II. Findings · Web viewMajor findings and concerns include the lack of an active radioactive material inventory control process for facilities involved in isotope production, an

Independent Assessment for Implementation of the Accelerator Safety Order at Brookhaven National

Laboratory

DRAFT REPORT

Executive Summary

The U.S. Department of Energy (DOE) Office of Science (SC) is accountable for the effective stewardship and management of ten world class laboratories. The Deputy Director for Field Operations (DDFO) establishes SC-wide goals, strategies, policies, and expectations to promote the safe and responsible operation of each laboratory. The Brookhaven Site Office (BHSO) is an organization within SC with responsibility to oversee and manage the Management and Operating (M&O) contract for the Brookhaven National Laboratory (BNL)

At the request of the BHSO Manager, DOE-SC performed an assessment to evaluate implementation of DOE Order 420.2C, Safety of Accelerator Facilities, at select BNL facilities. The purpose of the assessment was to evaluate all aspects of implementation of the Order as well as elements of Office of Science (SC) Management System (SCMS) and BNL’s Standards Based Management System (SBMS) relevant to accelerator safety. Overall, BNL and BHSO have the appropriate contract requirements and authorities to sufficiently ensure safe operations of the traditional accelerator facilities on site. However, BNL’s application of the accelerator safety requirements are dependent on each line management organization to ensure that the requirements are being met for the work being performed. This has led to inconsistencies and inadequacies in the application of requirements by BNL. The inconsistent application of accelerator safety requirements, SCMS and BSHO procedures and informal posture by BHSO has not provide adequate oversight to address these deficiencies.

Major findings and concerns include the lack of an active radioactive material inventory control process for facilities involved in isotope production, an inadequate hazard analysis to support current and planned isotope production and upgrade work, premature closure of corrective actions associated with previous reviews, and operating two non-traditional facilities as accelerators for over 7 years without performing the required accelerator readiness reviews.

Multiple Level 2 and 3 findings indicate there is a problem with risk identification and issues management. There is not strong evidence that systems are in place to adequately evaluate and correct these risks and issues in a timely manner. This report contains one Level 1 finding, fourteen (14) Level 2 findings, nine (9) Level 3 findings, and seven (7) recommendations.

2

II. Findings

Level 1

FIND-01-01- BLIP and RRPL/TPL have been operated and managed under a C-AD SAD and ASE since 2011 however, an ARR was never conducted for either facility.

Level 2

FIND-02-01- The C-AD SAD does not present sufficient descriptive information and analytical results to provide an understanding of risks presented by the proposed operations.

FIND-02-02- There are inconsistencies between the C-AD SAD and BLIP/RRPL ASE credited controls.

FIND-02-03- Steps 1 and 2 of SBMS accelerator safety subject area, procedure 9 are not consistent with DOE O 420.2C. The USI process should not only be based on the credited controls listed in the SAD/ASE or Maximum Credible Incidents, as stated in the procedure, but it should also ensure that any underlying assumption or hazard discussed, or not discussed, in the SAD/ASE is not challenged by the change.

FIND-02-04- The C-AD USI procedure is unclear and does not fully follow the BNL SBMS requirements.

FIND-02-05- The USI Checklist for Design Review Questionnaire for ATF to install a vacuum piping system and through the block shielding into the experimental hall concluded an incorrect USI determination.

FIND-02-06- There is no documentation that systematically determines if an activity can commence before DOE has provided written approval on USIs.

FIND-02-07- There is no current qualification program for future NSLS-II operators. NSLS-II operator requalification requirements are not well defined or documented.

FIND-02-08- Conduct of operations (CONOPS) deficiencies were identified during tours and interviews.

FIND-02-09- There are multiple instances the assessment team found of the site office not following BHSO-OA-14.

FIND-02-10- BHSO’s systemic lack of formal reviews and rigor in the document approval process displays a hesitancy to formally reject submittals or “hold up” approvals so as not to disrupt mission which is counter to the requirements of DOE O 226.1and SCMS.

FIND-02-11- The BNL corrective action to prepare an analysis and methodology for classifying RRPL as an accelerator facility and request DOE approval was not completed adequately.

FIND-02-12- The site office has not requested a formal justification and analysis of the classification of RRPL and BLIP.

FIND-02-13- DOE does not have a formalized process in place to re-classify existing facilities as accelerator facilities and identify where the approval level should be.

FIND-02-14- BNL issues management systems that support accelerator operations are not functioning properly to ensure that CAS can effectively provide the Department of Energy assurance that the accelerator facilities reviewed are safe, reliable, and operated in accordance with applicable regulations.

3

Level 3

FIND-L3-01- The C-AD SAD does not clarify how accelerator “facilities” are segmented within a shared building.

FIND-L3-02- In ATF the gas volume of the CO2 laser should be considered in the C-AD SAD for an oxygen deficiency hazard.

FIND-L3-03- Any revised ASE that is submitted to BHSO for approval should be accompanied by a revised SAD, positive USI analysis, or other safety basis to support the change.

FIND-L3-04- The contractor does not fully recognize ASE violations when they occur.FIND-L3-05- The issues management system may not be sufficiently robust to ensure adequate

closure of pre-start and post-start ARR findings.FIND-L3-06- From the assessment team’s small sampling of procedures there were multiple

instances of ASE controls not identified in procedures.FIND-L3-07- The C-AD assessments are driven externally, for instance by FDA requirements, rather

than Integrated Safety Management (ISM) principles.FIND-L3-08- There are no formal DOE or SC requirements for how often a formal accelerator

assessment should be performed however, seven years without a formal accelerator program assessment, when there is considerable mission growth in this area does not meet the intent of DOE O 226.1B, Implementation of Department of Energy Oversight Policy.

FIND-L3-09- Based on the tasks identified in the staffing analysis and interviews with the site office there are indications that the FRs are spread thinly and may not be able to adequately cover all the scope required by the staffing analysis.

Recommendations

REC-01- BNL should consider separating some of the accelerator facilities into their own SADs and ASEs to make them more usable.

REC-02- BLIP and RRPL should have an active radioactive material inventory control process that includes the total inventory of each facility.

REC-03- The team recommends restructuring Steps 5.1 and 5.2 in Procedure 1.10.1 to instruct the user to use the USI process to make a USI determination – not vice versa.

REC-04- Develop a detailed policy defining NSLS-II Operator qualification requirements.REC-05- BHSO should include in their procedures a regularly scheduled formal assessment of

the accelerator program.REC-06- A full hazard analysis should be performed that includes the total radioactive material

inventory in BLIP and RRPL and takes into account current and planned operations and the MEL Hot Cell Upgrade work.

REC-07- The site office and BSA should revisit and re-validate the formal justification and analysis of the classification of RRPL and BLIP.

Complete the prematurely closed NTS Causal Analysis corrective actions associated with findings from the 2010 Nuclear Hazard Categorization Self-Assessment and the 2010 DOE-HQ Facility Hazard Categorization Review.

4

Table of Contents

Executive Summary

Findings

1.0 Introduction

2.0 Scope and Performance Criteria

3.0 Assessment Methodology

4.0 Summary of Results

4.1 Safety Assessment Documents and4.2 Accelerator Safety Envelope4.3 Unreviewed Safety Issues4.4 Accelerator Readiness Reviews4.5 Training and Qualification4.6 Procedures and Plans4.7 Internal Safety Review System4.8 DOE Oversight Including DOE Orders and SCMS/Approvals (DOE and Contractor)

5.0 Conclusions

5

1.0 Introduction

The Brookhaven National Laboratory (BNL) is managed by Brookhaven Science Associates (BSA) for the Department of Energy. BNL is one of ten Office of Science (SC) laboratories and is a multi-program laboratory with a primary mission in the physics and chemistry materials areas. In September 2018 the Brookhaven Site Office (BHSO) Manager commissioned an independent assessment to evaluate the implementation of DOE O 420.2C, Safety of Accelerator Facilities, at BNL. The assessment team consisted of individuals from other site offices, the Headquarters’ (HQ) accelerator program, and experienced in hazard identification and mitigation. The assessment team was asked to consider two charge questions:

1. Are current BHSO/BNL contract requirements and authorities sufficient to ensure safe operation of the accelerator facilities? – Partially Met

2. Have the Accelerator Safety Envelopes and Safety Assessment Documents been accurately defined for the facilities under review? – Partially Met

Overall, BNL and BHSO have the appropriate contract requirements and authorities to sufficiently ensure safe operations of the traditional accelerator facilities on site; however, BNL currently operates two non-traditional accelerator facilities (i.e., the Brookhaven Linac Isotope Producer (BLIP) and Radionuclide Research and Production Laboratory (RRPL). Both facilities are managed by the Collider-Accelerator Department (C-AD). RRPL is also referred to as Building 801 (B801). BNL management decided to reclassify these two facilities as accelerators in 2009/2010. This decision was supported by BHSO; however, there is no accelerator categorization standard or other DOE documentation to support re-classification of a radiological facility to an accelerator and no evidence was provided to show that the justification for re-classifying these facilities was approved by DOE HQ. Regardless of the classification of the facility (i.e., radiological or accelerator) the hazard identification and management principles of Integrated Safety Management (ISM) and the requirements of the accelerator safety order are not being fully implemented by BNL or enforced by BHSO at these facilities.

While Accelerator Safety Envelopes (ASEs) and Safety Assessment Documents (SADs) are in place for all accelerators reviewed, the adequacy of the C-AD SAD and ASE could not be ascertained by the assessment team due its inherent complexity. Please see section 4.1 below for additional details.

2.0 Scope and Performance Criteria

Brookhaven has 17 identified accelerator facilities regulated under DOE O 420.2C. The assessment team performed the review via sampling since it was impractical to review all 17 facilities. Four facilities were chosen based on discussions with the BHSO. The four facilities assessed were:

1. Accelerator Test Facility (ATF), Collider-Accelerator Department2. Brookhaven Linac Isotope Producer (BLIP) and Radionuclide Research and

Production Laboratory (RRPL), Collider-Accelerator Department3. Laser Electron Accelerator Facility (LEAF), Collider-Accelerator Program4. National Synchrotron Light Source (NSLS)-II, Energy and Photon Sciences Department

6

There were ten specific scope elements included in the assessment plan.

1. Safety Assessment Document (SAD)2. Accelerator Safety Envelope (ASE)3. Unreviewed Safety Issues (USIs)4. Accelerator Readiness Reviews (ARRs)5. Training and Qualification6. Procedures/Plans7. Internal Safety Review System8. Shielding Policy9. DOE Oversight Including DOE Orders and SCMS Requirements10. Approvals (DOE and Contractor)

Requirements the assessment team assessed against included: DOE O 420.2C, Safety of Accelerator Facilities DOE O 226.1A, Implementation of Department of Energy Oversight Policy DOE O 422.1, Conduct of Operations DOE O 414.1D, Quality Assurance SCMS Subject Area: Facility Safety, Operations, and Infrastructure, Procedure 10,

Reviewing and Approving Accelerator Safety Documentation SCMS Subject Area: Facility Safety, Operations, and Infrastructure, Procedure 11,

Startup and Operations of Accelerator Facilities BNL SBMS Subject Area: Accelerator Safety, Procedure 2, Developing the

Safety Analysis and Safety Assessment Document (SAD) BNL SBMS Subject Area: Accelerator Safety, Procedure 3, Developing the

Accelerator Safety Envelope (ASE) 10 Code of Federal Regulations (CFR) Part 830, Nuclear Safety Management 10 CFR 835, Occupational Radiation Protection Internal implementing procedures/plans Approved SADs, ASEs, USI determinations, etc.

The assessment team members and affiliations are provided below.

Name Organization

Michael Epps - Lead Office of Safety & Security Policy

Joanna Serra Office of Safety & Security PolicyDaniel Middleton Office of Safety & Security PolicySalma El-Safwany Berkeley Site OfficeRuss Kelly Oak Ridge Site Office - Retired

In this final report the following changes have been made from the assessment plan: Scope area eight (8) was not assessed; Scope sections 9 and 10 are combined into one results summary section due to

the overlap in data to support the conclusions;

7

3.0 Assessment Methods

Pertinent documents (accelerator operating procedures, site office procedures, org charts, SADs, ASEs, etc.) were requested and reviewed in advance of the onsite portion of the assessment. The assessment team was onsite November 13-15, 2018 and performed a combination of desktop document reviews, interviews, and walkthroughs. Facilities visited during the onsite portion of the visit include NSLS-II, LEAF, ATF, BLIP and RRPL. Interviews included facility operators, authorization basis individuals, ES&H division members, program leads, and BNL management and BHSO personnel. BNL provided the additional documents to the assessment team through the BHSO in the weeks following the onsite review.

The review results are characterized in accordance with SCMS. Findings represent an identified inadequacy or improvement with implementation of a requirement. Findings are categorized further as either Level 1, 2 or 3. The definitions of each level are as follows:

Level 1- Issue of major significance that warrants a high level of attention on the part of line management. Typically an issue of such significance reflects a gap in addressing requirements of a systemic problem with implementing the requirements if left uncorrected, this level of finding could negatively impact the adequacy of operations and/or accomplishment of the SC mission.

Level 2- Issues that represent a non-conformance and/or deviation with implementation of a requirement. Multiple issues at this level, when of a similar nature, may be rolled-up together into one or more Level 1 Findings.

Level 3- Issues where it is recognized that improvements can be gained in process, performance, or efficiency already established for meeting a requirement. This level of finding should also include minor deviations observed during oversight activities that have been promptly corrected on the spot and verified as completed.

4.0 Summary of Results

4.1 Safety Assessment Documents

Discussion of ResultsMany questions arose regarding the Collider-Accelerator Division (C-AD) SAD. This culminated in additional document requests and additional interviews that took up the majority of the team’s resources for the C-AD facilities. The NSLS-II and LEAF SADs were reviewed for completeness. There were no major issues noted for the NSLS-II and LEAF SADs. The LEAF ASE is included as part of the SAD.

The C-AD SAD covers BLIP, RRPL, ATF and approximately 20 other “associated” accelerator facilities. The C-AD SAD is a 544-page document that, along with the many important references and citations, takes some time to unravel. Placing all C-AD accelerator facilities under one SAD makes reviewing and using the document challenging as the user must refer to multiple sections and appendices to connect all of the information to have a cohesive

8

understanding of each facility. The team suggests that BNL consider separating some of the accelerator facilities into their own SADs and ASEs to make them more usable (REC-01).The C-AD SAD presents the results of hazard identification and “risk assessment” in Appendix 1 (See Section 4.3 of the SAD). For the most part, Appendix 1 is not specific to the ~23 different facilities represented in the C-AD SAD. Appendix 1, entitled Hazards and Risk Assessment, does not consider the varying hazards that are specific to each facility and makes it difficult to understand which hazards should be prevented or mitigated for each facility or area. As a result, facility-specific credited controls are not explicitly identified in this appendix. The team had a difficult time understanding the genesis of some of the credited controls based on the hazard assessment. Also, Appendix 1 considers mitigating controls, but not preventive controls.Examples of weaknesses in Appendix 1 include:

Table A2-2 considers the impacts of external events (e.g., earthquake, severe weather, flooding, forest fire, aircraft impact) for the “Entire Facility”. The “Entire Facility” is assumed to mean all 23 associated accelerator facilities. The “possible consequences” does not include the release of radioactive material.

Table A2-8, “Hazards and Risk Assessment for Airborne Radioactive Releases,” is not specific to the hazards of individual facilities and lists 12 mitigative controls. Some of the mitigating controls flow to the ~23 individual associated accelerator facilities and some do not. This results in 276 different possibilities.

Table A2-10, “Hazards and Risk Assessment for Loss of Electrical Power,” is applicable to all facilities and does not consider the release radioactive materials as a possible consequence. “Hazard Mitigation” controls are not specific to the facility.

Table A2-11, “Hazards and Risk Assessment for Fire Event,” does not consider the release of radioactive and other hazardous material.

Table A2-12, “Hazards and Risk Assessment for Groundwater Contamination,” provides ten mitigating controls for all ~23 facilities, but, again, are not facility-specific.

The first sentence of Section 4.2.2 of the C-AD SAD, “Risk Minimization Approach for Radiation Hazards,” says “There is an insignificant risk of a serious radiation injury at BNL’s accelerators, experiments and support facilities.” This is contrary to the analysis represented in Appendix 1.

Section 4.3 of the C-AD SAD discusses “additional qualitative risk-assessments on specific jobs and in specific work areas using a standard method for developing, using, and maintaining risk assessments meeting the requirements of OHSAS 18001.” OHSAS 18001 is a British occupational safety and health standard and has not been adopted in the US. This section goes on further to discuss Job and Facility Risk Assessments and states “the JRA/FRA processes are analogous to the C-AD SAD safety analyses process and determination of Credited Controls used for accelerators facilities.” It is not clear how or if the FRA results are captured in the C- AD SAD and subsequent Accelerator Safety Envelopes (ASE).

Appendix 2 of the SAD, “Dose Assessment for Maximum Hypothetical Accidents at BLIP andTPL,” “bound(s) the consequences of all other radioactivity release postulated for the facility and is referred to as the maximum hypothetical accident (MHA).” It is noted that this “MHA” should probably be referred to as a Maximum Credible Incident (MCI). The document explained the methodology used for the dose assessment; however, input variables (e.g., dose conversion factors) were not made available. Authors of this assessment were not available to interview

9

during this review. MCIs (when properly applied) are important because they can put everything into context and allow DOE and BNL management to make proper risk-based decisions.

For RRPL, the MCI scenario is defined as the “overheating of a beaker containing either purified Sr or Ac solutions together with the failure of the ventilation ducts resulting in a release of radioactive isotopes into the laboratory area.” In addition, Appendix 2 adds that “an example of such an unlikely accident scenario would be a seismic event that damages the ventilation ducts and simultaneously result in an electrical short that overheats the beaker located on the electrical heater containing purified solutions from either Sr or Ac isotopes from two targets.” However, this example does not consider the rest of the radioactive material that can be stored in the facility (e.g., the RRPL vault, adjacent hot cell, acid scrubber, waste cans). The MCI should account for all hazardous material in the facility or state why this is unnecessary.

Regarding the hazardous material for RRPL, there is no radioactive material limit for the entire facility and there is no total inventory tracking or control. The vault, adjacent hot cell, acid scrubber, HVAC, etc. contain unaccounted radioactive material. If the properties of the hazardous material, both stored and processed in RRPL, inherently limit total inventory to safe levels, then this should be explicitly stated in the SAD. For BLIP, used water filters are stored below the main floor next to the hot cell and the assessment team could find no evidence that the hazardous material present in the water filters was accounted for in any hazards analysis. The assessment team, likewise, could not find evidence that hazardous material was being tracked in the facility inventory or if there was a hazardous material inventory limit for the entire facility. As with RRPL, if the properties of the hazardous material, both stored and processed in BLIP, inherently limit total inventory to safe levels, then this should also be explicitly stated in the SAD. BLIP and RRPL should have an active radioactive material inventory control process that includes the total inventory of each facility (REC-02).

The Material Hazard Analysis (MHA) used the ARCON96 code to estimate doses external to RRPL. It is not clear why this method was used. This code is used to determine commercial nuclear plant control room habitability during an accident. According to NRC Regulatory Guide 1.194, Atmospheric Relative Concentrations for Control Room Habitability Assessments at Nuclear Power Plants, “analysts should not assume that the use of the ARCON96 code as described in this guide is acceptable for purposes other than control room radiological habitability assessments.” Nonetheless the code was used to estimate dose at 60m and at the closest site boundary. In addition, Appendix 2 states that the use of ARCON96 results in lower atmospheric dispersion coefficients than NRC Regulatory Guide 1.145 (used by C-AD in the past), resulting in lower dose estimations.

C-AD SAD Section 4.15.3 discusses MCIs for BLIP, which includes the transportation activities. A Radiological Control Division accident analysis is discussed with relationship to a transportation accident; however, no formal calculation is included as a reference. The team received a copy of a January 3, 2011 BLIP Target Transportation Accident Memo from R. Karol to “File”. The team was told that this was the same accident scenario; however, the effective dose referenced in the SAD of 113 mrem does not match the effective dose in the calculation of 71 µrem. Also, a June 12, 2014 memo from H. Kahnhauser to L.Mausner titled “Accident Assessment of a Thorium Target Failure During Transport On-Site”, was provided to the team. This calculation has the same dose rate as that referenced in the C-AD SAD of 113 mrem, but, has an effective high release of 79m, not ground release as the C-AD SAD states. The team is

10

unsure of the assumptions made in the C-AD related to transportation.

It is the team’s understanding that a separate transportation document is used for the transport of targets from BLIP to RRPL. However, the document was not reviewed.

There is a second half to Appendix 2 titled, “All Scenarios for Buildings 931 and 801.” It is not clear why this is not in a separate appendix because this is the closest thing to a facility-specific, qualitative, and systematic hazard analysis that was reviewed by the assessment team. A reference to the 2nd half of Appendix 2 could not be found in the SAD. Section 4.15.17 discusses RRPL accident scenarios and the available mitigative controls that are in place; however, correlation to the 2nd half of Appendix 2 is unclear. It could not be determined how the results of the 2nd half of Appendix 2 were used in the SAD and subsequent ASE. The risk bin ranges in the 2nd half of Appendix 2 are different that those used in Section 5.4, Table 1 of the SAD. The methodology used in the 2nd half of Appendix 2 was not described. For example, each row thetable lists the event, mitigating “features,” and possible consequence and likelihood – in that order. It is not clear if the results for the event consequences and probabilities considered the mitigating features to be in place. However, judging by the assigned qualitative consequences and probabilities, this appears to be a mitigated analysis. The 2nd half of Appendix 2 does not discuss the amount of radioactive material assumed in the qualitative analysis.

Appendix 3 of the C-AD SAD, “In-Process Activity Limit for Building 801 TPL,” is an evaluation of the April 17, 2013 event that released radioactive material to the HVAC system creating elevated radiation levels outside the facility. This evaluation recommends an in-process limit of 50 Ci of Sr-82 (or equivalent). This limit is a credited control in the SAD.

The ASE (Section 2.2) has the following credited control: The TPL radioactivity in-process cannot exceed 50 Ci Sr-82 or equivalent; the C-AD Radiation Safety Committee shall determine equivalence. Section 5.11.1 of the SAD, “Credited Controls for Maximum Credible Incidents - ASE Limits” states “The determination of maximum radioactivity during a target processing may employ credible factors that account for a fraction of radioactivity that could become airborne, the fraction of activity that could be removed from the ventilation system by an acid scrubber or other device.” The ASE does not credit “an acid scrubber or other device.”

For the accelerator facilities that the team reviewed, it was identified that ventilation systems, power system, fire suppression systems, etc. are shared between accelerator facilities and non- accelerator facilities, particularly if an accelerator is in the same building as non-accelerator operations. However, there is little discussion on the impact that these shared systems could have on the accelerator facility, or non-accelerator facilities, if they are contained in the same facility. Many of these systems may be managed under other programs such as maintenance programs, etc., but these are not discussed in the SAD.

A specific example is the definition of the RRPL accelerator facility. The accelerator envelope for this facility is specific to processing operations, disregarding actual facility configuration. Room 2-58 and 2-60 both are considered part of the accelerator facility, but, the lab in between these two rooms is not considered part of the accelerator facility. Access to all three rooms is by the same corridor and they share ventilation. Also, Room 2-56 is not considered part of the accelerator facility but the only way to access Rooms 2-51 and 2-68 is through 2-56. In interviews with the RRPL staff, materials for the accelerator operations in RRPL are stored in

11

Room 2-56.

The way that segmentation is discussed in the SAD has led to confusion, by C-AD staff, regarding whether a USI needs to be completed on these types of shared systems. This is important if changes are made that are not part of the accelerator facility, but may impact the accelerator facility. The team found one example of a USI screen completed in June 2017 for the Building 801 MEL hot cells, Room 2-67, which determined that there was a potential for a positive USI. However, the team found no evidence of a USI evaluation actually being completed in the year and half since the screen was completed. Access to this room is through the accelerator facility and work in this area may impact operations in RRPL. The C-AD SAD does not clarify how accelerator “facilities” are segmented within a shared building (FIND-L3-01).Accelerator facilities that are segmented from non-accelerator facilities should have clear logical boundaries and shared systems such as ventilation, fire suppression, etc., should be discussed so that staff can appropriately identify hazards and screen for USIs.

During a tour of the ATF, personnel were questioned about possible oxygen deficiency hazard (ODH) concerns. Subsequent references were made to an exhaust fan that was there for the CO2 laser. Section 3.3.25 of the C-AD SAD states that an analysis shows that there are no ODH concerns. This appears to be in reference to a 25-gallon Dewar of liquid nitrogen and not the 350 L gas volume of the laser system. In ATF the gas volume of the CO2 laser should be considered in the C-AD SAD for an oxygen deficiency hazard (FIND-L3-02).

The issues identified in the discussion above may be “easily explained away”; however, the C- AD SAD does not present sufficient descriptive information and analytical results to provide an understanding of risks presented by the proposed operations (FIND-L2-01).

Conclusion

Many questions arose regarding the C-AD SAD. This culminated in additional document requests and additional interviews that took up the majority of the team’s resources during the assessment.

Although cumbersome, if shortcoming in the hazards analysis are appropriately addressed, the C-AD SAD and ASE could be sufficient for traditional accelerator operations. With that, RRPL and BLIP are not traditional accelerators, the former is an end station and the latter is more consistent with a hot cell facility.

Findings

Level 2 FindingsFIND-L2-01 The C-AD SAD does not present sufficient descriptive

information and analytical results to provide an understandingof risks presented by the proposed operations.

Level 3 FindingsFIND-L3-01 The C-AD SAD does not clarify how accelerator “facilities”

are segmented within a shared building.

12

FIND-L3-02 In ATF the gas volume of the CO2 laser should be considered in the C-AD SAD for an oxygen deficiency hazard.

RecommendationsREC-01 BNL should consider separating some of the accelerator

facilities into their own SADs and ASEs to make them more usable.

REC-02 BLIP and RRPL should have an active radioactive materialinventory control process that includes the total inventory of each facility.

4.2 Accelerator Safety Envelope

Discussion of Results

An ASE is only as good as the SAD which identifies the hazards, analyzes the hazards and establishes the controls for acceptable risk. Each facility reviewed had an ASE that was approved at the proper level.

For ATF and LEAF, the credited controls in the respective SADs were reflected in the ASEs. Periodic testing and inspections appear to be adequate to protect the controls.

For NSLS-II, the ASE was recently revised to allow for a personal protection system test interval of 24 months and to clarify authorized alternatives to ODH credited controls. BHSO approved this frequency decrease and the revised authorized alternative. The change was not reflected in the NSLS-II SAD. Any revised ASE that is submitted to BHSO for approval should be accompanied by a revised SAD, positive USI analysis, or other safety basis to support the change. (FIND-L3-03).

For BLIP and RRPL, it is not clear why the two separate facilities share the same ASE because they are two different facilities. Although they share a common mission, the two facilities have different hazards, operations and personnel.

There are inconsistencies between the C-AD SAD and BLIP/RRPL ASE credited controls (FIND-L2-02). These include ASE controls not derived from the SAD and controls derived from the SAD that are not carried into the ASE. Specific examples include:

ASE Section 2.4, The fork truck or equivalent conveyance is rated to safely carry the weight of the total load of the shielding cask and targets (transfer package) during transfer from BLIP to Building 801, is not derived from the C-AD SAD;

ASE Section 2.5, The transfer package is secured to the fork truck or equivalent conveyance using straps or chains that are tested, inspected and maintained for this use, is not derived from the C-AD SAD;

ASE Section 3.14, The BLIP operator must document that the following are met prior to transfer of irradiated BLIP targets to Building 801:...; is not derived from the C-AD SAD; and

C-AD SAD Section 5.11.3, Credited Control Supports to Protect Against Radiation Due to Access: During beam operations, the BLIP tank hotbox doors 1 and 2 must be

13

locked at all times (ASE). Bases: The BLIP hotbox has two locks, a lock owned by the BLIP Operator and one by the Radiological Controls Group at BLIP/RRPL. This ensures that no one can enter the hot box without proper work planning to consider dose and contamination control, does not carry through to the BLIP/RRPL ASE.

The assessment team is not questioning whether these are appropriate controls, but, all controls should be derived from the SAD and carried through to the ASE to ensure that all assumptions and relevant information related to these controls is analyzed using a systematic approach.

A review of previous ASE violations concluded that the safety of each situation was properly assessed and corrective actions or compensatory measures were put in place prior to resuming operations. Interviews with personnel found that the majority of the ASE violations were a result of prompting by the DOE Site Office. While this is indicative of a functioning oversight organization, it also suggests that the contractor does not fully recognize ASE violations when they occur (FIND-L3-04).

Conclusion

ASEs are approved by DOE at the proper approval level. Barring one the assessment team identified, credited controls derived from the SAD are reflected in the ASE. However, there are several controls in the ASEs that are not derived by the SAD. The contractor has been proactive when responding to ASE violations, but should be more proactive at identifying ASE violations (See further discussion in Section 4.6).

Findings

Level 2 FindingsFIND-L2-02 There are inconsistencies between the C-AD SAD and

BLIP/RRPL ASE credited controls.

Level 3 FindingsFIND-L3-03 Any revised ASE that is submitted to BHSO for approval should

be accompanied by a revised SAD, positive USI analysis, or other safety basis to support the change.

FIND-L3-04 The contractor does not fully recognize ASE violations whenthey occur.

4.3 Unreviewed Safety Issue


BNL has a Standards Based Management System (SBMS) subject area dedicated to accelerator safety. Section 9 of this subject area addresses the corporate expectations for Unreviewed Safety Issue Process. Steps 1 and 2 of SBMS accelerator safety subject area, procedure 9 are not consistent with DOE O 420.2C. The USI process should not only be based on the credited controls listed in the SAD/ASE or Maximum Credible Incidents, as stated in the procedure, but it should also ensure that any underlying assumption or hazard discussed, or not

14

discussed, in the SAD/ASE is not challenged by the change (FIND-L2-03). Interviews with staff also indicated that their understanding of the USI process was that a USIs only needed to be performed on credited controls.

The C-AD uses Procedure 1.10.1, Procedure for Identifying Unreviewed Safety Issues, to flow down requirements from the SBMS procedure. The C-AD USI procedure is unclear and does not fully follow the BSA SBMS requirements (FIND-L2-04). Examples of this include:

Not including a screening step as required by SBMS steps 1 and 2; Step 1.6 does not list the SAD as a procedure or process to help make USI

determinations as required by SBMS steps 1 and 2; The USI Checklist (in step 1.6) and as an Attachment to the procedure is not

described, discussed, or presented on how it should be used. No discussion on who is qualified and how the person is qualified to make USI

determinations (i.e., what type of training is required).

The C-AD USI process is entered by using the C-A USI Determination Form. The question of whether or not the current SAD and/or ASE addresses the hazard associated with the proposed work, event or activity appears to be determined by committee, as discussed in Procedure 1.10.1, Steps 5.1 and 5.2. The C-AD USI Determination Form directs the user to the USI Checklist which, during this assessment, was also referred to by staff as a USI screen, however this is not documented or discussed in the procedure as such. The USI Checklist focuses the user on areas regarding new radioactive material, shielding, access control, ODH, environmental and ventilation systems. The USI Checklist is a web-based questionnaire which concludes that a potentially positive USI exists if any of those affected areas are checked “yes.” If there are no “yes” boxes checked, then the USI is automatically negative. The USI checklist does not focus the user on all credited controls or direct the user to consider the hazard analysis in the SAD. For example, a procedure change for using the fork truck during a BLIP radioactive material transfer would screen out as a negative USI because the checklist questions do not consider that type of activity.

The assessment team sampled multiple C-AD USI determination forms for the 2017 SAD /ASE update and reviewed two C-AD USI checklists. The USI determinations were filled out by C-AD Associate Chair for ESSHQ, then signed by the C-AD ESSHQ Division Head and the C-AD Associate Chair for ESSHQ. Of the determinations sampled there were no USI determination forms filled out by the C-AD ESSHQ Division Head, which indicates all of the USIs completed and reviewed by the team were planned events, not those found due to maintenance or normal operations. It seems unlikely that with ongoing work in multiple accelerator facilities, not a single “discovery” USI was performed that rolled into the update. The lack of “discovery” or “backward looking” USIs for the multiple operating accelerator facilities is unusual and may be indicative that the USI process is not being applied to as-found condition.

The team reviewed the Design Review Questionnaire for ATF to install a vacuum piping system through the block shielding into the experimental hall. Question #1 on the USI Checklist asks: “Are any radiation barriers added, changed or modified by the job or project (for example concrete and steel blocks, earth shields, fencing)?” Contrary to the activity, the answer was “No” and resulted in a USI determination of “0” (negative). The USI Checklist for Design Review Questionnaire for ATF to install a vacuum piping system and through the block shielding into the experimental hall concluded an incorrect USI determination (FIND-L2-

15

05).

The team reviewed the Design Review Questionnaire for the MEL hot cell upgrade. The USI determination appropriately resulted in a “1” or potentially positive.

The team found one example of a USI screen completed in June 2017 for the Building 801 MEL hot cells, Room 2-67, which determined that there was a potential for a positive USI. However, the team found no evidence of a USI evaluation being completed. See the SAD Assessment Form for further information.

In addition to a formal screening step not being included in Procedure 1.10.1, the USI Procedure prematurely makes a determination on the whether the facility/activity has a USI prior to entering and completing the steps to make a determination. Steps 5.1 and 5.2 of Procedure1.10.1 instructs the Associate Chair for ESSHQ or C-A ESSHQ Division Head to make a USI determination before the USI Determination Form is completed. The purpose of the USI Determination form is to systematically walk-thru the process to evaluate whether the activity has potential for significant impact to safety. Although prematurely determining a USI prior to the process being followed is contrary to any USI process, the documents reviewed by the assessment team indicated that the USI Determination Form was being used as part of the USI process. The team recommends restructuring Steps 5.1 and 5.2 in Procedure 1.10.1 to instruct the user to use the USI process to make a USI determination – not vice versa (REC-03).

Based on the above discussion, the C-AD USI process is primarily an “expert based” rather than “procedure based” process. It relies on specific personnel with substantial knowledge and experience of the facility to determine whether an activity adversely affects credited controls.Other than the USI Checklist, with its issues discussed above, and a determination by committee, there is no documentation that systematically determines if an activity can commence before DOE has provided written approval on USIs (FIND-L2-06).

The team interviewed the NSLS-II Authorization Basis Manager who described what appears to be a robust system to track, process, and document all of the USI documentation for NSLS-II. NSLS-II apparently has a different USI process than C-AD.

Conclusion

The C-AD USI procedure instructs the user to make a USI determination prior to entering the USI process, thus negating the need or use of the USI procedure. C-AD does not have a process that systematically determines if an activity can commence before DOE has provided written approval.

NSLS-II has a system in place to track, process, and manage all of the USI documentation. NSLS-II USI evaluations clearly walk the user through questions regarding the hazard analysis in the NSLS-II SAD.

Findings

Level 2 Findings16

FIND-L2-03 Steps 1 and 2 of SBMS accelerator safety subject area, procedure 9 are not consistent with DOE O 420.2C. The USI process should not only be based on the credited controls listedin the SAD/ASE or Maximum Credible Incidents, as stated in the procedure, but it should also ensure that any underlyingassumption or hazard discussed, or not discussed, in theSAD/ASE is not challenged by the change.

FIND-L2-04 The C-AD USI procedure is unclear and does not fully followthe BSA SBMS requirements.

FIND-L2-05 The USI Checklist for Design Review Questionnaire for ATF to install a vacuum piping system and through the block shielding into the experimental hall concluded an incorrect USIdetermination.

FIND-L2-06 There is no documentation that systematically determines if an activity can commence before DOE has provided writtenapproval on USIs.

RecommendationsREC-03 The team recommends restructuring Steps 5.1 and 5.2 in

Procedure 1.10.1 to instruct the user to use the USI process to make a USI determination – not vice versa.

4.4 Accelerator Readiness Review


The team reviewed BNL’s historical ARRs and conducted selected interviews with the BHSO Facility Representative (FR) as well as C-AD and NSLS-II staff. The most recent ARR was conducted by C-AD in January 2018. A review of the procedures provided indicate that the referenced ARRs were conducted in accordance with DOE O 420.2C using an approach consistent with SBMS and the DOE Guide (G) 420.2-1A, Accelerator Facility Safety Implementation Guide

The C-AD ARR reports reviewed by the team included an on-site portion which emphasized a performance‐based approach with a strong focus on field activities that included walk‐downs and inspections of systems and structures, inspections of safety systems, interviews, and roundtable discussions with staff.

The NSLS-II ARR for the Storage Ring Commissioning report was the only ARR report provided for NSLS-II. This report was provided to the assessment team after the conclusion of the site visit. The assessment team noted that as with the ARRs performed within C-AD, the conduct of the ARR emphasized a performance based approach and was consistent with the requirements of DOE O 420.2C.

It was noted that the NSLS-II Storage Ring Commissioning ARR resulted in 11 pre-start findings, two of which were post-start findings from the previously completed Booster ARR that had been closed prior to the actions having been adequately completed. This raises two concerns:(1) the number of pre-start findings seems unusually large (e.g. C-AD ARRs pre-start findings

17

ranged from 4 to 7) which may indicate that the performance of the ARR was premature; and (2) the prematurely closed Booster ARR post-start findings indicate that the Issues Management System may not be sufficiently robust to ensure adequate closure of pre-start and post-startARR findings (FIND-L3-05). The following excerpt is taken from the NLSL-II Storage Ring Commissioning ARR:

“Two of the Booster ARR post-start findings appear to have been closed prior to the actions being adequately completed. It appears that the corrective action documentation, verification, and closure process for post-start actions are not adequate to ensure that the corrective action implementation is successfully demonstrated. The post-start findings were reviewed and verified prior to closure by the directorate ESH Manager. The directorate could benefit by having the closure packages receive a final review by someone independent of the organization. The resolution of two additional Booster ARR post-start findings does not appear adequate to address the concern originally identified. The resolution is not thorough and comprehensive enough to assure the ARR Team that the originally identified finding has been adequately resolved. Therefore, these findings will be identified as pre-start findings as part of this review (located in Section 4.0, Conduct of Operations Program).”

Conclusion

BNL has an ARR program that ensures facilities are adequately prepared for safe commissioning and/or operations in accordance with DOE O 420.2C. While this program has been recently applied at several BNL facilities, BLIP and RRPL have been managed by the C-AD Division since 2011 but no ARR has been performed (FIND-L1-01). Additionally, the assessment team observed similar findings in the area of operator training as reported in the 2014 NLSL-II Storage Ring Commissioning ARR Final Report. The lack of clearly defined operator training and qualification requirements was also a finding in the most recent NSLS-II ARR. (See FIND- L2-06 in Training and Qualifications)

Findings

Level 1 FindingsFIND-L1-01 BLIP and RRPL/TPL have been operated and managed under

a C-AD SAD and ASE since 2011 however, an ARR wasnever conducted for either facility.

Level 3 FindingsFIND-L3-05 The issues management system may not be sufficiently robust

to ensure adequate closure of pre-start and post-start ARR findings.

Section 4.5 Training and Qualifications


18

The assessment team conducted interviews and reviewed a variety of documents for the Training and Qualification Program at C-AD (LEAF, ATF, MIRP) and NSLS-II. Requirements have been established for each individual at BNL whose activities could affect safety and health conditions or whose safety and health could be affected by the facility activities. A controlled list of personnel that could affect or be affected by the facility activities is maintained by the respective C-AD or Photon Science Directorate. Access into specific areas is controlled through the use of safety system interlocks, locked doors, posted signage, and electronic badge readers.

BNLThe Brookhaven Training Management System (BTMS) is the database of record for all training at BNL. BTMS contains a training history for each BNL employee, guest, user, visitor, and contractor who completes training, challenge exams, and read and acknowledgements. The system includes a record of course titles, course numbers, dates of training, BNL identification (life/guest) numbers, and trainee score (pass or fail, if applicable). For laboratory training courses with mandatory requalification dates, employees, guests, users, and contractors are notified via BTMS of the need to complete training prior to expiration. The Training and Qualifications Program Office maintains electronic files of training records entered into BTMS. For radiological records, the T&Q Program Office maintains records for 75 years and archives data in a retrieval manner in accordance with Records Management Program requirements.

A training profile is created for each BNL employee and consist of Job Training Assessments (JTAs) which are based on individual roles, risks and hazards associated with activities, and site- specific work instructions. It is each employee’s responsibility to review their training records regularly with their supervisor, and update their records if and when their role or activities change. In addition to training courses, employees may be required to demonstrate practical application for a given task (such as a Job Performance Measure), especially for high-risk and hazardous work. Employees with expired training and qualification are not permitted to perform work associated with the given training and qualifications until the training requirement has been fulfilled.

C-ADThe C-AD Deputy Directorate Chief Operating Officer serves as the Training Manager and Conduct of Operations Deputy Group Leader. This individual also manages the C-AD authorization basis documentation and maintains the C-AD Operations Procedures Manual. Specific organizations within the C-AD define individual roles and responsibilities. Supervisors work with the C-AD Training Manager and ESH personnel to determine individual training requirements.

LEAFTraining records, qualifications and specific JTAs for LEAF operators and people who do accelerator maintenance are documented in BTMS. Three types of qualifications exist; Accelerator Operator, Interlock Operator, Laser Operator. Rosters are kept for Accelerator and Interlock Operators. LEAF-specific training and authorization is managed locally by the LEAF Supervisor.

ATF

19

Training records, qualifications and specific JTAs for ATF duty operators, Linac operators, Laser users, and Lase physicists are documented in BTMS. ATF-specific training is conducted and managed by the C-AD.

MIRP (BLIP/RRPL)Training records, qualifications and specific JTAs for MIRP, BLIP and RRPL staff, such as production managers, HP Germanium Detector, trainer/operator, and bioassay are documented in BTMS. Note: Department-specific training for MIRP (including BLIP and RRPL) is managed by the C-AD organization.

NSLS-IINSLS-II has a full-time Training Manager. Job Training Assessments (JTAs) are developed by the supervisor and NSLS-II Training Manager in accordance with BNL development requirements. The NSLS-II training group plays a key role in tracking and ensuring the completion of training. Training records for NSLS-II engineers and technical staff are stored in BTMS. All department-specific training and qualifications is managed locally by the Photon Sciences directorate. Training requirements for accelerator operators have been defined by the Beam Operations Group Leader (BOGL). The process involves OJT under the direction of an experienced qualified operator, exams, and evaluation by the BOGL while performing select tasks such as start-ups and shutdowns. Based on input from other staff, the BOGL will determine when the trainee is deemed qualified. To date there have been no new NSLS-II operators requiring training. The current operations staff were transferred from NSLS. There is no current qualification program for future NSLS-II operators. NSLS-II operator requalification requirements are not well defined or documented (FIND-L2-07).

Conclusion

BNL uses a computer-based lab-wide training database system to track the training and qualification records of BNL staff, including persons involved with LEAF, ATF, BLIP, and NSLS-II. The training interface enables authorized staff members to customize training requirements for each individual and to track training and qualification completion status. C-AD has a robust training and qualification program which includes a technical review process to define and maintain training and qualification requirements. While the process for operator training is well defined at NSLS-II, there is no current qualification program for future operators. NSLS-II operator requalification requirements are not well defined or documented. A similar finding was noted during the 2014 NSLS-II Storage Ring ARR. Develop a detailed policy defining NSLS-II Operator qualification requirements (REC-04).

Tasks that may affect safety and health, including operation of accelerator, experimental, research and development equipment, repair, maintenance, and emergency response are performed by appropriately trained and qualified personnel or trainees under the direct supervision of trained and qualified personnel. All personnel assigned to or using the accelerator facilities reviewed are trained in the safety and health practices and emergency plans consistent with their involvement in the task being performed; however, it is not clear that all personnel working in RRPL have been trained on the hazards associated with the MEL Hot Cell Upgrade because these hazards have not been fully addressed in the SAD. RRPL personnel should have training on the MEL Hot Cell Upgrade (See Discussion in Section 4.1 and 4.3 on MEL Hot Cell

20

Upgrade).

Findings

Level 2 FindingsFIND-L2-07 There is no current qualification program for future NSLS-II

operators. NSLS-II operator requalification requirements are not well defined or documented.

RecommendationsREC-04 Develop a detailed policy defining NSLS-II Operator

qualification requirements

4.6 Procedures and Plans


BNL uses their SBMS Accelerator Safety subject area procedures to implement DOE O 420.2C and other DOE/BNL expectations for accelerator safety. This subject area is divided into ten (10) sections that detail specific requirements for things like developing the safety analysis and safety assessment document and unreviewed safety issue process. Generally, except where noted in this report, the assessment team found that the SBMS procedures were consistent with DOE O 420.2C. The BNL corporate radiation control division has been responsible for maintaining this subject area since 2013 and providing support to line organizations in implementation since 2013. Moving procedures for this subject area to the corporate radiation protection division was meant to drive consistency through the lab’s implementation. However, for the USI process consistency in implementation of corporate USI procedures has not occurred (See FIND-L2-04). From the corporate procedures each line organization has the ability to develop their own internal procedures to implement the SBMS procedures. Both the C-AD and NSLS-II divisions have chosen to develop their own internal procedures. Generally, except where noted in this report, the assessment team found consistent flow down of requirements.

In addition to accelerator safety related procedures the assessment team sampled “on the floor” operating procedures in both C-AD and NSLS-II for things like target transfers, startup procedures, and room access. It was noted by the assessment team that the C-AD had over 1,000 procedures and NSLS-II had about 300 procedures. The ability to maintain (i.e., configuration management) this number of procedures comes with its own challenges. Both departments should continually strive to find the right number of procedures that allow appropriate direction to employees without becoming burdensome; then, maintain these procedures in accordance with applicable requirements.

The working level procedures sampled by the assessment team were not consistent in how they identify credited controls and assumptions made in the ASEs and SADs. In some procedures the step that controlled a credited control or assumption was called out as such (i.e., identified this as an ASE control) and in others this was not called out. From the assessment team’s sampling of procedures there were multiple instances of ASE controls not identified in

21

procedures (FIND-L3-06). Examples of inconsistently identified ASE credited controls include:

Procedure OPM 21.01.01 Step 4.3 describes that the ATF beam power limit is 5 Watts. This is a credited control 2.1 in the 2017 ATF ASE, but, the procedures does not identify it as such.

Procedure OPM 19.17.30 Step 5.1 requires that the transport route is sanded and/or plowed before transport. This is credited control 3.14.3 in the 2017 BLIP ASE, but, the procedure does not identify it as such.

Procedure OPM 19.17.30 Caution Box after Step 5.20 identifies the 10 MPH forklift speed as an ASE credited control.

During interviews with staff at both NSLS-II and C-AD the assessment team got varying degrees of understanding regarding what procedures included credited controls and which did not and how they are identified. The assessment team notes in the ASE section of this report that the lab has had very few ASE violations, but, without understanding which procedure steps protect credited controls, it is difficult for staff to know when they have violated a credited control, need to stop work, and review with management (See FIND L3-04). In addition, when it is not understood which procedures include a credited control it is difficult to maintain configuration management between the ASE/SAD and procedures.

Similar to the accelerator safety subject area BNL has a SBMS area for conduct of operations. C- AD and NSLS-II are both required to follow conduct of operations and have approved conduct of operations matrices. The assessment team was able to establish that line organizations had completed CONOPS matrices and the BNL Environment, Safety & Health (ES&H) organization independently validated the existence of procedures; however, no verification that the procedures are correct or appropriately applied has yet been performed. At the time of this report, NSLS-II is preparing to perform an internal assessment of the CONOPS program in FY19. ES&H is planning to observe and/or participate in this assessment with the intention of applying lessons learned to future institutional level CONOPS assessments.

Conduct of operations (CONOPS) deficiencies were identified during tours and interviews (FIND L2-08). For example, when touring the NSLS-II, attention was brought to the use of photographs attached to beamlines which are used to confirm the physical configuration of beamline components. When assessment team members questioned facility staff whether these photographs were operator aids, the staff answered that they were not: the photos were used only for ‘configuration management’. Another example, when BLIP and RRPL operators were interviewed, they could clearly and accurately describe the implementation of processes and procedures, but could not necessarily provide information regarding whether these processes and procedures were derived from ASE credited controls.

Conclusion

The assessment team has concluded that despite the development of institutional level procedures in SBMS to drive consistency throughout the lab, the C-AD and NSLS-II line managements reviewed have taken significantly different approaches to implementing accelerator safety order requirements. The two line organizations also have significantly

22

different approaches in the number and management of implementing procedures identified in the CONOPS matrices. BNL has self- identified the need to verify that procedures identified in the CONOPS matrices are correct and appropriately used, and is in the process of planning self-assessments. The assessment team recommends that the future CONOPS assessments also consider the number of procedures in use with regard to configuration management challenges. The assessment team also has concerns with the flow down of ASE credited controls to implementing procedures and facility operators’ recognition in these procedures of which controls derive from the ASE.

Proficiencies and Findings

Level 2 FindingsFIND-L2-08 Conduct of operations (CONOPS) deficiencies were identified

during tours and interviews.

Level 3 FindingsFIND-L3-06 From the assessment team’s sampling of procedures

there were multiple instances of ASE controls not identified in procedures.

4.7 Internal Safety Review SystemDiscussion of Results

The assessment team has verified that BNL has established a system to periodically assess facilities, systems and equipment at both the institutional and division levels. NSLS-II and C-AD have annual planned assessment schedules which address a variety of requirements including Work Planning and Control, USI, and Beamline Development as well as non-safety assessments such as Business and Financial Management. Based on the evidence provided to the assessment team, assessments are performed as scheduled with few delays. Both C-AD and NSLS-II assessment plans are consistent with flow-down requirements from SBMS.

The assessment team noted that many examples of C-AD internal assessments provided were directly related to FDA requirements (i.e., Good Manufacturing Process) for production of medical isotopes and thus were primarily focused on meeting QA requirements rather than safety. It also led the assessment team to conclude that the C-AD assessments are driven externally, for instance by FDA requirements, rather than Integrated Safety Management (ISM) principles (FIND-L3-07). Section 5.1 of the BHSO FY 2018 2nd period PEMP Feedback Report noted that, “The NSLS-II facility had a series of operational events this reporting period that may indicate a weakness in Conduct of Operations.” The report details a list of seven incidents and notes that BNL has planned an external review of NSLS-II’s Work Planning and Control process to address these concerns. Additionally, Section 6.4 of the BHSO FY 2018 2nd period PEMP Feedback Report noted that “BHSO has observed weaknesses in BSA’s proposed closure packages for high risk (Non-conformance Tracking System) corrective actions. Corrective actions (CA’s) have been deemed closed prematurely, lacking sufficient documentation, and not completed in accordance with the Corrective Action Plan.” The assessment team discussed in Section 4.4 ARRs of this report that two pre-start findings for the NSLS-II Storage Ring Commissioning ARR identified post-start findings from the NSLS-II Booster Ring ARR which had been inappropriately closed. Section 4.5 of this

23

report also notes that findings related to NSLS-II operator training were identified in the Booster Ring ARR and again in this report. In Section 4.8, DOE Oversight and Approvals, of this report the assessment team notes that corrective actions associated with findings from the Assessment of the Brookhaven National Laboratory Hazard Categorization Program were not fully completed prior to closure. These observations together call into question the general effectiveness of the issues management system which is necessary for the function of an Internal Safety Review System. (See FIND-L3-05)

ConclusionWhile both C-AD and NSLS-II have implemented Internal Safety Review processes which are consistent with institutional requirements, improvements to issues management will be necessary to ensure the effectiveness of the program. The assessment team found multiple instances of corrective actions being prematurely closed in various tracking systems. The assessment team is also concerned that many C-AD assessments seem to result from external drivers rather than the application of ISM principles.

Proficiencies and Findings

Level 3 FindingsFIND-L3-07 The C-AD assessments are driven externally, for instance by

FDA requirements, rather than Integrated Safety Management (ISM) principles.

4.8 DOE Oversight Including DOE Orders and SCMS/Approvals (DOE and ContractorDiscussion of Results

BHSO-OA-14, Commissioning and Routine Operations of Accelerator Facilities, and BHSO- OA-01, Conduct of Environment, Safety, and Health Assessments, are the local procedures site office facility representatives and environment, health, and safety professionals use to oversee BSA accelerator operations. These procedures include roles and responsibilities, information on how to review and approve ASEs, processing USIs, and tracking ARRs. The assessment team confirmed that these procedures, issued in 2016 and 2018 respectively, flow down requirements from DOE O 420.2C and applicable accelerator and assessment Office of Science Management System (SCMS) procedures. Although it was found that the site office procedure had no inconsistencies with the SCMS procedures on accelerator safety interviews with staff indicated that they were not directly using SCMS as a resource after it was removed from the online platform in 2017. They were not sure where it was located on the shared SC drive. There are multiple instances the assessment team found of the site office not following BHSO-OA-14 (FIND-L2-09). Examples include:

Section 4.1 requires that the Site Office Manager or designee shall ensure appropriate contractor-led ARRs are performed. An ARR was never conducted for BLIP or B801/RRPL in the more than 8 years of operation as an accelerator facility. The 2018 BLIP/RRPL ASE approval letter from BHSO, dated January 11, 2018, recognized the fact that an ARR was never performed for these facilities; however, only an external validation of the SAD and ASE within 3 years was required, not a full ARR.

Section 5.1.2 requires the technical reviewer to keep notes relating to the salient aspects of the review. However, the assessment team did not find evidence of notes or formal

24

record keeping for every ASE evaluation and approval.

The last accelerator safety specific formal assessment performed by the site office on BSA was in 2011. The assessment focused on performance and compliance with the USI process. There was one level 1 finding that identified BNL’s SBMS Accelerator Safety subject area as not been consistently implemented throughout BNL. A corrective action plan (CAP) was required to be submitted to the site office and tracked to closure by the laboratory. The assessment team could not confirm if there was a CAP developed and submitted to the site office.However, the team found similar issues with BNL not consistently implementing their SBMS procedures in the area of Accelerator Safety. This is further discussed in Section 4.6. Therefore, it can be concluded that the root cause of the Level 1 finding from 2011 was either not found or not corrected.

In addition to the 2011 assessment there are examples of site office surveillances, walk-throughs, FR awareness, and observations of contractor self-assessments in accelerator facilities. These activities are completed by the site office with focus on other areas related to safe operations, such as conduct of operations, but are not specific to whether the facilities meet the requirements of DOE O 420.2C and the associated SCMS, or SBMS requirements.

There are no formal DOE or SC requirements for how often a formal accelerator assessment should be performed; however, seven years without a formal accelerator program assessment, when there is considerable mission growth in this area does not meet the intent of DOE O 226.1B, Implementation of Department of Energy Oversight Policy (FIND-L3-08). DOE O 226.1B requires DOE to determine the level and/or mix of oversight to be tailored based on hazards, maturity and operational performance. Without periodic accelerator program assessments program issues and improvements cannot be identified and incorporated to ensure a current and safe accelerator safety program. BHSO should include in their procedures a regularly scheduled formal assessment of the accelerator program (REC-05).

DOE O 420.2C is included in the BSA contract through the appropriate contracting officer. BHSO oversight and operational awareness activities feed into the Performance Evaluation and Measurement Plan (PEMP) process, which helps determine contract performance fee. The FY 2017 and FY 2018 PEMP mid-year and final feedback reports were provided to the assessment team. In each of these feedback reports the site office notes that improvements need to be made to accelerator operations and documents, where appropriate, these improvements have been made in the time period of the feedback report. One example is the FY 2017 BHSO and BNL accelerator safety subject area management system risk analysis. In the FY 2017 PEMP mid-year feedback report this task was identified as being started and in the final FY 2017 PEMP assessment acknowledgement that this report was complete. The risk gap analysis did not identify gaps but did identify several opportunities for improvement. In interviews with BHSO staff it was communicated that while this was a good exercise it did not identify the issues with the program and the evaluation was “shelved” shortly after it was complete. The assessment team could not confirm how the report was being used. The FY 2018 second period PEMP performance feedback report identifies weaknesses with NSLS-II’s conduct of operations program.

25

In 2018 BHSO completed a FR staffing analysis, Determination of Facility Representative Coverage. This document requires approximately 4 full-time FRs to adequately cover all facilities. Currently, the site office has two fully qualified FRs and two safety SME’s that areinterim qualified part-time FRs. The two fully qualified FR Qualification Cards were reviewed for completeness. Both FRs are fully qualified to provide oversight to their respective accelerator facilities. The Brookhaven Accelerator Inventory lists 17 accelerators operated under the requirements of DOE O 420.2C. One FR is 100% dedicated to accelerator facilities and covers 14 (of the 17) accelerators. The other FR covers the remaining 3 accelerators and scientific laboratories dedicated to physics, computational sciences, energy sciences, etc. The remaining interim qualified FRs cover non-accelerator facilities (i.e., construction, utilities, and radiological facilities). Based on the tasks identified in the staffing analysis and interviews with the site office there are indications that the FRs are spread thinly and may not be able to adequately cover all the scope required by the staffing analysis (FIND-L3-09). The site office is aware of this issue and has an approved full time equivalent FR position that they have struggled to fill due to various reasons.

In addition to typical FR duties the FRs are responsible for review and recommendation to site office management approval of ASEs, restarts following ASE violations, or exemption requests. Although the assessment team found each of these documents had a formal approval letter from the site office, the formality of the reviews leading to approval varied. As stated above (FIND-L2-10) the assessment team did not receive or have any indication of detailed notes regarding the review and approval process of these ASEs, re-starts due to ASE violations, or exemption requests.Interviewees indicated that many of the comments were provided informally (i.e., emails or meetings) to BNL and were assumed to be addressed informally prior to the final submittal. In almost every example provided to the assessment team, the dialog required to resolve issues was undocumented. The only evidence of formal comment/acceptance done by BHSO and BNL for the facilities reviewed was on the 2009 BLIP SAD/ASE where there was a formal comment resolution matrix, a formal response provided by BNL on the comments provided by BHSO and formal BHSO acceptance of the comments. In review of this formal comment/resolution at least two of the comments reappear in our report related to the C-AD SAD/ASE. The team is unsure of the closure mechanism (i.e., verification step) to ensure that these comments were addressed adequately before approval by the site office.

Part of the informality of the process can be attributed to the short turn-around times required by the mission need of the action by BNL. BHSO approvals occur regularly within two to threeweeks of the formal submittal by BNL. Interviews with the site office indicated the short turn around was due to mission schedule. BHSO’s systemic lack of formal reviews and rigor in the document approval process displays a hesitancy to formally reject submittals or “hold up” approvals so as not to disrupt mission which is counter to the requirements of DOE O 226.1and SCMS. (FIND-02-10). The 2009 BLIP SAD approval is the only evidence of document rejection provided to the assessment team. This is as much of a reflection on BNL, as they are not giving the site office ample time to review and work through issues prior to them needing the approved document.

The assessment team also reviewed the reclassification of BLIP and RRPL from radiological facilities to accelerator facilities in the late 2000s since these are not traditional accelerator facilities and are not new construction. In October 2010, both BLIP and RRPL facilities

26

transferred from the Medical Department to C-AD. Prior to this transition both facilities were operated as radiological facilities under a Safety Analysis Report. At the time of transition C-AD developed safety analyses and an ASE that identified controls under the DOE O 420.2B, Safety of Accelerator Facilities, regulatory framework. BHSO approved the ASE on June 6, 2011. DOE O 420.2B did not have a formal definition of an accelerator so it would have been expected that DOE HQ be involved in what “constituted” an accelerator.

According to statements in the following document “Medical Isotope Production at BNL”, Laboratory Management decided to reclassify BLIP from a radiological facility to an accelerator facility based on a planned 2009 SC-wide Accelerator Safety Order Implementation Review. The decision to reclassify Building 801 as an accelerator facility was made following a 2010 SC-wide Nuclear Hazard Categorization Assessment. The SC Senior Nuclear Safety Advisor (SNSA) was charged with confirming there were no unidentified Hazard Category 1, 2, or 3 nuclear facilities at SC sites. BNL performed a Hazard Categorization self-assessment in February 2010 which was in turn reviewed by the SNSA.

The following excerpts are from the MIRP Operations Timeline and History of Authorization Bases section of the Medical Isotope Production at BNL Document mentioned above;

“2009 – A DOE accelerator assessment for all DOE accelerators is planned. In preparation, BLIP/Medical Department identifies BLIP as an accelerator facility and revises the SAD in accordance with DOE O 420.2B. Building 801 continues to be managed as a less than Hazard Category 3 Nuclear facility defined by BNL as a Radiological Facility.”

“2010 – DOE-SC initiates a Nuclear Hazard Categorization Assessment of all DOE-SC Labs. BSA performs a self-assessment in lieu of a DOE assessment in February 2010.” The review found that material exceeding DOE STD-1027-92 HC3 quantities was shipped from BLIP to Building 801.

According to the self-assessment final report, BLIP was identified by BNL as an accelerator facility and so was not reviewed as part of the hazard categorization self-assessment however, the report listed “Multiple findings associated with designation and implementation of Building 801 as a below Hazard Category (HC)-3 facility.” In response to the report findings BNL performed a causal analysis (CA) and prepared a corrective action plan (CAP). One of the corrective actions was for BNL to prepare an analysis and methodology using DOE O 420.2C, 10 CFR part 830, Nuclear Safety Management, DOE-STD-1027-92 CN1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE O 5480.23, Nuclear Safety Analysis Reports, and the BNL Facility Authorization Basis Program to determine if RRPL should be classified as an accelerator or radiological facility and to obtain DOE approval.

A DOE-HQ facility hazard categorization review of the BNL self-assessment was performed by the SNSA in August 2010. The review report issued did not discuss the change in facility classification for BLIP or B801 but did confirm the issues and findings identified in the BNL self-assessment. The DOE-HQ team reviewed the CA and CAP developed by BNL, but, did not review the corrective action closure document because it was not submitted to the site office by BNL until after the HQ report was finalized. No evidence was presented to show that the analysis stated in the CAP was ever completed, however the action was closed by BNL with BHSO approval. Additionally no evidence was provided to show DOE-HQ review or acceptance of the decision to reclassify RRPL as an accelerator as part of the self-assessment or the corrective

27

action closure.

BHSO approval of the ASE following the BNL decision to reclassify BLIP and RRPL as accelerator facilities may have been assumed by both BHSO and BNL to be DOE’s approval of the reclassification. However, no formal process exist for this type of reclassification and BHSO does not acknowledge the classification change directly in the ASE approval.The BNL corrective action to prepare an analysis and methodology for classifying RRPL as an accelerator facility and request DOE approval was not completed adequately (FIND-02- 11).

Due to the lack of DOE review documentation (FIND-L2-10 above) on the 2011 RRPL ASE the assessment team is unsure whether the change in facility classification was explicitly approved or if it was an oversight. Regardless, each subsequent approval of the ASE was an opportunity for the site office to request a justification for the classification of the facility. The site office has not requested a formal justification and analysis of the classification of RRPL and BLIP (FIND-02-12).

The following excerpts were taken from the above referenced isotope production document; “The BLIP facility was upgraded to support DOE’s strategy to mobilize natural resources

to supply a continuous and reliable source of special isotopes to the medical community.” “BLIP and the Linac have undergone upgrades that will increase beam intensity with a

corresponding increase in isotope production. In addition, the RRPL would like to consider processing Ac-225. With the increased radioactivity and the additional radionuclides being produced, BSA projects waste inventory to exceed the 10 CFR 830 Category 3 thresholds.”

“C-AD and BNL management concur that a change of status for the Waste Management Facility (WMF) building 865 to an accelerator facility is the preferred alternative to allow waste to be moved to that location without longer term hold-up and additional handling at C-AD.”

“BSA has proposed expanding the accelerator footprint at BNL to include Building 865, the radioactive waste building in the Waste Management Facility.”

The reoccurring theme that everything can be defined as an “integral part of accelerator operations” lead the assessment team to conclude that the decision to re-classify BLIP and Building 801 as accelerator facilities (as well as the proposal to reclassify building 865) were driven by the pursuit of a future mission and a desire to minimize the additional requirements associated with performing that future mission in a radiological or nuclear facility. Based on the pattern of document approvals, this approach was supported by BHSO.

The situation highlights a gap in DOE policy because no guidance or expectations are provided to site offices on the procedure to reclassify existing facilities whose mission may change as accelerator facilities. Many facilities that are classified as accelerator are new builds and must follow the prescribed processes in DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. DOE does not have a formalized process in place to re-classify existing facilities as accelerator facilities and identify where the approval level should be (FIND-02-13). BNL continues to operate BLIP and RRPL as accelerator facilities based on their

28

interpretation of the definitions in DOE Order 420.2C.

Findings

Level 2 FindingsFIND-L2-09 There are multiple instances the assessment team found of the

site office not following BHSO-OA-14.FIND-L2-10 BHSO’s systemic lack of formal reviews and rigor in the

document approval process displays a hesitancy to formally reject submittals or “hold up” approvals so as not to disrupt mission which is counter to the requirements of DOE O 226.1and SCMS.

FIND-L2-11 The BNL corrective action to prepare an analysis andmethodology for classifying RRPL as an accelerator facility

FIND-L2-12 The site office has not requested a formal justification andanalysis of the classification of RRPL and BLIP.

FIND-L2-13 DOE does not have a formalized process in place to re-classify existing facilities as accelerator facilities and identify where the approval level should be

Level 3 FindingsFIND-L3-08 There are no formal DOE or SC requirements for how often a

formal accelerator assessment should be performed however, seven years without a formal accelerator program assessment, when there is considerable mission growth in this area does not meet the intent of DOE O 226.1B, Implementation ofDepartment of Energy Oversight Policy.

FIND-L3-09 Based on the tasks identified in the staffing analysis and interviews with the site office there are indications that the FRs are spread thinly and may not be able to adequately cover allthe scope required by the staffing analysis.

RecommendationsREC-05 BHSO should include in their procedures a regularly scheduled

formal assessment of the accelerator program.

5.0 Conclusion

While BNL and BHSO have the appropriate contract requirements and authorities to sufficiently ensure safe operations of the traditional accelerator facilities on site, BNL has not consistently applied accelerator safety requirements or the hazard identification and management principles of ISM across all facilities. Additionally BHSO has not required BNL to fully comply with DOE accelerator safety requirements prior to authorizing the start of operations in all facilities.

29

The number of Level 2 and 3 findings indicate there is a problem with risk identification and issues management. There is not strong evidence that systems are in place to adequately evaluate and correct these risks and issues in a timely manner. The Contractor Assurance System (CAS) was reviewed as it pertains to implementation of DOE Order 420.2C, Safety of Accelerator Facilities, at the selected accelerator facilities. BNL issues management systems that support accelerator operations are not functioning properly to ensure that CAS can effectively provide the Department of Energy assurance that the accelerator facilities reviewed are safe, reliable, and operated in accordance with applicable regulations. (FIND-02-14).

There was evidence that the corporate ES&H division is trying to assist the line management with implementation and strengthening of CONOPS and ISM principles. However, the corporate ES&H management has limited authority to affect operational decisions.

30