ML20138L473
| ML20138L473 | |
| Person / Time | |
|---|---|
| Site: | 07001113 |
| Issue date: | 02/19/1997 |
| From: | GENERAL ELECTRIC CO. |
| To: | |
| Shared Package | |
| ML20138L471 | List: |
| References | |
| NUDOCS 9702240260 | |
| Download: ML20138L473 (22) | |
Text
._
4
- O b
ISA Summary GE Wilmington Dry Conversion Process 3
J j
GE Nuclear Energy
- jn Wilmington, NC
]V February 19,1997 i
i SupplementalInformation to License Renewal:
SNM-1097, Docket 70-1113 O
- =22
- 888 E8817 w '
C PDR
dc Dry Conversion Process Table of Contents Title Page Table of Contents i, ii, iii introduction 1
g ISA Teams 1
Procedures, Techniques and Tools 1
Process Organization 2
Methodology 2
)
Building Design Basis 5
General DCP Areas 5
i 1
Loss of moderation control in the DCP Facility due to water ingress 5
]
Fire / Explosion within the DCP Facility 6
Radiological exposure of personnel to airborne uranium 6
Asphyxiation of worker from excessive concentrate of nitrogen 7
Failure of the distributed process control system 7
Cylinder Storage and Handling 7
Loss of contained external to DCP leading to release of UF to the 7
6 environment Vaporization 8
UF6 release due to a loss of UF6 cylinder integrity within the 8
autoclave iV i ofiii
1 4
[
t Table of Contents Title Page i
Vaporization (cont'd) 8 UF6 release to the room due to failure of UF6 piping 8
l Cold trap rupture leading to release of UF6 9
l Criticality due to backflow of steam moderator into the cylinder 9
l i
Conversion 9-Loss of hydrogen containment leading to fire or explosion including 9-loss of HF containment and uranium containment i
Loss of moderation control leading to criticality in the kiln and 10 l
associated reactor and outlet hopper Criticality in HF areas caused by release of particulate uranium to 10 unfavorable geometry liquid system 6
10 Criticality in the HF area caused by a release of unreacted UF O
9=eous ur aium to uas re 8eometry Loss of moderation control due to backflow ofliquid from the HF 11 area Exposure of an operator to HF, steam, or radiological hazards from 1I backflow of reactor contents during recycle operations Personnel injury cause by moving machinery and rotating parts 11 Powder Outlet 12 Excess moderation in the cooling hopper 12 Homogenization 12 Excess moderation by introduction of hydrogenous material such as 12 pore former, die lubricant, water or oil Radiological exposure of personnel to airborne uranium caused by 13 loss of containment i
Personnel injury caused by rotating parts on the sifter and 13 homogemzer ii oflii
Table of Contents Title f.!!Et Blending, Slugging, Granulation and Tumbling 13 Excess moderation by introduction of too much hydrogenous 13 material, for example pore former or die lubricant, as a result of errors in weight, additive or mixing Excess moderation as a result of wet powder 14 Excess moderation as a result ofoil 14 1
Radiological exposure of personnel to airborne uranium caused by 14 loss ofcontainment Personnel injury caused by moving machinery and rotating parts 15 Powder Pack 15 Radiological exposure ofpersonnel to airbome uranium caused by 15 loss of containment
- ]
Personnel injury caused by moving machinery and rotating parts 15 Container Storage And Handling 15 Exceed moderation restricted area limits by overfilling storage 16 containers, introduction of too much hydrogenous material, or 4
violating spacer requirements for containers Large powder container falls on a person 16 HF Area 16 Criticality in HF area caused by excess uranium in the off-gas 16 collected in unfavorable geometry liquid system Release of fluorides through the stack to the environment 17 Employee exposure to excessive HF 18 Environmental spill ofliquid HF 18 Fire or explosion in the HF building or off-gas line 18 O
iiioflii a
c ISA Summary GE Wilmington Dry Conversion Process Introduction An integrated safety analysis (ISA) was performed to support the new dry conversion process at the GE Wilmington site. The analysis was conducted in accordance with Chapter 4, Integrated Safety Analysis, of SNM License 1097, submitted April 5,1996, as amended. The purpose of the analysis was to determine potential accident scenarios and risk, to ensure that controls are in place to prevent and/or mitigate accidents, and to rank the controls in relation to the risks which they mitigate so that the proper level of assurance measures can be applied to each. The broad scope of the analysis included criticality safety, radiological safety, environmental protection and industrial safety, including chemical safety and fire protection. This report summarizes the important results of the safety study for the dry conversion facility. Detailed records are retained p
on-site.
O ISA Teams The ISA was performed by teams of people of different expertise who systematically analyzed the hazards in a focused meeting environment. Each team included expertise in criticality safety, radiological safety, industrial safety and environmental protection. Also included were process and controls engineers. Because the process had never been operated at the Wilmington site, experts in the operation of existing plants utilizing this technology participated along with GE personnel.
Procedures, Techniques and Tools The ISA. team used the Hazop method and limited use of the What If method to complete the analysis. The hazop analysis was facilitated by and documented in a software package known as HazopPC, developed by Primatech, Inc.
This software was customized for GE to specifically capture nuclear hazards. Consultants from Primatech provided training to team participants early in the project, and facilitated the preliminary sessions.
Guidance for performing the analysis came from Primatech and from i
Page1of18
\\
l i
i Guidelines for Hazard Evaluation Procedures'. As the project neared completion, an O
internal procedure, P/P 10-20, Integrated Safety Analysis, was developed to define how I
i future ISAs would be performed and how the results ofISAs would be used to manage
)
risk in the operating factory.
j e
j Process Oreanization l
The DCP ISA was broken into the following segments and analyzed using the method i
shown:
I i
j Cylinder Movement - Hazop Vaporization - Hazop
)
Conversion - Hazop Powder Outlet - Hazop
)
1.
Homogenization - Hazop l
i Blending, Precompaction, and Granulation and Tumbling - Hazop HF Treatment - Hazop Containers / Storage - Hazop Powder Pack - What if j
I-lQ Methodology Hazards were identified using historical input from a variety of sources including safety information from other dry conversion facilities and public domain documents from other sites in the fuel cycle. The relationships between the hazards and DCP process deviations l
were developed through guided brainstorming and event visualization techniques.
Where the hazop methodology was used, each process segment was divided into logical i
nodes. For each node, the team first considered the intended operating conditions. Next they considered the possible deviations from the design intention using a list of parameters and guidewords. Typical parameters included:
I Flow j
Temperature Pressure 4
Composition Level
[
Weight s
' Guidelinesfor Ha:ard Evaluation Procedures, Second Edition with Worked Examples, Center for Chemical Process Safety of the American Institute of Chemical Engineers, New York,1992.
Page 2 ofI8 e
i-r
e i
4 Guidewords were used to identify possible deviations from normal. Example guidewords Q
included:
i l
No/None More l
Less As Well as Part of Reverse
)
Other than i
i Once possible deviations were identified, possible causes of the deviations were hypothesized. The consequence of the deviation was estimated through experience or technical evaluation. The severity of each consequence was rated on a three-point scale, j.
shown in Exhibit 1. The likelihood of the accident occurring with no controls in place i
j was estimated from experience on a three-point scale, shown in Exhibit 2. Safeguards or i
controls that prevent or mitigate the consequence were identified. Outside of the team environment, the controls were ranked in importance by the unmitigated risk, where:
l (Risk)unmitisaied = (Severity) x (Likelihood)onmiti,,,,4 3
4 The level of unmitigated risk was used to determine the level of assurances that would be I
applied to the controls.' Risk ranking is summarized in Exhibit 3.
[
Finally, the likelihood of the consequence occurring with the controls in place was "g
- estimated. Final risk was used by the team to judge the adequacy of the controls, where
!v (Risk)r:n.1 = (Severity) x (Likelihood)mitig.i.a If the final risk wasjudged by the team to be too high, recommendations for improvement were captured and reviewed with management. Recommendations that were adopted l
were tracked to completion.
l Consequences associated with UF. and HF were estimated using past experiences of GE Wilmington, FBFC, and other uranium processing facilities and experiences in the i
chemical industry. Criticality consequences were estimated using standard analytical methods. Radiological consequences were estimated by extrapolating our experience j
with the existing processes. Environmental, industrial, and chemical consequences, including fire and explosion, were estimated with the aid of material safety data sheets, j
chemical interaction information, and various modeling techniques, including emission 4
calculations and dispersion models for fence-line concentration.
O Page 3 of I8 i-
Exhibit 1 Severity of Conseauences Severity Radiologicall Environmental /
Ranking Criticality Industrial / Chemical exposure to an indivkfual member of fatality e
+
3 ine public off-site (5 rem,30 mg intake e
medical treatment for a member of the of U) public off-site severe exposure to an employee (400 permanent disability e
e rem internal plus extemal dose or 230 off-site contamination above regulatory mg intake of U) standards exceed regulatory hmits for employee serious injury e
e 2
exposure (5 rem,10 mg U internal) exceed permit hmits or regulatory limits lost time injury e
reportable release OSHA recordable injury exceed administrative hmits on daily air e
e 1
samples, lung counts, bioassays, e
first aid contamination, TLDs e
exceed internallimits 10% of annual exposure limit spillinside containment Unusual incident (UIR)
Exhibit 2 Likelihood Level Frequent y Likelihood 3
more frequent than once Likely to occur in the immediate future every two years 2
every two to fifty years Likely to occur during the life of the facility 1
less frequent than once every Not likely to occur during the life of the facility 50 years.
O incredible Likelihood is indistinguishable from zero.
Exhibit 3 Risk Matrix C
3 Mid-level o S
.Rbk.
n e 8
- 2 Low Risk Mid-level :
e e Rbk q r u i e t 1
Low Risk Low Risk Mid-level -
Rbk n y C
1 2
3 e
Likelihood O
Page 4 of 18
i e
Buildine Desien Basis O
The~DCP facility has been designed to meet the relevant building and fire protection standards. The design criteria were taken as bounding assumptions by the ISA teams with respect to external events, of which heavy rain, lightning strikes, and high wind are considered credible. The DCP facility is designed with a structural integrity providing a safety factor of two. It is built to withstand a sustained wind speed of 120 mph. Although the seismic activity is not considered credible, the DCP facility has been designed to meet the lateral acceleration requirements for Wilmington, North Carolina, as contained on the contour maps in ASCE 7-93. The electrical classification is Class I, Division. 2, Group B in close proximity of the conversion kilns, where there is some risk of H escape.
2 j
Elsewhere within DCP the electrical hazard classification is non-hazardous. The GE Wilmington site is located above the 100 year flood plain and thus is not considered susceptible to storm surge or flash floods.
j What follows is a summary of the more significant potential accidents identified and discussion of the controls that are in place to protect against them.
l General DCP Areas PURPOSE: To provide a facility where moderation is restricted, fire or explosion is Q-unlikely, and radiological exposure or contamination is minimized.
I ACCIDENT: Loss of moderation control in the DCP Facility due to water mgress.
j PROTECTION: The DCP process areas are designated as Moderation Restriction Areas I
(MRA). The building is designed to be water tight. The roof of the DCP building is designed to prevent water leaks and to provide an early warning of potential degradation.
Its special multi-layered construction incorporates a reinforced concrete slab roof deck, an EPDM membrane, a drainge system of extruded polystyrene insulation, a concrete slab i
over geotextile fabric, and a fully adhered butyl sheet. Degradation of the external barrier is detected by a visual observation of water in the drainage system. Also, there are no 9
penetrations on the roof of the building, and the roof slopes from east to west to convey rain water away to a gutter and downspout system on the west side of the building.
Air handling equipment is designed to minimize the possibility of water entering the Moderation Restricted Areas in DCP.
Moisture detectors and alarms are fitted downstream of the last coil on the air intake to DCP. While small amounts of water on the floor do not present a safety problem, the ground floor of the DCP building is raised in relation to the existing FMOX ground floor to prevent in-leakage of water from rising
- water, j
O l
Page 5 of I8
= - -
,i
1; 1.
i i
i ACCIDENT: Fire / Explosion within the DCP Facility O
PROTECTION: The DCP building is designed to comply with relevant fire codes.
1 Interior. doors and walls provide fire resistance. A comprehensive fire alarm and i
detection system includes smoke and heat detectors as well as H2 and HF detectors. Fire j
j alarm horns annunciate in the DCP building and in the HF building. Alarm signals are relayed to both the DCP control room and to the Site Emergency Control Center.
1 i
I A' CO. fire suppression system protects the HVAC ductwork and the HEPA filters.
2 j
Consistent with the Moderation Restriction Area, only carbon dioxide fire extinguishers 4
are installed within the DCP building. A water sprinkler system protects the HF building.
]
3 Operating and maintenance personnel receive fire fighting emergency training and are periodically tested by unannounced emergency evacuation exercises.
I i
H is handled and processed within closed systems. Ignitable concentrations of H are 2
2 J
prevented by positive mechanical ventilation. Hydrogen sensors are located within each kiln room, and continuously monitor atmosphere for unacceptable concentrations of I
i hydrogen.
i The DCP kiln generates a low specific surface area product, which is resistant to j
spontaneous oxidation in storage. Further protection against oxidation includes powder cooling, nitrogen blankets, and interrupted mixing cycles.
- O J
ACCIDENT: Radiological exposure of personnel to airborne uranium.
i PROTECTION: A general feature of the design of the DCP facility is the containment and ventilation philosophy to provide defense in depth against the escape of airborne j
3 uranium into areas in which personnel would not normally be required to wear personal I
protective equipment. Specifically, airbome uranium is contained by nitrogen seals at the j
connections between the processing equipment and storage / transfer containers. Uranium processing activities are housed within ventilated rooms, designed so that the lowest pressure is within the rooms themselves and air flows from outside to inside the rooms.
Each room has HEPA filtration to trap particulates within the room, and the air intake and extraction ducts are arranged to draw air downward and away from personnel work areas i
and provide adequate air changes to avoid static air pockets. Ultimately, the extracted air j
j is filtered through another HEPA filter bank before discharge to the environment.
l Redundant fan capacity and fan failure alarms are provided on the DCP HVAC system.
Operating procedures require floor operators to inspect the plant areas on a routine basis.
)
Existing GENE practices require operators to clean up visible contamination as soon as it j-is discovered. Tight fitting connections equipped with inflatable seals are installed at all i.
container filling and dump stations. Where flexibility is required in the powder feed iO pipework, rubber boots and internal metal sleeves are used to limit powder spillage in the B
Page 6 ofI8 1
event of a rubber boot failure. Operating and maintenance personnel are required to wear t
Q
- the designated personal protective equipment when breaking primary containment on l
uranium processing equipment.
A large powder spill within a containment room are evident when the operator views the f
operations through a window or enters the room to remove the container.
{
1 ACCIDENT: Asphyxiation of a worker from excessive concentration of nitrogen.
PROTECTION: Nitrogen piping systems were designed to exceed the anticipated operating pressures, and are pressure tested during installation. In the event of a leak in a process room, positive ventilation provided by the HVAC system is designed to supply adequate air changes. The HVAC system is equipped with redundant fans to assure i
reliability.
Plant procedures for entering confined spaces protect workers during' i
maintenance of the large vessels such as the homogenization blender.
ACCIDENT: Failure of the distributed process control system f
PROTECTION: All valves are designed to fail in a safe position in the event of a total control system outage. Active safety controls are implemented separately from functions l
that may be needed for normal operating functions and access, resulting in a more robust O
sonware operating system. Changes to the sonware are subject to strict version control per procedure. Important controls are functionally tested before start up and periodically thereaner.
l t
Cylinder Storare and Handline PURPOSE: Safe movement of UF feed material into and out of the facility.
)
6 ACCIDENT: Loss of containment extemal to DCP leading to release of UF6 to the
]
environment.
j l
l PROTECTION: UF6 cylinder integrity complies with the 30B type specification defined 1
- in USEC 651 Rev. 7, Jan 1995. The process design ensures that cylinders are handled only when the UF6 inside them is in the solid phase. Cylinder lining equipment has been designed and tested to handle the load. Operator training in UF6 cylinder handling includes the use of forklin trucks, cranes and hoists. Cylinders are moved with the cylinder valve cover in place and liRed to the minimum lin height consistent with the terrain. Overpressurizatica of a cylinder due to fire is prevented by strict control of the inventory of hydrocarbon fuels and combustible materials in the UF6 cylinder storage area 0
s aescrisea i= nuaso 1491. existi=8 amiaistr tive co trois ror the receipt a reie se Page 7 of I8 1
I 4
of UF6 cylinders ensure that overweight cylinders or enrichments greater than 5% nU are 2
O
=ot Froce sed ia oce.
i Vaporization PURPOSE: Supply UF6 gas to the reactor where it is converted to UO2 powder.
t ACCIDENT: UF6 release due to a loss of UF6 cylinder integrity within the autoclave.
PROTECTION: The autoclave has been manufactured to meet the ASME pressure vessel code, and is pressure-tested annually. The rated pressure exceeds the normal operating pressure of the UF cylinders. The integrity of the door seal is tested each time 6
a cylinder is loaded into the autoclave. A door latch proximity switch is interlocked with the cylinder heating cycle. Loss of seal pressure disables the autoclave heating sequence.
The internal pressure within each cylinder is verified to be below atmospheric pressure before heating as a safeguard against overpressurization during the heating cycle.
l The UF6 cylinder pressure is controlled at the desired set point by monitoring the UF6 line l
pressure downstream of the cylinder, and uses feedback control to regulate the current supplied to the autoclave heaters. Active controls prevent overpressurization of the i
cylinder by de-energizing the autoclave heaters on high temperature at the cylinder surface, or high temperature inside the autoclave.
j l
UF6 leak detection is installed as part of each autoclave system, and draws a sample from the autoclave annular space. The annular space is swept with heated dry nitrogen to prevent reaction with air in the event of a UF6 leak. This nitrogen may be fed at high j
j pressure to suppress potential leakage of UF6. As a result, a leaking cylinder can contmue 1
feeding safely to the reactor until the cylinder is empty and the hazard is reduced.
j To protect workers from exposure during cylinder installation, personnel are required to wear appropriate personal protective equipment when connecting and disconnecting the UF6 line pigtail to the cylinder.
ACCIDENT: UF6 release to the room due to failure of UF6 piping.
l PROTECTION: The piping integrity is assured by 100% radiographed welds on all UF6 l
. lines. UF -resistant gaskets are used at flanges, and bellows-sealed valves minimize stem 6
i leaks. The UF6 line is further protected against failure due to hydraulic rupture by automatic temperature control of the trace heating with high and low temperature alarms and high temperature interlocks that disable the affected section of trace heating.
1 i
Page 8 of 18 i
)
4 ew
-, +, -
m
s UF6 leak detectors are installed in each autoclave room. In the event of a UF leak in an 6
C autoclave room, the ventilation to that room is shutdown to contain the UF inside.
6 ACCIDENT: Cold trap rupture leading to a release of UF6
- PROTECTION: The cold trap has been manufactured and tested in compliance with ASME and CODAP pressure vessel codes. The cold trap heaters are disabled on high temperature, high pressure, or high weight. Valve line-ups are interlocked to prevent the inadvertent transfer of UF6 to unintended destinations, for example, cylinder-to-cylinder or cylinder-to-cold trap during conversion.
ACCIDENT: Criticality due to backflow of steam moderator into the cylinder.
PROTECTION: During operation of the plant, a positive flow of gas is maintained from the UF6 line to the reactor. Active controls automatically isolate the cylinder from the reactor in the event that positive pressure differential between the cylinder and reactor is lost. The UF cylinder skin temperature must be above a predetermined minimum value 6
before the UF6 feed valve can be opened.
O PURPOSE: To convert UF6 into ceramic-grade UO powder suitable for pelletizing.
2 This process includes the recycle of discrepant UO2 powder to reduce fluoride content.
ACCIDENT: Loss of hydrogen containment leading to fire or explosion. (Also loss of HF containment leading to worker injury or loss of uranium containment leading to personnel exposure.)
PROTECTION:
The primary protection against loss of containment is the kiln itself.
The kiln seals are oflabyrinth construction with the interspace pressurized with nitrogen.
The kiln is protected from overpressure by an automatic pressure control system.
Pluggage of the sintered metal filters at the gas discharge of the kiln could result in a pressure higher than desired. The filters are kept clean by a computer-controlled sequence that blows back the metal filters with nitrogen. During operation the pressure drop across the sintered metal filters is continuously monitored. Deviations from normal result in audible / visual alarms in the control room. Furthermore a high kiln pressure interlock stops the UF feed, followed by an orderly shutdown of the hydrolysis and 6
pyrohydrolysis steam and H2 feeds.
The kiln and associated vessels are housed inside a ventilated containment area. H2 O
detectors in the reems automatic iir stop the H2 and uFe feeds to the afrected conversion Page 9 of 18
kiln. HF detectors send audible / visual alarms to the control room, and the operators are O
trained to manually shutdown the gas feeds to the affected kiln.
ACCIDENT: Loss of moderation control leading to criticality in the kiln and associated reactor and outlet hopper.
l PROTECTION: To ensure that the steam fed to the reactor and kiln is dry, saturated i
l steam is superheated using electric heaters equipped with automatic temperature controls regulated by the computer control system. All steam lines are electrically trace heated and insulated. A low temperature condition activates audible / visual alarms in the control room. The heat tracing is equipped with redundant heating circuits.
Low steam temperature fed at the superheater or downstream of the superheater is sensed and interlocked to the steam feed control to the resctor.
Both hydrolysis steam and pyrohydrolysis steam supplies are protected by these controls.
A low temperature inside the reactor or on the reactor wall is sensed and interlocked to the steam and UF6 feed control. A low temperature interlock on the exterior of the kiln barrel also stops the steam and UF6 feeds. Similar alarms and interlocks are activated by thermocouples located inside and on the exterior of the outlet hopper.
q ACCIDENT:
Criticality in HF area caused by release of particulate uranium to b
unfavorable geometry liquid system.
PROTECTION: The primary protection against entry of particulate uranium into the offgas system are the shA. red metal filters housed in the top of the reactor. Further protection is provided by a back-up sintered metal filter unit installed in the offgas line downstream of the reactor. The integrity of both sets of filters is assured by continuous l
monitoring of the pressure drop across the fRm. The kiln filters are periodically backpurged with nitrogen during operation to minimize powder build up.
l Passive and active controls in the HF area that prevent criticality are described in the HF section.
ACCIDENT: Criticality in the HF area caused by a release of unreacted UF6 aqueous uranium to unsafe geometry.
PROTECTION: An excess of hydrolysis steam (normally a factor of two) is fed to the reactor to provide complete conversion of UF6 to the intermediate UO F. Furthermore, 22 sufficient pyrohydrolysis steam is p ovided to convert all the UF6 to UO2F and to UO in 2
2 the evet ofloss of the hydrolysis steam flow. A high UF6 flow interlock cioses the UF6 feed trJve and starts sweeping nitrogen to the injector nozzle. Similarly, low steam flow Page 10 of 18
l 1
i to the reactor stops UF6 feed. These control prevent less than stoichiometric flow of
[(
steam to the kiln and thus a loss of UF6 in the off-gas.
j i
j Other potential causes of a loss of steam flow to the reactor, for example, an open manual i
p vent valve in steam line, an open pressure relief valve on steam superheater, are mitigated j
by the-low flow interlock described above, operating and maintenance procedures j
including a startup checklist, routine inspections, and vendor-recommended periodic i
maintenance.-
l l
l Passive and active controls in the HF area that prevent criticality are described in the HF j
i section.
i l
ACCIDENT: Loss of moderation control due to backflow ofliquid from the HF area.
]
PROTECTION: The off-gas flow created by the condenser eductor and exhaust fans
]
prevents backflow. Condensation of HF offgas at the condenser creates an additional f
favorable draft. A passive barometric leg, by virtue of the height difference between the l
reactor offgas line and the vapor-liquid separator downstream of the HF condenser, l
prevents siphoning ofliquid to the reactor. Specific engineered controls are summarized i
in the HF section.
. n
.During shutdowns, protection against backflow is afforded by administrative controls V
which require physical isolation of the reactor from the HF system.
ACCIDENT:
Exposure of an operator to HF, steam, or radiological hazards from backflow of reactor opunts during recycle operations.
PROTECTION: In the event of a low pressure alarm at the inflatable seal at the recycle feed station, the recycle feed valve closes, preventing airborne contamination at the recycle port. The recycle station is located inside an enclosed kiln room. Operators are required to wear the designated personal protective equipment when making or breaking powder feed connections. A double valve arrangement equipped with a nitrogen purge in between prevents backflow of steam and hydrogen into the recycle container. A low pressure alarm on the recycle feed station alerts the operator to a condition which could result in off-gas flowing to the unicone.
ACCIDENT: Personnel injurf caused by moving machinery and rotating parts.
PROTECTION: The kiln drive units, reactor and recycle screw motors are protected adequately by machine guards. The start up checklist includes a step to check that these guards have been refitted following maintenance. A site-wide procedure defines lock-
, O out't 8-out Practices.
Page 11 of 18 1
1 4
O Powder Outlet PURPOSE: To cool the UO2 powder and ensure that it meets moisture criteria applicable to the Moderation Restricted Area, and to transfer the powder into transfer containers.
ACCIDENT: Excess moderator in the cooling hopper.
- PROTECTION: Controls in conversion that ensure dry powder in the kiln also limit the availability of moisture to condense on the powder. To keep steam from flowing into the cooling hoppers, a valve lock system is installed at the outlet of the kiln. This lock consists of two valves with a dry nitrogen purge between them. The cooling hoppers are further protected by continuous redundant dew point analyzers which measure the free moisture in the carrier nitrogen ns. A high moisture interlock stops the UF feed to the 6
kiln and initiates a controlk hutdown of the steam flow.
The control system automatically isolates the powder in the cooling hopper until the powder can be transferred under conditions favorable to criticality control requirements.
To prevent overfilling of the unicone on discharge from the cooling hopper, the computer system monitors the weight dispensed into the unicone via the process weigh scales, and i
terminates the sequence when the set weight is reached. In addition, there is a high weight interlock on the scale at the container filling station that will closes the cooling hopper discharge valve.
Homogenization PURPOSE: To produce a UO2 powder that is physically and chemically uniform for subsequent pressing into pellets and sintering.
Homogenization breaks down soft agglomerates, removes hard particulate material, and mixes the sifted powder to produce a uniform batch.
ACCIDENT: Excess moderation by introduction of hydrogenous material such as pore former, die lubricant, water or oil.
PROTECTION: Upstream controls in the conversion area limit the moisture content in the powder. Upstream controls in the recycle area similarly limit the moisture content of the recycled U30s. A high mass interlock closes the powder feed valve and limits the amount of surface-adsorbed water available for redistribution from the surface of the powder to one spot within the homogenizer.
A computer-assisted administrative control prevents the introduction of feed material containing pore former or die lubricant.
i Page 12 ofI8
l
,e I
l l
\\
The gearbox for the screw and arm assembly inside the homogenizer contains a special O
non-hydrogenous low moderation oil. The procurement and use of this oil is controlled via the maintenance planning and control system.
i l
ACCIDENT: Radiological exposure of personnel to airborne uranium caused by loss of containment.
PROTECTION: To prevent airborne contamination, the sifter shaft seals are purged with nitrogen. The sifter and homogenizer are housed within a ventilated containment area.
For additional protection, a dedicated containment hood surrounds the sifter and magnetic separator, A high powder level alarm is fitted on the oversize line from the sifter to alert the operator that the oversize bottle requires changing. Administrative controls including procedures and operator training ensure that the oversize outlet valve is closed before the bottle is removed.
l To prevent overfilling of the unicone on discharge from the homogenizer, the computer system monitors the weight dispensed into the unicone via the process weigh scales, and terminates the sequence when the set weight is reached. In addition, there is a high l
weight interlock on the scale at the container filling station that will closes the homogenizer discharge valve.
l ACCIDENT: Personnel injury caused by rotating parts on the sifier and homogenizer.
PROTECTION: There is an interlock that stops the rotation of the homogenizer screw and arm when the inspection hatches are opened on the top or bottom of the homogenizer.
l Also, the sifter rotation stops whenever the top inspection cover is opened or the end cover is removed. A site-wide procedure defines lock-out/ tag-out practices.
j Blending. Sleeeine, Granulation and Tumbling l
PURPOSE: The blending operation creates a powder which is of a specific, uniform enrichment. Additives improve compatibility. Slugging followed by granulation, forms a flowable, pressehle, granular solid suitable for high quality pressing and sintering.
Tumbling improves flowability of the powder.
ACCIDENT: Excess moderation by introduction of too nach hydrogenous material, for example pore former or die lubricant, as a result of errors in weight, additive, or mixing.
PROTECTION: Additives are prepared in separate equipment to prevent mix-ups during processing. Additives are weighed on an accountability scale and labeled. The additive bottle size limits the mass of moderator that can be added at one time. Unique couplings O
en the additive betties and the additive Ports assist in the centrei ef the addition.
Page 13 of 18
O The blend plan defines and documents the quantity and type of additive required for each blend. The computerized traceability system tracks the concentrations of additives and moisture in the powder fed to the blender. Computer systems ensure that each additive addition complies with the blend plan. Additive bottles are barcode labeled, and the computer systems prevent the feed valve from opening if the bottle does not match the expected barcode. The computer system provides a final comparison of blend weight to that expected from the blend plan. Local programmable logic controllers lockout the feed valve on high weight.
Rotation of the blender is assured by a sensor to improve the uniformity and reliability of the additive mixing step.
In the tumbling operation, additive preparation is protected by similar controls. Only one bottle is available in a tumbling room, and that bottle is administratively controlled so that it is assigned to the correct tumbler. The additive bottle size is limited, ensuring the necessary safety margin for criticality safety control.
ACCIDENT: Excess moderation as a result of wet powder.
PROTECTION: Upstream controls in conversion limit moisture' content in the powder.
O Similarly, upstream controls in the recycle area limit moisture in the U 0s. A high mass 3
interlock closes the powder feed valve and limits the amount of surface-adsorbed water available for redistribution from the surface of the powder to one spot within the homogenizer.
ACCIDENT: Excess moderation as a result of oil.
PROTECTION: Limited volumes of oils and greases are used on the slug press. The gearbox for the screw and arm assembly inside the blender contains a special non-hydrogenous low moderation oil. The procurement and use of this oil is controlled in the maintenance planning and control system. Grease is external to the granulator and tumbler and is not considered a significant hazard because ofits physical separation from the powder and the small quantity used.
ACCIDENT: Radiological exposure of personnel to airborne uranium caused by loss of containment.
PROTECTION: The blend / slug / granulate and tumbling processes are designed to protect workers from radiological exposure with the same protection described in the General
<h DCP Area section of this report. Additional controls prevent overfilling of the unicone at Page 14 of 18
9 the blender filling station or the bicone at the granulator filling station: the computer
(.
system monitors the weight dispensed into the container via the process weighscales, and terminates the sequence when the set weight is reached. In addition, there is a high weight interlock that closes the appropriate powder filling valve.
ACCIDENT: Personnel injury caused by moving machinery and rotating parts.
PROTECTION: There are interlocks that stop the rotation of the screw and arm when the inspection hatches at the top or bottom of the blender are opened. Containment around the rotating turret of the slug press limits access to the moving parts. The inspection hatch on top of the granulator is fitted with a hard-wired interlock which stops the motor when the hatch is opened. A hard-wired door lock on the tumbler room prevents operation of the tumbler unless the door is locked.
Powder Pack To dispense UO powder or granules from DCP storage containers to PURPOSE:
2 approved containers for shipment to customers.
' ACCIDENT: Radiological exposure of personnel to airborne uranium caused by loss of I
containment.
I PROTECTION, The container integrity is assured administratively by observing the operating procedures and recommended maintenance. Operators are required to wear appropriate personnel protective equipment when ' connecting or disconnecting powder feed connections. An inflatable seal assembly is fitted at the container feed station.
Powder packing operations are carried out within a ventilated hood, so that the operator can handle and seal the packed product through arm slits. The slits have adequate face velocity to reduce the risk of escape of airborne contamination.
I ACCIDENT: Personnel injury caused by moving machinery and rotating parts.
PROTECTION: The powder packing facility is housed in a separate room adjacent to the
. main storage area on the first floor of the DCP building. The powder packing equipment includes machine guards which protect operators from moving parts.
Container Storaee And Handline PURPOSE: To store large containers of powder containing various enrichments and additives until the powder is needed at pellet press operations.
O.
Page 15 of18
i j,,,.
i ACCIDENT: Exceed moderation restricted area limits by overfilling storage containers, iO introduction of too much hydrogenous material, or violating spacing requirements for l
containers.
l
![
PROTECTION: Powder is stored in high-integrity closed containers which are routinely l
inspected and maintained. Container gross, tare and net weights are tracked on the l
l computerized nranium material accountability system. A significant deviation from the j
official tare weight triggers a discrepancy alarm and halts any subsequent material
}
}
transactions involving the affected container.
Upstream process controls provide assurance tliat the uranium product meets the criteria l
[
for hydrogen content within the stomge area.
j l-A fixed support grid assists operating personnel to maintain the required minimum spacing between containers. Additional storage is authorized provided it takes place in l
I 3 -
approved locations.
i 4
l ACCIDENT: Large powder container falls on a person.
4 j
PROTECTION: The use of cranes and hoists for lifting and transporting contamers is
[
covered in a site-wide safety procedure that spells out safe practices and periodic inspection requirements. Operators are trained in the safe use of this equipment.
]
i
~
HF Area i
j PURPOSE: To produce nominal 50% aqueous hydrofluoric acid from the hydrogen j
fluoride off-gas generated during conversion of UF6 o UO2 and load the HF product into t
{
tank trucks for shipment to customers. The facility also scrubs the condenser off-gas to
[
remove residual HF fumes before release to the environment. Dilute HF scrubbing liquid is typically loaded into a truck for delivery to the site waste treatment facility to remove the HF before the water is released to the environment.
i j
ACCIDENT: Criticality in HF area caused by excess uranium in the off-gas collected in i
unfavorable geometry liquid system.
1 i
PROTECTION:
Dual inline sintered metal filters upstream in the conversion proces?
reduce the risk of uranium carryover to the HF area. In the unlikely event that both filters fail, each conversion line liquid HF stream is equipped with an individual uranium detector. if uranium is detected, the liquid is diverted to a favorable geometry tank known as the polluted tank. If the uranium concentration exceeds a higher trip level, the UF6 feed is stopped, followed by an orderly shutdown of the steam feeds to the affected kiln. The three HF streams combine in a common stream which passes through another O
uranium detector. iruranium is detected here. the uFe and steam reeds to aii three kiins Page 16 of I8
.?
3~
are stopped, and the HF produced during shutdown is diverted to a favorable geometry
, h taak.
The HF condensers are of favorable geometry, and the cooling capacity of the condensers l
is great enough to trap the UF6 in the event of a catastrophic release from the concersion kiln. The chilled water supply is protected by a low flow interlock at the condenser j.
which stops the UF6 flow to the kiln. The chilled water supply is also protected by a high
. temperature alarm and administratirontrols on the set-up of the system.
2.
Key manual valves that are opened to prepare the system for maintenance are included in pre-startup checklists, operating procedures, and training to prevent inadvertent by-pass of safety controls during operation.
A high liquid level in the vapor liquid separator stops UF6 feed to the affected kiln, and l
protects against unanalyzed HF condensate backflowing to the unfavorable geometry i
washing column. If the high level is coincident with uranium concentration detected by the uranium detector, both UF6 feed and steam flow to the kiln are stopped. Another protection against uranium in the washing column is a high liquid level interlock on the
{
polluted tank that stops UF6 flow to all kilns.
There is a high level sump alarm that annunciates locally in the HF building and remotely in the DCP control room. Administrative controls require that any leakage of unanalyzed
- .^
HF from a piping failure prior to the uranium detectors collected in the dike be sampled 4-and analyzed for uranium. This material is pumped back to the HF storage tanks or out to the mobile tanker only if the uranium concentration meets established release limits.
i i
i ACCIDENT: Release of fluorides through the stack to the environment.
PROTECTION: The kiln off-gas is scrubbed to remove fluorides from the off-gas before it is released to the environment. This process equipment is located inside a building, protected from freezing and severe weather. The temperature and pressure at the top and bottom of the wash column are continuously monitored and alarms locally in the HF building and also in the DCP control room. A low flow of water in the wash column stops the UF6 feed to the kiln (s). In the event of a failure in the water supply, an emergency feed water tank is maintained in a ready state to continue scrubbing until the remaining fluorides in the system are purged from the kiln lines. A high liquid level in the base of the wash column stops UF6 feed to the kilns. The HF stack emissions are administratively monitored to provide a feedback loop so that corrections can be made if the scrubbing process is insufficient to meet requirements.
O Page 17 ofI8
.t u.*
i 1
ACCIDENT: Employee exposure to excessive HF.
O PROTECTION: The HF equipment is designed to maintain integrity. The HF offgas line is PTFE-lined and rated for 250_deg C. Equipment reliability is enhanced by periodic I
maintenance. The integrity of the air-driven HF pump is protected by a interlock that shuts off the air supply in the event of high discharge pressure. Preventative maintenance
- of the pump diaphragms is performed in accordance with vendor recommendations.
l l
The building is equipped with safety showers in case of personnel exposure to liquid HF.
i Use of personal protective equipment is required when making or breaking containment.
Operators are trained in safe use of personal protective equipment. Operators are required to wear appropriate personal protective equipment during sampling. This requirement is including in operating procedures and training.
i HF fumes in excess of the alarm limit activates an alarm in the control room which is audible in the HF building. Additional waming lights are activated at the entrances to HF building. Periodic inspection of the remote HF building is required by the operators. An emergency HF scrubber is available for scrubbing the room air.
l l
All tanks are vented to the wash column. Tank trucks are vented to the wash column.
The tanker loading lines are washed with DI water into the tank truck before the lines are disconnected. A vacuum break valve facilitates complete draining of the tanker feed line before breaking containment and minimizes the potential for spills.-
ACCIDENT: Environmental spill ofliquid HF.
l PROTECTION: The' HF storage tanks are installed within a dike designed to contain i
liquid HF spills. The volume of the diked area is sufficient to contain a spill of the entire contents of the largest tank. The dike comprises two concrete slabs with the top _ slab t
coated with an acid resistant medium. A grid is installed between the two concrete slabs which gravity drains to a sample point. Periodic sampling allows for early detection of a breach in the top slab. The tanker loading bay also drains into the main dike and is similarly contained with a concrete slab coated with an acid -resistant coating.
i ACCIDENT: Fire or explosion in the HF building or off-gas line.
PROTECTION:
The eductor that controls the kiln pressure is operated with nitrogen j
instead of air. The off-gas from the wash column is diluted to below the lower explosive
}
limit of hydrogen by use of an air blower.
i 4
lO i
Page 18 ofl8 i
=. -.
-