D. R Bratzel, R. J. Cash, and G. D. Johnson
DE&S Hanford, Inc.

C. E. Olson and S. E. Slezak
Sandia National Laboratory

J. Young
Management Strategies, Inc.

Following a 1990 investigation into flammable gas generation, retention, and release mechanisms within the Hanford Site high-level waste tanks, personnel concluded that the existing Authorization Basis documentation did not adequately evaluate flammable gas hazards. The U.S. Department of Energy-Headquarters subsequently declared an Unreviewed Safety Question (USQ). Although work scope has been focused on closure of the USQ since 1990, the U.S. Department of Energy has yet to close the USQ because of considerable uncertainty regarding essential technical parameters and associated risk.

The U.S. Department of Energy recently approved a Basis for Interim Operation (BIO) to revise the Authorization Basis for managing the tank farms. However, the basis to establish effective controls for the flammable gas accident analysis is based on operational experience and qualitative judgment. The Project Hanford Management Contract team has formulated a refined safety analysis approach to close the flammable gas USQ. The process of closing the USQ will result in a refinement of the existing BIO. Besides using available flammable gas-related technical data, this process also uses formal expert elicitation to quantify the technical uncertainty associated with essential technical parameters affecting the flammable gas hazard. This process allows an effective means for comparing and optimizing waste tank control strategies for continued safe operation of the Tank Waste Remediation System facilities. The U.S. Department of Energy is committed to closure of the flammable gas USQ using this refined safety analysis approach as an integral step of the traditional nuclear facility safety analysis process to meet the requirements in the "Hanford Federal Facility Agreement and Consent Order" (Tri-Party Agreement) (1).

High-level radioactive waste has been stored in large cylindrical underground tanks at the U.S. Department of Energy's (DOE) Hanford Site in southeastern Washington State since 1944. Approximately 285 million liters of caustic waste are contained in 177 carbon-steel tanks. The waste forms in these single-shell tanks (SST) and double-shell tanks (DST) include liquids, slurries, salt cake, and sludges.

Radiolytic, thermolytic, and chemical reactions in the radioactive waste generate flammable gases, such as hydrogen and ammonia. These gas mixtures also include an oxidizer (nitrous oxide) and an inert component (nitrogen). Some wastes retain the gas mixture until a large amount builds up, and then a short-term gas release occurs into the tank headspace. Such a gas release can result in a flammable concentration in the tank headspace. The only remaining element required for a deflagration is an ignition source present at the time of the gas release.

Following a 1990 investigation into flammable gas generation, retention, and release mechanisms within the Hanford Site high-level waste tanks, personnel concluded that the existing Authorization Basis documentation did not adequately evaluate flammable gas hazards. This declaration was based primarily on the fact that personnel did not adequately consider hydrogen and nitrous oxide evolution within the material in certain waste tanks and subsequent hypothetical ignition in the development of safety documentation for the waste tanks. The U.S. Department of Energy-Headquarters subsequently declared an USQ. Although work scope has been focused on closure of the USQ since 1990, the DOE has yet to close the USQ because of considerable uncertainty regarding essential technical parameters and associated risk.

The DOE recently approved a Basis for Interim Operation (2) to revise the Authorization Basis for managing the tank farms; however, the USQ remains open. The two fundamental requirements for closure of the flammable gas USQ are as follows:

• Development of a defensible technical basis for existing controls
• Development of a process to assess the adequacy of controls as the waste tank mission progresses.

A traditional nuclear facility safety analysis is based primarily on the analysis of a set of bounding accidents to represent the risks of the possible accidents and hazardous conditions at a facility. The guidance in DOE-STD-3009-94, "Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports" (3), states that accidents representing "a complete set of bounding conditions" should be selected for analysis. The analysis of these selected accidents is then used to support identification of safety controls to manage the risk of accidents. The safety analysis report for the facility documents all these results which, when approved, become part of the Authorization Basis for facility operation.

While this approach may provide some indication of the bounding consequences of accidents for facilities, it does not provide a satisfactory basis for identification of facility risk or safety controls when there is considerable uncertainty associated with accident phenomena and/or data. This is due to the difficulty in identifying the bounding case and reaching consensus among safety analysts, facility operations and engineering, and the regulator on the implications of the safety analysis results. In addition, the bounding cases are frequently based on simplifying assumptions that make the analysis results insensitive to variations among facilities or the impact of alternative safety control strategies. The existing safety analysis of flammable gas accidents for the Tank Waste Remediation System at the Hanford Site has these difficulties.

However, Hanford Site personnel are developing a refined safety analysis approach for flammable gas accidents as an enhancement to overcome the fundamental difficulties with the traditional safety analysis approach. This refined safety analysis approach will solve the two basic difficulties of defining the bounding case and assessing the impact of controls. The refined safety analysis does this by explicitly quantifying the effects of the uncertainty in the state of knowledge about accident phenomena and data and providing a consistent basis for calculating the impact of alternative control strategies on parameters that affect accident risk. The refined analysis will also allow the assessment of the risk impact of the variability in conditions (e.g., waste inventory) among storage tanks in the Tank Waste Remediation System. Finally, the refined flammable gas accident safety analysis will support sensitivity studies to examine the impact on the results of differences in flammable gas accident perspectives.

The results of this refined safety analysis will be used as part of the quantitative, technical basis to identify an adequate, acceptable set of safety controls to manage the risk of these accidents. These results and conclusions will be documented in a Tank Waste Remediation System safety analysis report.

The refined safety analysis strategy for closure of the flammable gas USQ is based on methods for quantifying technical uncertainty that have been developed and successfully applied on other safety management processes within the DOE (4, 5) and the U.S. Nuclear Regulatory Commission (NRC) (6, 7). In addition to using all available measured ("pedigreed") data and analysis results, this process also uses formal systematic expert elicitation on flammable gas technical parameters of highest uncertainty and consequence. The experts are not directly elicited on the risk of specific bounding accidents. Figure 1 presents a conceptual diagram of the refined safety analysis process.

The focus of this refined process is to develop an Analysis Framework as a consistent method for quantifying the effect of potential controls on the risk of flammable gas ignition in the Hanford Site waste tanks. The analysis framework is used to quantify risk and uncertainty of combustion accidents (for frequency and dose) for specific tanks and the change in risk that would result from using different flammable gas controls. Evaluating the flammability risk for tanks, then comparing the risk among different baseline conditions, allows the relative need for controls on individual or groups of tanks to be determined. This enables the optimal determination of controls to be used to manage the tank farms. By comparing the risk reduction and cost of each flammable gas control option, personnel can select the optimal controls after rating the cost/benefit performance of each control against the risk.

The Analysis Framework is a lumped parameter model of flammable gas accidents that computes (1) accident frequencies and consequences, (2) the impact of controls on flammable gas risk, and (3) how the uncertainty in essential accident phenomena affects the computed risk. The risk evaluation method uses conventional accident analysis calculations to evaluate radiological dose consequences. The refined safety analyses are not traditional "bounding" safety assessments; they are "best estimates with quantified uncertainty." Only the method of quantifying essential parameter uncertainty distributions (i.e., determined by an expert elicitation process) differs from conventional safety analysis methods. Dose consequence results are expressed in terms of uncertainty distributions. Data, if or when they become available, can replace essential parameter uncertainty distributions.

The use of uncertainty distributions obtained through expert elicitation is not intended to replace the use of data gathered through field-sampling efforts. The risk evaluations are intended to capture the current state of knowledge so personnel can make decisions in the face of uncertainty. The uncertainty distributions represent a snapshot in time of the understanding of the factors that affect operational risks. As data are obtained, uncertainty distributions can and should be replaced with measurement distributions. The results from this process will be used to determine where data-gathering efforts will provide the most benefit toward reducing uncertainty in risk estimates. The results should also be used to improve the speed with which data are gathered by reducing burdensome safety requirements for operations in tanks that do not pose significant flammable gas risks. Ideally, the uncertainty distributions provided by the expert panel members will soon become obsolete because judgments based on them help accelerate data-gathering efforts. However, such data will not make the Analysis Framework itself obsolete. The data would reduce the uncertainty associated with the risk estimates computed using the Analysis Framework and improve safety analysis evaluations.

The methodology used to develop the Analysis Framework uses a formal systematic process developed and successfully applied on other safety management processes. The NRC guidance (7) for the use of formal expert elicitation recommends the use of systematic procedural steps. Personnel conducted the expert elicitation process according to this guidance and the systematic procedure containing the steps recommended by the NRC.

To date, personnel have completed the Analysis Framework and an Analysis Tool to address Hanford Site SSTs. The Analysis Tool is the software used to perform the tank-by-tank evaluations. The refined strategy was to first assess SSTs because these waste tanks have no significant amounts of supernatant liquid and are considered less of a flammable gas hazard than the DSTs. In addition, SSTs were addressed first because they are inactive (i.e., no further waste additions) whereas DSTs will involve many waste transfers before final waste retrieval and disposal. Lessons learned in assessing SSTs could be used to improve the process before assessing the more difficult DSTs. Currently, the Analysis Tool is being used to evaluate SSTs against the stated objectives above (i.e., calculate the risk impact of alternative flammable gas accident control strategies). The SST analysis activity will be completed in fiscal year (FY) 1998 to support closure of the flammable gas USQ for SSTs. The second phase of the project was initiated at the start of FY 1998 to address the hazard and risk associated with DSTs. The DST analysis activity will be completed in FY 1998 to support closure of the flammable gas USQ for DSTs.

Figures 2 and 3 illustrate the results of an assessment of baseline (i.e., current operation) conditions using the Analysis Tool for a representative passively-ventilated SST. In Figure 2, the horizontal line is displayed at the mean onsite dose consequence value for those runs that computed non-zero accident consequences. The triangle on the vertical line shows the median dose consequence value. In this example, the tick (end) marks of the vertical line are at the 5^th and 95^th percentile dose consequence values. The user may select any percentile values to be displayed. The vertical line is located at the mean frequency of events. The triangle on the horizontal line is located at the median frequency, and the tick (end) marks on the horizontal line are located at the 5^th and 95^th percentile values of event frequency. Figure 3 illustrates both the

onsite and offsite dose consequences for the same results displayed as complementary cumulative distribution functions. Scatter plots showing all the individual results of the Monte Carlo-type

runs can also be displayed. Results can be plotted for the onsite and offsite dose consequences, the onsite and offsite toxicological consequences, and for many different conditional consequence results.

Although the results illustrated in Figures 2 and 3 span several orders of magnitude, the results are very useful to those responsible for operational safety. The large fraction of Monte Carlo-type runs that compute zero consequences for events, the exceptionally low median dose consequence value, and the several orders of magnitude margin below risk guidelines even at the 95^th percentile level all provide very high confidence that current operations do not exceed risk guidelines. If the same tank is analyzed, assuming that a 2.8 m³/min active ventilation system is installed, the event frequency is relatively unaffected, and the median dose consequence is reduced by only a factor of 3 for those runs that compute non-zero consequences. However, in this example fully 90% of the Monte Carlo-type runs compute zero dose consequences. This information is important for assessing the need for additional controls and the efficacy of different potential controls.

Personnel are performing control analysis evaluations for all SSTs. How specific results compare from tank to tank or among representative tank groups will provide a clear assessment of where operational risk is highest, where and what controls are needed, and where current controls may be relaxed without causing risk to rise to unacceptable levels. This will allow controls to be optimized so the overall flammable gas risk for the Hanford Site tanks is minimized, costs are reduced, and resources are redirected toward reducing risk at more critical operations.

Essential observations and findings from work accomplished to date include the following:

• The refined safety analysis process and use of expert elicitation have effectively enhanced the traditional safety analysis approach to quantify the impact of the uncertainty in the state of knowledge about flammable gas accident phenomena and related data on the calculated risk.
• Independent oversight and peer review of the process have been important to ensure success of the results.
• For the technical safety analysis to be accepted by the regulator and to demonstrate compliance, the expert elicitation process must be formal, professionally structured, and well documented.
• The reproducibility of expert opinion is an overall concern of the process. The expert elicitation process must allow flexibility to introduce additional analytical and experimental results and data to replace or augment elicitation results.
• This refined analysis produces results that are more compatible with our state of knowledge about flammable gas accidents and the waste storage tanks. That is, the variability in our perceptions is represented in our computed assessment of risk.
• The refined safety analysis results are considerably different from the point values generated by traditional safety analyses. Therefore, the refined safety analysis results will likely require a greater effort devoted to interpretation and communication of results.

1. WASHINGTON STATE DEPARTMENT OF ECOLOGY, U.S. ENVIRONMENTAL PROTECTION AGENCY, AND U.S. DEPARTMENT OF ENERGY, "Hanford Federal Facility Agreement and Consent Order," as amended, Olympia, Washington (1996).

2. DE&S HANFORD, INC., "Tank Waste Remediation System Basis for Interim Operation," HNF-SD-WM-BIO-001, Rev. 0, Richland, Washington (1997).

3. U.S. DEPARTMENT OF ENERGY, "Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports," DOE-STD-3009-94, Washington, D.C. (July 1994).

4. U.S. DEPARTMENT OF ENERGY, "Principles and Guidelines for Formal Use of Expert Judgment by the Yucca Mountain Site Characterization Project," Office of Civilian Radioactive Waste Management, Yucca Mountain Site Characterization Office, 10 p. (May 1995).

5. U.S. DEPARTMENT OF ENERGY, "Probabilistic Volcanic Hazard Analysis for Yucca Mountain, Nevada," BA0000000-01717-2200-00082, Civilian Radioactive Waste Management System, Yucca Mountain Site Characterization Office (June 1996).

6. U.S. NUCLEAR REGULATORY COMMISSION, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants--Final Summary Report," NUREG-1150, 3 vols., Office of Nuclear Regulatory Research (December 1990).

7. U.S. NUCLEAR REGULATORY COMMISSION, "Branch Technical Position on the Use of Expert Elicitation in the High-Level Radioactive Waste Program," NUREG-1563, Office of Nuclear Material Safety and Safeguards (November 1996).

BACK