters. Criticality accidents may occur if enough fissile material to produce a chain reaction event, either critical or supercritical, is accidentally accumulated in one place. At Los Alamos National Laboratory (LANL), there are several nuclear facilities.4]FDI$T8_[1 The Plutonium Science and Manufacturing Directorate (ADPSM) provides special nuclear material research, process development, technology demonstration, and manufacturing
capabilities. ADPSM manages the LANL Plutonium Facility (PF-4) at Technical Area 55. PF-4 is a Radiological Control Area, where chemical and metallurgical operations with plutonium and other hazardous materials are performed. The presence of large quantities of fissile materials in numerous forms at PF-4 makes it necessary to maintain an active criticality safety program. The LANL Nuclear Criticality Safety (NCS) Program provides guidance to enable efficient operations while ensuring prevention of criticality accidents in the handling, storing, processing and transportation of fissionable material at PF-4. Operations with fissionable material at PF-4 have a defensible, documented, and implemented criticality safety basis commensurate with facility criticality hazards. Criticality is dependent on several interrelated parameters that combine to affect neutrons in one of three ways: Increase absorption and therefore fission in fissionable material[19_TD$IF]. Increase absorption in other materials thereby decreasing fission[20_TD$IF]. Increase or decrease the likelihood that a neutron will find the system surface and escape before causing fission[21_TD$IF]. The NCS Program is designed to protect personnel, the public, and the environment from the consequences of a criticality accident, though the use of the following controls: formality of operations, written operating procedures, criticality safety evaluations, criticality safety controls (engineered features & administrative features), and training. Deviation from one of these controls that leads to an increased likelihood of a criticality accident results in a criticality safety control infraction (CSCI). Not every violation of a safety limit would produce a nuclear accident. Most only intrude upon a portion of the safety margin. In order to achieve and sustain lower CSCI rates, PF-4 operations are continuously improved, through the use of Lean Manufacturing and Six Sigma business practices (LSS).[2_TD$IF]5 This
Journal of Chemical Health & Safety, March/April 2015
approach to PF-4 glovebox, radiological, Air Purifying Respirator, and Health and Safety operations has been report previously in this journal.[23_TD$IF]5–9 Employing LSS, statistically significant variations (trends) can be identified in PF-4 CSCI reports. The LSS program is a customer-focused, systemic approach that is based on utilizing data to manage and improve process performance quality, cost, and schedule. The LSS approach is a composite of two powerful improvement methods–Lean (focused on waste reduction) and Six Sigma (focused on defect reduction) and is applicable to both manufacturing and transactional processes. The following report concentrates on the latter, i.e., using the Six Sigma methodology to design a NCS process. Using the LSS approach results in the NCS events, increased customer satisfaction, reduced costs and decreased cycle time. The goal of process management is to understand how the process operates and to collect metrics that allow the process parameters to be adjusted (managed) to ensure customer satisfaction. This is accomplished through the use of a Process Management System, which is used to analyze, optimize, and manage process performance based on meaningful data. This includes identifying process scope and ownership and measuring performance. The Process Management System typically includes process performance data charts (metrics). The data is focused on both customer (output) metrics and process (input) metrics. After each CSCI a review process is triggered. Information on the CSCI is obtained from personal statements and critique notes and documented as a report. The cause or causes of the CSCI (attribute) are determined and corrective actions to eliminate or to mitigate the impact of the CSCI and to prevent their recurrence are developed, using a graded approach based on the severity of the event. ADPSM management expectations are that all CSCI’s be reported as soon as possible and the number of all CSCI’s approaches zero. In this study, trends have been identified in the NCS Program using the NCS Database. An output metric has been developed that measures ADPSM 9
Management progress toward [4_TD$IF]meeting its NCS objectives and goals. Using a Pareto Chart, the primary CSCI attributes have been determined in order of those requiring the most management support.
[24_TD$IF]DEFINITIONS
Criticality Safety Controls[25_TD$IF]. Controls, administrative requirements or engineered features designed to constrain the parameters within acceptable limits. Criticality Safety Evaluation[26_TD$IF] (CSE). A set of administrative requirements and engineered features that constrain the relevant criticality safety parameters to provide the required safety margin. Criticality Safety Limit Approval[27_TD$IF] (CSLA). The CSLA is a complete listing of all the criticality safety requirements required to establish the required criticality safety margin. The CSLA contains a complete process description. Criticality Safety Posting[25_TD$IF]. Criticality safety posting (CSP) is a posting that is a conveniently available reminder of those criticality safety requirements for which the operator has implementation responsibilities. It should be noted that the limits incorporate safety margins. A CSP is posted on the glovebox showing how much fissile material for a particular form is allowed. The criticality limit is based on an analysis of the conditions at that workstation. Altering those conditions with the potential to affect criticality safety requires a reassessment. Criticality Safety Control Infraction[25_TD$IF]. The compromise of an administrative control and/or engineered feature that may affect the criticality safety margin. For example, if a mass limit is exceeded or a solution tank fails, an infraction has occurred. Fissile Material[25_TD$IF]. A subset of fissionable material capable of sustaining a nuclear fission chain reaction with low-energy thermal (slow) neutrons. Examples of fissile materials include Pu-239, U-233, and U-235. Fissionable Material[25_TD$IF]. A nuclide that is capable of undergoing fission after 10
capturing either high-energy (fast) neutrons or low-energy thermal (slow) neutrons. Examples of fissionable material that are not fissile include: U-238, Pu-238, Pu-240, and Cf-252. Fissionable Material Handler[28_TD$IF] (FMH). A person who is certified by contractor management to manipulate or handle significant quantities of fissionable materials, or manipulates the controls of equipment used to produce, process, transfer, store or package significant quantities of such material. [29_TD$IF]Formality of Operations[25_TD$IF]. A program that includes conduct of operations and training elements that are sufficiently robust and monitored to provide a foundation on which Criticality Safety Evaluations (CSEs) and controls may be performed and established. Safety Margin[25_TD$IF]. Process designs that incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible.
[30_TD$IF]METHODOLOGY
Criticality Safety Control Infraction Output Metric[25_TD$IF]. The NCS database, supported by the NCS Division, is the primary repository for CSCI information at LANL, including investigation report, and primary attributes. Starting from January 2007 until July 2014, all CSCI that have occurred at LANL have been compiled. An output metric for LANL CSCI data has been developed using three sets of data: Recordable outcomes are represented by light blue bars[31_TD$IF]. Sub-recordable outcomes are represented by light yellow bars[31_TD$IF]. Linear Trendlines[32_TD$IF]. The sub-recordable outcomes include those that were determined to be ‘‘Not an Infraction’’ (N/A). The linear trendline is a best-fit straight line. A linear trendline is created by using the following equation to calculate the least squares fit for a line: y = mx + b[3_TD$IF].
where m is the slope and [34_TD$IF]b is the intercept. The linear trendline shows whether something is increasing or decreasing since the time that data had been first collected. The linear trendline represents long-term trends and gives a good indication of past years performance in the output metric. An ideal output metric shows both recordable and sub-recordable CSCI data steadily decreasing in long-term. The number of subrecordable CSCI’s should be an order of magnitude higher than reportable ones.[35_TD$IF]10 Severity Index[25_TD$IF]. As discussed above, after each criticality safety control infraction, a review process is triggered. The infraction is assessed against the Severity Index Criteria of Table 1. For the purposes of accuracy, objectivity, and consistency, the actual ‘‘as found’’ conditions must be assessed in determining the severity index. Ordinarily, from a criticality safety perspective, only Level 2, Level 1, and Level 1, NonCompliance infractions are reportable ([h ]FI$DT6_3 ighlighted in light yellow). These CSCIs are entered as reportable events into the U.S. Department of Energy (DOE) Occurrence Reporting Processing System (ORPS).1F]I$DT7_[3 1 A timeline was plotted of the CSCI severity level over the January 2006 and July 2014 time period. Criticality Safety Control Infraction Attributes[25_TD$IF]. Attributes of CSCI include the following: Administrative Requirement, Engineered Requirement, Equipment Failure, and Human and System Errors. Attributes result in an increase in the mass of fissionable material in a location as the result of Administrative Requirement[25_TD$IF], e.g., less than adequate uses of operating procedures, CSLAs, or CSPs[38_TD$IF]. Limits on items such as mass, volume, the number of containers, number of parts, etc., in place for the purposes of providing the required criticality safety margin. Compliance with these requirements is usually dependent upon operator actions. Engineered Requirements[25_TD$IF], e.g., less than adequate uses of equipment or design features that are
Journal of Chemical Health & Safety, March/April 2015
Table 1. Criticality Safety Control Infraction Severity Index.
Infraction Description
Severity Index
Not an Infraction. No loss of control of any of the criticality safety parameters, however, implementation was not as intended by the process and applicable criticality safety basis. Partial loss of control of a single parameter with two or more parameters providing criticality safety margin. Total loss of control of a single parameter or partial loss of control of more than one parameter with two or more parameters providing criticality safety margin. Total or partial loss of control of one or more parameters with only one FULLY intact parameter providing criticality safety margin. Total or partial loss of control of one or more parameters with no parameters remaining to provide criticality safety margin such that a criticality accident is possible or has occurred. Operations are being conducted with fissionable materials above the thresholds values without criticality safety guidance.
[(Figure_1)TD$IG]
credited and required for the purpose of providing criticality safety margin. Examples of equipment and design features include 6-inch pencil solution tanks, 4-inch slab tanks, and fixed shelf spacing storage racks. Equipment Failure[25_TD$IF], e.g., water leaking from a heating, ventilation, and air conditioning unit. Human Error[39_TD$IF]12 Skill Based Errors, Inattention or over-attention to performance of work affected the event. B2 Rule Based Error – ]FI$DT0_4[ a misapplication of a good rule for behavior or application of a bad rule applied for behavior during the work process impacted the event. Knowledge Based Error
– ]FDI$T1_4[ the problem was solved without using stored rules for behavior. The involved personnel were in a problem solving/troubleshooting mode. System Error[25_TD$IF], e.g., changes in system mass, shape, volume, moderation, interaction, neutron absorption, reflection, and density. Using a Pareto Chart, the primary attributes were determined. [42_TD$IF]RESULTS
From Jan 1, 2007 to July 2014, there were 209 CSCIs reported. Of those reported, 16 of them were reportable and 193 of them were sub-reportable. See Figure 1.
N/A Level 5 Level 4 Level 3 Level 2 Level 1 Level 1 Non-Compliance
There were 186 CSCIs reported at PF-4. Of those reported at PF-4, 11 of them were reportable and 169 of them were sub-reportable. The number of reportable CSCIs peaked in 2010 with 6. The number of sub-reportable CSCIs peaked in 2013 with 61. The ratio of sub-reportable to reportable CSCIs was 12. The long-term trend for reportable CSCIs was flat. The long-term trend for sub-reportable CSCIs was significantly rising. The variations of CSCI Severity Levels between January 2007 and July 2014 are shown in Figure 2. J- on the [43_TD$IF]X-axis means January. Between July and August 2010, six Level 1 Non-Compliance CSCIs occurred. Between January 2007 and July
Figure 1. LANL Criticality Safety Control Infraction Metric.
Journal of Chemical Health & Safety, March/April 2015
11
[(Figure_2)TD$IG]
Figure 2. LANL Criticality Safety Control Infraction Severity Level Timeline.
2014, no Level 1 or 2 CSCIs were observed. The Level 1 Non-Compliance CSCI’s that occurred in July 2014 did not occur at PF-4. Between August 2011 and 2013, three Level 3 CSCIs occurred. With Level 4 criticality safety infractions, no significant trends were seen. Starting in August 2012, Level 5 CSCIs began to accelerate. Starting in March 2010, N/A CSCIs began to accelerate. Between February and June 2009, there was a significant increase in CSCIs due to form limits and lack of verification issues. Between February and March 2010, there was a significant increase in CSCIs due to mass limit issues. Between July 2010 and January 2011, there was a significant increase in CSCIs due to procedure violation issues. There was a significant increase
in CSCIs in August 2010 due to operations performed in pass-through dropbox without CSLA. In June 2011, there was a significant increase in CSCIs, due to pass[-]FDI$T4_ through limit in the trunk line was being used for punching samples out of hemishells. The number of CSCI attributes between January 2007 and July 2013 can be directly compared to the number of CSCI attributes documented between August 2013 and July 2014 by dividing the values of the former by 6.58 (years). See Figure 3. Fifty-nine CSCIs had no attributes recorded. Sixty CSCIs had more than one attribute listed. Since August 2013, the number of attributes per year has significantly increased for Administrative and Engineered Requirements, and Human Error.
[(Figure_3)TD$IG]
Figure 3. Criticality Safety Infractions Attribute Pareto Chart, July 2007–July 2014.
12
[45_TD$IF]DISCUSSION
As 76% of the reportable and 92% of sub-reportable CSCIs are caused at PF4, the observations and corrective actions presented below are limited to those of ADPSM management. The long-term trend for reportable CSCIs at LANL was neutral, as shown in Figure 1 ]FI$DT6_[4 . The long-term trend for subreportable CSCIs appeared to be unfavorable. However, starting in 2009, the ratio of sub-[47_TD$IF ]reportable to reportable CSCIs increased significantly. Thus, the long-term trend for subreportable CSCIs is favorable. This demonstrates that workers were reporting CSCIs before they became serious. This lends validity that ADPSM management expectations are being implemented. Between July and August 2010, there was an unfavorable increase in Level 1 Non-Compliance criticality safety infractions, as shown in Figure 2. ADPSM management addressed this negative trend by implementing Conduct of Operations Mentor Support and Annual Process Walkdowns. Mentoring is a method of training for persons entering the field of criticality safety. This allows the candidate to work closely with a qualified criticality safety analyst as they complete the training program. Annual Process Walkdowns are conducted to discuss material flow; demonstrate understanding of types and quantities of material in each room,
Journal of Chemical Health & Safety, March/April 2015
and how material flows from area to area; describe the normal operating conditions and credible abnormal conditions for each room: discuss typical chemical, physico-chemical, electrochemical and metallurgical processes used in fissile material operations and typical offnormal conditions of such processes that can potentially impact the safety basis of a NCS evaluation. The contribution that Process Walkdowns (previously called Management Walk-Arounds) bring to operational safety has been reported in this journal.13 Between August 2011 and 2013, there was an unfavorable cluster in Level 3 CSCIs. ADPSM management addressed this negative trend by implementing Fissile Material Handling training and Conduct of Operations training. The increase in Level 5 and N/A CSCIs also demonstrate that workers were reporting CSCIs before they became serious. This also lends further validity that ADPSM management expectations are being implemented. With the use of the Pareto Chart, CSCI attributes were prioritized in relation to the number of infractions between January 2007 and July 2013, as shown in Figure 3. ADPSM management should concentrate on reducing Administrative and Engineered Requirements, and Human Error attributes. Nuclear criticality safety can be defined as practices associated with avoiding an accidental nuclear criticality event, i.e., an uncontrolled spontaneous nuclear fission chain reaction.[49_TD$IF]14 A variety of interacting parameters affect criticality safety, including mass, volume, shape and geometry, moderation, density, reflection, concentration, poisons, enrichment, and interaction. Ensuring criticality safety involves all of these parameters at the same time, which can be extremely complicated. PF-4 defense-in-depth is the facility’s built-in capacity to detect or prevent errors without suffering undesirable consequences, i.e., PF-4 ‘‘safety
envelope.’’[50_TD$IF]15 Redundant defenses improve safety margins, but also increase complexity. Flawed defenses and criticality safety hazards become more difficult to detect. Redundant defenses make program improvements more difficult to detect as well. Without quality trending, defenses can degrade or be eliminated over time. Positive trends that reflect ADPSM management commitment to nuclear criticality safety may be overlooked. Collecting CSCI data gives management information they need to concentrate on vulnerabilities that require management support. As CSCI data deviate from the optimum, PF-4 criticality safety operations can be improved to bring them back into control. Weaknesses in the NCS Program are corrected by informing workers what to look for and by establishing processes that methodically search for, document, and eliminate the causes of flawed defenses and error precursors. Continuous improvement through feedback is a primary means of identifying these weaknesses in work practices and NCS processes. This in turn improves the efficiency, cost-effectiveness, and formality of the NCS Program, which contributes to the LANL Continuous Improvement Program.
[51_TD$IF]CONCLUSIONS
The LANL NCS database documents and records CSCIs accurately and objectively. Data generated from analysis of CSCI data help identify and reduce number of corresponding CSCI attributes. A significant drop in Level 1 Non-Compliance CSCIs is due to ADPSM management implementation of Conduct of Operations Mentor Support and Annual Process Walkdowns. Resources should be concentrated on minimizing Administrative and Engineered Requirements and Human Error attributes. In-field monitoring of CSCI’s contribute to an organization’s
Journal of Chemical Health & Safety, March/April 2015
scientific and technological excellence by providing information that can be used to improve criticality safety operation safety. This increases technical knowledge and augments operational safety. ACKNOWLEDGEMENTS The authors would like to acknowledge the U.S. Department of Energy and LANL’s Plutonium Science & Manufacturing and Nuclear and High Hazard Operations directorates for support of this work.
REFERENCES 1. Monahan, S. Criticality safety and MOX. Actin. Res. Q., 1st/2nd Quart. 2007. 2. Mitchell, M.V.; et al. LA-UR-14-24428. June 2014. 3. McLaughlin, T.P.; et al. A review of criticality accidents. May 2000, LA13638. 4. http://t2.lanl.gov/nis/tour/sch007.html, link verified on October 18, 2014. 5. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 13–21. 6. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 22–30. 7. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(1), 31–40. 8. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2012, 20(2), 20–24. 9. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2013, 20(2), 34–39. 10. Cournoyer, M. E.; et al. J. Chem. Health Saf. 2011, 18(5), 43–55. 11. http://energy.gov/ehss/policy-guidancereports/databases/occurrence-reporting-and-processing-system, link verified on October 18, 2014. 12. DOE-1197, DOE STANDARD. Occurrence Reporting Causal Analysis; U.S. Department of Energy: Washington, DC, September 2011. 13. Cournoyer, M. E.; Maestas, M. M. J. Chem. Health Saf. 2004, 11(6), 12–16. 14. Rothe, R.E. Los Alamos National Laboratory: Los Alamos, New Mexico, April 2005, LA-UR-05-3247. 15. Human Performance Fundamentals Course Reference. Institute of Nuclear Power Operations, 2002.
13