ML20138D455

Rev 2 to Justification for Excluding UF6 Cylinder Storage Yards from Criticality Accident Alarm Sys Coverage

ML20138D455
Person / Time
Site:	Paducah Gaseous Diffusion Plant
Issue date:	03/31/1997
From:	Jeremy Dean, Hurrell S, Risnei V External (Affiliation Not Assigned)
To:
Shared Package
ML20138D407	List: ML20138D402 ML20138D455 ML20138D480 ML20138D487
References
KY-S-271, KY-S-271-R02, KY-S-271-R2, NUDOCS 9705010128
Download: ML20138D455 (67)

Text

-.

e

'- 4 N

Attachment I to GDP 97-0051 KY/S-271 Revision 2 Justification for Excluding UF Cylinder Storage Yards 6

from Criticality Accident.Alami Coverage i

March 1997 i

9705010128 970407 PDR ADOCK 07007001 l

g PDR_

1

KY/S-271 Revision 2 JUSTIFICATION FOR EXCLUDING UFs CYLINDER STORAGE YARDS FROM CRITICALITY ACCIDENT ALARM COVERAGE March 1997 Report Prepared by Safety Solutions I

i

- - - - - ~ ~ " ^ ^ ^

~

l

~

KY/S-271 Revision 2 l:

i l

Paducah Gaseous Diffusion Plant JUSTIFICATION FOR EXCLUDING UF, CYLINDER STORAGE YARDS FROM CRITICALITY ACCIDENT ALARM SYSTEM COVERAGE March 1997 Report Prepared by Safety Solutions 11645 South Monticello Drive Knoxville, Tennessee 37922 under Purchase Order 422088 LOCKHEED MARTIN UTILITY SERVICES, INC.

managing the Paducah Gaseous Diffusion Plant 7

for the United States Enrichment Corporation under contract USECHQ-93-C-0001 I

i J

_m

..m._. _. ~. _. _.. _ _ _ _ _ _. -

.m.__

~

6 L

e I

p l

l i

l i

I

[

l

'1 l

1

[

l

. DISCLAIMER This report was prepared as an account of work sponsored by an agency of the United States Govemment. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or useMness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privasely owned rights.

Reference herein to any specific commercial product, process, or service by trade name, I'

trademark, manufacture, or otherwise, does not necessarily constitute or imply its endorsement,

!=' -s or favoring by the United States Govemment or any agency thereof. The views recorr-and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.

1

)

l.

e*

6 e

e.

t l

^

l l

Approvals i

t Paducah Gaseous Diffusion Plant I

@M 3ki/97 j

NdS Analyst (Datd i

l GnC 3-ai-97 w,o NdS Reviewer Date i

s 3k< h>

c~ -

CS danager bate' i

l l

m i

j i

I J

T a

?

l CO TENTS List o f Tables............................................................... iv

'~)

L ist o f Figu res.............................................................. v i

i Acronfms..............................................................

vi

1. INTRO D UCTI O N...................................................... 1 -2 l

2.

D ESC RI PTI O N....................................................... 2 -7 l

l

3. M ETHODO LOG Y.....................................................

8-19 i

l 3.1 CYLINDER BREACH INITIATING EVENT (CYLBREACH)............. 8-16 l

3.2 DETECTION AND MITIGATION EVENT TREE EVENT (DETMIT)...... 16-19 j

4.

RES U LTS.......................................................... 19-3 0 1

l 4.1 IMMEDIATE MECHANICAL BREACH--HANDLING ERRORS......... 19-21 1

4.2 IMMEDIATE MECHANICAL BREACH.-EXTERNAL IMPACT DURING STORA G E...................................................... 21 -2 5 4

4.3 DELAYED BREACH (MECHANICAL FAILURE / CORROSION OF

' ]

UNDAMAGED CYLINDER)...................................... 25-28 l

4.4 DELAYED BREACH (CORROSION OF DAMAGED CYLINDER)....... 28-29 I

4.5 THERMAL D AMAG E........................................... 29-3 0 i

5. ANALYSIS ASSUMPTIONS............................................ 3 0-31 i

l

6.

SUMMARY

AND RECOMMENDATIONS................................... 31 j

7. RE FERENC ES....................................................... 31 -3 3 l

l I APPENDIX A CRITICALITY SCENARIO TABLES........................

A-t-A-23 4

e i

1 i

l i

l

[

i I

b i

til e

^

t TABLES 3-1.

Postulated criticality accident scenarios for PGDP cylinder yards............. 10-13 3-2.

Summary of criticality scenarios for a spec.ific cylinder yard................. 17-18 A-1.

Postulated criticality accident scenarios for PGDP cylinders yards.......... A-t-A-9 A-2 Summary of criticality scenarios for C-745-B........................ A-10-A-15 A-3 ' Summary of criticality scenarios for C-745-D.........

..... A-16-A-23 9

iv j

l I

FIGURES 2-1 Wide ang!c view of C-745-B NCS controlled storage........................... 3 2-2 NCS controlled storage areas, Rows P and Q in C-745-D......................... 5 3-1 Cylinder yard criticality event tree.

.9 l

l t

i l

1 l

4*

i V

I

ACRONYMS ALARA As Low As Reasonably Achievable CAAS Criticality Accident Alarm System

)

. DOE Department of Energy l

HAUP Higher Assay Upgrading Project l

HAZMAT Hazardous Material l

MD Manhattan District NCS Nuclear Criticality Safety NRC Nuclear Regulatory Commission l

PC3 Performance Category 3 l

PGDP Paducah Gaseous Diffusion Plant i

PORTS Portsmouth Gaseous Diffusion Plant USEC United State Enrichn ent Corporation a

f i

I r

aba t

I Vi

?l

t I

CIII GE LOG l

l Rev.

Affected Pages Reason for Revision Employee initials I

4,19, A-10, A-Change two operators to one operator SJH l

11, A-16, A-17 2

4, 6, 14, 19-25, Changed text to reflect the drop test results SJH 32,33 and discuss cylinder handling activities l

1 G

e i

(

vii i

l

I

1. INTROr UCrlON The Paducah Gaseous Diffusion Plant (PGDP) has committed to compliance with ANSI /ANS-8.3' and Department of Energy (DOE) Order 5480.242 for operations involving fissionable materials belonging to DOE and with 10 CFR Part 76.89' for operations involving fissionable materials belonging to the United States Enrichment Corporation (USEC). American National Standardfor Criticality Accident Alarm System, (CAAS) ANSI /ANS-8.3, Sect. 4.2.1, requires criticality monitoring and alarm systems for all activities for which the inventory of fissionable materials involved exceeds 700 grams of 2"U.

In cases where the mass of fissionable material exceeds the limits established in ANSI /ANS-8.3, DOE Order 5480.24, Sect. 7.b(3), exempts the operator from the requirements for a criticality monitoring and alarm system ifit can be shown that a criticality accident is impossible due to the physical form of the material or if the frequency of occurrence of criticality is 4

determined to be less than 10 per year. 10 CFR Part 76.89 requires a criticality monitoring and alarm system for all areas of the facility except for approved exclusions. A facility is excluded from the requirements by obtaining approval of the measures that will be used to ensure against criticality, including the kinds and quantities of material that will be permitted and measures that will be used to control those kinds and quantities of material. Reference 4 demonstrates that criticality is not a concern for UF cylinders that contain uranium enriched to <1 wt % 2"U. Therefore, PGDP UF 6

6 storage yards that contain only <l wt % 2"U cylinders are exempt from CAAS coverage.

Although there are 21 cylinder storage yards at PGDP where cylinders with material 2 I wt %

2"U may be stored, only five of these storage yards currently contain 2 I wt % 2"U cylinders. Three of these five storage yards (C-400, C-310, and C-360), due to their proximity to a process building, are curmntly protected by a CAAS.

The purpose of this document is tojustify exclusion from ANSI /ANS-8.3 and 10 CFR Part 76.89 for all cylinder yards that may contain 2 I wt % UF, cylinders. This justification evaluates the nature of hazards associated with and the controls applied to the 2 I wt % 2"U material stored to determine credibility of a criticality accident. Ifit can be demonstrated that a criticality accident is not credible, then the requirements for a CAAS stipulated in DOE Order 5480.24 and 10 CFR 76.89 are not applicable to PGDP UF cylinder storage yards.

6 In general there are two types of UF cylinder storage yards that contain >l ut % 2"U cylinders at 6

PGDP. One type stores >l wt % cylinders for a short period (i.e., usually less than 1 year); the other types provides long-term (i.e., longer than 1 year) storage of these cylinders. Due to increased handling, cylinders stored for a short period are more likely to experience handling accidents that result in an immediate breach of the cylinder containment. Cylinders stored for a long period are

2 more likely to experience a delayed breach due to corrosion. (It should be noted that natural phenomena and aircrafl crashes arejust as likely to impact both types of storage yards, and both types of yards may contain cylinders with both greater than and less than 1 ut % 2"U.)

In order to address the credibility of a criticality accident in all UF cylinder storage yards, a 6

representative example of each yard type was qualitatively analyzed to determine the likelihood of a criticality accident. C-745 B, currently used to store USEC cylinders,is representative of a short-term storage yard. C-745-D, currently used to store DOE legacy cylinders, is representative of a long-term storage yard. Since C-745-B and C-745-D are representative of all PGDP product cylinder storage yards, thejustification for excluding these two yards from CAAS coverage provided by this semi-quantitative analysis of C-745-B and C-745-D permits an exclusion from CAAS coverage for all cylinders yards.

The criticality accident scenarios addressed in this justification involve events that permit the introduction of moderator into the UF cylinder. Accident scenarios that involve the release of 6

uranium hexafluoride or UO F from the cylinder occur at a slow rate. Annual surveillance of 2 2 cylinders would detect movement of UF or UO F from the cylinder before sufficiently large 6

2 2 quantities could accumulate into a critical configuration. Also, there are no mechanisms in the immediate area of the storage yards that would facilitate the accumulation of released material into a layer that exceeds the minimum critical slab thickness. Based on this information, the development of a critical configuration outside the cylinder was not considered credible.

2. DESCRIITION This section provides a brief description of the location, physical characteristics, and inventory of the C-745-B and C-745-D cylinder yards as it relates to storage of a l ut % 2"U cylinders. This information is provided in support of the criticality control and frequency evaluation.

The C-745-B cylinder yard is located inside the security fence, in the northwest area of the site, at the intersection of Virgmia Avenue and Patrol Road. This cylmder yard is a gravel area covering approximately 384,800 square feet. The 2 I wt % cylinders are stored in one row of the yard which covers approximately 4500 square feet (i e.,1% of the cylinder yard). There are 90 storage positions in this row. As shown in Fig. 2-1, this row is identified as a Nuclear Criticality Safety (NCS) controlled storage area (i.e., the cylinders stored in this row are subject to NCS controls. These

.a w--

s.

,ma a.

a u., u

.a.__a.-.--.n u-n an...au_2

_..n.as.m masa.ma,a

,a, a aa.a.

v.suam._._.,.___,a._

-.-na,,-,---

3 i

~

i

?i d

t -

b

,j I

a i

l-8 3

)

2 l

\\.

u L.'s 1

,p II

.,a/y,

• 5 is

'i@tq Q&f l

h h'hhS'?"

S 0

=

i l

9 3

=

N i

2 l

u

.$n h

p 4

1 5

l 4

4 4

9

.,M.~

+

i l

d$i o

i N

!. g g 1

)

4 i

i

i 4

l 4

cylinders are stored on wooden saddles which rest on concrete tracks. The cylinders are raised above j

the ground and are not stacked. However, adjacent rows of <1 wt % 235U cylinders are stacked.

The C-745-B cylinder yard provides long-term storage for <1 wt % 235U cylinders and serves as 4

l interim storage for USEC-owned 2 I wt % product cylinders that are overflow from the C-400 cylinder yard. As needed, the 21 ut % 2"U cylinders are brought to C-745-B in batches of fewer than 20 cylinders. These cylinders remain in interim storage a few months (less than 12 months) before being returned to C-400 for off-site shipment or to C-310 for further processing.

Since these cylinders are stored in this yards only on an interim basis, delayed breach mechanisms are not expected to be relevant to this storage area. However, in the unlikely event that the cylinder must be stored for an extended period, the analysis considers t!ic impact oflonger term breach mechanisms.

The C-745-D cylinder yard, shown in Fig. 2-2, provides loag-term storage for both <1 wt % 235U 235 cylinders and > 1 wt % cylinders. There are 56 21 ut % U cylinders in C-745-D. These cylinders consist of 5010-ton cylinders,3 2.5-ton cylinders and 3 MD (Manhattan District) cylinders that are owned by DOE. The assays on all but three of the cylinders are <2 ut %. The three cylinders >2 wt % (a 10-ton,2.5-ton, and an MD cylinder) have assays of 3.246 ut %,2.1843 wt %, and 2.2412 wt %, respectively.5 The C-745-D cylinder yard is located inside the security fence, in the southern area of the site, southeast of the intersection of 14th Street and Michigan Ave. This cylinder yard is a concrete pad covering approximately 162,000 square feet. The 21 ut % cylinders are stored in three rows of the yard which cover approximately 4050 square feet (i.e.,3% of the cylinder yard). As shown in Fig. 2-2, these rows are identified as NCS-controlled storage areas. These cylinders are stored on concrete saddles which rest on a concrete ped. The cylinders are stored slightly above grade and are not stacked. The figure also indicates tha: adjacent rows of <1 wt % 235U cylinders may be stacked.

The operator uses a crane or a cylinder handler designed to handle filled cylinders to load and l

unload filled cylinders onto a specially designed transport vehicle (trailer) used for movement to the l

cylinder yard. If all transport vehicles are tagged inoperable, the plant shift superintendent may l

approve the use of the cylinder handler (i.e., only those designed to handle filled cylinders) to n.sve l

solid cylinders to the cylinder yards. Loading and unloading of cylinders in the cylinder yards is l

accomplished using the cylinder hauler. Traveling speed for straight sections of road is limited to a l

maximum of 15 miles per hour per operating procedure CP4-GP-BG-2102. This procedure also l

limits the trailer cornering speed to 5 mi!es per hour. The cylinders are transported over designated l

hauling routes designed to minimize the distance traveled through congested areas and the number of l

t i

I

-5 l

1

. Q^%'%7i 5.Q.'n 1

?

r c

. 4 3

l g,

I

y..

g a.k.t, #,.

h.

g t

i

,r*

) h;' ' i,,L e.

.q

, p, t..

s,g I

..'.,1-Q. ' U;,

b;:,

.t i

y

\\.

v t.

y,. WL.W

< p.

[

.w s *c-

r. s i

g I. f t '.

.'( TP i

.,[;; h,.

i

.: m'

s..

n

?

.\\

^

R, c.s. 5:.'.E],J' 1.';

t phi ?:?.

b. gL i,,sr n 6.:. R i

., ~ ~

.M t

+

w, A. qc; v.,j2 7

y i ;, ?.w - #.e c;-

M o

\\ f.

..: 's W. %~:irQli '-

.5

'. 7, %.,,.._.$..,/. j.).s

. ii. '

/

l

..?-

w, s,C i, O

A>

a.

2

.%. y? =.':3. T g

r-

..s%-

. q5 f f y

-ns 3

~

~ ~.

,q.r.. x. W....P-1 l

lg,..., ' ' ' ' _.

y s, *}:l.

~. '

tg

x' g.

l l

b l;: ;

..( ' ' '

u i

,g

...y {

0 x,

.4)k[;S'J[',

j l

' ~ d lY

~

- -. c c

MA:3 J,.t/.7f[. :. k' ' ', 9 ' -",

h, j.'

, y. ::

2,s

..,r

..a.

.~

,.,.. fV.n..(,..,f.i i.

..n -

A,

.... p....

.,u v:

1.... g: U... 's &,...

g a.,,.gL e.

x. e. <

u

?

}t%',':

L)

E E

l h

.y.

J..

1 x

~

t h,".,* -\\ '. s I

'..- },,.Q Q%'f-N y,; - *

.. ~

[..,.,

,,.... ~

u 4

fng.,p ((k[h f.

.jl,hh.

=

. -.[

1

,4.;,i. ;,

l f.

T. _

^

U.' &. m. ~ S'

~'-:.

~,' d S f

.s

~-

. S,^

. -em;,,.

. g ;,, ~'..,5...

i 1

4 1j i

4 l

i i

u,

b.

{-

6 l

turns made by cylinder trucks. If during movement or inspection a breached cylinders is discovered, l

3 1

the operator is instructed to:

evacuate the area and notify supervision and the plant shift superintendent if an active UF.

a reaction is indicated, i

i note basic cylinder information, evacuate the area, and notify supervision.

1

+

1 f

Inspections of all cylinders in storage containing <1 wt % 2350 are performed every four years to j

ensure containment integrity and that the cylinders remain in a safe, usable condition. The purpose of this inspection is to maintain as low as reasonably achievable (ALARA) exposures and minimize environmental impact. For those cylinders where advanced corrosion is observed, a one-year

[

inspection interval is imposed. In addition, the perimeters of all cylinder yards are surveyed annually to confirm the postings that minimize employee exposures.

i The product cylinders containing >l ut % 2'50 are inspected annually. The purpose of this inspection is to identify advanced corrosion and cylinder damage that might permit the introduction of water into the cylinder.

Inspection teams, consisting of a minimum of two inspectors, examine the cylinders to identify leakage, cracks, excessive corrosion, bent or broken valves or plugs, and broken or torn stiffening rings or skirts. These or other conditions that may affect the continued safe use of the cylinder are documented and appropriate corrective actions are taken.

The inspectors possess prior inspection data for comparison purposes. The criteria used by the inspectors to identify conditions requiring documentation are listed in UE-QA 14.1, " Inspection of UF Cylinders in Storage."' The criteria are categorized as " General," " Cylinder Body Contact Point," " Valve End of Cylinder," and " Plug End of Cylinder." The general category covers damage such as corrosion of the wall, heavy scale on the ground, or a bent stiffening ring. The cylinder body contact points are examined to identify deterioration or discoloration of the saddles or other conditions that place the cylirder in contact with the ground. Discoloration of the saddles indicates that excessive cylinder corrasion has taken place The cylinder valve and the associated area are examined to identify evidence ofleakage, damage, or misalignment. The plug and plug end are examined to identify any damage or conditions that could result in plug leakage.

In order to be qualified to inspect the UF. cylinders, the inspectors must receive 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of training and must pass a written test on the subject matter. The inspector is trained in how to inspect the cylinder wall, valve, and plug and what constitutes a breached and severely damaged cylinder.

7 1

Any defects / damage that meet the inspection criteria are documented on the inspection log sheet.

If the damage involves a breach, the area is evacuated and the supervisor is notified. If the breach is emitting HF, then the Plant Shill Superintendent is notified and the Hazardous Material (HAZMAT)

Response Team is summoned to the location of the release. The cylinder is patched to prevent further leakage. The response team is directed by procedure not to spray water on the leaking cylinder.

In addition to the inspection the cylinders receive while in storage, all UF cylinder are routinely

)

6 inspected as they are received and before sampling, emptying, filling, or shipping to ensure that they remain in a safe, usable condition.' A careful inspection of cylinders and valves is an important prerequisite to any operation. Filled cylinders may be dented or otherwise damaged; therefore, cylinders are moved with carc All cylinders are periodically inspected and tested throughout their service lives at intervals not to exceed five years. Full cylinders are not emptied simply to comply with the five-year test cycle.

However, cylinders that have not been inspected and tested within the required five -year period, once emptied, are not tc0!!cd until properly reinspected, retested, and restamped on the name plate.

Cylinders ccanining UF,, that have not been recertified within the five-year requirement period are visually inspected fer degradation of the cylinder wall before shipment. Any questionable conditions are investigated ftrther; ultrasonic wall thickness measurements are made, if appropriate.

The five-year itspection includes internal and external examination of the cylinder by a qualified inspector (one who has passed the written examination sponsored by the National Board of Boiler and Pressure Vessel Ir.spectors or other competent inspector designated by the owner's inspection authority), an ASME code hydrostatic strength test, and an air leak test. This periodic inspection and tc:n is in accordance with ANSI N14.1. Cylinders that pass the periodic inspection and tests are restamped on the name plate with the month and year that the inspection and tests were performed.

Records of periodic inspections and tests are retained for five years or until a subsequent periodic inspection and test has been performed and recorded.

A UF cylinder is removed from service (for repair or replacement) when it is found to have 6

leaks, excessive corrosion, cracks, bulges, dents, gouges, defective valves, damaged stiffening rings or skirts, or other conditions which, in the judgement of the qualified inspector, render it unsafe or unserviceable. Cylinders are no longer used in UF service when the shell and/or head thickness have 6

decreased below the values specified in ANSI N14.1.

8 3.0 METIIODOLOGY The purpose of this evaluation is tojustify the exclusion of UF cylinder storage yards from 6

CAAS coverage. The criticality hazards and the controls applied to the 2 I wt % 2"U material stored in short-and long-tenn storage yards (C-745-B and C-745-D) are analyzed to determine the credibility of a criticality accident. Justifying the exclusion of the representative examples of the two yard types from CAAS coverage permits the exclusion of all cylinder yards from the CAAS coverage requirement. The basb approach to the evaluation is to identify the controls and any necessary conditions for critical.ty, identify methods of failing the controls and achieving the necessary conditions (i.e., criticality scenarios), and estimate the frequencies of the criticality scenarios semi-quantitatively. This approach is implemented through the application of the cylinder yard criticality event tree shown in Fig. 3-1. This event tree is comprised of two events that define a general l

criticality scenario: a cylinder breach, and detection and mitigation of the breach.

Each event tree sequence is assigned an endstate of either "NC," no criticality, or "CC," critical configuration. The methods used to estimate the frequency or probability associated with each event are discussed below. The general event tree represents many specific scenarios and is used as a guide in determining the frequency of each criticality scenario.

3.1 CYLINDER BREACIIINITIATING EVENT (CYLBREACll)

The initiating event of the general event tree is "a cylinder breach." Table 3-1 was used as a check sheet to methodically postulate cylinder breach mechanisms in the field. The completed check sheet is Table A-1 in Appendix A. The breach mechanisms for a cylinder can be categorized as:

immediate mechanical breach, delayed breach (mechanical failure / corrosion of undamaged cylinder),

delayed breach (corrosion of damaged cylinder), or thermal damage. An immediate mechanical breach is a rupture of the cylinder due to impacts with other cylinders, equipment, the ground, etc.

On the other hand, a delayed breach is a cylinder breach that occurs over a relatively long period of time due to corrosion. Delayed breach (corrosion of damaged cylinder) is similar to mechanical failure with the exception that an event has occurred to shorten the length of time

CYLINDER DETECTION' AND' d

BREACH MITIGATION t

i t

CYLBREACH DETMIT SEO END-STATE-NAMES i

1 NC r

i' 2

CC i

w

+

?

. i 4

i i

L 1

4

.[

i A

t i

Fig.3-1. Cylinder yard criticality eventtree.

[

a l

-.- ~: T-'

F Table 3-1. Postulated criticality scenarios for PGDP cylinder yards Mechanism of Initiators Cause(s)

Potential

Response

Likelihood' breach consequences time' t

1. Immediate ham / ling

a. cylinder handler failure immediate cylinder S

mechanical breach errors results in cylinder damage breach; water /

(drop, impact, or puncture) atmospheric moisture enters cylinder; unsafe configuration

b. human error results in immediate cylinder S

cylinder damage (drop, breach; water /

impact, or puncture) atmospheric moisture enters cylinder; unsafe configuration i

external

c. overhead equipment /

cylinder breach over M

/mpact during adjacent structures fall time; water /

o t

storage onto cylinder atmospheric moisture enters cylinder; unsafe l

configuration i

u

d. tornado or tornado cylinder breach over W.

missiles impact cylinder time; water /

causing breach atmospheric moisture enters cylinder; unsafe configuration

.t

e. cylinders impact each cylinder breach over W

other due to earthquake time; water /

t atmospheric moisture enters cylinder; unsafe configuration i

L 5

+<

a.-.-

..w.+

m--

- ---- 1

• r--.,----

-wus -@.W'-

4

?

wmL v

^m

Table 3-1. Postuinted criticality scenarios for PGDP cylinder yards (continued)

Mechanism of Initiators Cause(s)

Potential

Response

Likelihood '

a breach consequences time'

f. cylinders impact each cylinders contact each W

other due to flood (soil other; cylinder breach under cylinders erodes over time causing cylinders to roll)

g. vehicle accident immediate cylinder S

damages cylinder breach; water /

atmospheric moisture enters cylinder; unsafe configuration

h. airplane crash immediate cylinder S

breach; water /

t atmospheric moisture C'

enters cylinder; unsafe configuration

2. delayed breach cylimler wall

a. corrosion gradual development L

(mechanical failure /

failure ofcylinder breach; corrosion of water /

undamaged atmospheric moisture cylinder) enters cylinder; unsafe configuration cylinder valve

b. corrnsion atmospheric moisture L

leaAnge enters cylinder; gradual development of hole due to llF; atmospheric moisture enters cylinder; unsafe configuration m~n, m

. ~

. m..

.m.

m a.

• -. w u

2 M

-.. ~.

Table 3-1. Postulated criticality scenarios for PGDP cylinder yards (continued)

Mechanism of Initiators Cause(s)

Potential

Response

Likelihood -

consequences time' breach cylinderplug

c. corrosion water / atmospheric L

failure moisture enters cylinder; gradual development of hole due to llF; water moisture enters i

cylinder; unsafe configuration

3. delayed breach handling

a. cylinder handler failure gradual development L

(corrosion of errors results in damage to of hole if damage is i

damaged cylinder) cylinder surface undetected; water /

atmospheric moisture enters cylinder; unsafe configuration l"

b. human errors in gradual development L

handling cause damage to of hole if damage is cylinder surface undetected; water /

atmospheric moisture enters cylinder; unsafe configuration improper

c. cylinder stored with gradual development L

storage surface on the ground of hole if damage is undetected; water /

atmospheric moisture enters cylinder; unsafe configuration 4

.A

....... ~.

_ -...~...

t v

1

?

Table 3-1. Postulated criticality scenarios for PGDP cylinder yards (continued) i Mechsalse of Initiators Cause(s)

Potential

Response

Likelihood consequences time' breach external

d. corrosive agents from gradual development L

source adjacent facilities of hole if damage is undetected; water /

atmospheric moisture enters cylinder; unsafe l

configuration

4. thermal damage fire

a. airplane crash damage to cylinder S

wall or plugs; water /

atmospheric moisture enters cylinder; unsafe configuration i

b. vehicle fire (e.g., engine damage to cylinder S

U' fires, fire due to accident wall or plugs; water /

involving ruptured fuel atmospheric moisture tanks) enters cylinder; unsafe configuration

c. grass fire damage to cylinder S

well or plugs; water /

atmospheric moisture enters cylinder; unsafe configuration

' S = immediate (s24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

W = s week M = s month L = <l year 4

~~~...,

4

---A a--

wr-

a 14 i

required for corrosion to breach the cylinder (e g., handling errors that damage the cylinder wall).

Events that breach the cylinder due to exposure to excessive heat are categorized as thermal damage.

The " initiators" column of Table 3-1 was used to identify general events and failures that could cause the breach mechanism. These initiators were further specified in the "causes" column. The " potential j

consequences" and the " response time" for detection and mitigation of the consequences is also recorded in Table 3 1. The credibility of these accident scenarios is evaluated in subsequent sections of this justification. " Response time" categories were determined based on the estimated detection l

and response times. Scenarios with high alerting factors that would permit immediate detection of cylinder damage or breach were assigned a category of"S." The "S" category includes accident initiators that would be responded to within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of their occurrence. This is considered l

reasonable since the response required is to cover the breach to prevent moderator intrusion.

j Scenarios where there is a high alerting factor, but the initiator itself could prevent immediate

esponse (e.g., tornado), were assigned a category of"W." The "W" category conservatively allows f

up to one week for response. Scenarios where detection depends on periodic presence of personnel j

were assigned a category of"M." The "M" category conservatively allows up to a month for response i

to these scenarios. Scenarios where detection depends on the periodic cylinder inspections were assigned a category of"L" The "L" category allows up to one year for response to these scenarios based on the current inspection inten al.

Tests documented in Reference 8 were performed at the Oak Ridge Gaseous Diffusion Plant to determine the impact of water entering a cylinder filled with solid UF,. These tests evaluated leaks

{

into the void region of the cylinder as well as leaks into the region filled with solid UF.

6 f

Tests conducted on simulated breaches in the void region of the cylinder evaluated two p ;tential I

situations; one where a film of crystalline UF was present on the interior cylinder wall and the other

. where no UF. was deposited on the cylinder wall. Tests of cylinders where enstallme uramum q

hexafluoride was present on the cylinder wall revealed that holes up to one inch in diameter in a 6.25-inch-diameter MD cylinder are almost immediately plugged with UO F, from the hydrolysis of 2 2 f

uranium hexafluoride, and metallic compounds formed when HF reacts with the metal in the cylinder wall. Although holes greater than one inch were not tested, it is expected that some holes that exceed l

one inch in diameter would be plugged on product storage cylinders because of their larger diameter (-

l 48-inches). Water agitation on the plug andjarring of the cylinder were not successful in dislodging l

j; the plug. In cases where the plug was removed, a new plug was almost immediately formed. The f

rapid fonnation of these plugs precluded further introduction of water into the cy inder. It should be noted that the normal filling of the cylinders with UF will result in the formation of cn stalline UF.

6 l

on all interior surfaces of the cylinder wall.

2 I

1 1

m

--,n n

,,, -~ -

a

15 Tests performed on specially prepared cylinders where no crystalline UF was present on the 6

cylinder wall resulted in the production of no plug. Water entered the cylinder resulting in a reaction with the solid UF. The essentially instantaneous reaction forms an insoluble layer over the UF. A thin green layer produced by metallic products formed from HF reactions covers a thicker yellow layer. This yellow layer composed of UO +2H 0+HF covers an orange band of U 0 F or UOF 2

2 2 3 6 Under the orange band is the unreacted UF. Once the water is saturated, the layers become stable at a density of 270 gU/1. The conclusion drawn from the chemical analysis was that instantaneous reactions result in the formation of solid layers which limit the rate of diffusion of water vapor in and HF out through the layers covering the UF. Criticality safety analysis models of a cylinder in which 6

water enters the void space of the cylinder and reacts with the UF indicate that the cylinder is 6

subcritical

• However, since diffusion of water vapor through the insoluble layer, although slow, continues indefinitely, References 9 and 10 do not substantiate subcriticality for an unlimited period.

Tests performed where the simulated fracture was located in the region covered by solid UF6 revealed that a plug similar in composition to the previous case, immediately formed. However over time the diffusion of water vapor through the plug continues to produce HF that attacks the cylinder wall. The cylinder breach and the UO:F region slowly become larger with solid state diffusion of 2

water vapor in and HF out through the layers coverin*g the UF. Reference 11 concludes that the 6

larger cylinder breach at the Portsmouth Gaseous Diffusion Plant (PORTS) discussed in Reference 12 would have resulted in a critical configuration had the UF been 5% enriched. Reference 11 indicates 6

that the reaction proceeds quite slowly with the large cylinder breach and subsequent hydration occurring over a 13-year period.

The conclusions that can be drawn from these tests and analytical models include:

small breaches of the cylinder void space and the subsequent reaction with wet air or water will result in the development of a plug that precludes the introduction of water, larger breaches of the cylinder void space and breaches of the cylinder wall region covered by UF will permit water to contact and hydrate the UF.,

6 instantaneous formation of an insoluble layer limits the rate of hydration of the UF, and 6

the detection of a cylinder breach and the mitigation of any water intrusion are necessary in order

+

to preclude a critical configuration.

I l

16 Since the reaction proceeds at a slow rate, the annual cylinder inspection will identify the breach before the hy dration of sufficient UF, to form a critical configuration.

3.2 DETECTION AND MITIGATION EVENT TREE EVENT (DETMIT)

The" detection and mitigation" event tree event is evaluated using the " consequences" and

" response time" columns of Table 3-1. These columns identify ways that a particular type of breach would be detected and repaired to prevent the introduction of moisture.

The response time for breach accident scenarios includes time for both detection and mitigation.

Since mitigation of a breached cylinder is accomplished by covering the damaged area or plugging the breach, the time to mitigate any cylinder breach is expected to be brief(i.e., less than an hour).

However, the time to detection of a cylinder breach is influenced by the breach initiator. For instance, handling accidents in which the cylinder is breached immediately should be detected at the time of occurrence. Less energetic initiators in which the cylinder is damaged but not breached may go undetected until an annual inspection. Similarly, breaches that occur when the storage yard is unoccupied (tornado) may go undetected until conditions permit ar. inspection.

Table 3-2, a blank worksheet, was developed to provide additional cylinder yard-specific details for the scenarios addressed in Table 3-1. Completed worksheets for the two cylinder yards addressed in detail are provided as Tables A--2 and A-3 in Appendix A. The " accident identifier" column references a scenario from Table 3-1. An estimate of the frequency of the initiating event for the scenario is provided under the " initiator /cause frequency" column. These frequencies are order of magnitude estimates based on engineering judgement. Appropriate methods of preventing the cylinder breach or mitigating the event to limit the intrusion of moisture are listed under the

" prevention / mitigation" column. The " estimate of criticality likelihood" column provides information and results on the credibility of events in the criticality event tree for the specific scenario as applied to the specific cylinder yard. The " estimates of criticality likelihood" are order of magnitude estimates based on engineering judgement of the accident scenario given the initiator frequency, the response time (detection / recovery), and availability of moderator. The observations

i!

i

1 0

+

t t,

y it lac*

i d

t ir o c o f h i

ol e

e k t

i al m

i tsE d

ray re dn i

lyc c

if ic n

e o

p i

t s

a a

ig t

r i

+

o m

f

/n so o

i i

t r

n a

e n

v e

e c

r s

P

)

y s

t r

i e

la d

c n

i i

l t

y ir c

c d

f e

o ga yr m

a a

d m

n e

m s

u u

u *y f

a c o

S c

n

/r n

e o

2 ou i

t t

s a

t o

3 i e r

a t

r l

i f r

e n

o b

I c

/

a e

T ru l

ia h

f c

l a

a e

ic r

b na la h

ic ce n

m a

(

t r

h ne c

h i

ef e

c di m

a t

i e

c n c e e

r d

b t

Ai i

d a

d e

e y

m a

l m

e d

a.

b.

c.

d.

e.

f.

g h.

a.

b.

c.

I I

l l

I l

I l

1 1

2 2

2 2

9 4

4 t

_oo y

t i

la ic*d t

ir o co f hi ol e e k t

i al m

i ts E

)

deun i

tnoc

(

dray re d

n n

i o

l i

y t

c a

c g

i i

f t

i i

ce m

p

/n s

o a

i t

r n

o e

f v

s e

o r

P iranecs y

t i

l a

c i

t i

r c

f o

yr e

a s

)

m u *y s

a c r

a c n e

r

/r e d

u S

ou n

i t

q l

a e

y a

'/

i 2

t r

c if 3

n d

I e

e g

lb a

a m

T a

d fo no isorroc r r t

r

(

e ne h

g

/y /y i

ef c

a d 4 di a

m 00 t

icn e

1 1 ce r

a r

r

'/y a 2 /y Ad b

d i

l

- ff4 d

a 0 aa0 ey m

1 ' 4 1

a r

>00 <

l e

f f1 1

e h

d

- = = =

t a.

h.

c.

d.

a.

b.

c.

3 3

3 3

3 4

4 4

4 ABCD e

.c 19 1-and conclusions stated in this last colunm serve as the basis for the overall determination of the need 4

for CAAS in the specific cylinder yard.

j It should be noted that the scenarios discussed in Sect. 4 and Appendix A are evaluated for the 10-ton and 2.5-ton cylinders stored in C-745-B and C-745-D. As noted in Sect. 2, there are three MD I

cylinders in C-745-D. The highest assay material in these MD cylinders is 2.2 wt % 2"U. Reference j '

13 provides a minimum critical radius for 5 wt % 2"U water-moderated systems of 19.6 cm (7.72 '

i inches). The nominal radius of an MD cylinder is 6.25 inches. Therefore, criticality resulting from i

the breach of MD cylinders currently stored in C-745 D is not considered credible.

i 4.RESULTS 3

I i

1 l

The results of this evaluation of the criticality accidents associated with the C-745-B and C-745-r j

D cylinder yards are presented in the form of completed versions of Tables 3-1 and 3 2 and discussions of each scenario. Table A 1 is the completed version of Table 3-1. Each scenario was evaluated to identify any factors to be considered in quantifying the events in the cylinder yard criticality event tree (Fig. 3-1). The " likelihood" column identifies factors that affect the frequency of the scenario initiator and the probability of detection and repair. Tables A-2 and A-3 are completed versions of Table 3-2 for C-745 B and C-745 D, respectively. These tables further define the i

criticality accident scenarios with emphasis on cylinder-yard-specific factors that affect the scenario -

frequency. The evaluation of the criticality scenarios and the resulting frequency estimates, as detailed in Tables A-1, A 2, and A-3, are discussed below.

4.1 IMMEDIATE MECHANICAL BREACH-HANDLING ERRORS l

Two types of handling error initiators were considered: immediate mechanical breaches due to failures of the handling equipment and human errors. In these scenarios, the breach occurs at the time of the failure / error due to an impact, drop, or puncture. While handling errors are credible, it is unlikely that they would result in the immediate breach of a solid cylinder. If a breach occurred that I

was less than 1 in. in diameter, experimental data indicates that the breach would be scaled by the l

~

rcaction products per the discussion presented in Sect 3.1. Although some breaches larger than 1 in.

l in diameter may be scaled by this reaction, breaches larger than 1 in. diameter are considered l

extremely low frequency events baxd on the following discussion.

l An evaluation of 10 ton UF cylinder integrity following drop tests has been conducted at

-[

6 PGDP"" These tests involved both thin-walled (i.e.,5/16 in. wall thickness) and thick-walled (i.e.,

l 5/8 in. wall thickness) cylinders containing a ballast that simulated the weight and characteristics of l

20 UF " The impact tests were made from a height of 20 feet with the cylinder in the horizontal l

attiNde onto a solid concrete pad. Thin-walled cylinders were dropped with a horizontal impact from l

a height of 10 and 20 feet. Thick-walled cylinders were dropped with a horizontal impact from 20 l

i feet. Thick-walled cylinders were also dropped with a vertical impact onto the valve end of the l

cylinder. Drops were also conducted from 1 meter onto a 6-in. diameter steel piston to determine the l

cylinder's resisunce to puncture. Following the drop tests, the integrity of the cylinders was pressure l

tested and the u cids were dye penetrant tested. None of the thin walled c)linders showed any l

indication of failure following the tests. The only failure involved a thick-walled cylinder being l

dropped onto the piston. A similar test of a thin-walled cylinder did not result in a failure. The l

damare to the thick-walled cylinder is believed to be a result of weakening from previous drop tests.

l Additional tests documented in Reference 15 indicated that another 1-meter drop test involving the l

valve end head striking a piston did not result in a rupture. A 30-foot drop onto the plug end at a 20*

l angle from the vertical also did not result in a failure. During handling operations at PGDP, no l

product cylinder would be lifted more than 20 feet. Operations in the cylinder storage yards do not l

involve lifting the cylinder more than is necessary to clear the cylinder saddles on the transport trailer l

which is less than 10 feet. Rupturing a cylinder as a result of a drop in the cylinder yard is not a l

significant concern because of the minimal lifting height and the fact that sonne of the cylinder yards l

are gravel which absorbs some of the energy from the dropped cylinder. Also, cylinders are only l

lifted when it is necessary to move the cylinder from the yard. The presence of personnel during l

cylinder lifting permits inunediate identification of accidents involving a breached condition. Based l

on the testing documented in References 14 and 15, the probability that a cylinder would fail with a l

hole larger than 1 in. diameter due to mishandling in the cylinder yards is considered to be extremely l

low. Also, if a breach of the cylinder did occur, the location of the breach would most likely be at the l

bottom of the cylinder near the site of the impact mitigating the potential for direct introduction of l

precipitation into the cylmder.

l Although the probability of a cylinder rupture due to mishandling is extremely low, the availability of moderation and successful detection and repair was evaluated. Successful detection and repair in a brief time (i.e., an hour or less) is credible due to the preser.cc of an operator and the j

high alerting factor of a cylinder drop or puncture. A cylinder mishandling event that results in a l

breach of the containment will be accompanied by a release of HF which is visible as white smoke.

l While application of a waterproof cover provides the best protection against a critical configuration, l

any cover that would mitigate the introduction of water would significantly reduce the risk of l

criticality. Sources of moderator include atmospheric moisture and precipitation.

l Water introduced into the cylinder will react with the UF. fonning UO F and HF. In order for l

2 2 water to moderate the uranium in the cylinder, the UF would first have to be converted to UO F l

2 2 L

i

l 21 since water reacts preferentially with UF. This conversion of UF. to UO F consumes the initial l

2 2 water that enters the cylinder. According to Reference 16, for every 1 pound of water that reacts l

j j

with UF approximately 6.6 pounds of uranium is reacted. Based on a maximum subcritical mass of l

l 49.1 pounds of uranium, as many as 7.4 pounds of water would be consumed in the conversion of l

4 r

UF. to UO F before moderation could occur This evaluation assumes that the reaction products fail l

2 2 to seal the cylinder from further water intrusion as indicated by actual experiments for holes of s 1 in.

l l

1 1

diameter. An unsealed hole would permit water to enter the cylinder where the entire surface of the l

)

UF. in the c>iinder would be exposed to the water. The water would hydrate all UF, it came in l

contact with as it pooled inside the cylinder, Since cylinder cooling results in a uniform slab surface l

inside the c>iinder, there is no physical mechanism that would cause selective hydration of 49.1 l

{

pounds in a spherical configuration. Therefore, the hydration of UF is expected to result in a thin l

)

i 1

slab of UO F on top of the UF.. Assuming there was a mechanism that would result in selective l

1 2 2 l

hydration in a spherical configuration, in order for a criticality to result from this accident scenario, l

the breach would have to occur during a severe rain storm. Considering a breach that was 6 inches in l

diameter in the top of a c>iinder, more than 7 inches of rain would have to fall before the cylinder l

4 l

would be filled with 7.4 pounds of water. This amount of water only converts the UF to UO F. A l

6 22 l

substantial mass of additional water is required for moderation of the UO F under optimum l

2 2

)

conditions. Severe storm data for PGDP indicates that 5 inches of rain might occur over a 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> l

period once in 100 years. Therefore, it is unlikely that more than 7 inches of rain would fall such that l

1 7.4 pounds of water could enter a breached c>iinder before a cover or patch could be applied to the l

c)iinder. The frequency of such a severe storm occurring following an event in which a cylinder is l

dropped and breached with a 6 inch diameter hole is not considered credible. Since the breach from a l

dropped load accident is most likely at the bottom of the cylinder, the introduction of significant l

quantities of water into the cylinder is considered unlikely. As discussed in Sect 3.1, if water did l

enter the cylinder through a hole larger than 1 in. diameter, the formation of an insoluble layer over l

the UF, reduces the rate of subsequent hydration such that the formation of a critical configuration is l

nutigated. Based on this information, it is not considered credible that scenarios involving an l

a f

immediate mechanical breach due to handling errors would result in a criticality.

i 4.2 IMMEDIATE MECilANICAL BREACII-EXTERNAL IMPACT DURING STORAGE There are several different types ofimmediate mechanical breach initiators with the potential to i

3 impact a cylinder while it is in storage. These include impacts from overhead structures, imp::ts from other cylinders due to flooding, aircraft crash, tornado, carthquake, and aircraft crash. The l

potential for the initiators to cause damage to a cylinder that exceeds 1 in. diameter is evaluated. In l

22 performing the evaluation, the first issue to be addressed is the credibility of the initiators.

Subsequent paragraphs of this section address the credibility of these initiators.

Overhead Equipment. There are no heavy structures or equipment over either of the cylinder yards. However, the cylinder yards do contain wooden utility poles and lighting poles. The weight of these utility poles is neglmible in comparison to the weight and strength of the cylinders. If a pole were to fall, most of the energy associated with the weight of the pole would be acting on the ground as it fell. When the pole strikes the cylinder (s), only a portion of the total energy is transferred to the cylinder (s). Considering the limited damage to a cylinder following an elevated drop test of 20 feet, l

falling utility poles are unlikely to breach a cylinder based on engineering judgement. Therefore, falling overhead equipment is not considered a credible criticality initiator for holes that would l

cxceed 1 in. diameter.

l Flooding. Based on the references cited in Table A-1, the credible flood levels are below the low point within the security fence. Flooding is not considered a credible means of breaching a cylinder.

Aircraft Crash. The frequency of a > I wt % 2"U cylinder being breached by an aircraft crash was estimated in Table A-1 using the frequency of an aircraft crash in the specific yard and an estimated probability that a > I wt % cylinder is impacted based on the percentage of the cylinder yard occupied by the 2 I wt % cylinders. The calculation of the frequency of an aircraR crash in a specific yard, provided in Reference 18, considers the total effective area of a yard to be the sum of the shadow area, the skid area, and the true target area.

The shadow area depends on the height of the structure and on the aircraft angle of attack. For the PGDP study, a conservative angle of attack of 45' was assumed.

The skid area (area plane skids through after striking the ground) is considered to be negligible consistent with Reference 19 because of the man-made barrier provided by the rows of UF cylinders.

Due to its proximity to Kentucky Hogs Airfield and Barkley Regional Airport, general aviation involving small aircran rather than commercial aviation involving large aircraft poses the greatest risk to PGDP. The largest aircraft routinely scheduled to land at the Barkley Regional Airport is a 34-seat commuter plane. Aircraft served by the Kentucky Hogs Airfield are much smaller than those served by Barkley Regional Airport. The rows of stacked, partially filled and filled 10-ton cylinders in the storage yards provide a significant barrier against light aircran skidding a significant distance.

The true target area is the total amount ofland area occupied by the structure or, in this case, the storage yard. The true target area for the calculations presented in Reference 18 was the area of the l

yard. The true target for this assessment is the area occupied by the cylinders with an assay >l wt %

2"U. As noted in Sect. 2, in both C.45-B and C-745-D the 21 wt % cylinders occupy less than 10%

of the total area of the yard. Therefore, the frequency of an aircran crash into the >l% cylinders in j

the storage yards is an order of magnitude lower than the frequency of a crash reported in Reference

23 18 (3.1E-06/yr for C-745-B and 1.3E-06/yr for C-745-D). Therefore, the expected frequency of an j

aircraft crash into the > 1 wt % cylinders in these yards is considered to be 3.1 E-07/ yr for C-746-B l

and 1.3E-07/yr for C-746-D. Both frequencies are below the threshold of credibility.

l In the event that an aircraft did crash in a cylinder yard, contacting the enriched cylinders, a ciitical configuration is not necessarily the resulting consequence. Since the emergency response team is trained not to spray water on UF, cylinders, sufficient moderator is rot readily present. A rainstorm during the time it takes to cover or patch the cylinder (s) breached by an aircraft crash will introduce only limited quantities of water into the cylinders. It has been shown that more than 7.4 lbs l

of water is required to achieve a criticality under optimum conditions. However, as discussed in Sect.

l 3.1, the formation of a plug for holes s I in. diameter or an insoluble layer over the UF for holes > 1 l

6 in. diameter precludes an immediate critical configuration. The plug prevents subsequent l

introduction of water. The emergency response team is trained to plug or cover any cylinder breach l

to prevent further introduction of water. The insoluble layer slows the hydration reaction permitting l

the removal of water from the breached cylinder before a critical configuration can be formed. Based on this information, a critical configuration resulting from an aircraft crash in a cylinder yard is not considered a credible accident scenario.

Tornado. The frequency of a 144-mph tornado at PGDP is estimated at 2.0E-05/ year.2 ; the 20 estimated frequency of a 128-mph tornado is 4.0E-05 22 A tornado of this magnitude is expected to do considerable damage to buildings and equipment. It is unlikely that a fully loaded 10-ton cylinder would be significantly damaged by the tornado based on the following factors:

weight of a loaded cylinder varies between 15,000 and 20,000 lb, cylinders are stored low to the ground in saddles that prevent rolling, the cylinder surface area to weight ratio and center of gravity are not conducive to movement by high winds, and 20 fl drop tests resulted in minimal damage to the cylinders with no loss in containment integrity.

Although unlikely, a tornado may breach a partially filled cylinder that exceeds a critical mass. A cylinder breach due to impact from a tornado missile is also considered a credible event. However, i

Reference 23 indicates that a tornado missile must strike a cylinder valve or a portion of the cylinder wall that has had significant corrosion in order to breach the cylinder. The availability of moderation and successful detection and repair was evaluated. Successful detection and repair of a bren hed 1

24 cylinder in a short time (i c., a week or less) is credible because of the high alerting factor of a tornado. (The "W" response time (Table 3-1) was conservatively chosen due to the uncertainty of response time following a tornado.) Sources of moderator include atmospheric moisture and precipitation. Although it is credible for precipitation to enter a breached cylinder in the week assumed to detect and repair a breached cylinder, the formation of a plug or an insoluble layer over the UF, precludes an immediate critical. configuration. The plug precludes subsequent introduction of l

water for holes s 1 in. diameter. The insoluble layer, discussed in Sect. 3.1, slows the hydration l

reaction for holes > 1 in. diameter permitting the removal of water from the breached cylinder before l

a critical configuration can be formed. Based on this information, it is not considered credible that l

scenarios involving a mechanical breach due to a tornado would result in a critical configuration.

Earthquake. The peak ground acceleration for a 1000-year return period earthquake consistent with Performance Category 3 (PC3) is 0.25g.2 Therefore, it is considered credible that an carthquake could occur. However, Reference 23 indicates that a 0.25g earthquake will not damage a UF.

cylinder. Credible carthquakes with a magnitude greater than 0.25g may breach a cylinder.

l However, for breaches that are s 1 in. diameter, the reaction products from the initial water or wet air l

intrusion will seal the breach. For breaches > 1 in diameter that are not scaled by the resulting l

reaction, an insoluble layer is formed over the UF, reducing the rate of hydration which facilitates l

water removal. If a cylinder were breached, successful detection and repair in a short time (i.e., a l

week or less) is likely due to the high alerting factor of an earthquake. Therefore, it is not considered credible that scenarios involving a mechanical breach due to an earthquake would result in a critical configuration.

Vehicle Accidents. The volume of traffic in C-745-B and C-745-D is very low due to their remote locations and is limited primarily to personnel involved in cylinder inspections and movement. The speed limit in these areas is 25 mph and vehicle drivers are instructed to maintain a safety margin of distance of 25 feet.2' Only vehicles used to handle and transport a cylinder are expected to approach within 25 feet of a cylinder stored in the yards. As previously discussed. the l

transport trailer and cylinder handlers are restricted to a speed limit of 15 miles per hour for straight l

portions of the road and 5 miles per hour for turns. The frequency of a vehicle accident in a parking l

lot at speeds comparable to those observed in the cylinder yards (<25 miles per hour) is estimated to l

be 1.29 accidents per 1E+06 miles.2' Therefore, a vehicle accident in the cylinder yards is a credible l

event; however, a vehicle accident severe enough to breach a cylinder is conservatively considered to l

l occur only 10% of the time because of their rugged construction. In fact, the drop tests indicate the l

cylinders were not breached when they struck the ground at a speed of 25 mph. The availability of l

moderation and successful detection and repair was evaluated. Successful detection and repair of a breached cylinder in a short time (i e., a few hours) is likely due to the presence of the vehicle driver

25 and personnel providing assistance to the vehicle driver. Sources of moderator include atmospheric moisture and precipitation. While small quantities of water may be introduced into the cylinder before repair can be completed, the formation of a plug or an insoluble layer over the UF, precludes an immediate critical conGguration. The plug precludes the introduction of water for hoics s 1 in.

diameter. The insoluble layer slows the hydration reaction given water intrusion for holes > 1 in.

diameter, permitting removal of water from the breached cylinder before a critical configuration can be formed. Based on this information, it is not considered credible that scenarios involving a mechanical breach due to a vehicle accident would result in a criticality.

l 4.3 DELAYED BREACII(MECilANICAL FAILURE / CORROSION OF UNDAMAGED CYLINDERS) l The initiators categorized as delayed breach may occur as a result of normal corrosion or mechanical failure. Corrosion may impact the cylinder wall, the cylinder valve, or the cylinder plug.

Since the cylinder valve is the only active component (i c., changes state), it is the only component considered vulnerable to a mechanical failure. The impact of these initiators on cylinders in both l

long-term (i.e., cylinders in C-745-D) and interim (i.e., cylinders in C-745-B) storage is considered in the following discussion.

C-745-B Accident Scenarios. Since UF, cylinders are stored in the C-745-B yard only on an interim basis, delayed breach mechanisms are not expected to be relevant to this storage area.

However, in the unlikely event that the cylinder must be stored for an extended period, the impact of delayed breach mechanisms is considered. It should be noted that these cylinders would be subject to the annual inspection given all cylinders containing >l% "U. Therefore, for a cylinder component (cylinder wall, valve, or plug) to experience corrosion to the point of breach, numerous human errors involving either failure to perform the annual inspection and/or failure to detect the breach given performance of the inspection would have to occur. Considering the extended time required for normal corrosion to breach a cylinder, the multiple, independent failures to detect the corrosion with annual inspections is not credible. As discussed in Sect. 3.1, a small breach would be immediately plugged by the formation of reaction products at the site of the breach. Accordingly, these accident scenarios do not result in a credible critical configuration.

According to Reference 27, the failure rate for a cylinder valve is 2E-07/ hour. Based on the failure rate, it is considered credible that the cylinder valve could fail on a product cylinder while it is in C-745-B. However, due to the design of the valve, presence of the cylinder skirt, and the positioning of the cylinder in the saddle (valve is at 12 o' clock position), water is not likely to enter

26 the cylinder through the cylinder valve. The one-inch, right-angle valve design limits both the direction from which water may directly enter the valve and the volumetric flow rate through the valve. The cylinder skirt (valve shields on some cylinders) protects the valve from falling water. The fact that the external valve opening is parallel to the ground and water must change direction upon entering the valve to enter the cylinder minimizes water intrusion. As shown in the photograph in Sect. 2, the cylinder valves for cylinders stored in storage yard C-745-B are stored with their valve covers on. The valve cover provides further protection against water intrusion through the valve.

Based on this information, it is not considered possible for water to enter the cylinder via the cylinder valve between inspections. If some water did enter the cylinder, Sect. 3.1 indicates a plug would be immediately formed precluding further introduction of water. Based on this information, it is not credible for cylinder valve failure to result in a critical configuration.

C-745-D Accident Scenarios. Ahhough cyiinders in C-745-D are not stored with valve covers in place, the introduction of water through the cylinder valve of these cylinders is not considered credible. As previously discussed, the cylinders are stored with the valve in the 12 o' clock position.

Since the valve is a right angle valve with its opening parallel to the ground, water must flow against gravity to enter the valve, then negotiate a right angle to enter the cylinder. No physical process is available to cause the water to flow in this manner.

Cylinder valve failures by corrosion in storage area C-745-D may be detected during the annual inspections. Procedures require examination of the cylinder valve for corrosion and damage during the inspection. If a cylinder valve is damaged by corrosion, a small quantity of water may enter the cylinder. As discussed in Sect. 3.1, the resulting reaction products will plug the hole caused by the conosion. This plug precludes further introduction of water. Due to the accessibility of the cylinder valve for inspection, the protection afforded the cylinder from direct water impingement by the skirt, and the formation of a plug that precludes further water intrusion, it is considered credible that the cylinder valve failure in C-745-D will be successfully detected before a critical configuration is formed.

Each cylinder is equipped with a threaded plug that facilitates cleaning. Cylinder plug failures will exhibit signs of external corrosion which will increase the probability of detection. Procedures require the examination of cylinder plugs for corrosion and damage during the annual inspections.

Like the cyiinder valves, the cylinder plugs are protected from direct water impingement by the cylinder skirt. Ar discussed below for cylinder wall failures,it will take an extended period for the cylinder plug (threed area) to corrode to failure. A deposit forms and hydrates over a long period of time. Due to the extended time required for corrosion and deposit fonnation and hydration, it is not considered possible for water to enter the C-745-D c)linders via the plug between annual inspections.

If water did enter the cylinder at the plug, an insoluble layer would be formed over the UF,

6

27 i

l precluding an immediate critical configuration. Therefore, this criticality accident scenario is not i

i 1

considered credible.

Due to the orientation of the cylinder in the saddle, corrosion failures of the cylinder wall that occur in the vapor space are more likely to be identified during inspections than those occurring in the l

solid space. Reference 28 lists a corrosion rate of 4.38 mils / year for cylinders in storage. This corrosion rate is conservative when applied to the a I wt % "U cylinders stored in C-745-D primarily due to the difference in storage methods. As discussed in Sect. 2, these cylinders are stored on concrete saddles on a concrete pad; the data used to derive the corrosion rate was primarily for depleted cylinders stored on wooden saddles on the ground or stored directly on the ground. The time required to corrode through a thin-walled cylinder was estimated in order to evaluate the l

potential for detecting corrosion spots before a breach. (It should be noted that this estimate is conservative as it does not account for the additional time required for deposit formation and I

hydration following the breach.) The thickness of a thin-walled cylinder, such as some of those stored in C-745-D,is 0.3125 inches.' Therefore, the time required for corrosion to penetrate the wall of a thin-walled cylinder is calculated:

(0 3125 inches) = 71 years (0.00438 inches / year)

Failure to detect corrosion on the upper sides and top of the cylinder during multiple inspections would have to occur to allow the corrosion to progress to a breach. Due to the visibility of corrosion that occurs on the upper half of the cylinder, the multiple inspections that will occur before breach, and the slow rate of corrosion, it is considered credible that such corrosion will be detected and repaired before breaching the cylinder. If the corrosion went undetected until breach, Sect. 3.1 indicates that the UF and water reaction products would plug the hole precluding further introduction of water and a critical configuration.

Corrosion of the cylinder wall leading to breaches in the solid space will occur on the lower sides I

and bottom of the cylinder. As discussed above, the corrosion will progress at a relatively slow rate.

Failure to detect this corrosion during multiple inspections would have to occur to allow the corrosion to progress to a breach. As discussed in Sect. 3, the scenario in which a solid space breach occurs and goes undetected for a long period of time has occurred at PORTS. It sho'dd be noted that a comprehensive cylinder inspection program was not in place during the period that the corrosion and

(-

breaches are thought to have occurred at PORTS. It is not considered credible that normal corrosion l

failures of the cylinder wall on the lower sides and bottom of the cylinder would remain undetected given the current annual cylinder inspection. Therefore, it is not considered credible that accident

l 28 scenarios involving solid space breaches due to wear or corrosion on cylinders in long-term storage (e g., C-745 D) could result in a critical configuration.

Although the corrosion rate for cylinders stored in direct contact with the grc,und leads to an acceptable time to breach in this example, storage in this fashion is not acceptable. Storage of the cylinders directly on the ground poses hazards to the inspectors as well as the potential for the cylinders to contact and damage each other. It is not the intent of this analysis to suggest that cylinders can be stored directly on the ground without negative effects.

4.4 DELAYED BREACil(CORROSION OF DAMAGED CYLINDERS)

Delayed breach initiators occur due to corrosion of cylinders damaged by handling errors, improper storage, and external sources. In these accident scenarios, the cylinder wall is damaged, but the containment function is not compromised. Over time, corrosion acts on the site of the damage, causing the cylinder to be breached.

C-745-B Accident Scenarios. Cylinders stored in C-745-B are of the thick-wall (0.625 inch) variety. If one of these cylinders were damaged so that a portion of the cylinder wall was reduced to half its normal thickness (0.3125 inch), the time required for corrosion to breach the cylinders is 71 years. It should be noted that an event that gouges half the original thickness of the cylinder wall will in all likelihood be detected by the operator. The operator is trained to report such occurrences to the supenisor if the event goes unreported at the time of occurrence, the annual inspection should detect the damage. Due to the extended time required for corrosion to breach a damaged cylinder, the annual inspection of all product cylinders, and the interim storage ftetion of C-745-B, these initiator types are not credible.

C-745-D Accident Scenarios. The improper storage initiator is not considered applicable to C-745-D. In C-745-D, the 21 wt % "U cylinders are stored on concrete saddles on concrete pads. The 2

cylinder rests in the concrete saddles with each saddle contacting the cylinder near the stiffening ring.

The saddle presents a smooth surface to the cylinder. Therefore, the cylinder's tha mal expansion and contraction is not expected to cause excessive damage to the c)linder wall 4 lule the saddle may collect small quantities of water, the actual corrosion rate should be consistent with the assumed corrosion rate since the assumed rate modeled c)linders stored directly on the ground. Given the time required for corrosion to breach an undamaged thin-walled cylinder (71 years) and the one-year inspection frequency, a breach due to corrosion at the saddle is not considered a credible accident scenario. It should be noted that the inspector is trained to inspect the saddle for discoloration indicative of corrosion or a breach This method of storage does not result in damage to the cylinder that might enhance corrosion. In addition, no external sources (e g., adjacent facil: ties) were

1 i

29 j

identified that could cause damage to a cylinder at the C-745 D cylinder yard. This initiator,

{

therefore,is not applicable.

j lt is considered credible that handling errors d'

' quipment failures or human errors could l

cause damage to the cylinder that is compounded by corrosion. However, the cylinders stored in the C-745 D storage yard are not routinely handled or moved. Once these cylinders are safely placed in their saddles, they are not likely to incur damage that would reduce the time necessary for corrosion

)

{

to breach the cylinder. Because the damage to the cylinder may be slight (e.g., a cylinder bumps into i

another during movement), detection at the time of the event may not occur. The previous calculation of time to breach a cylinder due to corrosion assur,pd the cylinder was in an undamaged state. This j

j j

calculation assumes the time to breach is shortened because the cylinder wall is damaged. It is conservatively assumed that the initiating event (e.g., handling error) results in damage to half of the f

cylinder wall thickness. In order for the subsequent corrosion to progress to a breach, the damage l'

must be undetected initially. The greater the damage, the more likely it will be detected when it j

occurs (i.e., an error damaging one-half of the cylinder wall thickness is much more detectable than 4

an error damaging one-tenth of the cylinder wall thickness.) A handling error that damages one-half l

the cylinder wall was chosen as a conservative maximum that could occur undetected. This means j'

that it would take approximately 35 years for the subsequent corrosion to progress to a breach. Given l

the current one-year inspection interval, multiple independent failures to detect the corrosion must j

occur in order to result in a breach. It is, therefore, not considered credible that scenarios associated with accelerated corrosion due to handling errors could result in a criticality in C-745-D.

i l

4.5 THERMAL DAMAGE 1

l The only credible sources of thermal damage to the cylinders in C-745-B and C-745 D are fire and lightning strikes. Initiators of fire include aircraft crash, vehicle fires, and grass fires.

[

Fire. As previously discussed, it is not credible that an aircraft crash would impact a 2 I wt %

2"U cylinder. If the aircraft crashed in an adjacent row, the mass of the adjacent double-stacked cylinders would provide a buffer between the a I wt % :"U cylinders and the fire. Due to the barrier 4j; posed by the filled cylinder, it is not considered credible that an aircraft crash in another part o^he cylinder yard would breach a a I wt % 2"U cylinder. In the unlikely event that a cylinder is breached,~

no source of moderator is immediately available. The emergency squad is trained not to spray water on a UF cylinder. However,if water did enter a UF, cylinder through a breach, Sect. 3.1 concludes 6

that the water would form a plug or an insoluble layer over the UF, precluding an immediate 6

criticality. Based on this information, thermal damage to a cylinder due to an aircraft crash is not considered a credible initiator of a critical configuration.

t 3

)

30 Vehicle and grass fires are classified as "non-structure fires" by the fire department. Available i

data from the fire department indicates that during the last three years, there were approximately two non-structure fires per year. None of the data involved a cylinder yard.2' The volume of vehicle traffic in the cylinder yards is low and primarily limited to personnel performing inspections and moving cylinders. As previously noted, vehicle drivers in the cylinder yards are instructed to 1

l maintain a safety margin of 25 feet. Combustible materials are limited to that associated with the vehicle. Though unlikely, it is considered credible that a vehicle fire could occur in the cylinder yard.

)

However, no mechanism exists to pool leaked fuel such that the resulting fire breaches the cylinder.

i r

i It is not considered credible that a small fire due to a vehicle accident would result in a cylinder

]

breach.

A grass fire is not applicable to C-745 B due to the lack of grass around the cylinders. There is l

some grass on the outer edges of the NCS-controlled storage and in cracks in the concrete pad at C-745 D. Ilowever, due to a lack of credible ignition sources and insufficient combustible material to breach a cylinder,it is not considered credible that a grass fire in C-745-D would breach a a I wt %

zuU cylinder.

l Lightning Strike. The mean annual lightning strike density for PGDP is eight flashes per square kilometer based on Reference 30. For most cylinder yards at the plant, the frequency of a lightning strike is, therefore, approximately 0.12/yr. Since the cylinders are stored Ic,w to the ground, lightning I

is more likely to strike the utility and light poles in the yard. Iflightning were to strike a UF.

cylinder, the electrical energy would be conducted to ground via the concrete saddle. Reference 31 j

indicates that metal tanks in contact with the ground are sufficiently grounded to preclude damage l

from direct stroke lightning. Evidence of this conclusion includes gasoline storage tanks in flat areas like Florida that are routinely struck by lightning but do not develop holes or explode. In a similar fashion the UF, cylinder is grounded via the concrete saddle. Concrete is a reasonable conductor of electrostatic charge. Based on this information, direct stroke lightning is not a credible initiator of a cylinder breach.

5. ANALYSIS ASSUMPTIONS Cylinders that exceed I ut % 2"U are inspected in accordance with Procedure UE-QA 14.1 once every year.

l 2

Cylinders that exceed I wt % "U are spaced such that the inspection can detect damage or corrosion

+

i on the lower sides and bottom of the cylinder.

i f

i

31 UF cylinders that exceed I ut % "U are stored off the ground in saddles that preclude rolling of 2

+

6 the stored cylinders.

Cylinders that exceed I wt % 2"U are inspected for damage following occurrence of an earthquake or tornado at the site.

6.

SUMMARY

AND RECOMMENDATIONS The purpose of this evaluation is to justify the exclusion of the UF cylinder storage yards from CAAS coverage. This is accomplished by identifying and semi-quantitatively estimating the likelihood of critical configuration scenarios to determine credibility in two representative cylinder yards: C-745-B and C-745 D. By justifying exclusion of these two representative yards from CAAS coverage, all UF.

cylinder storage yards may be exempted from CAAS coverage. The scenarios weie methodically identified and are documented in Tables A-1, A-2, and A-3. Each scenario was divided into the two events comprising the cylinder yard criticality event tree (Fig. 3-1), the breach initiator and breach detection and repair. The likelihood of each scenario is semi-quantitatively estimated based on the frequency / probability estimate for the two events. These likelihoods are also documented in the Appendix A tables.

j None of the accident initiators analyzed for C-745-B and C-745-D result in a credible critical configuration. Since these yards are representative of all PGDP UF, cylinder storage yards, a criticality accident involving the storage of UF cylinders in any PGDP storage yard is not considered credible.

6 Therefore, the UF cylinder storage yards are excluded from the ANSI /ANS-8.3 and 10 CFR Part 76.89 6

requirements for CAAS protection.

i

7. REFERENCES l.

American National Standardfor Criticality Accident Alarm System, ANSllANS-8.3-1986, American Nuc! car Society, LaGrange Park, Illinois, August 29,1986.

2. Nuclear Criticality Safety, DOE Order 5480.'24, U.S. Department of Energy, August 12, 1992.

3.10 CFR Part 76.89.

4. Technical Justification: Uranium Enriched to Less Ihan 1 Weight Percent '"U - Safetyfor Operations at the Paducah Gaseous Diffusion Plant, KYlS-248, Martin Marietta Utility Suvices, Inc.,

March 31,1995.

5. Inventory of DOE PGDP Storage Account 150, Compiled by Carol Ewing on August 14,1995.

32

6. " Inspection of UF, Cylinders in Storage," Procedure UE-QA 14.1, Paducah Gaseous Diffusion Plant, Paducah, Kentucky.

7.

Uranium Hexafluoride: A AfanualofGoodHandling Practices, USEC-651, Revision 7, United States Enrichment Corporation, January 1995.

8.

Mallet, A.J., Water Immersion Tests ofUF, Cylinders with Simulated Damage, Union Carbide Corporation Nuclear Division, Oak Ridge Gaseous Diffusion Plant, Oak Ridge, Tennessee, November 7,1967, 9.

Letter, E.J. Barber to Tommy Wayne Hines, " Conditions After Water Fills Ullage in 1-Ton Cylmders," Martin Marietta Energy Systems, Inc., 02k Ridge, Tennessee, December 7,1992.

10. Letter, H.R. Dyer to P.D. Lassiter, " Additional Calculations for the Paducah Tiger," Martin Marietta Energy Systems, Inc., December 7,1992.

I 1. Investigation ofBreached Depleted UF, Cylinders, POEF-2086, ORNL/TM-11988, E.J. Barber et. al., Oak Ridge National Laboratory, September 1991.

12. Assessment of Potential Critical Configurations in Breached UF, Cylinders with 5 wt %

Enriched Uranium, memorandum from H.R. Dyer (MMES) and P.B. Fox (MMES) to W.R. Brock (MMES), Martin Marietta Energy Systems, July 19,1995.

l3. Afinimum Afass ofAfoderator Requiredfor Criticality ofHomogeneous Low Enriched Uranium Systems, ORNUCSDfrM-284, W.C. Jordan and J.C. Turner, Oak Ridge National Laboratory, December 1992.

I4. Myers, J. L., et. al., Testing ofTen-Ton Capacity Uranium Hexafluoride Shipping Containers, l

KF-D-2032, Union Carbide Corporation, Paducah Plant, January 1964.

l

15. Richardson, E. W. and Bernstein, S., Additional Testing of Ten-Ton Uranium Hexafluoride l

Cylinders, KY-631, Union Carbide Corporation, Paducah Plant, September 1971.

l l 6. Nuclear Criticality Safety Evaluationfor Small Penetrations into the Cascade At PGDP, NCS A l

GEN-10-02, Request No.1917, February 1997.

l

17. Nuclear Criticality Safety Evaluation for Removal and Handling of Contaminated Equipment l

at PGDP,NCSA GEN-10, Request 1663, May 1996.

l l8. The AnnualProbability ofan Aircraft Crash at U.S Department ofEnergyPaducah Gaseous Diffusion Plant, K/GDP/SAR 70, Martin Marietta Energy Systems,Inc., August 1995.

I9. U.S. Nuclear Regulatory Commission Standard Review Plan, NUREG-0800, Section 3.5.1.6, Rev. 2, July 1981.

20. Natural Phenomena Hazards Afodeling Project: Fxtreme Wind /Tornada Hazard Afodelsfor DOE Sites, UCRL 53526, Rev.1, Lawrence Livermore National Laboratory, Livermore, California, August 1985.

33

21. Design Evaluation Guidelinesfor IX)E Facilities Subjected to Natural Phenomena Hazards, UCRL 15910, Lawrence Livermore National Laboratory, Livermore, California, June 1990.

22. Basis ofInterim Operationfor the UF, Cylinder Storage Yards Paducah Gaseous Diffusion Plant, K/GDP/SAR-99, Lockheed Martin Energy Systems, Inc., Oak Ridge, Tennessee, August 1995.

23. Design Analysis and Calculations NPH Evaluationfor Stacked UF, Cylinders at Storage Yards, DAC-19045-CCA-60, Martin Marietta Energy Systems, Inc., Oak Ridge, Tennessee, June 12,1995.

24. Overviev: ofSeismic Considerations at the Paducah Gaseous Diffission Plant, KlGDPISAR-31/R1, Martin Marietta Energy Systems, Inc., October 1992.

25. Parking Next to UF, Cylinders,95-004, Industrial Safety Department, Paducah Gascous Diffusion Plant, May 3,1995.

26. Comparison ofAccident Ratesfor Two Truck Configurations, P.P. Jovanis et. al., Transportation Research Record #1249.

27. Equipment Failure and Screening-Level Human Error Data For Estimation of Accident Frequencies in Building C-360 Toll Transfer andSampling Facility at the Paducah Gascous DtJJusion Plant, K/GDP/S AR-35, Martin Marietta Energy Systems, Inc., Oak Ridge, Tennessee,1993.

28. Prediction of External Corrosion for UF, Cylinders: Results of an Empirical Method, j

ORNL/TM-13012, B.F. Lyon, Oak Ridge National Laboratory, June 1995.

29. Summary of"non-structure" fires at PGDP, compiled by Butch McKinney, August 14,1995.

30.

Strike Density for Contiguous United States from Thunderstorms Duration Records, NUREG/CR-3759, U.S. Nuclear Regulatory Commission, Washington, DC, May 1984.

3 l. Protection AgainstIgnitions Arising Out ofStatic, Lightning, and Stray Currents, Recommended Practice 2001, American Petroleum Institute, Washington, DC, March 1982.

l l

l APPENDIX A CRITICALITY SCENARIO TABLES l

l

{

i l

. _. _ ~.

~

i i

\\

k Table A-1. Postalated criticality accident scenarios for PGDP cylinder yards r

t t

Mechanism of Initiators Cause(s)

Potential -

Response

Likelihood e

breach consequences time' I. Immediate handling

a. cylinder handler failure immediate cylinder S

Failures of the cylinder handler are mechanical breach errors results in cylinder damage breach; credible. Sources of moderation include (drop, impact, or puncture) water / atmospheric atmospheric moisture and precipitation.

i moisture enters Detectiori of breach is considered likely cylinder; unsafe due to presence of operator during event l

configuration and high alerting factor of a cylinder handler failure severe enough to breach the cylinder. When the cylinder is

[

inspected following an event, the damage will be detected and repaired to limit moisture intrusion s

b. human error results in immediate cylinder S

Iluman errors in handling cylinders are y

r cylinder damage (drop, breach; credible. Sources of moderation include impact, or puncture) water / atmospheric atmospheric moisture and precipitation, moisture enters Detection of breach is considered likely -

cylinder; unsafe due to presence of operator during event.

configuration and high alerting factor of human errors i

significant enough to breach a cylinder.

{

When the cylinder is inspected following an event, the damage will be

{

detected and repaired to limit moisture intrusion t

I i

. l h

f i

~

. ~

D Table A-k Postulated criticality accident scenarios for PGDP cylinder yards (continued)

- Mechanisme of Initiators Cause(s)

Potential

Response

Likelihoo'd breach consequences tinie*

external

c. overhead equipment /

cylinder breach over M

ne overhead equipment includes utility impact during adjacent structures fall time; water /

poles and lights which will not breach a storage onto cylinder atmospheric moisture cylinder upon impact. Any damage enters cylinder; unsafe could shorten the time for corrosion to configuration breach the cylinder if the damage goes imdetected. Ilowever, it is not considered credible that the damage caused by a fallen utility / light pole would remain undetected for the 30 years required to breach a damaged cylinder by corrosion a

i i

r

~

t

[

[

l t

e 0

s l

5 Table A-1. Postulated criticality accident scenarios for PGDP cylinder yards (continued) l Mechanism of Initiators Cause(s)

Potential

Response

Likelihood breach a

consequences tiene*

d. tornado or tornado cylinder breach over W

A tornado is a credible event.. Reference missiles impact cylinder time; I indicates a tornado missile would not causing breach water / atmospheric permit the introduction of water unless a j

moisture enters missile penetrated a cylinder wall or t

cylinder; unsafe impacted a cylinder valve. Reference 1 l

configuration also indicates a tornado missile will not penetrate a cylinder wall unless corrosion has reduced the thickness of

[

the thin-walled cylinders lo less than one-half. Detection of the breach is considered credible due to high alerting factor of the event. Ilecause of their i.

nuclear criticality potential, product

[

cylinders containing a I wt % "U will 8

+

be inspected for damage within one i

week ora tornado event. When the i

cylinder is inspected following the r

event, the damage will be detected and repaired to limit moisture intrusion.

This criticality scenario is not considered credible O

8 1

m i.. m m...m

.--sua

-m a-,. _. _ _ --_'

m---

-a s-w g-e r

Table A-1. Postulated criticality accident scenarios for PGDP cylinderyards (continued) i Mechanism of Initiators Cause(s)

Potential

Response

1.ikelihood breach consequences time *

e. cylinders impact each cylinder breach over W

Although the frequency of an other due to earthquake time; earthquake is credible, storing the water / atmospheric cylinders low to the ground reduces the

)

moisture enters frequency that a cylinder is breached cylinder; unsafe due to an earthquake. Iteference I conGguration indicates that a 0.25g earthquake would not result in any cylinder failures or in stacked cylinders contacting another cylinder. Detection of breach is considered likely due to the high alerting factor of the event. llecause of their

~

I nuclear criticality potential, product cylinders containing 2 I ut % 3"U will f

he inspected for' damage within one week of the occurrence of an carthquale event. When the cylinder is inspected following the event, the damage will likely he detected and repaired to limit water intrusion. 'Ihis criticality scenario is not considered credible

f. cylinders impact each cylinders contact each W

8

'the PGDP SAR states that the low other ilne to flood (soil other; cylinder breach point within the fence is 375 feet.

imder cylinders erodes over time K/GDP/ Salt-302' indicates that the causing cylinders to roll) ~

10,000-year extreme storm wouhl not result in flooding above 370.8 feet.

K/GDP/SAR-7' <!cfmes a probable maximum flood of 369 feet and states that the historical masimum flood for the area was 347 feet. Flooding is not considered a credible means of breaching a cylinder

+

.--m --.

-- m..-.

m m

m n-

~

r i

Table A-1. Postulated criticality accident scenarios for PGDP cylinder yards (continued)

Mechanisni of Initiators Canse(s)

Potential

Response

Likelihood o

breach consegmences -

time' a

g. vehicle accident immediate cylinder S

Due to the extremely low traffic volume damages cylinder breach; in the vicinity of the cylinder yards, the water / atmospheric low speed limit (25 mph) in the area, it

[

moisture enters is not considered credible that a vehicle i

cylinder; unsafe accident resulting in a breached cylinder

[

configuration would occur. Detection of the breach is f

considered likely due to presence of personnel during or following the event

[

and high alerting factor of a vehicle i

accident severe enough to breach a h

cylinder. When the cylinder is inspected following an event, the damage will be g

detected and repaired to limit water D

intrusion L

i i

?

I b

i 1

t 0

4 e _.,,....

---

__,-m,---.r_.r-_.-------a w

me 1r W

m

.--.c--

.a m

t

'r t

Table A-1, Postulnied criticality accident scenarios for PGDP cylinderyards (continued)

I f

i Mechanism of Initiators Cause(s)

Potential

Response

Likelihood

[

breach consequences time"

h. airplane crash immediate cylinder S

Based on a conservative estimate, an breach; aircraR crash in the C-745-B and C-745-(

water! atmospheric D cylinder yards is considered credible j

moisture enters (3.lE-06/yr and 1.3E-06/yr,.

[

cylinder; unsafe respectiv'ely).5 This estimate is the

{

configuration frequency of an aircraR crashing

{

somewhere within the yard. In both

[

j yards, the a I wt % cylinders comprise

[

<10 % of the yard. Ilowever, when the probability ofimpacting the few a I wt%

{

cylinders stored in the yards is

{

considered, the frequeracy of breaching a i

t a I wt % cylinder from an aircraR crash D

[

is not credible. In the unlikely ev'ent of a f

beeach, lack of available moderator

^

precludes a critical configuration.This criticality accident scenario is not i

cmisidered credible f

i

2. delayed breach cylimler unll

a. corrosion gradual development L

Corrosion that continues undetected for (mechanical failure /

failure ofcylinder breach; more than 70 years may result in.

f corrosion of water /

cylinder wall failure. Ilowever, it is not undamaged atmospheric moisture considered credible that the annual i

eylinder) enters cylinder; unsafe inspection wouhl fail to identify l

configuration corrosion unail cylinder wall failure t

)

occurs t

l i

.m.-

..m m.

m.

~

Table A-1. Postulated criticality accident scenarios for PGDP cylinder yards (continued)

Mechanism of Initiators Cause(s)

Potential

Response

Likelihoo'd breach consequences time

• cylinder valve

b. corrosion water / atmospheric L

Corrosion that continues undetected for lealage moisture enters more than 70 years may result in cylinder; gradual cylinder valve failure. Ilowever, it is not development of hole considered credihte that the annual due to ilF; inspection would fail to identify atmospheric moisture corrosion until cylinder valve faih:re enters cylinder; unsafe occurs configuration cylinderplug

c. corrosion water / atmospheric 1.

Cmrosion that continues undetected for f<nture moistute enters more than 70 years may result in cylinder; gradual cylinder plug failure. Ilowever, it is not g

development of hole considered credible that the annual p

g-due to llF; inspection would fail to identify -

4 atmospheric moisture corrosion until cylinder plug failure enters cylinder; unsafe occurs configuration

3. delayed breach harulling

a. cylinder handler failure gradual development 1.

Failures of the cylinder handler are (corrosion of a errors results in damage to of hole if damage is credible. Detection of subsequent damaged cylinder) cylinder surface undetected; water /

corrosion depends on frequency and atmospheric moisture thoroughness of inspections enters cylinder; unsafe configuration

b. human errors in gradual development L

llaman errors in handling cylinders are handling cause damage to of hole if damage is credible. Detection of subsequent cylinder surface undetected; water /

corrosion depends on frequency and atmospheric moisture thoroughness ofinspections enters cylinder; unsafe configuration

Table A-1. Postislated criticality accident scenarios for PGDP cylinder yards (continued)

Mechanism of Initiators Cause(s)

Potential

Response

Likelihood a

breach consequences time" improper

c. cylinder stored with gradual development L

a I wt % cylinders in the C-745-Il and storage surface on the ground of hole if damage is C-745-D cylinder yards are stored on undetected; water saddles located on pads. Although atmospheric moistu-e storage of >l wt % cylinders directly on enters cylinder;imsafe the ground is possible due to shipping configuration errors, breaching a cylinder due to improper storage practices is not considered credihte. A cylinder stored in the wrong yard will be detected by material balances before corrosion causes a cylinder breach. Also the corrosion rate data assumed storage on i

the groimd D

oo exterrut

d. corrosive agents from gradual development L

The C-745-il and C-74 5-D cylinder source adjacent facilities of hole if damage is yards are surrounded by other cylinder undetected; water /

yards. Ilreaching a cylinder by corrosive atmospheric moisture agents from adjacent facilities is not enters cylinder; unsafe applicable configuration

4. thermal damage fire

a. airplane crash damage to cylinder S

Significant effects from fire would be wall or plugs; water /

limited to the area ofimpact. Adjacent atmospheric moisture double stacked cylinders would limit enters cylinder; unsafe effects if crash is not in same row as a i configuration.

wt % cylinders. See previous discussion (initiator I.h) on an aircrall crash impacting the a I wt % cylinders a

i

=_. _e --_-.

m.

m

<.2

m. m -u

-um m

1 m

- a

- u-

-irr a

!~

Tabic A-1. Postulated criticality accident scenaries for PGDP cylinderyards (continued)

Mechanism of Initiators Cause(s)

Potential

Response

Likeliliood breach consequences time *

b. vehicle fire (e.g., engine damage to cylinder S

As discussed in Sect. 4, available data fires, fire due to accident wall or plugs; water /

from the fire department indicate a involving ruptured fuel atmospheric moisture frequency of"non-structure" fires of tanks) enters cylinder; unsafe approximately two per year. None of configuration these fires involved the cylinder yards.

Combustible materials would be limited to that associated with the vehicle.

Dreaching a cylinder from a vehicle fire is not considered credible

c. grass fire damage to cylinder S

As discussed in Sect. 4, available data wall or plugs; water /

from the fire department indicate a atmospheric moisture frequency of"non-structure" fires of h

enters cylinder; unsafe approximately two per year. None of configuration these fires involved the cylinder yards.

Here is minimal or no grass in the areas containing a I wt % cylinders in C-745-D and C-754-II, respectively. A grass fire would not provide sufficient heat to breach a cylinder in these yards lightning striae d. lightning damage to cylinder I.

As discussed in Sect.1, lightning may wall; water enters strike a cylinder in storage. Ilowever, cylinder; unsafe the electrical current would be configuration conducted to ground by the saddle precluding damage to the cylinder

• S = immediate (s24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

W = s week M = s month L = <l year A

t Table A-2. Suminary of criticality scenarios for C-745-B Accident Initiator /cause Prevention / mitigation Estimate of erificality 6

identiller frequency" likelihood *

1. Immediate mechanical breaek I.a B

inspections of cylinder handling equipment /

D - Failure of the cylinder handler is a cylinder handler failure detection of breach is credible due to random event, independent of detection and causes cylinder breach (4.0 = 10 / demand

• presence of operators and high alerting factor repair of the cylinder. Altimugh the 4

= 800 cylinders / year' of event; rapid inspection and repair of cylinder handler failure is credible, it is not

= 2 lins / cylinder cylinder will limit moisture intrusion.

considered credible that the operators

= 6.4 x 10-'/ year)

Probability of failure to detect immediate would ignore an accident severe enough to breach of cylinder is 0.01. Probability of breach a cylinder and the subsequent ilF failure to follow procedure and cover release and allow the breached cylinder to damaged cylinder is 0.01 sit for an extended period of time without taking mitigative actions. As discussed in -

Sect. 3, although water may enter a cylinder, the formation of an insoluble layer o

over the UF, precludes an immediate critical configuration. Therefore, this criticality scenario is not considered credible for C-745-Il 3

a S

,1.

t

~

m

..._ _...... _._~.

t Table A-2. Suniniary of criticality scenarios for C-745-B (continued)

Accident laitiator/cause Prevention / mitigation Estimate of criticality l

n identifier frequency

• likelihood

• j l.b B

training of personnel involved in cylinder D - fluman errors in cylinder handling are human error causes cylinder handling / detection of breach is credible due random events, independent of detection breach (1.0 = 10 / demand' to presence of operators and high alerting and repair of the cylinder. Although the 4

x 800 cylinders / year' factor of event; rapid inspection and repair of human errors are credible, it is not x 2 lifis/ cylinder cylinder will limit moisture intrusion.

considered credible that the operators

(

1.6 x 104/ year)

Probability of failure to detect immediate.

would ignore an accident severe enough to

=

breach of cylinder is 0.01. Probability of breach a cylinder and the subsequent IIF failure to follow procedure and cover release and allow the breached cylinder to l

damaged cylinder is 0.01 sit for an extended period of time without taking mitigative actions. As discussed in Sect. 3, although water may enter a cylinder, the formation of an insoluble layer 4 l

over the UF. precludes an immediate l

critical configuration. Therefore, this

~

criticality scenario is not considered credible for C-745-B i

1.c D

mass of fallen utility / light pole would be D - Due to the lack of overhead equipment, f

overhead equipment causes distributed among all of the cylinders -

in general, and, more specifically, the lack cylinder breach (engineeringjudgement based impacted and would not be sufficient to of overhead equipment with a large mass l

on low number of utility poles breach a cylinder; damage that could shorten -

(e.g., overhead cranes), it is not considered j

near storage yard) the time necessary for corrosion to lead to a credible that overhead equipment could fall breach is not a factor due to the interim onto and breach a cylinder in C-745-il. As nature of cylinder storage in C-745-B previously stated, corrosion following t

damage is not of concern in C-745-Il due to i

its interim storage fimction t

i I

f i

-m u

1. --w-w P-

-^=

• t-eaW' a-eur v' O

_ - ~. _ _...... - - - _ _... -.. -.

g i

Table A-2. Sumniary of criticality scenarios for C-745-B (continued)

Accident laitiator/cause Prevention /niitigation Estimate of criticality s

identlHer frequency

• likelihood

• i, 1.d D

na/ inspection and repair ofimpacted As discussed in Table A-1,This criticality tornado or tornado missile cylinders mRer tornado scenario is not considered to be credible 1

causes cylinder breach (frequency 128-mph tornado I

4 4 x 10 / year

• x probability missile hits valve 1

0.01 -4 x 104/ year)

I.e B

storage of cylinders low to the ground /

D - As discussed in Table A-1, this earthquake causes cylinder inspection and repair ofimpacted cylinders criticality scenario is not considered s

breach (0.25g carthquake aRer the earthquake credible Ix 104/ year)'

~

I.f D

storage of cylinders on saddles that pre < lude D - As discussed in Table A-1, it is not 9

t Hooding causes cylinder rolling considered credible that a flood would g

breach (not credible)tti impact the a I wt % cylinders stored in C-745-n i

?

i t

4 D

.O

.e

=

se

\\

r Table A-2. Summary of criticality scenarios for C-745-II(continued)

Accident Initiator /cause Prevention / mitigation Estimate of criticality a

identifier irequency*

likelihood

• I.g D

vehicle speed limits and limitations on D - The a I wt % cylinders are not stored on vehicle accident causes vehicle access to cylinder yards / detection of a main thoroughfare of the C-745-B yard.

cylinder breach (engineering judgement based breach is credible due to presence of vehicle There is minimal traffic flow in C-745-B on truck accident rate in driver, or personnel looking for vehicle driver due primarily to cylinder inspections and parking tot of 1.29/103 miles' and high alerting factor of event; rapid movements. As discussed in Sect. 4, when and probability that I in 10 inspection and repair of cylinder will limit the frequency of a vehicle accident is accidents would be significant moisture intrusion combined with the~ probability that the enough to damage a cylinder) vehicle impacts and breaches a cylinder, the scenario is not considered credible. In addition, it is not considered credible that the operators would ignore an accident severe enough to breach a cylinder and 3

allow the breached cylinder to sit for an n

extended period of time without taking mitigative actions. Therefore, this criticality scenario is not considered credible for C-745-11 1.h C

D - liased on the discussion in Table A-1, airplane crash causes cylinder this criticality scenario is not considered to breach 3.1II-06/ year' into yard; be credible 3.lli-07/ year into >l wt %

cylinders

2. delayed breach (mechanical failure / corrosion of undamaged cylinder) 2.a D

annual inspections and repair; proper D-Due to the interim storage function of corrosion of cylinder wall storage / annual inspections and repair C-745-II, the inspections of product causes breach (engiriceringjudgement based cylinders, the good condition of the on inspector repeatedly failing cylinders, and the time necessary for to detect co rosion of thick-corrosion to breach a cylinder, cylinder walled cylinders) wall failure is not considered credible for the a I we % cylinders in C-745-il

~

Table A-2. Suenniary of criticality scenarios for C-745-B (continued) e Accident Initiator /canse Prevention / mitigation Estiniste of criticality identifier fregnency*

likelihood

• 2.b D

annual inspections and repair; proper D - The cylinder valve is visible and easily corrosion ofcylinder valve storage / annual inspections and repair examined dwing periodic inspections.

causes breach (engineering judgement based Detection of a failed cylinder valve is on inspector repeatedly failing considered credible The cylinder valve is to detect corrosion ofcylinder visible and there could be detectable levels valvp) ofIIF in the vicinity. Moisture entering the cylinder through the cylinder valve would enter the vapor space. Orientation of the cylinder valve during storage precludes the introduction of water into the cylinder.

liased on discussions in Sect. 4, criticality due to a leaking cylinder valve is not 3

considered credible 4-2.c D

annual inspections and repair; proper D - Due to the interim storage function of corrosion of cylinder plug storage / annual inspections and repair C-745-II, inspections of product cylinders, causes breach (engineeringjudgement based the time necessary for corrosion to cause a on inspector repeatedly failing cylinder breach, and the good condition of to detect corrosion of cylinder the product cylinders, cylinder plug failure i

plug) is no: considered credible for the a I wt %

i cylindert in C-745-Il

3. delayed breach (corrosion of damaged cylinders)- Due to the time required for coerosion to breach a damaged product cylinder, the annual inspection of cylinders, and the interim storage function of C-745-B, this mechanism is not considered credible for the a I wt % cylinders in C-745 Il

4. thermal damsge 4.a C

rapid action to extinguish fire will limit the D -Ilased on the discussion in Table A-1, fire from aircraft crash causes effects of heat this criticality scenario is not considered breach (3.l E-06/ year)'

credible i

I

. m..m

.m m

m m

z.

N

I 1

l t

s Table A-2. Sunianary of criticality scenarios for C-745-B (continued)

Accident Initiator /cause Prevention / mitigation -

Estisante of criticality 6

identifier frequency

• likelihood

• 4.b D

limiting vehicle access to cylinder yards; D - Due to the low frequency of vehicle fire from vehicle accident limited amount of fuel in vehicle tank /

traffic in C-745-B combined with the low t

causes breach (engineeringjudgement based detection of breach is credible due to probability of vehicle fires in the cylinder -

on truck accident rate in presence of vehicle driver and high alerting yard,' the probability ofinvolving a a I wt

[

parking lot 1.29/10* miles' and factor of event; rapid inspection and repair of

% cylinder (<0.I), and the low amount of f

probability that I in 10 cylinder will limit moisture intrusion combustible materials, it is not considered accidents would be severe credible that a vehicle fire woukt breach a enough to damage the fuel tank)

~

a I wt % cylinder in the C-745-B yard 4.c D

there is no grass in the vicinity of the a I wt D - Due to the lack of combustible material grass fire causes bread

% cylinders in the C-745-B yard and ignition sources, this scenario is not (engineeringjmigement based considered credible for C-745-B h

on lack ofvegetation in G

immediate vicinity of storage yards) 4.d A

D - Saddle acts as a conductor of electrical lightning causes cylinder charge; therefore, accident scenario is not breach credible l

j

• A =f> 10-8/yr 8

B = 10 afa 10'/yr C=104a f a 10'/yr l

D =f< 104/yr a

.___.__..__....__._._____m..________-____m____._________._____..._________-,.__m

.-m-.

- ~ ~ -

~m m-.. -

__.___,_____M

Table A-3. Sunianary of criticality scenarios for C-745-D 5

t Accident Initiator /cause Prevention /miligation Estimate of criticality C

identifier frequency

• likelihood I. Immediate mechanical breach I.a B

Inspections ofcylinder handling equipment /

D - Failure of the cylinder handler is a cylinder handler failure detection of breach is credible due to random event, independent ofdetection and causes cylinder breach' (4.0 = 104/ demand' presence of operators and high alerting factor repair of the cylinder. Ahhough the x 800 cylinders / year' of event; rapid inspection and repair of cylinder handler failure is credible, it is not

2 lifts / cylinder

cy' linder will limit moisture intrusion.

considered credible that the operators 6.4 x 104/ year)

Probability of failure to detect immediate would ignore an accident severe enough to breach of cylinder is 0.01. Probability of breach a cylinder and the subsequent IIF failure to follow procedure and cover -

release and allow the cylinder to sit for an damaged cylinder is 0.01 extended period of time without taking mitigative actions. As discussed in Sect.

t 3.1, although water may enter a cylinder, D

the formation of an insoluble layer over the E

UF. precludes an immediate critical configuration. Therefore, this criticality scenario is not considered credible for C-745-D G

i

~ Table A-3. Suntntary of criticality scenarios for C-715-D (continued)

Accident Initialor/cause Prevention / mitigation Estimate of criticality identifier frequency

• likelihood t

i 1.b B

training ofpersonnel involved in cylinder D - Iluman errors in cylinder handling are -

human error causes cylinder handling / detection of breach is credible due random events, independent of detection i

breach (1.0 x 10 '/ demand' to presence of operators and high alerting and repair of the cylinder. Although the x 800 cylinders / year' factor of event; rapid inspection and repair of human errors are credible, it is not x 2 lifts / cylinder =

cylinder will limit moisture intrusion.

considered credible that the operators 1.6 x 104/ year)

Probability of failure to detect immediate would ignore an accident severe enough to breach of cylinder is 0.01. Probability of breach a cylinder ahd the subsequent IIF failure to follow procedure and cover release and allow the cylinder to sit for an damaged cylinder is 0.01 extended period of time without taking mitigative actions. As discussed in Sect.

3.1, ahhough water may enter a cylinder, the formation of an insoluble layer over the UF. precludes an inunediate critical.

configuration. 'lherefore, this criticality scenario is not considered credible for C-745-D-1.c D

mass of fallen utility / light pole would be D. Due to the lack of ove head equipment, overhead equipment causes distributed between the ground and all of the in general, and, more specifically, the lack cylinder breach (engineering judgement based cylinders impacted and would not be of overhead equipment with a large mass on low number of utility poles sufficient to breach a cylinder; damage from (e.g., overhead crancs), it is not considered near storage yard) the impact could shorten the time necessary credible that overhead equipment could fall for corrosion to lead to a breach if the onto and breach a cylinder in C-745-D.

damage is not detected and repaired Due to personnel occupancy from periodic inspections and the alerting factor of a fallen utility / light pole, it is considered credible that the event woukt be detected and any damage noted and/or repaired to prevent subsequent corrosion from l

k breaching the cylinder m

k

.t I

Table A-3. Suentnary of criticality scenarios for C-745-D (continued) i Accident Initiator /cause Prevention / mitigation Estimate of critic'ality e-identiner frequency" likelihood 1.d D

na/ inspection and repair ofimpacted D - As discussed in Table A-1, this tornado or tornado missile cylinders aRet tornado criticality scenario is not considered to be causes cylinder breach (frequency 128-mph tornado credible 4

4 x 10 / year

• x probability l

missile hits valve 0.01 =

[

4 4 x 10 / year) 1.e.

B storage of cylinders low to the ground /

D - As discussed in Table A-1, this canhquake causes cylinder inspection and repair ofimpacted cylinders criticality scenario is not considered to be l

breach (0.25g earthquake aRer the earthquake credible I x 10-8/ year)'

.)

i 1.f D

storage of cylinders on saddles that preclude D - As discussed in Table A-1,it is not

?

flooding causes cylinder rolling considered credible that a flood would g

breach (not credible)'*d impact the a I wt % cylinders stored in C-745-D l

i i

?

i i

t

L

~

T Table A-3. Siemn ary of criticality scenarios for C-745-D (continued)

Aceldest Initiator /cause Prevention / mitigation -

Estimate of criticality I

a identifier fregnency*

likelihood l.g D

Vehicle speed limits and limitations on D - 7he a l wt % cylinders are not stored on vehicle accident causes vehicle access to cylinder yards / detection of a main thoroughfare of the C-745-D yard cylinder breach (engineeringjudgement based breach is credible due to presence of vehicle and are,in fact, surrounded by other on tmek accident rate in driver, or personnel looking for vehicle driver cylinders. There is minimal tralTic flow in parking lot of 1.29/10' miles' and high alerting factor of event; rapid C-745-D due primarily to cylinder and probability that 1 in 10 inspection and repair of cylinder will limit inspections. As discussed in Sect. 4, when f

accidents would be significant moisture intrusion the frequency of a ' vehicle accident is i

enough to damage a cylinder combined with the probability that the i

vehicle impacts and breaches a cylinder, the scenario is not considered credible. In I

addition, it is not considered credible that i

the operators would ignore an accident j

severe enough to breach a cylinder and allow the breached cylinder to sit for an extended period of time without taking mitigative actions. Therefore, this criticality scenario is not considered credible for C-I 745-D t

1.h C

D - As discussed in Table A-1, this i

airplane causes cylinder criticality scenario is not considered to be breach IJE-06/ year' into yard; credible IJE-07/ year into > I wt %

cylinders

[

i k

l i

b

.co.-ammmmm.-

.=

a

.A. m w.

-i.i J

a.m mm* --

u -

m 1.

ww'w w

a V-P1't1, m-w

---%w.

r=

v t

Table A-3. Suinniary of criticality scenarios for C-745-D (continued)

Accident Initlator/cause Prevention / mitigation Estimate of critic'ality frequency

• likelihood Identifier

2. delayed breach (mechanleal failure / corrosion of undamaged cylinder) 2.a D

annual inspections and repair; proper D - Ilased on the discussion in Sect. 4, corrosion of cylinder wall storage / periodic inspections and repair criticality due to corrosion of undamaged causes breach (engineeringjudgement based cylinders is not considered credible for the on inspector repeatedly failing a I wt % cylinders stored in C-745-D to detect corrosion of thin-walled cylinders) 2.b D

periodic inspection, and repair; proper D - The cylinder valve is visible and easily corrosion of cylinder valve storage / periodic i..spections and repair examined during periodic inspections.

causes breach (engineering judgement based Detection of a failed cylinder valve is on inspector repeatedly failing considered credible. There could be N

to detect corrosion of cylinder detectable levels ofIIF in the vicinity.

h-valve)

Moisture entering the cylinder throu' h the g

cylinder valve would enter the vapor space.

Orientation of the cylinder valve during storage prechides the introduction of water into the cylinder. Ilased on discussions in Sect. 4, criticality due to a leaking cylinder valve is not considered credible 2.c D

periodic inspections and repair; proper D - The cylinder plug is visible and easily corrosion of cylinder plug storage / periodic inspections and repair examined during periodic inspections. A causes breach (engineeringjudgement based failed cylinder plug would show indications on inspector repeatedly failing of deposit formation due to exposure of the to detect corrosion of cylinder UF. to atmospheric moisture. Detection of plug) a failed cylinder plug is considered credible. Itased on discussions in Sect. 4, criticality due to a leaking cylinder plug is not considered credible s

I

~

t Table A-3. Susuntary of criticality scenarios for C-745-D (continued)

Accident Initiator /cause Prevenlion/ mitigation Estimate of criticality likelihood identifier frequency *

3. delayed breach (corrosion of damaged cylinders) 3.a C

inspections of cylinder handling equipment D - Based on the discussion in Sect. 4, criticality due to corrosion breaching cylinder handler failure causes damage that is attacked (engineeringjudgement based damaged cylinders is not considered by corrosion on inspector repeatedly failing credible for the a I wt % cylinders stored in to detect corrosion of thin-C-745-D walled cylinders) 3.b C

training of personnel involved in cylinder D - Based on the discussion in Sect. 4 human error causes damage handling criticality due to corrosion breaching that is attacked by corrosion (engineeringjudgement based damaged cylinders is not considered on inspector repeatedly failing -

credible for the 2 I wt % cylinders stored in to detect corrosion of thin-C-745-D ej, walled cylinders) 3.c D

proper storage / periodic inspections and D - a I wt % cylinders in C-745-D are,

improper storage causes repair stored on concrete saddles on concrete corrosion (engineering judgement based pads; breaching a cylinder due to improper on violation of operational storage practices is not applicable procedures) 3.d D

D - The C-745 D cylinder yard is surrotmded by other cylinder yards; corrosive agents cause corrosion (engineeringjudgement based breaching a cylinder due to adjacent.

on distance to nearby facility) facilities is not applicable -

4. thermal damage e

4.a C

rapid action to extinguish the fire will limit As discussed in Table A-1, this criticality the effects of the heat.

scenario is not considered credible fire from aircraR crash causes breach (1.3 E-06/ year)'

i 4

______.__.,i_____..____.a..A.6--a

. m -2.

--- u 7-

>A

%m

-1 t

4 O

9 Table A-3. Sumainty of criticality scenarios for C-745-D (continued)

Accident Initiator /cause Prevention / mitigation Estimate of criticality Identifier frequency

• likelihood 4.b

,D limiting vehicle access to cylinder yards; D - Due to the low frequency of vehicle fire from vehicle accident limited amount of fuel in vehicle tank /

traffic in C-745-D combined with the low causes corrosion (engineeringjudgement based detection of breach is credible due to probability of vehicle fires in the cylinder on truck accident rate in presence of vehicle driver and high alerting yard, the probability ofinvolving a a I wt parking lot of I.29/10' miles' factor of event; rapid inspection and repair of

% cylinder (<0.I), and the low amount of and probability that I in 10 cylinder will limit moisture intmslon combustible materials, it is considered accidents would be severe incredible that a vehicle fire would breach a enough to damage the fuel a I wt % cylinder in the C-745-D yard tanks) 4.c D

there is minimal grass located on the edges of D - Due to the lack of combustible material grass fire causes corrosion the area used for storing 21 wt % cylinders.

and ignition sources, this criticality scenario i

(engineeringjudgement based it is not considered credible that buming such is not considered credible for C-745-D D'

on lack of vegetation in a small amount ofgrass would generate M

immediate vicinity of storage sufficient heat to damage a cylinder. In yards) addition, there are no credible ignition sources in the area 4.d A

D - Saddle acts as conductor of electrical lightning causes cylinder charge; therefore, accident scenario is not breach credible 4

P

• A =f> 10 '/yr B = 10'82fa10d/yr C = 1042f2104/yr D =f< 104/yr i

1

=

1 6

~.

-m m

i 5

A-23 APPENDIX A REFERENCES I.

Iksign Analysis and Calculations NPH Evaluationfor Stacked UF, Cylinders at Storage Yards, DAC-19045-CCA-60, Martin Marietta Energy Systems, Inc., Oak Ridge, Tennessee, June 12,1995.

2. Final Safety Analysis Reportfor Paducah Gaseous Diffission Plant, KY-734, originally issued March 29,1985.

3. Local Drainage Analysis ofthe Paducah Gaseous Dif]itsion Plant, Paducah Kentucky, During an Ertreme Storm, K/GDP/S AR-30, R.O. Johnson et. al., Oak Ridge National Laboratory, May 1993.

4. Probable Maximum Flood Calculation for the Paducah Gaseous Diffusion Plant, Paducah.

KentucAy, K/GDP/SAR-7, R.O. Johnson et. al., Oak Ridge National Laboratory, August 1992.

5. The AnnualProbabilityofan Aircraft Crash as ths U.S Department ofEnergy Paducah Gaseous Diffission Plant, K/GDP/S AR-70, R.J. Anderman, Jr. and B.R. Everman, Oak Ridge National Laboratory, August 1995.

G.

Fault Tree Analysisfor Potential UF, Release Accidents in C-360 Toll Transfer and Sampling Facility at the Paducah Gaseous Dif]itsion Plant, KI GDP/SAR-33, Martin Marietta Energy Systems, Inc., June 30,1993.

7.

Letter from R.W. Schmidt to J.J. Turner, dated April 19,1994, " Peak Cylinder Handling Rates for Safety Analysis," Martin Marietta Energy Systems, Inc.

8.

Basis ofinterim Operation for the UF, Cylinder Storage Yards Paducah Gaseous Diffission Plant, K/GDP/SAR-99, Lockheed Martin Energy Systems, Inc., Oak Ridge, Tennessee, August 1995.

9.

Jovanis, P.P.. e* al, Comparison ofAccident Ratesfor Two Truck Configurations, Transportation Research Record 1249.

l