ML20216G511

Evaluation of UF6 Cylinder Yard Requirements for Criticality Prevention/Detection Issues Basis for DOE Position

ML20216G511
Person / Time
Site:	Portsmouth Gaseous Diffusion Plant, Paducah Gaseous Diffusion Plant
Issue date:	06/30/1997
From:	Carter J, Knief R, Roth J AFFILIATION NOT ASSIGNED, ATI
To:
Shared Package
ML20216G423	List: ML20216G417 ML20216G511 ML20216G540
References
K-D-6589, NUDOCS 9709150210
Download: ML20216G511 (57)

Text

y 4

~"

K-25 7

n f[ OAK RIDGEL-9 K

L -25 SITE EVALUATION OF j

UF CYLINDER YARD REQUIREMENTS 6

p,

=

FOR CRITICALITY PREVENTION / DETECTION T/

ISSUES n......

A 4

,,,, 7-1,

BASIS FOR DOE POSITION v

.g r

1

$p J,

+

fC 4

l'.

Q 1

L

.m ;

(

3 June 1997

+

1

{

p.

}

Prepared for F

d U. S. Department of Energy i

by

[,

J. Roth, ATI Corp (28K DRT27C) g j.

.;.a b

~^

R. A. Knief, Ogden Environmental, Inc. (AGB90)

N d

J. C. Carter, J. C. Carter Associates, Inc. (HAJ05)

-F R. W. Schmidt, Lockheed Martin Energy Systems, Inc.

i:V M

K. D. Keith, Lockheed Martin Energy Systems, Inc.

.4 N

[hf

.)

anx 4

[

-) {!jg.)

i L

l gl; L

M l

a

r s

e..

_ o 9 312 sy; ra

- l+:

~

> ~

4, 9709150210. 970821 i,

k PDR ADOCK 07007001 R.i. -

B PDR yqr __

"WC

? :P

~? ~,

n iMANAGEDBY? '

[ LOCKHEED MARTM ENERGYSYSTEM% MC.'

E-: FOR THE UNITED STATES ;

-r DEPARTMENT OF ENERGY I n,,;

L 4

'E :. ~

e t

e e

DISCL A!ME R This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, not any of their employees, makes any warranty, express or implied, or assumes any legal habihty or *esponsibility for the accuracy, completeness, or use-luiness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manu-facturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors empressed herein do not necessarily state or reflect those of the United States Government or any agency thereof e

o e

6 1

K/D-6589 EVALUATION OF UF CYLINDER YARD REQUIREMENTS 6

FOR CRITICALITY PREVENTION / DETECTION ISSUES BASIS FOR DOE POSITION June 1997 Prepared by J. Roth, ATI Corp. (28K-DRT27C)

R. A. Knief, Ogden Environmental, Inc. (AGB90).

J. C. Carter, J. C. Carter Associates, Inc. (llAJOS)

R. W. Schmidt, Loe.kheed Martin Energy Systems, Inc.

K. D. Keith, Lockheed Martin Energy Systems, Inc.

for LOCKHEED MARTIN ENERGY SYSTEMS,INC.

managing the Oak Ridge K-25 Site and Oak Ridge Y 12 Plant and managing Environmental Management Activities at Paducah Gaseous Diffusion Plant and Portsmouth Gaseous Diffusion Plant undct contract DE-AC05 840R21400 for the U.S. DEPARTMENT OF ENERGY 1

CONTENTS EX EC UTI VE S UM M A RY......................................................... ES 1.

I NTR ODU CTI ON.,.......................................,.........

1 l.1 P u rpo s e.........................................

.1 1.2 Issues in a Decision to Exclude Cylinder Yard CAAS Coverage....................... I 1.3 Summary of Basis for DOE Position............................................ 2 1.3.1 Relationship of Cylinder Yards Containing Li to DOE Position....................... quid UF. Liquid Muerial

................................ 2 1.3.2 Relationship of Cylinder Yards Containing Solid UF Material to DO E Pos it io n........................................................ 3 2.

DESCRIPTION OF CYLINDERS, OPERATIONS, UF. CliEMISTRY, AN D C RI TI C A LITY........................................................... 5 d

2.1 Cylinders Used for Containing Enriched Product.................................. 5 2.2 Cylinder llandling and Storage Operations....................................... 7 2.2.1 Overview of Enriched Material Flow..

...... 7 2.2.2 Cylinder liandling Operations......................................... 8 2.2.3 S t o rag e M od es................................,.................... 9 2.2.4 Cylinde r i nspectio ns.................................................

12 2.3 U F. Ch e m i stry...........................................................

13 2.3.1 Chemistry of the UF. ll 0-l!F-Fe System..................................

14 2

2.3.2 Physical Description of Development of a llole in a UF. Cylinder.............

15 2.4 Nuclear Criticality Safety for UF. Storage.....................................

16 2.5 CA AS Decision Factors 18

3. CYLINDER YARD CRITICALITY ISSUE.......................................... 21 3.1 Requirements for Criticality Accident Alarm System...,...............,.,...... 21 3.1.1 Com pliance Plans................................................ 21 3.1.2 S tandard ANSI /ANS-8.3............................................ 22 3.1.3 N RC Regulatory G uide 8.12......................................... 23 3.1.4 Previous DOE Requirements..............

23 3.2 Double Contingency Evaluation.....................

.................... 26 3.3 Current Cylinder Yard Controls for Criticality Prevention...................,..... 26 3.3.1 Current Controls for Cylinder Handling...................

27 3.3.2 Current inspection Controls in Cylinder Yards.

..... 27 4.

BASIS FOR CURRENT CRITICALITY PREVENTION......

29 4.1 Accideri Scenarios - Cylinder Integrity.......................................... 29 4.1.1-Handling and Storage Operations..................................... 29

4.1.1.1 Cy li n d er d rop................................................. 29 4.1.1.2 Corrosion induced failure.................................. -......., 31

'4.1.2 Natural Phenomena Failures............................................ 31 4.1.2.1 Earthq uake........................................

4.1.2.2 Fl ood i n g.....,..............................................

4.1.2.3 W i n ds.........................................

4.1.2.4 Con c lu s ion....................................

Fire induced failures....................................

4.1.3 4.2 Cylinder Reliability Conclusion.............................................

~

..... 34

5. NEED FOR ADDITIONAL MEASURES TO PREVENT /F" GATE CRITICALITY...... -

35 5.1 Cylinder Handling Controls.....................................,,........... 3 5 5.1.1 Storage of Liquid UF. Cylinders......................................... 35 5.1.2 Storage of Solid UF, Cylinders.......................................... 3 5 5.1.2.1 Small hole - solid phase...........,............................. 3 6 5.1.2.2 Large hole - solid phase......................................... 3 6 5.1.2.3 Small hole - vapor phase......................,................. 37 5.1.2.4 Large hole - vapor phase.....................,.................. 3 7 5.1.2.5 Cylinder storage yard fires.....,,................................ 3 8 5.1.2.6 Cylinder storage yard personnel entry requirements.,.........,,...,. 38 6.

CONCLUSIONS AN D POSITION...................,............................ 4 0 R E FE REN C ES................................................................ 4 5 4

4

-9

_J

EXECUTIVE

SUMMARY

An open United States Nuclear Regulatory Cornmission (NRC) certification issue remains against the Paducah Gaseous Diffusion Plant (PGDP) and Portsmouth Gaseous Diffusion Plant (PORTS) cylinder yards operated by the United States Enrichment Corporation (USEC) with regard to the need for a Criticality Accident Alarm System (CAAS). A CAAS would be used to monitor the various cylinder yards at the facilities that contain cylinders oflow enriched (1.0 to 5.0 wt% Um) uranium (LEU). The contention is that a breach of one of these cylinders could lead to - i undetected, inadvertent nuclear criticality. This report provides an in-depth review of the criticality issue for the USEC cylinder storage yards at PGDP and PORTS and establishes the basis for exclusion from CAAS requirements.

Cylinders containing LEU are safe from criticality concerns unless a substantial quantity of moderator is mixed among the uranium atoms. Therefore, steps in the process of storing cylinders in the open yards at PGDP and PORTS have been to ensure that (1) the cylinders designed and fabricated for long. term service as multiple use containment devices are handled to maintain integrity and (2) the cylinders are inspected to insure the environment does not cause undetected loss ofintegrity. Experience and research has shown that in the event of cylinder integrity loss, the introduction of water into the breached cylinder is sufficiently slow that there is more than ample time to detect the breach and take action to prevent l

criticality conditions from being achieved.

ES. I Background

}

The GDPs have operated for over 50 years (including the Oak Ridge GDP) without a criticality accident and without CAAS in any ofits cylinder yards. The liquid cylinder cool-down areas and temporary storage areas adjacent to facilities that process or transfer enriched UF. are covered by the CA AS systems in these buildings. Both DOE and USEC have enriched material located in non-CAAS covered cylinder yards. However, most cylinders containing enriched material b: longing to USEC are located in short-term storage cylinder yards adjacent to the cascade or toll transfer facilities that are covered by CAAS. No criticality accident has occurred in a cylinder during this entire period of operation because 1) the cylinders are tough and effective storage containers which prevent water from entering',2) handling procedures developed from many years of experience minimize the potential for cylinder damage which may cause a site for water entry to develop, and 3) a moderated critical mass of U* is difficult to achieve inside a cylinder even if water enters it.

The requirements for CAAS coverage originate from NRC regulations and DOE Orders requiring monitoring of operations involving enriched uranium in quantities greater than a minimum critical mass in accordance with the American Nuclear Society (ANS) standards ANS 8.1 and 8.3. These standards provide for an exclusion to CAAS coverage where criticality is not credible or CAAS provides no reduction in total risk. The analysis and investigations performed by the GDPs and the experience GDP operators have had with UF. handling and storage have previously led DOE to conclude that cylinder

' Water is an effective neutron moderator that is necessary to create a criticality condition

_ C)hnder Yard CAAS Exclusion Basis Paper ES.1 June 1997

yard criticality was not a credible event, and CAAS coverage of cylinder yards LEU provided no reduction in total risk.

ES.2 DOE Position The DOE believes that an exclusion to the CAAS requirements for the areas where solid low-enriched UF.issts ed isjustified because criticality is not credible and a CA AS would provide no reduction in the total risk. The key elements in this position are:

There are relatively few cylinders oflow-enriched UF located in areas that are not already covered by a CAAS; For this small exposed population oflow-enriched UF. cylinders, the steel cylinder provides a robust barrier to the addition of moderator to the UF., with limited opportunity for cylinder handling or other activities to damage a cylinder severely enough to either cause an immediate breach or to initiate the accelerated corrosion that could lead to a breach; Required inspections during handling and storage create a high probability that any damage that could lead to a breach would be detected before a breach occurred; The physical and chemical properties of solid UF in contact with water and a steel container act to severely retard the entry of water, and further retard the movement of water or other hydrogen-l-

bearing reaction products into the bulk of the cylinder. This behavior provides a period of years after a breach occurs t efore a criticality becomes possible; Periodic cylinder insp:ctions and other detection opportunities create a high probability that any breach would be detected during the years before suf0cient moderator for criticality could enter the cylinder; and, CAAS coverage of cylinders containing solid UF provide no total risk reduction to personnel and may even increase personnel risk.

ES.3 Discussion Cylinder handhng operations are crucial to safe operations because, when the cylinders are placed in the storage yards in an undamaged state, there are only two other causes/ types of cylinder failures that could allow moderator to interact with the UF. :

~

long-term corrosion (cylinders used for enriched material storage are 1/2 to 5/8-inch thick); and natural or man made phenomena causing an immediate breach.

Cylinder handling begins at the withdrawal facilities with full liquid cylinders? Controls have been established over the years to ensure cylinders containing liquid are handled with extreme care. (Liquid-filled cylinders are placed in special areas with CAAS coverage until fully solidined.) Once cooled, the cylinders are lifted by a special vehicle and transported to other cylinder yards. Each cylinder is

" Cylinders are filled by weight. Once solidified, there is a substantial void volume amounting to approximately 40% of the full eylinder volume.

C3 nder Yard CAAS Exclusion. Basis Paper ES 2 June 1997 h

m

methodically and carefully traded by Material Accountability with cylinder locations precisely Edocumented. Control measures governing the vehicles, handling, and stacking have been developed over the years of operations at the GDPs to ensure that cylinders are handled with care to prevent cylinder damage that would then require repairs or might result in a release of material. Generally, when cylinders are adjacent to buildings they are covered by CAAS, and when they are in the cylinder yards away from buildings, there is no CAAS coverage.

The cylinder itself is the primary control to prevent criticality condition. Typically, a product cylinder is a 30- or 48 inch diameter, thick walled (1/2 to 5/8 inch thick), steel cylinder that is air tight. At cylinder filling, UF, is high-purity and, thus, has very limited moderator content. After cool-down the cylinder is below atmospheric pressure and_will remain so unless the cylinder valve is opened or the cylinder void space is breached. Unless a breach occurs, moderator (water) cannot nter the cylinder to e;ause criticality The integrity of the cylinders is maintained because cylinder handling controls and inspections are employed to ensure that cylinders have not deteriorated or been damaged suf0ciently to be breached.

The reliance on inspections of cylinder integrity has proven to be suf0cient, primarily due to the reaction chemistry of UF. with water. UF, chemistry, and especially interactions with water and steel, have been extensively evaluated. Small holes found in a very few cylinders have shown that the reaction of UF.

with moisture at the hole results in the following: HF created by the chemical reaction attacks the steel at the interface, and forms complex compounds ofiron and uranyl Duoride, which results in a barrier that prevents or retards further moisture penetration.

In larger holes, the intrusion of moisture results in the reaction of the UF. and then hydration of the compounds formed. Fmther moisture intrusion occurs very slowly over time, and the penetration needed to form a critical mass and geometry at 5% enrichment takes years to accomplish (greater than 10 years).

On the basis of these Ondings, DOE concluded that cyli. der inspections at speciGed intervals were practical and suf0cient to (1) prevent small releases of uranium and ilF from continuing over a period of time and (2) prevent the relatively few cylinders with enriched material from becoming a criticality concern.

To ensurr the adequacy ofinspections for the prevention of releases and eventual establishment of conditions criticality and/or mitigation of releases, administrative controls were placed on cylinder handling operations to minimize the possibility that a cylinder containing product or depleted material would be breached or damaged. The controls, some of which are discussed previously, include:

minimization of the height above the ground that cylinders could be carried, the rigging used to carry them, handling procedures in the presence of other cylinders, and

+-

stacking requirements.

These controls, coupled with the inspections, were considered adequate to ensure that no criticality condition could develop within the cylinder yards that are not caused by CAAS.

'A 48-inch diameter cylinder is limited to 4.5% enrichment ifit is to be shipped off site.

Cylmder Yard CAAs Exdusion Basis Paper ES4 June 1997

ES,4 Conclusions In this review, the current practices have been re-examined with the perspective of(l) whether CAAS coverage is needed in cylinder yaids containing stored enriched material, in order to provide an adequate level of assurance that workers are protected in the yards from criticality or (2) whether that level of protection is provided through the prevention measures already in practice or can be provided through additional administrative controls on the cylinder handling and storage that extend prevention to resolve issues not previously considered.

No new controls were found to be necessary; however, one control was considered important enough to emphasize or to extend the current practice:

1, Limit the use of water in the cylinder yards according to a pre-fire plan that determines when water or dry chemicals should be used on cylinders containing enriched materials Given the (1) existing and potential additional controls proposed above,(2) reliability of cylinder integrity, (3) UF. chemistry, and (4) inspection cycle, criticality is not realistically possible. Thus the original determination that no CAAS is required for the cylinder yards is supported.

Cylinder Yard CAAS Exclusion Basis Paper -

ES 4 June 1997

1. INTRODUCTION The Paducah (PGDP) and Portsmouth (PORTS) Gaseous Diffusion Plants (GDPs) process large quantities of uranium hexa 11uoride (UF.). Much of this material is then stored, in solid form, in large area lots or " yards" around the processing facilities at these sites. In the UF., the isotope U2" may be at the naturally occurring assay (about 0.7 wt %), depleted (less than 0.7%), or enriched (greater than 0.7%).

With the handling and stcrage of enriched material greater than or equal to I wt % U2", there is some risk of an inadvertent criticality resulting from accidental breach of a UF. container, or cylinder, concurrent with appropriate conditions to moderate the UF., DOE has judged the potential for such a criticality incident as not credible and, thus, has not required monitoring capability of these storage areas to alert personnel working in and around these areas.

The GDPs (PGDP, PORTS, and the now-shutdown plant in Oak Ridge) have been operated by DOE and its predecessor agencies for more than 50 years without an inadvertent criticality. During this time, the UF. cylinder storage yards did not have criticality accident alarm system (CAAS) coverage. Recently, the production facilities at the GDPs were leased to the United States Enrichment Corporation (USEC).

Concurrent with the leasing of these facilities to the USEC, the Nuclear Regulatory Commission (NRC) l was tasked by Congress to regulate the nuclear safety of the leased portions of these plants. NRC then promulga'ed rules which included a provision (1) that criticality alarm coverage be provided for all areas where enriched material is handled or (2) that an exclusion to this requirement be requested and justified.

l USEC subsequently requested an exclusion to this requirement for certain plant areas, including the cylinder yards, bcsed largely on the prior DOE requirements and positions. DOE Orders allow an exclusion from CA AS coverage for areas containing material enriched to 1.0 wt % and above where the judged probability of criticality accidents is less than 104/yr.

1.1 Purpose The purpose of this paper is to provide an in depth review of the basis, and provide additional support, for DOE's historical conchision that CAAS is neither necessary nor beneficial in the cylinder storage yards. This basis includes evaluation of(l) extensive analysis, research, and experience with UF and storage cylinders and (2) understanding of criticality issues and controls developed over the life of plant operations. This paper also re-examines the controls established for cylinder handling and other t

operations in the cylinder storage yards that are integrally related to the basis established for cylinders and concerns related to criticality safety.

1.2 Issues in a Decisit.n to Exclude Cylinder Yard CAAS Coverage The issues associated with the USEC request for an exclusion from CAAS coverage of the USEC product-cylinder yards are (1) whether criticality in a cylinder is a credible accident scenario and (2) whether CAAS would provide any protection for workers in these cylinder yards or in adjacent nearby areas. These two issues can be addressed by the investigation of the following four questions:

1.

Is cylinder integrity sufficiently robust to preclude or limit failure to a manageable threat?

Cylinder Yard CAAS Exclusion Daus Paper 1

June 1997 l

l o

2. Can water or other moderator enter a cylinder undetected and in sufficient quantity to dissolve enough uranium to produce a critical configuration?

3.

In the event that such moderator were to enter a cylinder, can adequate moderator mixing with the uranium bearing material occur to cause criticality?

4.

In the event of criticality, will an alarm enable personnel to evacuate the area quickly enough to avoid harmful radiation doses?

As stated in standard ANSI /ANS 8.3', CAAS should be incorporated in operations where a significant reduction in total risk would be achieved. Historically, DOE has concluded that significant risk reduction would not be achieved. And as interpreted from 10 CFR Part 76, absence of risk reduction must be 2

demonstrated tajustify an exclusion from CAAS coverage.

USEC's submittal of August 1996' provided their basis for exclusion of the Cylinder Storage Yards from CAAS coverage. The NRC response on February 28,19974, concluded that the basis provided was insufficient to demonstrate that a large break failure of a cylinder was improbable and, thus the probability of criticality is negligible. The position of the NRC Staffis that CAAS must be installed unless betterjustification, including detailed definition of controls, is provided. The subsequent discussions of this paper addresses (1) the four questions presented above and (2) the NRC staff's response to the USEC submittal. An overview of the basis developed in this paper and the subsequent position developed from this basis follows.

1.3 Summary of Basis for DOE Position l-As discussed in Section 1.2, the main issues associated with cylinder yard CAAS concern the following:

the credibility of criticality in the cylinder yards and whether CAAS would provide risk reduction.

PGDP and PORTS have 14 and 21 cylinder storage yards, respectively. Most of these yards are still underjurisdiction of DOE and contain cylinders oflegacy depleted UF.. Relatively few cylinders at each plant contain enriched UF.; many of these cylinders have only a remaining " heel" of enriched material, with the remaining cylinders either partially full or full to the weight limit. Although there are no restrictions on which of the yards can contain the enriched material, only a few yards at PGDP contain enriched material. Likewise, there are several yards that contain enriched material at PORTS. At both sites, the locations for all enriched-material cylinders are defined. Both DOE and USEC conduct complete material accountability surveys every 6 months which confirm the locations of all cylinders; Both DOE and USEC store enriched UF. in solid form. Only USEC handles cylinders containing enriched UF. in liquid form. The latter cylinders are restricted to specific cool down areas.

1 1.3.1 Relationship of Cylinder Yards Containing Liquid UF, Material to DOE Position PGDP has only two areas, Product Withdrawal and Toll Transfer, where cylinders containing enriched liquid UF. may be placed for a short cooling period. PORTS has four such areas namely, Feed and Vaporization, Extended Range Product, Low Assay Withdrawal, and Toll Transfer. Cylinder movements Cyhnder Yard CAAS Exclusion. uasis Paper 2

June 1997 i

1 i

s

within liquid storage areas are minimized to only those necessary to allow cool down. Because release from a liquid cylinder in the presence of water results in the most realistic criticality scenario, all areas at GDPs where enriched liquid UF is handled are covered by CA AS. Tims, liquid cylinder handling and cool down pads are not considered further in this report.

1.3.2 Relationship of Cylinder Yards Containing Solid UF. Material to DOF Position Cylinders transported to the cylinder storage yards for long-term or temporary storage contain only solid UF.. If a cylinder were to be severely damaged in route to one of these yards or while being placed in a storage array within a yard, there is no immediate criticality concern because the reaction of solid UF.

with moisture in the air is extremely slow (as discussed in Section 2.3), allowing ample time for response before criticality would be possible. Once stored in the yards, the cylinders remain in place and undi.turbed unless it is intended that they be sampled or emptied at a later time. Thus, the solid cylinders are seldom moved, and each solid cylinder is involved in only a few handling operations.

For cylinders that contain solid material, criticality is not an immediately credible event. This statement is based on the following considerations:

strength and durability of the pressure-vessel cylinders used to contain enriched UFg t

care used in cylinder handling; and chemistry ofl>F,,, water, and steel of the cylinder wall which produces self-plugging should a breach occur.

Cylinder damage may occur in a handling mishap, from impact caused by movemi nt during a seismic event, as the result oflong-term corrosion, from a postulated missile generated by a tornado, or from an airplane crash. Cylinders have been tested throughly for response to impact, with particular attention to transportation accidents. Based on the test data, a through wall puncture of a cylinder containing solid UF. is highly unlikely for any of the above events. In a few instances, cylinders have been dropped or impacted with the edge of another cylinder's stiffener ring with the result that cracks or small openings have occurred or a cylinder valve has been damaged creating a small hole. In none of these cases has criticality been an immediate possibility because a substantial amount water or other moderator must enter the cylinder (e.g., as quantined in Section 5.1.2) and a critical geometry obtained. Intrusion into the cylinder of sufficient moderator to cause criticality would be a function of UF. chemistry and cylinder breach orientation such that water could enter readily. Due to chemical self-sealing, more than 10 years cou d be required for such intrusion of water following a small breach (see Chapter 2).

The only scenario for which criticality might be possible in a relatively quick time frame would be a coincideat breach and fire as might follow an aircraft crash. If firemen responding to such an emergency were to direct a water hose directly into a cylinder breach, the barrier normally formed by chemical self-sealing could be eroded as quickly as it formed, and the uranyl fluoride could dissolve rapidly to form an aqueous solution. This combination of events, however, would be considered beyond extremely unlikely

- (i.e., less than 104/ year).

(

=

C)Imder Yard CAAS Exclusion - Basis Paper 3

June 1997 l

2

m For the reasons cited above, DOE takes the position that criticality is not a credible event in the yards used for long-term, UF. product cylinder storage. This position is based on the following:

roSust integrity of the pressure vessel cylinders in combination with controls for cylinder handling which make a major cylinder breach extremely unlikely; UF chemistry which forms a barrier to prevent immediate intrusion of a signincant amount of e

water and prevents a moderated critical mass from forming for years (more than 10 years based on test data); and, inspection requirements for cylinders to ensure that any breach or cylinder damage would be detected and ameliorated long before a criticality condition could be achieved following any handling anomaly, natural phenomena event, and/or external manmade event.

The purpose of a CAAS is to detect radicion and to provide a distinctive alarm to al rt personnel to evacuate from the affected areas. A CAAS Joes not prevent criticality. From the standpoint of risk, it is noted that few workers are actually in the c3 nder yards at any one time and that there is infrequent 1i worker activity in the vicinity of enriched cylinders. Those yards that are subject to the greatest handling activity are associated with cylinders containing enriched liquid where CAAS coverage is provided. If criticality were to occur with workers present, the CA AS system would not be suf0cient to prevent those workers nearby from receiving a harmful dose; and there would be few others for whom the alarm might be useful. Other personnel risk reduction considerations are identined in Chapter 6. Thus, DOE concludes that a CAAS in the cylinder yards achieves no signincant benent in worker safety either by warning personnel of a criticality event or by preventing a criticality from occurring. Chapters 3 and 6 show the development of this conclusion.

7 I

Each of the basis factors identined above are addressed in the following chapters. Chapter 2 provides a basic discussion about cylinder design, cylinder handling practices, UF. chemistry, and criticality.

Chapters 3,4, and 5 present a more detailed consideration of each of these issues and the controls needed to support the basis. Chapter 6 states the conclusions of this report and DOE's position.

Cyhnder Yard CAAS Exclusion Dasis Paper 4

June 1997

i

2. DESCRIPTION OF CYLINDERS, OPERATIONS,

(

OF CIIEMISTRY, AND CRITICALITY 6

1This section provides a brief review of the key ele nents ircolved in the criticality issue within the cylinder yards at PGDP and PORTS. For criticalit i to occur in a cylinder of enriched UF. a moderator must be introduced into the cylinder. The cylinderi are originally filled with high purity UF., under operating controls that ensure that no moderator is present. Therefore, any moderator must be introduced through a breach in the cylinder during handling o storage. If cylinder integrity is maintained, a criticality cc.nnot occur. The first pan of this sectic n discusses the design and construction of UF.

cylinders and how they are used in the GDPs. The handlir.g and inspection of these cylinders arc discussed in some detail in order to identify the po ential for damage and the many opportunities for detection of an" damage to the cylinders.

The next part of this section discusses the chemica! reactions that occur between the solid UP., water from the environment, and the iron in the cylinder if a cylinder is breached. The only widely available source of moderation for UF. cylinders is water. la boratory tests and field experience have shown that the physical and chemical behavior of solid UF. act to severely slow the introduction of water into a UF.

cylinder through a hole in the cylinder wall. This bohavior greatly increases the opportunity for detection and mitigation of a breached cylinder before enougi moderator is introduced to the cylinder to make a criticality possible.

The final part of this section discusses nuclear critic ality safety as it specifically applies to UF. in storage. This discussion focuses on elements reyuir:d to achieve a criticality in a UF. cylinder. For UF.

enriched '

to 1% to 5% U2", achieving criticality is difficult and is not likely to be achieved by natural process in a cylinder storage yard.

2.1-Cylinders Used for Containing Enriched Product

' UF. is stored and transported as a solid inside strong, steei, pressure vessels referred to as cylinders.

These cylinders are designed, fabricated, inspected, and maintained according to requirements specified in ANSI N14.1-19905 and other national and international standards and regulatory requirements.

A typical UF. cslinder is shown in the following diagram. Note that not all cylinder types have all of the features shown (such as skirts, lifting lugs, or stiffening rings).

j

. C)lmder Yard CAAS Exdusion Basis Paper 5

June 1997

.l l

Typica U,Cyha Stiffening

/ Rmg 1

Skirt /

Wye /

Uftm0

/ Lug s

/

l Nameptme/

Cy%rsder

$dd UF, Cy5nde p Cylnder e

Head y pg 3

.g 5

Note: Type 3r0 LEb eyknrars do not have stiffening rings or hfting lugs.

Type 480 tails cylinder: do not have skirts.

?

Various UF. cylinder designs have been in use at the enrichment plants and elsewhere in the nuclear

- industry since the 1940s. By the end of 1997, USEC, DOE, and its predecessors will collectively have purchased about 70,000 cylinders: 80% cf them for long-term storage of depleted UF and 20% for storage of a mix of feed and product cylinders. The current designs have been in use for over To years.

The four major types of cylinders currently in use are the following:

48G 14-ton thin wall tails cylinder,

. - 48Y 14-ton feed cylinder, 48X 10-ton en iched product cylinder, and 30B 2.5-ton enriched product cylinder.

Since this document focuses on the need for CAAS coverage for UF enriched to 21 wt % U2", the 48X 10 ton and 30B 2,5 ton product cylinders are of primary interest.

Cylinders are designed specifically for the storage and transport of UF., This design includes allowance for routine handling. The cylinders used for storage of enriched UF. have thick walls with allowance for L corrosion and damage:

- C) finder Yard CAAS Exclusion pasis Paper 6

June 1997 4

-t

The 48X 10 ton cyllader is fabricated from 5/8 inch steel, which includes a l!8-inch corrosion or

+

damage allowance.

The 30B 2.5 ton cylinder is fabricated from 1/2-inch steel, with a 3/16-inch corrosion or damage allowance.

The A 516 steel used for UF cylinders was selected, in part, because it retains its toughness over an operating temperature ranging frcm 40'F to +250'F. Routine inspections for damage or significant corrosion are performed before any filling or emptying operation, and no cylinder may be filled unless it has been hy drostatically tested and thoroughly inspected within the previous > years. 'l he toughness of o

these cylinders has been repeatedly demonstmted in drop tests ano other packaging tests conducted over the years.

During the 50 years of operations at the GDPs, only two cylinders have sustained an immediate breach as the result of dropping or other mishandling. These instances occurred in 1966 and 1978 and involved the inadvertent dropping, due to equipment failure, of cylinders containing liquid UT in 1990, several other cylinders were found to have deveioped ho'-- due to extensive corrosion. This corrosion damage was attributed to cracking caused by impacts to the cylinders wbn they were being stacked years earlier, These few incidents out of approximately 70,000 cylinders is evidence of their derability.

2.2 Cylinder IIandling and Storage Operations The operation of the cylinder storage areas and the methods of cylinder handling provide the primary threat to cylinder integrity, and are therefore fundamental issues in determining the potential need for CAAS coverage in the cylinder storage areas. Cylinder yard operations determine which initiating events are most likely, what detection methods exist, and who might be exposed to the effects of an inadvertent criticality.

2,2.1 Overview of Enriched Material Flow Before examining the cylinder handling operations themselves, a review of GDP operations will be helpful to see where cylinders containing enriched UF. are used and what handling operations are necessry. The enrichment complex has two major classes of enriched material and several minor ones.

The major classes are intermediate assay product, which is used as enriched feed (typically referred to as Paducah product feed or ! PF), and low-enriched uraniura (LFU) product. The minor classes include customer-returned LEU material as enriched feed, out-of-specification material being held for future processing, and enriched material stored in cylinders that require special handling.

One of the largest flows of enriched material is the shipment of PPF from PGDF 3RTS. PGDP currently fills one to two 10-ton cylinders per day with UF. at assays that oidinar9y run to 2% and may go to 2.75% eventually. The PPF cylinders are cooled, packaged in certified overpacks for shipment, and sent to PORTS via truck or train, At PORTS the material is unloaded and stored until it is needed as enriched feed to the diffusion cascade. Empty cylinders are returned to PGDP for reuse.

LEU product enriched to the customer's specified assay (typically around 4 wt %) is normally withdrawn from the cascade into 10-ton product cylinders. These cylinders are then cooled and stored temporarily C)lmder Yard CAAS Exclusion Basis Paper 7

June 1997

until customer owned 2.5 ton product cylinders arrive in preparation for shipment. The 10-ton cylinders are then heated and st.mpled, and the LEU material is transferred into the customer owned 2.5 ton cylinders. If the customer orders being filled do not require all of the LEU in the 10-ton cylinder the remainder may be cooled and returned to storage until the next order at that assay is processed.

Otherwise, the small " heel" of UF. in the 10. ton cylinder is allowed to cool, and the cylinder is returned to storage until it is filled again from the cascade. These operations occur primarily at PORTS, since the PGDP is currently lir.ited to a maximum assay of 2.75%.

Once LEU product has been transferred into customer owned 2.5 ton,;ylinders, the cylinders are cooled e

and placed in temporary storage until they are shipped to the customer's selected fuel fabricator.

2.2.2.

Cylinder llandling Operations There a:e six basic cylinder handling operations that occur daily at the

")Ps. While not all of these bear directly on the need for CAAS in the cylindc~ yards, they demonstrate the range of activities performed on the cylinders, and therefore the challenges to cylinder integrity. These six operations are receiving cylinders, placement in a cylinder yard, storage, retrieval from a cylinder yard, UF. transfer, and shipping.

Receiving Cylinders The GDPs receive cylinders for many reasons, including new empty cylinders for plant use; full normal feed cylinders; full or partially full cylinders of enriched material for tefeeding; and empty cylinders (containing only a small" heel" of UF.) to be 611ed with product.

Every cylinder arriving at the GDPs is inspected using a formal checklist specined by plant procedure (see Section 2.2.4). This inspection includes checks for visible cracks, dents, gouges, and damaged valves or plugs. Shipment documents are checked, and the cylinder is weighed to verify the quantity of UF in the cylinder. This data is erdered into the plant accountability system, which is used to track each cylinder at the site.

Placensentin the Yards Once a cylinder has been received or a transfer operation has been completed, the cylinder is placed in the appropriate storage yard (this may be a liquid UF. cool-down area, short term storage, or long-term storage). The cylinder is inspected and weighed as part of the preceding step. No formal inspection is performed at this time, although any significant damage to the cylinder would likely he noticed by the trained operator. The cylinder movement is contrott d by the specific procedure covering the equipment e

being used. If the cylinder is being moved into long term storage an inspection of the cylinder and the saddles or other cylinders that it will rest upon is performed both before and after stscking to ensuie that none of the cylinders involved are damaged by the stacking. Accour'ebility records are then updated with the new cylinder location.

UF. cylinders can only be moved with approved equipment. This equipmeet includes cranes, f orklifts, cylinder stackers, and some trailers or railcars. The equipment used to move cylinders must be inspected nd maintained according to written plant procedures. Varying degrees ofinspection are required each a

shift, monthly, quarterly, and annually. Only properly trained einployees may operate and inspect this equipment.

Cylmder Yard CAAS Excluson naus Paper June 1997

r Storage Enriched cylinders in long term storage are inspected according to procedure every year (see Section 2.2.4) Cylinders in short term storage or in the liquid UF. cool down areas (LUCAs) are typically not in place long enough to be inspected under this procedure. (These storage modes are discussed in detail in Section 2.2.4) Cylinders in shon term storage and in the LUCAs are located in areas that receive daily traffic, and are spaced such that signincant damage or leakage would be visible to personnel in the area.

In addition, all cylinders are checked for accountability purposes every six months (see Section 2.2.4).

Retrievalfrom Yarde

-v Cylinders are retrieved from the yards when they are needed for another processing step or for shipment.

If the cylinder has been in place for more than one year it is visually inspected before and after it is lifled from it's storage location. If the cylinder has been in place less than one year no formal inspection it performed when the cylinder is retrieved. However, the operator has a close view of the cylinder as it is being attached to the lifting device. The lifting and movement is performed according to the written procedure appropriate to the type of equipment being used. No weighing is required. Acewotability j

l records are updated to reflect the new cylinder location.

UF Transfer (Feed, Withdrawal, Transfer, orSampling)

Before any heating or UF. transfer operation the cylinders involved receive a formal inspection (see Section 2.2,4). Once the transfer is complete the cylinder is weighed and the accountability records are updated.

- Shipping

- Cylinders are carefully inspected before shipping (See Section 2.2.4), and the accountability records and L

shipping papers are prepared according to the cylinder destination.

2.2.3 Storage Modes

" Cylinder yard" refers to any area where UF. cylinders may be stored. There are three basic modes of cylinder storage: liquid UF. cool down; short term storage; and long-term storage. Liquid UF cool-down always takes place in designated, specially marked areas that are segregated from other cylinder storage and handling.The short term and long-term storage discussed here refers to intent and duration rather than to a specific location. While cylinders in short term and long-term storage are typically segregated somewhat for convenience, a significant amount of overlap exists, particularly at PORTS Portions of E long term storage s.reas may be used for overnow short term storage, and likewise some cyl.inders may be stackcd in long-term mode in the yards next to the withdrawal and transfer buildings. Plant procedures do not restrict the use of the cylinder yards for either short-term or long-term storage. Procedures do restrict liquid UF. cylinders to specifically approved liquid UF cool-down areas (LUCAs),

Note, further, that current plant procedures do not restrict the storage of enriched material to specinc areas. Nearly all of the material in long-term storage is dep!cted UF., but a small amount of enriched material is in long term storage, particularly at PORTS. This material is predominately LEU that does not mee: product specincations or is stored in cylinders that cannot be handled under normal procedures

- because of some flaw, such as cracked lifting lug welds. Likewise, most of the material in short-term 1

storage is enriched, but some other material, such as incoming natural assay feed, may be placed in short-

^

Cyhnder Yard CAAS Exdusion Dasis Paper

-9

~

June 1997

term storage. Cylinders containing enriched and non enriched material may be intermingled in any of the cylinder storage yards. However, intermingling is currently limited to two yards at PGDP and several yards at PORTS.

Liquid UF, Cool-down Cylinders are filled by pumping liquid UF. into them. The cylinders must then cool for several days to allow the UF. to fully solidify. Current requirements call for a minimum of 3 days cool-down for 30-inch cylinders and a minimum of 5 days for 48-inch cylinders. During the early part of this cool-down period a major release of UF. would be possible if the cylinder were breached. Within 12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the liquid UF, has cooled to the triple point (147'F and 22 psia) and solid UF, has started to form on the inside surfaces of the cylinder. During the entire 3 to 5 day cool down period cylinders are held in special LUCAs, where operations are carefully controlled in order to minimize the possibility of cylinder damage or of a UF. release, LUCAs are specially identified storage areas next to each building where cylinders might be Hlled or heated. These areas are part of the USEC leased facilities. The LUCAs are roped off from the surrounding area and are identified by appropriate signs. Because they are located next to buildings that have CAAS coverage, all enriched cylinder LUCAs are covered by existing CAAS detectors.d Because the enriched cylinder cool-down areas are covered by the CAAS in the adjacent buildings. the GDPs are not reauesting an exclusion from CAAS.p.auirements for these areas.

f Short-term Storage Short-term storage is defined as temporary storage for less than 1 year. Short-term storage areas are lo,:ated adjacent to buildings where cylinder operations take place. These areas are used as temporary storage and as staging areas to support on-going feed, withdrawal, and transfer activities. Because these areas are part of ongoing operations, they are under USEC control.

Physical Characteristics I

Short term storage areas are medium sized yards adjacent to buildings where cylinder operations take place. Because the yards are located near UF.-handling facilities, the yards are generally inside the CAAS coverage envelope. However, cylinders in the interior of the yards may be too distant or shielded from the CAAS detectors by the cylinders around them. The short term yards are well-drained concrete pads.

Access Short term storage areas are bounded by the edges of the concrete pads. The areas are not fenced off, although ropes or chains may be used to identify areas requiring a radiation work permit (RWP). General vehicle access is permitted. Emergency response notification is readily accomplished from these locations, dThe railcare used at PORTS for temporary cool-down are believed to be under CAAS at all times. It is possible to position the railcars outside of CA AS coverage. The plant has the responsibility to ensure that all enriched liquid-filled cylinders are covered by a CAAS.

Cylinder Yard CAAS Exclusion Basis Paper 10 June 1997

Cylinder Mot emenn The cylinders in short term storage are spaced for easy access. Typically,30-inch cylinders are handled with a forklift using a specialfixture to hold the cylinder securely. These cylinders are arranged in rows on the ground without saddles. Chocks are used at the ends of each row to prevent movement. The 48-inch cylinders are handled with straddle carriers at PORTS and with cylinder stackers or forklifts at both PGDP and PORTS. The 48-inch cylinders are placed on wooden or concrete saddles with spacing between cylinders to facilitate handling. Cylinders may be moved in bad weather, but personnel will typically wait out periods of heavy rain.

Detection Opportunities The cylinders in short term storage are spaced for easy access. This spacing tends to make any damage readily visible to personnel working in the yards. These yards receive daily traffic, so there is ample opportt.nity for personnel to spot HF smoke or other leakage. Since the most likely accidents involve mishandling or vehicle impact, a trained operator would be alertcd to any damage that occurs. The cylinders are not subject to formal inspection (although any enriched cylinders stored for 1 year or more would be subject to formal inspection, as discussed in Section 2.2 A). All cy linders are subject to an accountability inventory every 6 months (see Section 2.2.4).

Long-term Storage Long-term storage areas are used primarily for tails cylinders, with a a relatively small number of other cylinders that are not expected to be used in the near future. Aside from tails cylinders, the material in long term storage may be unusable because it does not meet feed or product specifications, or because it is in cyimders that, while safe for storage, cannot be heated. The majority of the long-term cylinder yards remain under DOE control, but some long term storage is leased by USEC.

PhysicalLayout Long term storage yards can be quite large. The long-term cylinder yards at PORTS are all hard surfaced.

PGDP uses a combination of hard surfaced and gravel lots. Both types of surfaces are graded to provide good drainage. The long term storage yards are often well away from the process areas, so these yards are typically outside effeuive coverage from the existing building CAAS detectors.

Access Long term storage yards aie identified by the long rows of stacked cylinders. The yards inside the main plant fence are generally not fenced or roped off from the general plant area. PORTS has some yards outside the main plant fence that are separately fenced. Plant vehicles may enter the yards. RWP requirements are clearly identified by signs around the yard perimeter.

Cylinder Movements The cylinders in long-term storage are usually stacked two cylinders high to reduce the space required (at PGDP enriched product cylinders are not stacked). The cylinders are placed in double rows, with a center aisle wide enough for a cylinder stacker to maneuver. The cylinders on the bottom row are placed on concrete or wooden saddles, and the cylinders on the top row are stacked directly on the bottom row cylinders. Cylinders are usually placed by using cylinder stackers, but mobile cranes may be used for lifting provided they receive the specified inspection and maintenance immediately prior to such use.

Activity in the long-term storage areas is typically limited to daylight hours in good weather.

C)lmder Yard CAAs Exclusion. Basis Paper 11 June 1997 l

l l

. Dettcrion Opportunities The long term storage yards are often well away from the process areas, so once a row is filled with cylinders, there is little traffic in that area. Because there may be long periods of time between visits to a particular aisle in the yard, two sets ofinspections are performed. First, a careful inspection is performed immediately after a cylinder is stacked to ensure that the cylinder and its adjacent cylinders were not damaged by the stacking operation. After that, each depleted cylinder is inspected every 4 years.

Cylinders containing enriched material are inspected annually, as described in Section 2.2.4. In addition, all cylinders are subject to an accountability inventory every 6 months (see Section 2.2.4).

2.2.4 Cylinder Inspections As noted above two separate cylinder inspection procedures are in use at the GDps. One procedure is used to detect cylinder or valve damage before any UF. transfer to or from a cylinder. The other procedure is used to detect excessive corrosion or other damage to cylinders in storage. This inspection is performed annually for cylinders containing enriched material (or for damaged cylinders), and every 4 years for other cylinders. In addition, all cylinders are subject to an accountability audit every six months.

l These inspection procedures are described below, i

inspection Prior to UF, Transfer Before any operation in which UF is transferred to or from a cylinder (such as sampling, filling, feeding, or transfer) or upon receipt or before shipment, the cylinder is carefully inspected in accordance with plant procedure (Xp2 TE TE6031," Guidelines for Inspection and Rejection of Cylinders"). Trained inspectors caiefully examine the cylinder surface and *he plug and valve. A check sheet is used to en%re that all of the required items are covered. The following items are checked:

damage (dents, cracks, gouges, tears, etc) to the cylinder shell or head; damage to the circumferential or longitudinal seam welds; damage to the cylinder skirt, stiffening rings, or lifting lugs; bent, damaged, or iniproperly threaded valves and plugs; markings (or lack thereof) on valve and plug indicating rejected lots; and cylinder hydrostatic test date (may not be filled if more than 5 years past last test).

Inspection of UF. Cylinders in Storage All cylinders in long-term storage are periodically inspected to ensure that they retain their integrity. This inspection procedure is documented in UE-QA 14.1," Inspection of UF. Cylinders in Storage". Cylinders containing UF. enriched to 2 I wt % U2" are inspected annually. Cylinders with known damage may be inspected more frequently. These inspections are performed by teams of trained employees. Because the majority of cylinders in long-term storage are stacked, the inspectors use Dashlights, mirrors, aad poles to examine as much of the cylinder surface as possible. A check sheet of defect criteria is used to ensure a complete inspection. This inspection looks for many of the same items as the standard inspection but includes some differences to reflect the differences between operations and storage, An actual breach is readily apparent from the color of the reaction product and from the staining on the cylinder and its neighbors. In addition to looking for signs of a breach, the inspection looks for conditions that might eventually result in a breach. The items reviewed include the following:

Cylmder Yard CAAS Exclusion. n.uis Paper 12 June 1 W 7

.. =

holes in the cylinder;

.. damage (dents, cracks, gouges, tears, etc) to the cylinder shell or head; damage to the circumferential or longitudinal seam welds; damage to the cylinder skirt, stiffening rings, or lifting lugs; heavy pitting, scale, or other indications of corrosion; indications of corrosion or leakage on the ground or on other cylinders adjacent to the one being inspected; cylinder, stiffening rings, or skirt in contact with the ground; standing water or indications of wetness under the cylinder; contact with or damage from the lifting lug on adjacent cylinders; a

lifting lug in contact with other cylinders; saddle condition; and plug and valve condition.

Sen*l-Annual Accounto!.llity Audit Every 6 months each cylinder is audited for accountability purposes. This audit involves an inspector verifying the location of the cylinder and copying information from the nameplate on the valve-end of the cylinder. This is not a formal inspection, but it requires an inspector to look closely at the cylinder. Any severe darange, such as an open breach or active reaction with atmospheric moisture, would therefore be noticed.

Other Detection Opportunities Several routine activi;ies in the cylinder yards provide additional opportunities for a breached cylinder to be detected, llealth physics surveys are performed annually at the boundary of each yard. A breached enriched cylinder could be detected during this survey. Also, the runoff from concrete cylinder yards is collected and must be sampled for unacceptable contamination before it can be released to the plant discharge. This analysis would be likely to detect the effects of a breached cylinder, 2.3 UF Chemistry UF. is chemically reactive with water to form a uranium particulate (UO F ) and hydrogen fluoride (liF) 2 2 according to the stoichiometric chemical equation UF.+ 2H O ~ UO F + 4HF 2

2 2 This reaction c an be rapid when liquid UF is released, vaporizes, and mixes with moist air. However, the reaction of solid UF, with water is quite slow. Furthermore, the reaction is retarded by the formation of hydrated UO F, which is resistant to further reaction.

2 2 The following discussion summarizes the general chemistry of the reaction of solid UF., water, and the cylinder wall when a cylinder is breached. Specific application to a particular break location is discussed 4

l CyImder Yard CAA3 Excimion nasis Paper 13 June 1997 x

later in this report with regard to the need and type of controls that may preclude the break or halt the progression of the chemical reactions prior to the formation of a moderated, potentially critical mass.

2.3.1 Chemistry of the UF.-II,0-IIF Fe System A search of the literature was performed in order to develop the information necessary to understand the chemistry of the UF. H,0 HF Fe system. A series of water immersion tests of UF. cylinders with simulated damage was conducted to deterraine the extent of water in leakage (K D 1987).* In openings of up to 1 inch in diameter, located either in the cylinder vapor space or solid phase, an insoluble plug of hydrated UO F and metallic products is formed, The reaction between the UF., water. and iron in the 2

cylinder wall is represented by UF. + 2 H O - UO F (white solid) + 4HF 2

2 3UF. + 13.5H O +2Fe - 3UF.

• 2.5H O(green solid) + 2FeF 3H O (yellowish to tan solid),

2 2

3 2

or the moisture reacts with the solid contained UF to form hydrated UO F (yellow solid) and HF. The 2 2 HF reacts with the iron present in the cylinder wall and with the UF to form insoluble UF -based iron compounds (green solid) that plug any small(less than 1 inch) hole (s) present in the cylinder wall and l

restrict inflow of additional moisture.

l Studies performed by Leitnaker et al. (K/TSO-9, Part 1)' indica:e that hydrated UO F forms a relatively 2 2 low [smah) surfa,:e area that is resistant to further reaction with water through a release of heat. This heat of reaction aids in making the resulting compound resistant to further penetration by reactive sintering.

The reaction between UO F and water is represented by 2 2 UO F + XH O - UO F. XH O (yellow solid),

2 2 2

2 2 2

where the most stable hydrate appears to be with X equal to 1.6. As shown below, this reaction tends to tie-up about 22% additional water into a stabilized surface on the UF. substrate which retards the diffusion of additional water into the UF..

The combination of reactions depicted above, provide resistance to the accumulation of water in a damaged cylinder. This resistance provides suf0cient time (on the c'ler of years) for the identification and repair of damage before a quantity of moderator suf0cient to cause criticality can penetrate and accumulate.

Note that the definition of a small hole, up to I inch in diameter, discussed throughout this report is used because that was the maximum size hole investigated and reported in the literature (K-D-1987). The conclusion that small holes will plug was developed from information contained in POEF 2086

" investigation of Breached Depleted UF. Cylinders"' and K D-1987 "Weter Immersion Tests of UF.

Cylinders With SimulateJ Damage". The plug develops (1) in the cylinder vapor-phase area as a result of Cyhnder Yard CAAS Eulusion Dasis Paper 14 Junc 1997 l

the presence of a crystalline UF. layer located on the inside surface of the cylinder wall or (2) in the i

cylinder solid-phase area as a result of the presence of solid UF.and iron in the cylinder wall. The iron.

UF. complex is relatively insoluble in w ster, and as a result, forms a water impervious layer on the UF.

i substrate. This impervious layer restricts the movement of water through the UF similarly to that which occurs as a result of diffusion. However, over a period of time, the HF formed during the reaction of water with UF., reacts with the iron in the cylinder wall to cause enlargement of the hole and entry of additional water. Entry of water (mo:sture) into the cylinder will change the li/U ratio from an initial value of 0.088, which is a process parameter that is determined from product purity requirements, to higher values. During this review, it was recognized that the information generated in FOEF 2086 referred to depleted uranium contained in the thin walled 48G,' tails' cylinders and not to the enriched uranium 30B or 48X product cylinders. However, the chemistry of UF. is not dependent on the uranium isotope present.

o l

According to Leitnaker, hydrated UO F appears to be a thermodynamically stable compound. As a 2 2 r sult, the system UFcH O comes to equilibrium very slowly b, cause equilibrium depends on the 2

permeability of the hydrated UO F layer. Although it has been calculated that there must be 6.6 lb of 2 2 uranium present for every pound of water in order to complete the reaction of UF. to UO,F, as much as 2

22% more water will be used up to form the more stable hydrated UO F compound (UO,F 1.611,0).

2 2 The nature and orientation of the reaction product layers account for the stability of the impermeable layers and the slowness of the reaction. The compounds exposed to limited amounts of water tend to be unreactive and insoluble. Similarly, those compounds located inside the cylinder tend to be insoluble in HF. Each layer contributes to reduce the rate of diffusion of water to the unreacted surface of the solid UF. located in the cyiinder and to limit the rate of diffusion of HF out of the cylinder.

2.3.2 Physical Description of Development of a IIole in a UF. Cylinder A hole in a cylinder wall develop:d as a result of stress induced corrosion fracture results in hydration of the contained UF. The chemical attack begins in the fracture, at or near the external surface of the cylinder wall. The UO F (white) produced is retained in the fracture and produces a plug that slows the 2 2 diffusion of UF. to the surface. When the diffusion of the UF. to the surface is reduced so that the water vapor is in excess at the fracture, aqueous HF is produced that dissolves some of the UO F. An acidic 2 2 solution is formed which attacks the iron of the cylinder wall producir.g an insoluble green UFcFe hydrate and an insoluble yellowish to tan iron fluoride hydrate. Near the exit of the fracture, the reaction ofIlF with water produces aqueous HF that dissolves the previously produced UO F hydrate allowing 2 2 the formation of additional UF -Fe hydrate and the area of the fracture surface continues to enlarge. This phase of the reaction occurs within the nrst 12 months of the generation of the fracture. Based on this scenario, it has been determined that enlargement of the hole occurs at a relatively constant rate and signi0 cant enlargement of the hole takes years to accomplish as shown in the study of the two breached

~

cylinders found at the PORTS facility.

C>lmder Yard CAAS Exclusion - Basis Paper 15 June 1997 l

m

2.4 Nuclear Criticality Safety for UF Storage Nuclear criticality safety (NCS) for the UF, cylinder storage yards requires preventing the uranium content from accumulating in quantities, chemical form, and combination with other materials (particularly water) that can suppon a sustained neutron chain reaction, i.e., be critical or sustain criticality. Stated alternatively, it is necessary that the UF. remain Siberitical.

There are two especially useful reference values related to critical!ty for the low enriched uranium (LEU) produced by the GDP First, uranium with less than I wt % U2" cannot be made critical regsrdless of chemical form. Second, uranium enriched to less than 5.5 wt % U2" is soberitical unless diluted by low mas' " moderating" material such as the hydrogen in water.'

Thus, the maximum 5 wt % U2" material stored in the form of UF. in the product-storage cylinders at the GDP is stcred " dry," i.e., absent moderator. Product purity standards require 99.5 wt% UF. which, assuming the residual is entirely llF, corresponds to a hydrogen to-uranium ratio (ll:U) of only 0.088.

From a practical standpoint, slightly moderated LEU is suberitical so long as its H:U2" s 10 (i.e.,

hydrogen-to-nssile atom ratio is less than or equal to 10).(The latter also corresponds to H:U s 0.5, considering the total uranium content, and about i I volume percent water in a solution with UO F,.)

2 Various configurations ofinterest based on the presence of moderator with UO F include the following:

2 2 A critical sphere with 49 lb [22 kg] of U (2.7 lb [1.2 kg) of U2" @ 5.5 wt %) and 7.4 lb [~1 gal or ~41; of H 0; plus unknown, but large volume of H O for reDector."

2 2

A maximum stberitical spherical mass of 5 wt % U " with " full"(230 cm) H O reflection)--

2 1.64 kg U2" [3.61 lb U2"]

A maximum suberitical slab thickness of 5 wt % U2" with " full" H O rerk. tion of 12.6 cm 2

[4.96 in]

A 30 x 12-inch ellipsoid of 5 w t% U2" at 1800 g U/L and H/U-10.3 of 66.2 kgU [3.3 kg U2"]'3 Minimum spherical critical mars at 5 wt % U2" - 37 kg U [1.85 kg U2"]"

l Because criticality is not possible with very dry UF. and because critical masses are relatively small for LEU solutions, the UFi product storage cylinders have been designed to provide strict moderator control.

The product-storage cylinders ofinterest (30-inch and 48-inch-diameter) are approved for storage of UF.

up to 5 wt% U2". This provides some latitude as the following conGgurations of 30A/B (30-inch-diameter) cylinders are required for a critical con 0guration:"

A single cylinder (at 99.5% purity) Giled with -18 wt % U2n An in6 nite two high array of cylinders 611ed with ~7 wt % U2" This data provides insight into UF. and water mixtures necessary to achieve and inadvertent criticality.

C)hnder Yard CAAS Exclusion - Dasis Paper 16 June 1997

In another scenario, namely over stacking, analyses have demonstrated that the array at the allowed enrichment of 5 wt % and purity of 99.5% would have to be stacked more than Ove high to be critical.

The cylinders are moved on the concrete pads using a fork lift truck with limitec vertical reach, so it is not conceivable that the cylinders could be stacked to this height, it is the accepted practice not to stack any full UF. cylinders more than two high, so any deviation from this practice would be revealed well before an unsafe situation could occur.

As previously stated, to transform UF in an individual cylinder to a critical con 0guration requires suf0cient mass,

+

breach of the cylinder to allow entry of water or other moderator.

e presence and entry of the moderator, and non detection of the situation for a suf0cient period of time to allow chemical transformation a

i and/or recon 0guration of the UF. to a critical condition.

The multi-ton quantities of UF. in each full cylinder assures more than sufficient material for a critical mass under a variety of conditions.

Breach of the cylinder could occur by valve failure, puncture, or break. Any valve rupture or puncture / break that allowed subsequent dispersal of UF and or UO F to the ground would be of minimal 2 2 concern for criticality safety in that collection in a spherical shape is non-mechanistic because the low critical mass con 0gurations require solutions. A thin slab of S wt % U2" would still be suberitical at a

' depth of over 5 inches assuming good reDection by the concrete pad and ground below it and lack of a thick water reDector on top (which even ifit existed, would require some sort of separation to avoid merely diluting the solution below the concentration that could go critical. Without dikes or berms such accumulatisn is not possible.

~

In practice most valve failures and small punctures would be chemically self-sealing (by mechanisms described in Section 2.3) and prevent outnow of the solid UF or its chemical products even if the breach were in contact with the solid. Large breaches could allow for entry of water or other moderator materials

- but as described in Section 2.3, it would take years to accommodate a sufficient quantity of water to exceed the critical concentration.

Moderators such as moisture, precipitation, Dre tighting water, or organics (e.g., paint or vehicle fuel) are present in differing amounts and frequencies. Their entry into a breached cylinder would depend on breach location, size, and action of chemical self-scaling mechanisms.

To avoid potential criticality, breaches and moderator entry would require detection times commensurate with the scenario mechanisms (e g., as described in Section 4.1) and accounting for inspections and other controls. In general terms, mechanisms for a major breach would be expected to be self-alerting / annunciating and allow for prompt response such as covering, patching, or cylinder movement.

Otherwise, periodic inspections and controls would be expected to provide indication of delayed effects (e.g., denting and subsequent corrosion).

The safety analysis reports for the GDPs state that the UF product storage cylinders do not nieet the double contingency principle (whose definition is provided in Section 3.2.1). The sole controlled CyImder Yard CAAS Exclusion Daais Paper 17 June 1997

parameter is moderation. Following the highly unlikely event of a cylinder breach, moderator exclusion is no longer assured. Thus, in a classic sense, the double contingency principle is not met. Moderator in sufficient quantity and with the abill.y to enter the cylinder and form a critical mass, however, is ad immediately aval'.able. Ample detection time (as indicated above (and in detail later in the report) based on such factors as breach size. Self. alerting, chemical self sealing, and inspections) could be considered a defacto "second contingency" with a very high likelihood of preventing establishment of a critical con 0guration.

2.5 CAAS Decision Factors l

i*

All of the factors that could innuence the likelihood of criticality in a plant should be considered when judging the need for a CAAS. A set of seven factors has been used by the United Kingdom's Nuclear Installations Inspectorate (Nil) to make such decisions for situations including product cylinder storage."

The factors and the% valuation for puduct cylinder storage at the GDFs are presented in this section.

1. Chemica. 30,re, purity. lsotople composition Nature. UF. is solid at ambient temperature and atmospheric pressure, turns gaseous at elevated temperature (a 133*F at I atmosphere), and is liquid above 147'F and 22 psia UF. is not water soluble but reacts with water to produce UO,F, and llF. A stable hydrate forms at UO,F e 1.611,0.

3 The hydrate format 6n and its interaction with the steel in a cylinder is responsible for the observed self sealing of small cylinder breaches.

Purity. The product purity specification is 99.5 wt% UF., if the residual is all liF, the il to U ratio is 0.083, or about 0.1.

hotopic compm/tlan. Low enrichment uranium (LEU) of less than 5.5 wt% U2" in any form is suberitical when unmoderated. LEU at 5 wt% U2"(the maximum allowed in a 48X product cylinder) is suberitical for homogeneous mixtures with II:U s 10 (which corresponds to ll/U2" s 0.5, or approximately 11 vol % 11,0 ).

2. Mass of thsile material. The mass of uranium in a large product stoiage cylinder is less than a critical mass at 5 wt % U2" when dry (LEU s 5.5 wt % U2" is suberitical in any a

amoun when unmoderated/ dry);and tess than to MUCll greater than a minimum critical mass, with increasing moderation (i.e.,

+

?ncreased 11:U as described in #1 above) 3.

l'rosimity of moderators. Moderators are not present full time or purposely. The outdoor stationary storage is subject only to humidity, periodic precipitation, occasional organics (e.g., paint, vehicle fuels), and potential fire fighting liquids (which are limited due to minimization of burnable or combustible materials in the yards). The chemical nature of the UF./UO,F system provides for 2

exclusion of moderator by the self. sealing of holes or other breaches at least as large as one inch in diameter.

C)lmdct vard CAAS thcluuon. nasts Papet 18 June 1997 Y

4. Complexity of process.' The " process" is remarkably simple, i.e., storage oflarge, rugged j

cylinders in a stationary con 0guration on wooden or concrete cradles. The cylinders are subject to handling only for placement; retrieval; and, possibly, detailed inspection. Potential process 1

i upsets-all of which are self alerting / annunciating-include only drop, contact with anoth.;r cylinder (s), vehicle callision, or external event.

5. Presence of operators. Operator presence is non routine, but includes either their (1) proximity under, and as part of, conceivable circumstances for an active breach (e.g., drop, vehicle collision, i

other contact) or (2) response to other self alerting / annunciating situations (e.g., drop, vehicle collision, other contact by another operator; external event (e.g., sir craft crash, tornado, seismic event]). Due to this non routine presence, it is not likely that operators would be nearby e cen if

" spontaneous" criticality were to occur (e.g., as associated with long term corrosion and water l

ingress or a dramatic external event).

6. Ihsign of facility /shleiding. In this case, the " facility" consists of the product storage cylinders and l

the storage yards. The cylinders are pressure vessels designed to withstand harsh treatment associated with (1) normal operations: routine filling and emptying with consequent handling and temperature changes and (2) transport: local and long distance [the latt_er inside an overpack J. The 1:

cylinders also have been tested and demonstrated to withstand serious drop scenarios. The storage-yard portion of thefacility provides only for placement, sitting in place, and retrieval of cylinders j

and for interaction with any natural and person caused events.

7. Extent of operator reliance / engineering safeguard.

l' Operators perform thefollowing activilles:

move cylinders of solid UF. from near building locations where cooling and solidification have taken place; place cylinders in storage locations; e

perform inspection (for cause orperiodically, generally no more than annually);

+

move cylinders from stcrage positions back to process buildings; detect or respond to potential cylinder damage, e.g., drop,' vehicle collision, contact by other e

operator, or external event (e.g., air craft crash, tornado, seismic event); and patch or otherwise remediate a damaged cylinder, For any given cylinder, operator interaction is very infrequent; however, due to the large number of cylinders, the overall tasks are frequent. The tasks also are oflow dif.1culty (not complex).

Thus, operator qualification is of the type that generally does not require extensive initial '

training or retraining.

_ 'It is reiterated that the current " process" includes only (1) cylinder storage and getting cylinders to and from that configuration; (2) solid UF., not liquid UF.; (3) incidental cylinder movement, not transport; and (3) low enriched uranium (a I wt% U2" with a maximum of $ wt% U2") allowed in the cylinders.

Cylmder Yard CAAS f ulusion s Basis Paper 19 June 1997

Engineering ufcguards. Nuclear criticality safety depends primanly of the robustness of the cytinders, which are actually pressure vessels Minimum operator attention / reliance is required for this highly passive " safety system," where the valve is the only moving part. Valve rupture is chemically self scaling, although subsequent collection of UF,/UO F2 on the ground would not be a criticality 2

safety concern (as explained in Section 2.4).

D. N. Simister, of the Nil, notes that ". experience in the UK is that cach case for omission must be treated ca its own ments and that a professionaljudgement must be taken by criticahty practitioners based around agreed criteria li.e., those stated abovel "Ile goes on to say that "regarding UF, product-cylinders storage, la licensec] has made a case which Nil has accepted." Based on an evaluation of the factors similar to that provided above for the GDP. he noted that "at first sight the large mass of fissile material and the requirement for limited moderation would suggest that enticality accident alarm system lCAAS) coverage would be appropriate in assessing the adequacy oflthe licensce'sj case we have considered additional arguments which have been put forward by the licensee including the robustness of the cylinder contents dunng fault conditions (self pluggmg), the margins of safety present during normal and abnormal operctions, and the likely range of faults w hich might be credible on a licensed nuclear site."

In Chapters 3 through 5, this report validates and expands the same conclusion for the GDP product cylinuer storage yards.

- 4 4

4 Oltnder Yard CAAs f.xdusion. Basis Paper 20 June 1997

3, CYLINDEll YAllD ClllTICALITY ISSUE 3,1 Requirements For Criticality Accident Alarm System Requirements for CAAS for USEC-leased facilities at PGDP and PORTS are contained in Chapter 10, Code of Federal Regulations, Part 76,"Certi0 cation of Gaseous Diffusion Plants " Section 89,

' Criticality ( Alarm] Requirements' (10 CFR 76.89). Thus, the basic regulatory requirement for CAAS at the GDP is that The Corporation must maintain and operate a criticality monitoring and audible alarm system meeting the requirements of paragraph (b) of this section in all areas of the facility. The Corporation may describe for the approval of the Commission denned areas to be excluded from the monitoring requirement. This submittal must describe the measures that will be used to ensure against criticality, including kinds and quantities of material that will be permitted and measures that will be used to control those kinds and quantities of material.

The Compliau !'lans for each site identify the compliance status. The PGDP status is given in PGDP Compliance Plar, issue 8", and the PORTS status is given in PORTS Compliance Plan issue 11". The safety analysis reports (SAR) and technical safety requirements (TSR) contain current requirements for the installed system.

Requirements for CAAS, with specine application to coverage of UF. product cylinder storage yards, are considered in two categories. The Orst category consists of the CAAS specine requirements appliM by NRC through regulations supported by ANS 8 Series Standards and NRC Regulatory Guides. The second category of requirements are through commitment in the license application [in the safety analysis report (SAR))(l) to meeting the double contingency principle or, for situations w here this is not possible, to providing an evsluation which demonstrates safety, including a description in the S AR accident analysis te: tion, an.J (2) to having clearly denned controls and technical safety requirements (TSRs). Full UF, product-storage cylinders have been assigned to this latter category, i.e., have been judged act to meet the douole contingency principle.

Prior to NRC certincation of the GDPs, alarm system requirements were provided by DOE Orders, all of which rely explicitly on the guidance of ANSI /ANS 8-Series Standards. In a number ofinstances, the DOE Orders specify exceptions to provisions of the Standards.

3.1.1 Compliance Plans USEC and DOE commitments with respect to 10 CFR 76.89 are contained in Compliance Plan issues, entitled for each of the GDPs,"heeptions for Criticality Accident Ahrm System" and referenced to SAR Section 5.2.2.5," Criticality Accident Alarm System Coverage."" Each states that:

A CA AS is provided to alert personnel if a criticality accident should occur.

4 C)lmder Yard CAAS liclusion Hasis Paper 21 June 1997

.' g

.4 e

USEC will submit, in accordance with the Compliance Plan, the analpes for alarm settings, detector placement, and the analyses required by 10 CFR 76.89(a) to demonstrate that criticality anonitoring and alarm coverage is not required in certain areas of the facility.

Descriptions of Non Compliance for both plants essentially state A criticality accident alarm system is not provided for all areas of the facility.... Uranium cylinder and low level waste storage areas and some Ossile material [ transportation) activities have been excluded consistent with dot: guidance. NRC approval has not been received for excluding the applicable plant areas (i.e., those containing >700 grams of U2") from criticality accident alarm system coverage.

Each plan of Action for compliance states 10 CFR 76.89(a) permits USEC to request NRC approval for specinc areas to be excluded from criticality accident alarm system coverage. USEC will provide criticahty detector coverage in all I

l areas of the plant except for those areas identined andjusti0ed by USEC and approved by NRC.

3.1.2 Standard ANSI /ANS 8.3 Standard ANSI /ANS 8.31979," Criticality Alarm System,"is the underlying basis for CAAS requirements in 10 CFR 76.89 and the DOE Orders. This standard, as used in 76.89, requires the following:

4.2.1 The need for criticality alann systems shall be evaluated for all activities in which the inventory of Ossionable materials in individual unrelaied areas exceed 700 g of U2"....

The standard goes on to state that 4.1.1 Alarm systems shall be provided wherever it is deemed that they will result in a reduction in total risk. Consideration shall be given to hazards that may result from false alarms.

and 4.1.2 Installation of an alarm system implies a non trivial risk of a criticality accident.,..

ANSI /ANS 8.3 is used internationally by the nuclear safety community. Uniformly, the Standard is interpreted to mean that the need for CAAS be evaluated for all activities in which the inventory of Ossionable materials exceed a designated threshold. This stresses a proactive approach (i.e., to decide

~

w here they are needed) rather than a reactive approach (i.e., to begin with the assumption that they are C)lmder Yard CAAS Esclusion. Baus l' aper 22 June 1997

1

. 7

.w needed everywhere and then seck exception or exclusion for areas where they are not needed). The emphasis of the Standard is also on the risk reduction benefit of CAAS and allow $ use ofjudgment to determine where alarms are needed based on assessment of risk.

Ilecause the ;r.ventnries of enriched uranium are sircable in each full product cylinder at the GDP, the "need for criticality alarm systems" clearly must be evaluated to comply with the Standard. Key elements in the decision of whether or not to install alarms should be based on (1) the existence of a non. trivial risk of criticality and (2) whether such alarrns provide a reduction in total risk to plant personnel. Thus, under the guidance and requirements from the standard, the decision to install or not install CAAS is dependent on assessment of the total risk (i.e., that associated with a critical excursion,md all other events with significance to safety) for each situation. As concluded in this report, CA AS in the cylinder yards is deemed to not reduce the total risk of radiat!on exposure to personnel at the GDPs. (Qualitative arguments are explored in Chapter 4.)

3,1.3 NRC Regulatory Guide 8.12 Regulatory Guide 8.12." Criticality Accident Alarm Systems'" addresses issues germane to Part 76 requirements as follows:

o Paragraph 4.2.1 of the [ ANSI /ANS 8.3) standard indicates that the need for criticality alarms must be evaluated for such areas uhere licensed special nuclear material is handled, used, or stored. if such an evaluation does not determine that a potential for criticality exists, as for example, where the quantitles or form of special nuclear material makes criticality practically impossible or where geometric spacing is used to preclude criticality, such as in some storage spaces for irradiated nuclear power fuel, it is appropriate to request an exclusion from CAAS coverage la these areas.

Thus, the Regulatory Guide highlights the distinction between the approaches of the ANSI /ANS 8.3 Standard and the 10 CFR 76.89(a) regulation that was explained in Section 3.1.2 above, 3.1.4 Preslous DOE Rtquirements Prior to NRC certification, CAAS requirements were provided by DOE Order $480.5," Safety of Nuclear Facilities," Section 11, ' Nuclear Criticality Safety *). Subsequently, Order 5480.24, " Nuclear Criticality Safety," replaced Order $480.5 and was itself replaced by DOE Order 420.1. Each Order relied explicitly on the guidance of ANSI /ANS 83 and, where referenced in the Orders, ANSI /ANS 8.1". In a number of instances, the Orders specify exceptions to provisions of the ANSI /ANS Standards.

DOE Order $480.5, Section i1, states that The following basic elements of nuclear criticality safety shall be provided in contractors' programs involving significant quantities of fissionable materials:

d C)lmder Yard CAAS Esclumn - Duis Paper 23 June 1997

~

(g),, criticality alarm system shall be installed in all locations wherein the quantitles of Assionable material may exceed 700 grams of uranium 235... These limits may be exceeded when justified by consideration of the physical form and isotopic distribution of the Assionable material. Hisjustl0 cation must be based upon a documented analysis demonstrating that, in such cases, the alarm system is not required.

As written, this subsection focuses heavily on the presence of CA AS, which is to be expected at most facilities that process and handle Assile materials. Ilowever, an exception is provided for the requirement "whenjustined by consideration of the physical form and isotopic distribution of the Assionable material" The appropriatejmtykat/on was construed to be based on analysis (e.g., in a SAR) and to include a formal approval of exception to the requirements by the cogniz. ant DOE Program Secretarial l'

• Of0cer.

Two other statements in DOE Order $480.$. Section 11, Subsection (h), although not requirements t.nder l

the interpretation for Subsection (g), nonetheless suggest applications to the GDPs. The Orst is that j

" Provisions shall be made to minimlre false alarms." This highlights the fact that false alarms are potential contributors to an increase in risk to personnel as a result of the installation of CA AS (especially in areas such as the product cylinder storage yards for reasons explained in Section 3.3).

Then, Subsection (h) goes on to state that

... such alarm system are not sequired for material during shipment or material packaged in approved shipping containers awaiting transport, provided no other operation involving fissionable material not so packaged is permitted on the dock or in the shipment area. Such an area or dock shall be located so that the interaction between Ossionable material positioned thereon and any other arrays of Ossionable material is essentially zero.

This situation is closely related to UF. storage in cylinders. Arguments that a critical excursion is not credible under such conditions are presented in this report.

Although DOE Order 5480.24 was issued about the same time as the GDps began the certl0 cation process, and thus was not ever a formal requirement, several ofits provisions are illustrative of DOE's approach to CAAS requirements.

DOE Order 5480.24 specincally addresses criticality accident alarm systems in Section 7.b., as follows:

REQUIREMENTS. The contractor criticality safety program for nuclear facilities shall include the following requirements:

b. The requirements in ANSl/ANS 8.3 relating to the needs for an alarm system are not applicable to this Order. For the purpose of this Order, Criticality Alarm Systems (CAS) and criticality detection systems (CDS) shall be required as follows:

(1) In those cases where the mass of Ossionable material exceeds the limits established in paragraph 4.2.1 of ANSI /ANS 8.3 and the probability of criticality is greater than C)hndet Yard CAAs Escluson Dam Paper 24 June 1991

t 104 per year (as documented in a DOE approved SAR), a CAS meeting ANSI /ANS 8.3 shall be provided to cover occupied areas...

(3) In those cases where the mass of Ossionable material exceeds the limits established in paragraph 4.2.1 of ANSI /ANS 8.3, but a criticality accident is determined to be impossible due to the physical form of the Ossionable material, or the probability of occurrence is detennined to be less than 10' per year (as documented in a DOE approved SAR), neither a CAS nor a criticality detection system (CDS) is required..

.. Also, neither a CAS nor a CDS are required for Ossionable material during shipment of fissionable rnaterial packaged in approved shipping containers, or i

Ossionable material packaged in approved shipping containers awaiting transport l

provided no other operation involving Ossionable material not so packaged is 6

permitted on the dock or in the shipment area.

DOE provides additional Interpretive Ouldance through DOE /HQ/NE 70,22 which states that 4

The use of 10 does not necessarily mean that a probabilistic risk assessment (PRA) has to be perfonned. Reasonable grounds shall be presented on the basis of commonly accepted j

engineeringJudgment.

Thus, according to DOE Order $480.24 and its Interpretive Guldance, a " stand alone, formal quantitative analysis" is needed (but not necessarily a PRA), prior to completion of the updated SARs, to suppon exclusion.

KY/S 271, Rev. 2 developed such a quantita'ive analysis, providing what DOE would have considered to be ",iustl0 cation" for the position that a nuclear criticality accident is an incredible event. The approach is consistent with the interpretation of DOE Order 5480.24, Section 7.b. Thus, the Ur. product cylinder storage yards do not have CAAS installed because a critical excursion has not been considered to be a credible event.

The relatively new DOE Order 420.1, which replaced DOE Order 5480.24 in 1996, identifies one additional element in Section 4.3.3(e)(4) specifically as follows:

If a criticality accident is possible wherein a slow (i.e., quasi static) increase in reactivity could occur leading from suberiticality to supercriticality to self shutdown without setting off emplaced criticality alarms, then a CAAS might not be adequate for protection against the consequences of such an accident.

To aid in protecthig workers against the consequences of slow criticality accidents in facilities where analysis has shown that slow criticality accidents are credible, CAAS should be supplemented by warning devices such as audible personnel dosimeters fe.g., pocket chirpers / Dashers, or their equivalents), area radiation monitors, area dosimeters, or integrating

[CAAS). If these devices are used solely as criticality warning devices in accordance with this Section, they shall be exempt from the calibration requirement of DOE Order 5480.11 (Radiation Protection for Occupational Workers,12 2188).

C)lmder Yard CAAS Dclusion liasis Paper 2$

June 1997

Thus, for a " slow" criticality accident-which would be characteristic of the scenario where water moderator leaked and/or diffused slowly into fissile material such as solid UF In a breached cylinder solid UF. -an alarming personal dosimeter (chirper) may be a better detection device than a CAAS, (A proposed 1997 revision to the ANSI /ANS 8.3 standard states that "If criticality accidents oflesser magnitude than the minimum accident of concern given in $ 6 [of ANSI /ANS 8.3) are of concern, then other detection methods (e.g., audible personnel dosimetry] should be considered. These other detection methods are not considered as criticality accident alarm systems and are not covered by this standard."

o 3.2 Double Contingency Evaluation Regulatory Guide 3.4, " Nuclear Criticality Safety in Operations with Fissile Materials Outside of j

Reactors" Standard ANSI /ANS 8.1 1988, which states the following:

i In Section 4.1.2 4

.... Process Analysis. Before a new operation with fissionable materials is begun or before an existing operation is changed, it shall be determined that the entire process will be suberitical under both normal and credible abnormal conditions. Care shall be exercised to determine those conditions which result in the maximum effective multiplication factor (k,n),

i In Section 4.2.2 i

l Double Contingency Principle. Process designs should, in general, incorporate sufficient i

factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible. As noted previously in j

Section 2.4 the safety analysis reports for the GDPs state that the UF. product storage l

cylinders do not meet this double contingency principle. The sole controlled parameter is moderation. Following the highly unlikely event of a cylinder breach, moderator exclusion is no longer assured. Thus, in a classic sense, the double contingency principle is not met. Maderator in sufficient quantity and with the ability to enter the cylinder and form a critical mass, however, is al immediately available. Ample detection time (as indicated this report) based on such factors as breach size, self alening, chemical self.

sealing, and inspections) could be cons!dered a defacto "second contingency" with a very high likelihood of preventing establishment of a critical configuration.

e 3.3 Current Cylinder Yard Controls for Criticality Prevention A large breach of a cylinder has been concluded to be improbable due in part to the strength and ruggedness of cylinders used for enriched material and to the controls that are in place at the GDPs.

These controls are divided into two categories: those that control cylinder handling operations and those

- that control inspections.-

. C)lmder Yard CAAS belusion. Basis Paper, 26 Junc 1997

Plant controls on cylinder handling ensure that challenges to cylmder integrity are rninimized. Cylinders handled in accordance with these controls are expected to maintain their integnty even when a mishap occurs, since the conditions will be well within the constraints of the cylinder drop tests discussed in documents KY/D 2032", KY-477", KY $00", and in KY-6312' GDP controls governing inspections provide the additional assurance that if an anomaly occurs, the involved cylinders will be examined for damage and, if necessary, action will be taken to halt the possibility of water intrusion into the cylindet and to re-establish cylinder integrity long before a possibility of cnticality exists.

3.3.1 Current Controls for C)linder llandling L

%c following controls (KY/S 271, Rev. 2) are intended to prevent damage to cylinders containing LEU during handling and to ensure operators take the necessary precautions upon an incident or upon detection i

of a breached cylinder.

1. Cylinders containing liquid UF. may be lifted only by the building cranc. Cylinders containing liquid are moved from the building to a cooling pad immediately adjacent to the respective building with a load certified cranc and not moved again until the contents have solidified. Equipment or other cylinders may not be lifted over a cylinder that contains liquid UF,.

2.

Cylinders containing solid UF. must be moved to cylinder yards by an approved load certified carrier. A vehicle moving a cylinder must be maintained the following specified speed (s):

Ahsas s less than 15 mph AND less than 5 mph on curves (KY/S 271, Rev. 2, p. 4).

3. Cylinders must be stored off the ground in long term storage (KY/S 271, Rev. 2, p. 4).

4.

Cylinders containing enriched material are not stacked (KY/S 271, Rev. 2, p. 4).

5, Operators are trained in emergency response associated with cylinder breach (KY/S 271, Rev. 2, p. 6).

6.

Water is not allowed for use on a cylinder with leaks (KY/S 271, Rev. 2, pp. 29 30).

3.3.2 Current inspection Controls in Cylinder Yards The following controls (KY/S 271, Rey, 2) arc intended to detect cylinder damage that may have occurred during or subsequent to previous handling:

1. An inspection will be conducted of each cylinder upon its receipt at the plants, prior to heating in an autoclase, prior to filling, and prior to shipping. (KY/S 271, Rev. 2, p. 7).

2. Annual inspection will be conducted of cylinders storage in storage that contain LEU per detailed procedure UE-QA 14.1. (KY/S 271, Rey,2, pp. 6 and 30).

Cylm&r Yard CA% laducon lusis Paper 27 Jutw 1991

3. At least two inspectors will examine each cylinder containing enriched rnaterial. (KY/S 271, R:v. 2, p. 6)

4. Inspectors must pass required inspection training, including a written test. (KY/S 271, Rev. 2, p. 6).

$. An annual survey of postings is required for each cylinder yard. (KY/S 271, Rev. 2, p. 6).

e e

l I

e-t C)lmder Yard CAAS Esclusion Basis Paper 28 June 1997

4 J

4. BASIS FOR CURRENT CRITICALITY PREVENTION a

4.1 Accident Scenarios CylinderIntegrity As discussed previously, extensive requirements have been adopted for the handling of cylinders to ensure that accidents are prevented and the integrity of the cylinders are maintained. The Gaseous Diffusion Plant Safety Analysis Repon Upgrade Program considered a numbe of possible accidents that could cause cylinder breach"". Several of these accident scenarios were pri narily concerned with the release ofliquid UF. and did not address the potential for criticality following the release. Accident scenarios reviewed in this chapter focus on criticality concerns associated with cylinder handling. 'lhe physl:al location of the cylinders is important to the issue only in terms of CAAS coverage.

Scientine research and data verify that any amount of LEU is suberitical in the absence of moderator. In the scope of this discussion, uranium in the fonn of UF. is stored in airtight containment cylinders for the purpose of storage and transport, as described in Chapter 3. The cylinders serve as the only barrier to protect the uranium from moderator intrusion. Thus, for criticality to be possible, the containment cylinder must be breached in some manner in which to either release a signincant amount of UF. In the presence of a potential moderator or to allow ingress of a signincant amount of moderator. As noted above, previous safety analysis work has examined the ways in which cylinders may be breached. These include possible cylinder damage by handling and storage operations, natural phenomena events, and Gre.

4.I.1 ilandling and Storage Operations llandling and storage of cylinders present the most likely scenarios for a cylinder to be damaged to the point of cylinder breach. This could occur in several ways:

drop of a cylinder, either individually or with one or more cylinders, a

vehicle accident, or corrosion. induced failure.

+

4.1.1.1 Cylinder Drop Cylinders serve two purposes: containment nnd moderator control. Cylinders are handled that contain UF. in either liquid or solid form. Since cylinder failures involving these two UF, hazard states result in signincantly different physical effects, each will be described separately in this section.

C)lmder Yard CA AS Inclusion. Basis Paper 29 June 1997

Liquid UF. Cylinder Breach Cylinder failures are of greatest concern with cylinders that are Olled with liquid UF.. For this reason, all liquid. filled cylinders are handled with overhead cranes that are subjected to stringent quality control measures and periodic inspection and test requirements, as captured in the plant TSRs Lift heights for liquid Giled cylinders are minimized to reduce the likelihood of failure in the unlikely event the cylinder is dropped. Cylinders are also spaced carefully in the cool.down area to minimize the possibility of cylinder to-cylinder collisions.

Liquid. filled cylinders are pressurized because of the vapor pressure of UF.. As a result, failures with liquid nlled cylinders result in signincant releases of UF. as the UF vapor or liquid is expelled from the breach. Even for very small breaches of a liquid Hiled cylinder, a signiHeant UF./UO,F and ilF cloud will be rapidly formed. The visible cloud will self announce the failure, alerting operations personnel and others to the failure. With the release to the environment, liquid UF. will immediately Cash tu a mix of 40% vapor and 60 % solid. Ilowever, due to the small UF. particle size, much of the solid may also become airborne during a liquid release. This is evidenced in the two most signincant accidental UF.

liquid releases in the United States: the 1978 PORTS cylinder drop [ORO 7572'] and the 1986 Gore, Oklahoma, hydraulic cylinder failure (NUREG.ll89*). In both cases, only a small amount of the rnaterial released was recovered.

Given the volatility ofliquid UF., the only conceivable means to effect an inadvertent criticality is to collect the material after release in a critical con 0guration while moderated. This is not impossible, but is extremely unlikely due to the distribution ofil in the form of110 or liF in any remaining uranium 2

compounds near the break and the geometry of the compounds following termination of the release.

Neverd eless. In areas where liauld nlled evlir.ders containing > l wt % U2" are handled or t

stored. existing CAAS coverace is provided.

Solid UF, Cylinder Breach Cylinders filled with solid UF. are routinely moved from cool down areas to long-term storage yards and stacked as described in Chapter 3. With these movements, the potential exists to drop a cylinder or impact against another cylinder potentially resulting in either a direct breach of the cylinder wall or c weakening in the wall creating a potential accelerated corrosion site. The breach of the cylinder wall allows water initusion or loss of moderator control. In the event of a catastrophic failure of a cylinder, a large mass of UF. could be enposed.

Once liquid UF. solidifies in cylinders, the cylinder pressure is sub-atmospheric. Depending on the location of the breach, the failure may be in the cylinder vapor space or in the solid UF. region. If the failure occurs in the vapor space, any immediate cylinder failure will draw air into the cylinder until cylinder pressure equalizes with the atmosphere. The introduction of iir into a cylinder will also introduce water vapor, which reacts with UF. in the cy linder vapor space, ilF is generated along with -

C@njer Yard CAAs Lulusn.n. Basis Paper 30 June 1997

heat from the exothermic reaction' which increases the pressure in the cylinder above atmosphere, expelling some of the vapor space contents. Eventually pressures equalize when diffusion of water va into the cylinder accompanied by atmospheric pressure changes allow additional water to enter the cylinder. With the release of11F, any nearby operator would be alerted by the irritating gas and the visible vapor.

In situations where the cylinder breach is catastrophic ( l.e. the shell is circumferentially split or "the bottom" of the cylinder falls out), signincant material would be released directly to the environment.

Again, this type event would be "self alerting"in that a trained operator would directly observe the initial failure before a critical configuration could form with suf0cient moderator-if such a connguration is possible.

4.1.1.2 Corrosion Induced failure

- The issue orcorrosion induced failures has been considered in detail within the DOE complex as a result ofinquiries from the Defense Nuclear Facilities Safety Board in the past two years. Previous incident evaluations (in POEF 2086) and more recent studies and experience clearly indicate that cyiinder failures due solely to corrosion take tens ofyears to develop in thin walled cylinders containing depleted uranium. Weaknesses in the cylinder wall due to previous damage or impact may accelerate the time to failure similar to the reported failure at PORTS. Even if a cylinder had damage similar to the damage in this specluc case, a failure in the cylinder wall due to cylinder impact about the stiffening ring would require several years to produce signincant hydration of the contained material to approach minimum critical mass, even if we conservatively assume spherical geometry, optimum moderation, and full reDection.Therefore, with a reasonable inspection program, corrosion induced failures can be controlled to eliminate any criticality related concerns in the thick walled cylinders that are primarily used for cylinders containing a I wt % U2".

4.1.2 Natural Phenomena Failures Natural phenomena events include earthquake, wind, and Hooding. These events have been evaluated for both PGDP and PORTS.

4,12,1 Earthquake Cylinder yard arrangements with cylinders stacked were found to have adequate capacity to withstaad an Evaluation Basis Earthquake (EBE) without significant impact. However, greater magnitude canhquakes could result in some' minor damage where cylinders are stacked with their stiffener rings in contact with each other. Where this stacking technique has been used, strong lateral ground motion could cause the top cylinder to slip and fall the several inches that is the width of the stiffener ring. The impact from the ring and the weight of the full cylinder could cause denting and possibly cracking of both cylinders near tl.'e ring impact area, but it would be not suf0cient to cause a through wall puncture of the cylinder.

Cracking may lead to a small opening in the cylinder, but this result is not indicated for the height of this

!The reaction of solid UF. with water is endothermic; however, the hydration of UO,F: are exothermic, resulting in a net release of energy 9

Cylinder Yard CAAS Inclusion Unsis Papct 31 June 1997

postulated fall. The lining lugs would not be involved in any seismically induced interaction. Thus, seismic events could contribute to accelerated long-term corrosion problems with cylinders that may have suffered impact from cylinder slip and ring contact. Ilowever, this potential would be identined in inspections following an earthquake event.

The practice of stacking cylinders ring to-ring is not a major concem for cylinders containing enriched material. While cylinder stacking ring to ring has occurred occasionally in the cylinder yards, most cylinders are stacked with the rings of the cylinders already in contact with the main cylinder body.

Further, the majority of the 48X cylinders that do have stiffening rings only contain depleted material.

Cylinders containing enriched material are not stacked at PGDP, but some stacking of product cylinders may occur at PORTS.

Soil liquefaction has also been examined at both sites and determined not to be an issue for earthquakes up to a 5,000 year return level. Cylinders containing enriched material typically are stored on concrete pads, which reduces liquefaction effects.

4.1.2.2 Flotaling Evaluations [POEF LMES.89" and KY/EM.174"] of regional Hooding and local intense precipit tion l

for both sites concluded that Dooding was not a problem for either site for the evaluation basis Good.

PORTS is located about 113 feet above the historical Hood level for the Scioto River. Temporary ponding may occur around the main process building, during a 10,000 year return interval storm to a depth from about 4 to 5 inches, but the storm sewer system requires only a few hours to recover to drain the excess water to the outfalls. PGDP is at a nominal grade of 380 feet, with the lowest point being 367 feet. The historical high water mark (in 1937)is 341.7 feet elevation. The temporary ponding effect at PGDP is similar to that at PORTS.

A Cooding event of suf0cient magnitude to Dood cylinder yards could provide moderator to the cylinders of stored LEU material, but it would not cause introduction of the moderator interstitially necessary to achieve a critical state. Cy linders have been analyzed assuming full reDection (immersed in water) and shown to be suberitical. Moderator could enter the cylinders if breaches preexisted the Dooding event.

Ilowever, the intrusion of water into the UF material occurs very gradually as explained in Section 2.3.

Thus, even if there were cylinders with substantial undetected breaches existing prior to the Dood, there would be no short term concern from criticality. Also, ample time would exist, post Hood, to inspect the cylinders containing enriched material and to determine w hether their integrity was still intact. Also, ample time would exist to take any action necessary to halt the progression of water intrusion into any cylinder (s) found to be affected.

Another aspect of Gooding that might occur is the saturation of the soil underneath cylinders causing them to sink into the ground. This has occurred in the older y ards for depleted uranium cylinders that were prepared with loose gravel and with no use of concrete. The enriched material is stored in yards that have a concrete mat for suppor' Thus sinking into the ground is not likely, Even so, this scenario would not result in major structural loading on a cylinder ifit were to sink. The concerns and response would be the same as if the cylinder were submerged directly in water. It would be recovered, examined, and actions taken if necessary to reverse the effect of any breach.

C)hnder Yard CAAs Eulunon Dans Paper 32 June 1997 a

Flooding of either site so severely that marine vehicles, houses, or other massive objects might cause damage to cylinders, is too remote to be a consideration because the maximum Dood level is still 100 feet below the elevation of the PORTS storage yards and 12 feet below the elevation of the PGDP storage yards Therefore, ilooding of a cylinder yard produces no condition that would be an immediate cause for criticality concern. Only controls involving prudent periodic and post event inspections would be required to cover the criticality concerns associated with the Hooding event.

4.1.2.3 Winds Both GDPs have been evaluated for evaluation basis winds corresponding to a 250 year return interval.

The controlling wind considered for both plants was a straight wind. Tornadoes did not control at the return period evaluated. Neither straight winds nor tornadoes would cause direct damage or movement of cylinders. An evaluation" looking at wind born missiles, as specified in DOE STD 1020 94, demonstrated that cylinders will not be punctured by debris in winds up to 300 mph.

Because of the chemical behavior discussed above, there is ample time to survey for damage following l

the event and to take actions necessary to recover any cylinders breached by the event without fear of imminent criticality.

4.1.2.4 Conclusion Natural phenomena events are not expected to be initiators for criticality in the cylinders of solid enriched material within the cylinder yards. Reasonable, low probability, natural phenomena events cannot cause catastrophic failures of cylinders. Minites associated with more energetic tornadoes could cause significant, though not catastrophic demage, but at very low probabilities, llowever, the nature of salid UF, response is such that criticality would not occur immediately, even in a rain storm. Therefore, the most prudent controls associated with these events are periodic and post-event inspections.

4.1.3 Fire-induced Failures Accidental Orcs in the cylinder yards could potentially threaten failure of one or more cylinders. Cylinder failure could result from liquefaction of the solid UF, and concomitant expansion leading to hydraulic rupture. As a result, Dres produce consequences similarly to that of a liquid Olled cylinder rupture, with the added heat input from the fire. Release of the cylinder contents then would present loss of moderator control. The likelihood of a Gre is minimized by controlling combustible materials in the cylinder yards.

Mitigation of a fire in the yards will be conducted through emergency response. Both sites have local fire Oghting capability with the fire fighters trained on fi;;hting fires involving site hazards. Fire fighting plans are in place to address potential involvement of fissile material by avoiding the use of water or other effective neutron moderating substances.

Cylmder Yard CAAS Excluson. nasis Paper 33 June 1997

4.2 Cylinder Reliability Conclusion Sections 2.1 and 2.21escribe the cylinders used for the stcrage of enriched UF and the handling they receive. Section 4.1 identines the possible accident scenarios that the cylinders might expect to endure.

These discussions show that the likelihood of cylinder damage is low.

Cylinders exposed over the long term may develop areas of rusting, w here moisture collection has been particularly acute, that eventually penetrates the cylinder. Ilowever, out of approximately 70,000

)

cylinders, the few that have developed this condition were detened through the inspection program in

=

suf0clent time to prevent criticality (even if they had been cylinkts of enriched material). Though it is l

realistic to assume that a few cylinders per year will develop small breaches, these cylinders are less i

likely to contain enriched material. [ Cylinders used to store enriched material are thicker, stored in better conditions, fewer in number; and newer.)

%e probability of an accident or failure which would produce a large hole in a cylinder is very small. A large hole is denned here as greater than 1 inch; a small hole as less than I inch. Two cylinder failures occurring more than 20 years ago p*oduced signincant release ofliquid UF.. Note however, these failures did not produce holes that would allow the free now of water into a cylinder.11andling procedures were restricted as a result of those two events. Although handling mishaps cannot be climinated, the probability of one occurring is now small because of the combination of cylinder design (as demonstrated r

in the tests) and the low likelihood of a mishap that would significantly challenge the cylinder's integrity, in the event that cylinder damage did result from a signincant mishap, the operational history of the GDPs has shown that the failure would likely be con 0ned to a small(less than 1. inch) split adjacent to a stiffening ring near the point ofimpact. INen if a split were greater than 1. inch, it would not allow an immediate intrusion of water into the cylinder, and it is highly probable that the handling operator would observe it immediately. Therefore, for all practical purposes, a cylinder failure leading to a criticality event is not considered credible (i.e., cylinder failure plus water hydration leading to a critical moderated mass).

9 C)linder Yard CAAS 12ntuuon. Basis Paper 34 June 1997

5.

NEED FOR ADDITIONAL MEASURES TO PREVENT / MITIGATE CRITICALITY The integrity of the product cylinder is the primary control used to prevent a criticality condition. As a result, the integrity of the cylinder must be maintained, and controls must be established to ensure that authorired cylinder handling and storage operations will not violate that integrity. Controls that have been established at each of the facilities to ensure proper handling are provided in Section 3.4. In order to funher ensure that criticality conditions are prevented in UF. yards the following minimum set of controls should be established to mitigate the consequences of the accident scenarios previously' discussed. These controls incorporate (1) those currently in place or contemplated at each of the facilities and (2) additional ones that have been identified as a result of this study. The controls identified include surveillance, inspection, handling, and placement.

5.1 Cylinder Handling Controls

$.l.1 Storage ofI.lquid UF. Cylinders At both PODP and PORTS, the single most plausible incident that could result in a nuclear criticality accident would be the drop of a full liq'ald UF. cylindes into a substantial depth of standing water. This incident can be limited through a prohibition on the movement ofliquid UF. cylinders into areas where a substantial depth of standing water is present, llowever, since these areas are already under CAAS coverage and the cool down areas are well drained concrete pads, liquid cylinder operations are not -

considered further in this report.

5.1.2 Storage of Solid UF. Cylinders As long as the integrity of the solid UF, cylinder is maintained, there is no potential for the entry of hydrogenous materials into the cylinder to create a potential nuclear criticality. The integrity of the container can be compromised through corrosion, impact, or drop mechanisms. Outside storage of cylinders subjects them to corrosive action by moisture and high humidity. The corrosive action is known to accelerate over n period of time as a result of stress or impact of the cylinder wall. This corrosive action can cause the development of holes in the cylinder wall Similarly, holes in the cylinder walls can be caused by impact incidents (e.g., traffic accidents, airplane crashes, tornado missiles) or through the drop of a cylinder (e.g., break off of a valve or plug, impact on a sharp ob,)ect) lloles can occur in cylinder wall areas in contact with the vapor phase or solid phase UF., hereafter teferred to as " vapor.

phase areas" and ' solid phase areas " respectively. These holes have b.en arbitrarily classified as "large" If greater than one inch diameter, or "small"ifless than one-inch diameter. Sections 5.1.2,1 through 5.1.2.4 present a discussion of controls that can be established for each class of hole. Storage yard fires and personnel entry are discussed in Sections 5.1.2.5 and 5.1.' 3.

Cylmder Yard CAAS Exclunon. Dans Peer 3s June 1997

5.1.2.1 Small hole. solid phase Small holes in the solid. phase area of the UF. cylinder can be generated as a result of eccrosion at impact induced stress points, tears, or cracks in the cylinder wall. Information provided in POEF 2086 indicated i

that an impervious plug of ruction products, consisting of hydrated UO F, and Fe UF, complexes, forms at the hole to limit the diffusion of moisture into the hole through the UF. or the llF out of the hole.

llorever, over a period of time, the ilF formed during the reaction of water with UP. reects with the iron of the cylinder wall to cause enlargement of the hole. This investigation also indicated that it took at least 13 years to hydrolyze about 1756 kg of UF. and 4 years to hydrolyre 21 kg of UF. as a rcsult of the corrosion scenarios, Note that these breaches occurred in thin walled cylinders. It would have taken considerably lonyer to establish holes in thick walled product cylinders. 'Ihe document, ORNIJCSD/TM-284, indicated that it would take about 37 kg of hydrated UO,l', in a spherical geometry to go critical. In the case studied,it was estimated that at least 8 years of corrosive action uould be required to forrn enough UO,F, to 30 critical ifit were in a spherical form.

In order to preclude the accumulatica of sufUclent hydrated UOf, that could go critical, procedures have been established to perform periodic inspections / examinations of all product cylinders to ensure the imegrity of the cylinder. It was noted in KY/S 271. Rev. 2, that the facilities have committed to an annual inspection frequency. This frequency will ensure the integrity of the product cylinder and should also preclude generation oflarge stress corrosion induced holes in these cylinders, or identify any stress corrosion holes early in their development, in addition, the cylinders must be properly spaced in order to facilitate the inspection activities.

Controls:

Perform annual inspections and/or examinations of all product cylinders to ensure the integrity of the cylinder.

Ensure that each product cylinder is appropriately spaced to facilitate inspection on an annual cycle.

5.1.2.2 Large hole. solid phase The instantaneous formation of krge holes in the sol;d phase area of UF cylinders is not considered to.

be credible because of the structural stability of the cylinder wall as reinforced by the solid UF. present in the cylinder. This was demonstrated during drop tests run on thin wall ($/16 inch) and thick wall (1/2 to 5/8 inch) cylinders. All of the cylinders approved for LEU at: of the thick wall type. During the drop tests, no large-scale cataerophic damage was exhibited on any of the cylinders tested. Details of these tests were provided in KY/D-2032, KY 477, KY 500, and in KY 631.

Controls:

Perform annual inspections and/or examinations following any event censidered a threat to cylinder integiity of all product cylinders to ensure the integrity of the cylinder.

Ensure that each product cylinder is appropriately spaced to facilhate inspection on an annual cycle.

C)lmder Yard CAAT.!'ulusion Hans Paper 36 June 1997

s 5.1.3.3 Small hole-vapor phase Small hows are deflued as those that are 1 inch ir diameter or less. Small holes in the vapor phase area of i

a r.olid UF cylbdct can be generated as a result of a loss of a valve, plug. or crack caused by mechanical ir.teraction of scac type. As shown in studies performed at both sites, a layer of crystalline UF. forms on the inside surface of the cylinder during cooling ofliquid UF. to solid UF., Interaction of moisture with UF causas %e fananon of UO,F, and ilF. Interaction ofIlF with iron in the cylinder wall and 3

whw]'.% cr.nes the formation ofinsoluble UPcFe compounds that plug the hole and restrict entry of dditb:ui.ncinture. As a result, this scenario is not expeded will result in the formation of a critical ruass of hy6:ced UU,F. Ilowever, in order to preclude the possible formation of a critical mass, 3

surveillances and/or insptions should be conducted on en annual cycle on all product cylinders held in storage in excess of 1 year, to ensure integrity of the cylinder. Corrosion of cylinders is minimized by placing the cylinder into cradles. In this manner, the cylinders are raised off the ground which restricts the area of the cylinder that may be subjected to corrosion from moisture in the ground. These cradles also provide stabilized spacing of the cylinders.

Controls:

Ferform annual surveillances and/or inspections of all product cylinders held in storage for

+

longer than 1 year to ensure the integrity of the cylinder.

Ensure all product cylinders in long term storage are stored off the ground to provide stability and to help reduce the cylinder surface subject to corrosion.

5.1.2.4 Large hole. vapor phase Large holes are defined as those that are greater than I inch in diameter. Large holes in the vapor phase area of a solid UF. cylinder could be generated as a result ofimpact during transport, a drop, or through impact by a tornado missile or the drop of a heavy piece of equipment. It is not expected that large holes in the vapor rhase area of a solid UF. cylinder will plug as a result of the formation of UO F, or UFcFe 2

compounds : hat are insoluble, liased on the results of the droo tests previously discussed. it is also not expected that such significant damage will occur. llowever, as shown by Leitnaker, ifit were to occur, excess moisture reacts with UF. to form a stable hydrated UO,F, layer that restricts the transport of additiona; watei to the UF. located below the hydrated layer. The system UF. Il O comes to equilibrium 2

at a slow rate as a result of this hydrated UO,F, lay er.

If one assumes the presence of a quarter inch solid stabilhed layer of 5% enriched, hydrated UO;F in a 48 inch diameter,10 ton cylinder, at a density of 6.4 grams /cc. this would account for about 4.1 kg U2" (109 kg UO,F,)in the stabilized layer. Although it would tske only about 37 kg of UO,F in a spherical geometry to go reitical, it is estimated that it would take about a 4.96 inch slab (2157 kg UO,F,) of hydrated UF. to go critical. Infonnation provided in POEF 2086 indicated that it took about 13 years to hydrate about 1756 kg of UF. and 4 years to hydrate 21 kg of UF. as a result of the corrosion scenario.

Therefore, as long us there is no mechanism available to convert from slab geometry to spherical geometry within the cylinder, there is no reason to believe that criticality would take place.

C3 mder Yard CAAs i:sclusion. Dasis Paper 37 June 1997 1

Since cach of the scenarios identified for the formation oflarge holes involves a highly visible incident, actions should be taken as soon as safely practicable to perform inspections and/or examinations of potentially affected cylinders to ensure the integrity of the cylinder or to repair the cylinder, as required.

In addition, movement of cylinders or heavy equipment over other cylinders should be limited.

Control:

Perform inspections and/or examinations or repairs on affected cylinders, as soon as safely practicable, to ensure the continued integrity of the cylinder.

5.1.2.5 Cylinder storage yard Ilres in the event of a fire, the temperature of the solid UF, in the cylinders would be elevated, thereby causing the UF, to liquefy and pressurire the cylinder. A large fire would create the potential for hydraulic failure within the cylinder. in order to reduce the potential for fires that could affect the integrity of the cylinders, actions must be taken to control the fire load present in the storage areas and to establish a Pre-Fire Plan. This can be accomplished by restricting the quantity of fiammable liquids (such as oil, diesel fuel, hydraulic fiulds, gasoline, or cleaning solvents) present. The quantity of combustible materials (such as wood, plastic, paper, vegetation, and construction materials) is procedurally controlled. The Pre-Fire Plan should be prepared to provide directions to the site fire brigade and off site fire companies on how various types of fires should be handled and where water and/or dry chemicals should be used. For example, to preclude the potential for dissolving plugs that cover holes in cylinders caused by inadvertent corrosion, care must be taken not to use high pressure water fire hoses on fires that might occur in the cylinder storage yards.

Controls:

1. Limit the quantities of flammable liquids in the UF, cylinder storage yards to as low as practicable.

2. Eliminate the presence of extraneous combustible materials in the UF, storage yards.

3. I estrict the use of water in the UF, cylinder storage yards in accordance with a pre fire plan.

5.1,2.6 Cylinder storage yard personnel entry requirements Several additional controls should be incorporated it to procedures used in connection with operations associated with the lifting, transfer, placement, storage, inspection, and surveillance of UF., These controls could provide assurance through " defense in depth" that the workers will be protected in the storage yards if an inadvertent release of UF. or criticality should occur. They should also ensure that appropriate inspections can be and/or have been performed to assure the integrity of the cylinders through a restriction on stacking of full product cylinders. For example, each individual authorized to perform these operations should be adequately trained concerning w hat actions should be taken iflarge quantities of uranium or violations of cylinder spacing requirements are observed while they are working C)hnder Yard CAAS Deluuon Basa Paper 38 Junt 1997

in the storage yard. in addition, emergency response personnel should be trained on action to be taken in case failed cylinders are identitled or a Orc occurs in a cylinder yard. An additional control that might be considered include the issuance of radiation monitoring devices (e.g., chirpcra) that would notify the worker that an inadvertent criticality excursion had taken place. Emergency response teams entering the cylinder yards should also be trained to assume that UF containtnent has been lost or that an inadvertent criticality is possible and respond accordingly.

Controls:

Provide appropriate criticality safety training to workers w ho perform any activities in UF.

l cylinder storege yards.

Provide adequate spacing of product cylinders to ensure that appropriate inspections of each cylinder can be performed.

lssue alarming personal dosimeters radiation monitoring devices (chirpers) to emergency

+

response team members entering a UF cylinder storage yard in the event of an emergency.

Provide each emergency response team entering a UF. cylinder storage yard with a radio that would be used to immediately notify management of any off normal conditions identined in the storage yard.

4 Cylinder Yard CAAS Eulusion. Basis Paper 39 June 1997

i I

6. CONCLUSIONS AND POSITION This paper has examined the available tesearch and data on the factors that affect the potential to have a criticality event in a cylinder storage yard. The cylinders used for storage of enriched UF. have been reviewed for their ruggedness and whether the formation of a large breach is realistic. The intrusion of moisture into a cylinder and its reaction with UF. inside a cylinder have been reviewed to determine whether a critical mass could occur and, if so, under w hat conditions. The requirements for and effect of CAAS coverage in the cylinder yards have been examined. The controls that are currently used and might be used to further prevent cylinder yard criticality have been rey!ewed. These examinations have led to the conclusions that form the basis for the DOE position on whether a CAAS system is needed in the i

cylinder yards. Those conclusions are presented below.

)

Conclusions.'

l. Cylinders j

The cylinders are robust pressure vessels intended for long-term storage. Cylinder test data indicate that the design is sufficiently strong to resist both small and large through wall failures. The tests subjected the cylinders to drops from heights greater than would be encountered in current

+

operations. The tests did not demonstrate that it was impossible to have a large breach of the cylinden however, the tests indicated that significant cylinder damage is not likely. Therefore, with j

these parameters included in the controls, no cylinder breach is likely even in the event of a major

- cylinder handling error.

2.1 Accident Scenarios l

The range of credible accident scenarios, including natural phenomena events, were reviewed. No credible accident mechanism was identified that could produce a major breach except a cylinder drop. An analysis performed for the GDP SAR program has shown that cylinders can withstand both the direct effect and potential missile impacts from tornados and other winds up to 360 mph. Given the controls governing the types of devices and the inspections required on the load bearing members of the cylinder carriers, a dropped cylinder from a height that could potentially cause significant damage is considered to be improbable; however it cannot be ruled out.

l 3.

Critical Mans Potentials UF Chemistry and Water intrusion To investigate the likelihood of a criticality in the cylinder yards, the ability of water to enter the cylinder and the subsequent response when water enters were examined. The chemical reactions -.

associated with UF. and water have been throughly investigated. For a small hole in the cylinder, the -

- etTect of this reaction would be that a barrier would form preventing further water intrusion. lf a larger hole were to develop in an area well exposed to the elements, sufficient water entry to cause.

i-criticality might be possible in a prolonged storm or under a situation in which a fire hose was used on the cylinder. These situations are concluded to be unrealistic since a large hole would be

[

r

[i

]

Cylinder Yard CAAS thclusion. lsasis Paper 40 June 1997 I

• r---

==.. r - me v - i. w w w-seg n -e-ei rs-

-vetem,---

m' ye

+-w--

w-e m W w-*p m-y-

---

E--aw wyhH'i**--seh eef w'** W*7 TD 7

7*-r$-et'

- ' ' **i-JW-t WT'="CF-*T-v'n v' fr d *p

• Wehu-TW'EI TM'-Y

• FT

_ ~ _ _ _ -.

i l

immediately detected following the event or the hole would be plugged by the object that caused it.

Ilowever, even if a large quantity of water entered, the reaction with the material would still form a barrier retarding further reaction. lt would take years for enough water to penetrate into the cylinder airl mix with Ur. to form a critical geometry. Therefore, it is concluded that there is adequate time to detect and ameliorate the breached condition hefore there is any possibility of crit'cality. Thus, inspections of the cylinders, especially after any event that can be considered a threat to cy!inder integrity, in combination with handling controls to minimize cylinder exposure to damage are adequate to preclude cylinder yard criticality events.

4. Criticality Accident Alarm System Decision As explained in Chapter 3, the ANSI /ANS 8.3 Standard requires criticality monitoring and alarm systems (1) w here a critical excursion is credible and (2) when it can be expected that the installation of such a system will reduce total risk. ANSI /ANS 8.3 also requires that " Consideration shall be given to hazards thri may result from false almns..., in considering the risk reduction benefits of an alarm system, it should be recognized that hazards mry result from false alarms and subsequent sudden interruption of operations and relocation of persennel." Thus, w hether to employ crhicality nccident alarm system is an important administrative des ision.

Ilisto icelly, the UF, product cylindes storage yards at the GDPs have not used CAAS because a critical excursion has been judged to be a highly unlike'y event, it has been suggested that such systems "wc,uld not hurt and could be helpful " Three factors dictate against such a conclusion:

total risk to personnel including risks of other events with significance to safety, cost ofinstallation and maintenance, and overall potential value to the facility.

e These three factors are addressed below.

A. Total Risk Alarm Hesponse To clarify the issue of total risk, it is worthwhile to examine the expected personnel response to criticality and other alarms. The response to a radiological alarm (i.e., indications of a high reading on a continuous air monitor (CAM) or alarming personal dosimeter) is to initiate deliberate evacuation and seek " safe haven" nearby. For a fire alarm, the ivorker has been trained to observe the fire; judge whether it can oe controlled locally; and ifit cannot, shutdown work; evacuate deliberately; and " avoid panic."

The main purpose for sounding the criticality alarm is to initiate an immediate evacuation. This l

means that personnel do not take time for wash up orjob shutdown. Complete evacuation from the l

facility follows. [The urgency of the evacuation is indicated by experience with the alarm system i

used at Los Alamos National Laboratory (LANL) prior to 1980.The loud, Klawn horn used to signal C)lmdct Yard CAAS 1:scluuon. Daus Paper 41 June 1997

evacuation is unnerving-somewhat by design. At LANL, the last three false alarms were each accompanied by injuries to personnel, the worst being a broken ankle.]

Fer outdoor alarms a lighting strike may trigger a false alann or do damage to a CA AS; this has been the experience at several oiber fuel cycle facilities.

At the ODps, there may be some ar,.biguity as to proper alann response for cylinders in proximity to other buildings. lf a CAAS alarm sounds in a UF. product cylinder storage yards, should personnel evacuate toward the nearest building? Should persons in the nearest building evacuate to the outside, potentially toward a storage yard?

Alarrn System Risks In addition to providing a signal for evacuation aner an excursion had occurred, the potential benefits of a CAAS are postulated to include the following:

warning of an impending excursion.

indication of the rate of change of the radiation level, and acquisition of data on background radiation levels.

+

Ilowever, it isjudged that the Hrst two of these potential benc0ts would occur too quickly or that the background neutron level is too low for the system to respond in a meaningful manner. The third (data acquisition on background radiation levels) could be better acquired by using regular dosimeters.

At least three concerns are likely te translate to increesed risk to personnel as a result of the installation of a CAAS:

The potential for a false alarm to cause a worker (either in the storate yards or nearby / adjacent facilities) to make an operating error such as causing a cylinder to be dropped with, worst case, potential UF. dispersal.

The potential for a CAAS signal to be used as a diversion to cause evacuation of the facility and allow security guards and other safeguards systems to be bypassed.

A concern associated with the requirement for extra sources of energy to power the CAAS.

The need for maintenance on elevated CAAS detectors, horns, and support equipment introduces a new hazard.

Even though advancing technology is reducing false alarm rates, the conclusion remains as stated below:

a critical excursion is unlikely, risks outweigh the benents, and e

some benents are more readi;/ available by other means (e.g., alarming personal dosimeters

+

[ chirpers), which ahhough they do not meet the ANSI /ANS 83 requirements for CAAS, do appear to be appropriate for monitoring routine radiation levels).

C)knder Yard CAAS INclunon. !!aus Paper 42 June 1997

I 4

De potential benefits of a CAAS are offset by (1) the potential harmful effects of the alami on personnel, (2) the potential compromises of safeguards and security; and (3) the need in some locations for an extra energy source where one does not currently exist, Overall, safety is enhanece when the number of"munediate ceacuation" alanns is mtelligently minimited Without CAAS, the net risk to operations personnel is reduced in addition, the workers are less concemed about improbable issues such as enticahty and can focus more attention on perfonning l

their assigned tasks and controlling other credible risks.

H. Cost installation costs for the CAAS in the UF product cylinder storage yards at the GDPs were estimated, in 1997, to range between $20 million to $$0 million. The system would entail compliance with

+

continuing maintenance and surveillance requirements that would add to the installation cost. Rese funds could be more effectively utilir.ed if spent on other safety efforts that clearly can be shown to reduce total risk (i.e., cost benefit m tenns of risk reduction does not support installation of CAAS in the GDps' long term storage yards).

C. Value The configurations of UF. product cylinder storage yards at the GDPs differ from the configuration of other facilities at the GDPs and at other NRC fuel cycle licensee sites. Thus, the risk issue of evacuation to or from surrounding yards and buildings will be difficult to resolve. The followirig questions have not been considered:

Where on site would the CAAS annunciate?

llow would the CAAS distinguish where the criticality is occurring?

llow could the evacuation routes be estabhshed to avoid individuals evacuating toward the e

criticality?

A criticality excursion is a substantially less important event than the UF. release that is a far more likely result of a cylinder breach.

Radiation detectors, portable air rnonitors, or alarming personal dosimeters can detect the presence of airbome UF if a cylinder is breached and will sound promptly or otherwise indicate the presence of radioactive material (based on specific design). Any or all can serve the same purpose as a CAAS.

Events that could lead to eventual criticality, especially scenarios that pose the greatest threat (e g,

cylinder drop), are self alerting / annunciating. This further contributes to a reduction in the number of benefits that wou'd result from CAAS coverage, Overall, the CA AS cxclusion is supported by considerations of(1) the total risk to personnel. (2) the cost ofinstallat 4on and maintenance, (3) the potential value to the facility, and (4) the extremely low probability of a critical excursion. Chapter 3 shows that the exclusion also is consistent with requirements, c>lmder Yard cAAs ladmon naus Paper 41 -

June 1997

The Ilritish Nuclear Installation Inspectorate reached the same conclusion in response to a request by a licensee in exclude their product cyhnder storage areas for CAAS coverage (see Section 2.5)

DOC l'OSITION Ilased on the findings presented in this section and on supporting data, CAAS coverage serves no beneficial purpose in the product-cyhnder storage yards where it does not presently exist, Criticahty is adequately preventable with the inspection and le.ndling controls that are described in Chapter 5 of this report.

Therefore, provided these controls are functioning at the plants, the cyhnder yards should be granted an cNClusion e

e

( ylmdct Yard CAAS imiuuon. ltaus Paper 44 June 1997

i itEFERENCES 1

1 1 ANS!/ANS 8 31979 "Cnticahty Alarm S) stem", American Nuclear Society, LaGrauge Park,11.

l 2.10 CFR Part 76 " Certification of Gaseous Diffusion Plants", Source: 59 FR 48960, September 23,1994.

3. Letter dated August 1996 to J.W.N. Ilickey from R. L. Woolley, "Paducah Gascous Diffusion Plant Docket no 70 7001 Criticahty Accident Alarm System E.semption Request ODP 96 0172" l

4. Letter dated February 28,1997 to J.11. hiiller, USEC, from R. C. Pierson, NRC, " Linkage of Criticahty Accident Alarm System Technical Safety Requirements (TSRs) Compliance Plan Requirements for Portsmouth (PORTS) and Paducah (PODP) Gaseous Ditl'ution Plants" 5 ANSI /N14.1 1990, " Uranium liexafluoride Packaging for Transport," American National Standards Institute, June 21,1990.

6.A. J. h1allett " Water immersion Tests of UF Cylinders with Simulated Damage," K D 1987, Union 6

Carbide Corporation, Oak Ridge, TN, November 1967.

7 J. hl. Leitnaker, et al,"Theco, dwamic Properties of the ilF il:0 UO F System, Part 1. The UO F 2

2 3 System," IUTSO 9, Pan 1, LMFS, Oak Ridge, TN, February 1996.

8 E. J. Barber et al, " Investigation of Breached Depleted UF, Cylinders," POEF 2086, ORNUTM Il988, ORNL, Oak Ridge, TN, September 1991, 9.11. C. Paston and N. L. Pruvost, " Critical Dimensions of Systems Containing U2", U ", and U2"," LA.

10860 MS,los Alamos National Laboratory,1986 10.W. C. Jordan and J. C. Tumer, " Minimum Mass of Moderator Required for Criticality of Ilomogeneous Lo v Enriched Uranium Systems," ORNUCSDflM 284, Oak Ridge National Laboratory, December 1992.

11. Safety Solutions, "Justifi tion for Excluding UF, Cylinder Storage Yards From Criticality Accident Alarm System Coverage," KY/S 271, Rev. 2, Knoxville TN, March 1997.

12. Letter dated July 19,1995, from II R. Dyer & P. D. Fox to W. R. Drock, " Assessment of Potential Cntical Configurations in Breached UF. Cylmders w,th 5 ut% Ennched Uranium" 13.W. C. Jordon & J. C. Turner, " Minimum Mass of Moderator Required for Criticahty ofilomogeneous Low Enriched Uranium Systems," ORNUCSOTFM 284, ORNL, Oak Ridge, TN, December 1992.

14. Private commumcation, K. Bhanot, DNFUSpringfields, U.K. to J. Roth, ATI Corp., Collegeville, PA, May 1997 15 D N. Simister and D. J. Mason, "UK Regulatory Experience in the Assessment of Safi*y Case tbr Omission of Criticality incident Detection and Alarm Systems," Trans. Am. Nucl. Soc., vol. 76, Nov.

1997.

Cylmd.:t Yard cms I.xclumm nanis Pap t 45 June 1997

16.D. N. Simister, Nuclear Installation Inspectorate, Merseyside. United Kingdom, letter dated 16 May 1997.

17. DOE Compliance Plan Project Team," Plan for Achieving Compliance with NRC Regulations at the Paducah Gaseous Diffusion Plant," DOE /ORO 2026/R3, Oak Ridge, TN, July 9,1996.

18. DOE Compliance Plan Project Team, " Plan for Achieving Compliance with NRC Regulations at the Portsmouth Gaseous Diffusion Plant," DOE /ORO 2027/R3, Oak Ridge, TN, July 9,1996.

19.SAR Sect. 5.2.2.5 " Criticality Accident Alarm System Coverage," Rev. 3,5/31/96 for each plan.

l 20 NRC Regt,latory Guide 8.12-Rev. 2," Criticality Accident Alarm Systems," October 1988

21. ANSI /ANS 8.1 1988, " Nuclear Criticahty Safety in Operations with Fissionable Materials Outside Reactors," American Nuclear Society, LaGrauge Park,11, October 7,1983

22. Memorandum, N. Goldenburg tc Distribution, " Interpretive Guidance for DOE Order 5480.24, Nuclear Cnticality Safety," DOE /HQ/NE-70, February 17,1993.

23. Mycts, J. L. et al, " Testing of Ten-Ton Capacity Uranium Hexafluoride Shipping Containcts, "KY/D-2032, January 1964.

24.Pedigo, W. R. et al.," Preliminary Testing of 10-Ton UF Containers," KY-477, Union Carbide 6

Corporation, Paducah, KY, February 10,1965.

25.Pedigo, W R et al., " Testing of Ten Ton Uranium Hexafluoride Cylinders," KY 500, Union Carbide Corporation, Paducah, KY, October 22,1965.

26. Richardson et al., Additional Te: ting of Ten-Ton Uranium Hexafluoride Cylinders," KY-631, Union Carbide Corporation, Paducah, KY, September 15,1971.

27.D. A. Walker and H. G. O'Brien, "Portsmouth Gaseous Diffusion Plant United States Enrichment Corporation, Balance of Plant Facilities, Plant Safety Operations Analysis," K-GDP-SAR-112 RI, Oak Ridge, TN, January 1997.

28.D. A. Walker and H. G. O'Brien. "Paducah Gaseous Diffusion Plant United States Enridment Co,poration, Balance of Plant Facilitics, Plant Safety Operations Analysis," K-GDP-SAR 108 R1, Oak Ridge, TN, January 1997.

29.ORO-757 Draft " Investigation of Occurrence involving Release of Uranium Hexafluoride from a Fourteen-Ton Cylinder at the Portsmouth Gaseous Diffusion Plant on March 7,1978," June 1,1978, 30 NUREG-1189," Assessment of the Public Health Imoact from the Accidental Release of UF, at the Sequoyah Fuels Corporation F tcility at Gore, Oklahoma," US Nuclear Regulatory Commission, March 1986.

C)hnder Yard CAAS Exclusion nasis Paper 46 June 1997

31." Safety Analysis Report, Portsmouth Gaseous Diffusion Plant," POEF LMES-89, RO-A, Chapter 1, Section 1.4.2.1.3," Flooding". LMES, Oak Ridge, TN, January 1997, 32." Safety Analysis Report, Paducah Gaseous Diffusion Plant," KY/EM 174 RO-A, Chapter 1, Section 1.4.2,1.3, " Flooding", LMES, Oak Fidge, TN, January 1997.

33.V. Krishnan,"NPH Evaluation for Stacked UF. Cylinders at Storage Yards," DAC-19045-CCA 60, LMES, Oak Ridge, TN, June 12,1995.

e 4

T e

4 e

O f

e Cyhnder Yard CAAS Eulusion Hasis Paper 47 June 1997