6
Overview of Site-Specific Risk Assessment

The National Research Council's (NRC) Stockpile Committee was established to provide the Army with independent scientific and technical advice on the Chemical Stockpile Disposal Program (CSDP). In carrying out its activities, the committee has maintained a continuing interest in the scope and methods employed by the Army to manage the risks associated with storage and disposal of the stockpile.

In the past, the committee reviewed activities at Johnston Island (NRC, 1984) in the Pacific Ocean, about 700 miles southwest of Hawaii, where the Army completed construction in 1990 of the first full-scale facility for the destruction of the stockpile using the baseline incineration system. Reviews of the Johnston Atoll Chemical Agent Disposal System (JACADS) Operational Verification Testing (including destruction of M55 rockets with GB and VX, ton containers of mustard, and 105mm artillery projectiles with mustard) (MITRE, 1993c); the JACADS-specific risk assessment (U.S. Army, 1987) and the risk assessment performed in support of the Army's Final Programmatic Environmental Impact Statement (FPEIS) (U.S. Army, 1988); on-site observations of JACADS operations; and visits to the Tooele Chemical Agent Disposal Facility (TOCDF) construction site led the committee to recommend additional risk assessment work.

The committee noted that the risk assessment to support the FPEIS was directed toward assessing the relative risks among various disposal (or continued storage) options (NRC, 1993a). The risk analysis as presented in the FPEIS was not directed at managing risk at any one site. The continental sites at which lethal chemical agents and munitions will be destroyed all differ substantially from Johnston Island, as well as from one another, with regard to terrain, weather, the density of nearby population, transportation network, the size and variety of stored agents and munitions, other aspects, and, possibly, destruction technology. The committee observed that the FPEIS needs to be supported by more site-specific risk analysis to provide an adequate basis for total risk management of the CSDP.

Experience in the nuclear power industry has demonstrated that risk assessments provide the best basis for quantitative risk management (U.S. Nuclear Regulatory Commission, 1994) (Taylor, 1994). In addition, they have been shown to provide a rational basis for the discussion of community concerns. Knowing not only what the risk is but also what is driving it at the basic event level permits specific actions of risk control and a quantification of the effectiveness of those actions.

The committee stated that the long-range benefits to the Army of site-specific risk assessments goes beyond simply quantifying the risk. The site-specific risk assessment can be an important management tool in the decision-ranking process in relation to design, operations, personnel training, maintenance, and plant modifications. Site-specific risk assessment is necessary at every location where lethal chemical agents and munitions will be destroyed, regardless of the method of destruction.

This chapter presents the committee's specific previous recommendations with respect to risk assessment and risk management and the committee's interpretation of the Army's response to those recommendations. It describes the Army's plans for risk assessment and risk management at the TOCDF and Tooele Army Depot chemical stockpile and their current status. Finally, it provides the committee's findings with respect to the chemical agent disposal facility risk management program.

NRC Recommendations on Risk Management

The committee has presented recommendations on risk management of the CSDP in three separate documents. Although there is some duplication among the recommendations, all of them are discussed in the following pages.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 55
--> 6 Overview of Site-Specific Risk Assessment The National Research Council's (NRC) Stockpile Committee was established to provide the Army with independent scientific and technical advice on the Chemical Stockpile Disposal Program (CSDP). In carrying out its activities, the committee has maintained a continuing interest in the scope and methods employed by the Army to manage the risks associated with storage and disposal of the stockpile. In the past, the committee reviewed activities at Johnston Island (NRC, 1984) in the Pacific Ocean, about 700 miles southwest of Hawaii, where the Army completed construction in 1990 of the first full-scale facility for the destruction of the stockpile using the baseline incineration system. Reviews of the Johnston Atoll Chemical Agent Disposal System (JACADS) Operational Verification Testing (including destruction of M55 rockets with GB and VX, ton containers of mustard, and 105mm artillery projectiles with mustard) (MITRE, 1993c); the JACADS-specific risk assessment (U.S. Army, 1987) and the risk assessment performed in support of the Army's Final Programmatic Environmental Impact Statement (FPEIS) (U.S. Army, 1988); on-site observations of JACADS operations; and visits to the Tooele Chemical Agent Disposal Facility (TOCDF) construction site led the committee to recommend additional risk assessment work. The committee noted that the risk assessment to support the FPEIS was directed toward assessing the relative risks among various disposal (or continued storage) options (NRC, 1993a). The risk analysis as presented in the FPEIS was not directed at managing risk at any one site. The continental sites at which lethal chemical agents and munitions will be destroyed all differ substantially from Johnston Island, as well as from one another, with regard to terrain, weather, the density of nearby population, transportation network, the size and variety of stored agents and munitions, other aspects, and, possibly, destruction technology. The committee observed that the FPEIS needs to be supported by more site-specific risk analysis to provide an adequate basis for total risk management of the CSDP. Experience in the nuclear power industry has demonstrated that risk assessments provide the best basis for quantitative risk management (U.S. Nuclear Regulatory Commission, 1994) (Taylor, 1994). In addition, they have been shown to provide a rational basis for the discussion of community concerns. Knowing not only what the risk is but also what is driving it at the basic event level permits specific actions of risk control and a quantification of the effectiveness of those actions. The committee stated that the long-range benefits to the Army of site-specific risk assessments goes beyond simply quantifying the risk. The site-specific risk assessment can be an important management tool in the decision-ranking process in relation to design, operations, personnel training, maintenance, and plant modifications. Site-specific risk assessment is necessary at every location where lethal chemical agents and munitions will be destroyed, regardless of the method of destruction. This chapter presents the committee's specific previous recommendations with respect to risk assessment and risk management and the committee's interpretation of the Army's response to those recommendations. It describes the Army's plans for risk assessment and risk management at the TOCDF and Tooele Army Depot chemical stockpile and their current status. Finally, it provides the committee's findings with respect to the chemical agent disposal facility risk management program. NRC Recommendations on Risk Management The committee has presented recommendations on risk management of the CSDP in three separate documents. Although there is some duplication among the recommendations, all of them are discussed in the following pages.

OCR for page 55
--> Report on Operational Verification Testing The final recommendation in the Stockpile Committee's Evaluation of the Johnston Atoll Chemical Agent Disposal System Operational Verification Testing: Part II (NRC, 1994a) dealt with risk assessment: Complete the risk assessment for the Tooele Chemical Agent Disposal Facility during the systemization period. (OVT2-6) Because experience from Operational Verification Testing (OVT) at JACADS resulted in a number of changes to the design and planned operations at TOCDF, the committee wanted to ensure that the effects of those changes on risk would be examined. The Army has adopted this recommendation in stepwise fashion. Because of time constraints, the entire risk assessment will not be completed before the start of agent operations at the TOCDF. However, risk assessment pertinent to each campaign (the disposal of a particular agent/munitions type) will be completed and lessons learned will be applied before the start of each campaign. The first analysis for campaigns 1 and 2 (GB and VX M55 rockets with co-processing of bulk items) was completed in April 1995. Modifications to the TOCDF and its operations are in progress and will be completed prior to the start of agent operations (St. Pierre, 1995a). The draft report describing the final analysis for the first two campaigns was completed on June 26, 1995. The complete TOCDF risk assessment is expected to be published in the first quarter of 1996. The committee believes that the Army's approach to the TOCDF risk assessment meets the intent of this recommendation. NRC Letter Report on the Chemical Stockpile Disposal Program Risk Management Process Recommendations for Facilities in the Continental United States In January 1993, the committee sent a letter report to the Assistant Secretary of the Army recommending specific actions to enhance the CSDP risk management process (NRC, 1993a). That letter report made three specific recommendations for site-specific risk assessments for facilities in the continental United States. The recommendations are discussed below. The first was: A site-specific, full-scope, scenario-based risk assessment should be performed for each continental U.S. facility, starting with the Tooele facility. (RISK-1) The Army's site-specific, full-scope, scenario-based risk assessment of the TOCDF is described in the following sections. For technical and administrative reasons, there are multiple risk assessment projects and reports as described below (e.g., "an accident quantitative risk assessment," "a health effects risk assessment," and "a reconfiguration risk assessment"). The committee understands the logic behind the various assessments but believes that the multiplicity of assessments can cause misunderstanding among reviewers, government agencies, and the public. The Army should adopt a standard language that recognizes the ensemble of risk-related projects as "the risk assessment,'' and individual studies should always be referred to as components of the wider "risk assessment." The second recommendation was: Each site-specific risk assessment should include the case of continued storage without disposal as one scenario. (RISK-2) The current Tooele risk assessment is limited to analysis of the activities associated with the first and second campaigns. Risks associated with continued storage will be addressed later (St. Pierre, 1995b). The accident quantitative risk assessment (QRA) team obtained additional expert assistance to address specific aspects of the risk of continued storage and associated agent/munitions handling. An expert seminar was held on June 27–30, 1995, to develop better models and data for evaluating risks from handling munitions. In addition, an external expert review of health effects and consequence modeling was held on June 22, 1995, to provide a better basis for modeling these effects. The third recommendation was: The risk assessments should be quantitative and include the following features: bottom-line results on the health effects to on-site personnel in terms of likelihood and consequence, including a site-specific atmospheric dispersion and health effects analysis and an analysis of emergency response capability; a clearly defined set of scenarios that, taken together, provide a comprehensive representation of the risk;

OCR for page 55
--> dependency matrices that display inter- and intrasystem dependencies; a human action analysis that represents the human role in controlling risk; quantification of risk from all causes, including both internal events (plant and plant-people failures) and external events (earthquakes, fires, floods, aircraft crashes, etc.); site-specific hardware, software, procedures, training programs, maintenance practices, and operations personnel (including site-specific storage facilities and munitions handling activities); risk contributors in such terms as random failures, common cause failures, multiple failures, and human error; and an uncertainty analysis to display clearly how much confidence the analysts have in the precision of the quantitative results. (RISK-3) The accident QRA is progressing in a manner consistent with the goals of this recommendation. Not all the above features are included in the summary report on campaigns 1 and 2, a draft of which was circulated for comment on June 26, 1995, but they are all part of the ongoing accident QRA. Broad Guidelines for Risk Management The committee's letter report provided five broad guidelines the Army should use to conduct site-specific analyses. The first guideline was: Modern, up-to-date methodologies should be employed, such as those found in the risk assessments reported in NUREG-1150. (RISK-4) The accident QRA meets the first guideline. The second guideline was: The risk assessments should be conducted by organizations with recognized expertise in the field, but not otherwise involved in the CSDP. In a similar vein, independent peer reviews are an absolute requirement. (RISK-5) Science Applications International Corporation (SAIC), the organization conducting the analysis, has recognized expertise in the field, as do the individuals from SAIC actually leading the work. In areas where SAIC does not have the requisite expertise, they have obtained the services of subcontractors who meet the requirements. In a few difficult areas where methods have not yet been developed and data are sparse, SAIC is convening expert panels to develop recommendations based on experience and expertise. SAIC is involved in other projects at the TOCDF and for the Chemical Stockpile Disposal Program. Nevertheless, the Army and other organizations within SAIC appear to be protecting the QRA team from outside influence and to be dealing with them as an independent organization. Discussions with team members show that they have a healthy skepticism for information and opinions expressed by the Army management and by the Army, EG&G, and SAIC personnel involved with the TOCDF. The evolving process for risk management reflects a challenging and competitive, but still cooperative, relationship between these organizations. Independent review has been established with the QRA Expert Panel, a group of five experts brought together under contract with MITRE and who operate independently of project management. Three of the panel members have extensive QRA experience, primarily in the field of nuclear reactor safety but with additional experience in the analysis of aerospace and process chemical facilities. One panel member is a member of the U.S. Nuclear Regulatory Commission's Advisory Committee on Reactor Safeguards. Another is a combustion expert from Brigham Young University in Salt Lake City, who also provides some degree of local perspective for the panel. Two are professors of engineering at major universities. Two are chemical engineers with process safety experience. All five have extensive professional experience and are consultants for major organizations. One member of the Stockpile Committee member was invited to monitor the Expert Panel meetings, generally two days each at two-month intervals. The Stockpile Committee member provided no guidance (that is the role of members of the Expert Panel), but was able to interrogate individual analysts and to delve deeply into the details of the QRA analysis. The committee is satisfied that the approach taken by the Army meets the intent of the recommendation. The third broad guideline was: Local representatives of neighboring communities must be involved early. Their concerns about the CSDP may be substantial, and will warrant consideration throughout the analysis process. (RISK-6)

OCR for page 55
--> The Army attempted to involve the community as early as spring of 1994 (Amos, 1994) and at intervals since then. However, as was noted in chapter 5, key elements of the community seem to have missed or misinterpreted the interactions. Additional efforts are required to involve the community successfully. Lessons learned here could be applied at future sites. The fourth broad guideline was: Emphasis must be placed on human reliability factors, particularly in light of the human factors issues raised by the Stockpile Committee in reviewing the first phase of Operational Verification Testing at JACADS. (RISK-7) The QRA team has brought human reliability experts into the project. However, so far, because of the limited quantity of agent that can be processed in the facility, no human error event significant to off-site release has been identified. The committee expects that the impact of human reliability on worker risk and stockpile handling accidents could be important, and the committee expects that the QRA will examine these areas. The committee will carefully monitor this analysis as the work proceeds. The fifth broad guideline was: To avoid overstatement of the results it is important that the confidence levels of the risk parameters be fully displayed. It is this process of quantifying the uncertainty in the risk that will establish the reliability of the conclusions. Experience has indicated that the results of a risk assessment provide valuable information on the importance of different contributors to risk, not only in terms of hardware failures but also in terms of human errors and deficiencies in procedures and software. Thus the risk assessment can lead to process changes that reduce overall risk. (RISK-8) The Expert Panel had asked the QRA team to expand and clarify their effort in characterizing the uncertainty. The committee expects that the QRA will meet the intent of this recommendation and will examine this area as the work proceeds. Recommendations Report In the Recommendations report (NRC, 1994c), the Stockpile Committee stated that risk analyses of both storage and disposal operations have shown that cumulative total risk to the public and to the environment is generally dominated by storage rather than disposal operations, at least in terms of the risk of acute agent exposure. The committee suggested that the risk analyses be updated, but recognized that strong evidence shows that new studies are not likely to alter significantly the distribution of risk. Furthermore, although there is no evidence of imminent disaster, storage and disposal risks will increase in time as the stockpile continues to deteriorate. The only way to avoid the continuing and growing risk of both acute agent exposure and long-term health effects is to eliminate the hazardous materials. Recommendations 2 through 5 of the Recommendations report deal with risk assessment. The recommended assessments were intended to verify the conclusions for each specific site and to address concerns expressed by the public. The first of these recommendations was: The committee expects the latent risk from storage, handling, and disposal activities to be low. However, new risk analyses should be conducted that explicitly account for latent health risks from storage, handling, and disposal. (REC-2) The latent risk from agent release during disposal activities (including handling required for disposal) for campaigns I and 2 was calculated in the draft summary report circulated June 26, 1995. Latent risk from continued storage and handling, as well as risk from later campaigns, will be included in the accident QRA that is to be published early in 1996. Latent risk from routine releases during normal operations is the subject of the health risk assessment to be directed by the state of Utah. The committee is concerned that this study may not be fully site-specific (e.g., perhaps using meteorology from Salt Lake City rather than Tooele), may not be directly comparable with the accident QRA results, and may not realistically address the probabilities of various possible releases. The Army should link the health risk assessment results with the accident QRA in one summary document describing the entire Tooele risk assessment and risk management program. The second of these recommendations was: Updated analyses of the relative risk of storage, handling, and disposal activities should be completed as soon as possible. (REC-3) The updated analysis for accidental release of agent at the TOCDF is under way and is expected to be completed in early 1996. Although the analysis of the

OCR for page 55
--> risk of storage and continued handling has not yet been completed, the campaign 1 and 2 accident QRA suggests that expediting destruction of agent will reduce total risk to the public. Earthquake scenarios are major contributors to risk at the TOCDF (Benjamin, 1994). Seismic events are likely to pose even greater risk to the stockpile than to the disposal facility. Therefore, the longer the stockpile remains, the higher the cumulative likelihood of such an event. The third recommendation was: New risk analyses should be site specific, using the latest available information and methods of analysis. At this time, since there is insufficient knowledge of potential alternative technologies, a first-cut series of analyses should compare the relative risks of continued storage and disposal by the baseline system. Analyses should identify the major contributors of total risk including storage. The analyses will confirm or refute the present belief that maximum safety dictates prompt disposal. (REC-4A) At this writing, no more than a first-cut analysis of storage risk is available for the TOCDF; a complete analysis is expected in early 1996. For reasons described above (REC-4A), it appears that maximum safety dictates prompt disposal. The Army should revisit this issue as the risk assessment for the TOCDF and chemical stockpile proceeds. The fourth recommendation was: As new, site-specific risk analyses become available, the Army should reconsider the schedule of construction and operation of disposal facilities and, if indicated, reorder the remaining sequence so as to minimize any subsequent cumulative total risk. The Army should also consider reconfiguring each high-risk stockpile to a safer condition prior to disposal if this will significantly decrease cumulative total risk. (REC-4B) Risk management of the stockpile is planned to include reconfiguration alternatives. Some reconfiguration has been accomplished at another site but not yet at the TOCDF. The Army has recently indicated that the TOCDF site manager has requested inclusion of the stockpile (i.e., continued storage) in the TOCDF Risk Management Plan discussed below. The committee strongly supports this idea. The fifth recommendation was: As research progresses on potential alternative technologies and as their potential for improved safety becomes apparent, site specific risk analyses should be reexamined, with the potential alternative substituted in the baseline system, to estimate overall system performance. In view of the limited potential for overall safety improvement, however, the disposal program should not be delayed pending completion of such research. (REC-5) Work on alternative technologies is continuing, as is construction and operation of the baseline incineration system. It is still too soon to perform comparative risk assessment for any alternative technology. A baseline incineration system exists at the TOCDF, and alternative technologies are not under consideration for this site. Once proven alternatives become available, they may be considered if indicated by the integrated programmatic risk assessment for Tooele. TOCDF Risk Management Plan The reason for performing risk assessment is to permit a more rational basis for managing facility design and operations. To take advantage of a thorough risk assessment, it is essential to develop a risk management plan that lays out the process for using the risk assessment within the overall plant management structure. The Army produced the first draft of the TOCDF Risk Management Plan (RMP) in April 1995 (U.S. Army, 1995c). The RMP is written for the TOCDF site manager, but some material was added for other audiences. The TOCDF RMP is intended to be the central guidance document for plant safety, integrating the myriad regulations that define safety at TOCDF. Indeed, one purpose of the RMP is to demonstrate the wide variety of programs in place that combine to enhance safety at the facility. Figure 6-1 (U.S. Army, 1995c) illustrates the logic flow of the RMP, with the accident QRA playing a central role in the decision process for emergency preparedness, management of change, performance evaluation, and incident investigation, and with all these activities feeding back to the QRA. Figure 6-2 (U.S. Army, 1995c), depicts the range of federal (OSHA, EPA, and DoD), Army, USACDRA (PMCD), Tooele Army Depot, Utah, and local regulations that drive the TOCDF safety program. These regulations will not be fully integrated into the body of the RMP. But they are tied together, and the separate documents are cited. Recent indications are that the Army expects to integrate the TOCDF and Tooele Army Depot stockpile programs into the RMP. The draft is currently being revised for

OCR for page 55
--> Figure 6-1 Overview of the Risk Management Plan. Source: U.S. Army, 1995c. consistency and completeness and is expected to be in place before the start of agent operations. The committee endorses the RMP approach and the integration of the TOCDF and site risk management. The committee has also observed the risk management process in action when the Army reviewed early accident QRA results, developed alternative plans for dealing with high-risk scenarios, evaluated them, and adjusted schedules for operations and actual plant hardware to eliminate unnecessary risks. Formalizing an effective process of continuing risk reduction in the RMP is an important goal. The examples below are from a recent TOCDF memorandum (Holmes, 1995). Risk results leading to these changes were calculated in the first draft analysis (U.S. Army, 1994d). During the development of the QRA, there has been extensive interaction between the QRA team and facility personnel (both on site and in the headquarters of the Program Manager for Chemical Demilitarization). This interaction began with development of process operational diagrams (PODs), which were used to define systematically the process steps. Review of these diagrams by both the QRA team and project personnel increased the operational understanding of both parties. As the QRA nears completion, routine reviews of insights are held between the QRA team and project personnel. These reviews serve many purposes. If the assumptions in the analysis are not correct or are inconsistent with experience, the assumptions are corrected and the assessment recalculated. If the analysis warrants, discussions are held to identify modifications to the operating strategy or operating procedures to mitigate the risk. The QRA frequently identifies additional processing step modifications that would most effectively mitigate the risk. Assumptions are jointly developed and used in the assessment to ensure proper mitigation of the identified risk. If the analysis results are acceptable, the approach agreed upon is implemented in the field, and the assumptions are published

OCR for page 55
--> Figure 6-2 Hierarchy of regulations that define safety at the TOCDF. Source: U.S. Army, 1995c. as part of the risk assessment documentation so they can be validated during the site Pre-Operational Survey. Interaction between project personnel and the QRA team is informal at this point. Nevertheless, the approaches utilized will serve as the basis for developing the analysis requirements documented in the Risk Management Plan. As discussed earlier in this report, the QRA has already affected several aspects of TOCDF operations. Some of these are described below (see also chapter 2). Operation of Metal Parts Furnace Feed Airlock The QRA identified a possible scenario involving the buildup and ignition of vapors in the metal parts furnace feed airlock. The phenomenon was most significant for bulk agent containers but also applied to projectiles. As a direct result of this insight, steps are being taken to limit the possibility that this event could occur, possibly by venting the airlock to the metal parts furnace afterburner. Procedural changes could also significantly limit the probability of this

OCR for page 55
--> type of scenario. The QRA team is working with the Program Manager for Chemical Demilitarization to assess proposed modifications to minimize the risk. This issue will be resolved before start-up of metal parts furnace agent operations. Weteye Bomb Aluminum and Agent Interaction The QRA identified the potential for interaction between molten aluminum and liquid agent in the metal parts furnace during processing of the aluminum weteye bombs, possibly leading to an explosion within the furnace. Calculations in support of the QRA indicated that the presence of liquid agent at the onset of aluminum melting could not be ruled out. The potential for the explosion of molten aluminum and water is known to exist, although there is a good deal of uncertainty about the conditions that produce explosions. No information is available concerning aluminum and agent, but the phenomenon could not be ruled out. As a result of this finding, the order of the campaigns was changed. Ton containers will be co-processed with GB rockets during the first campaign instead of weteye bombs. This change was made for two main reasons. First, the metal parts furnace GB trial burn requirements would require larger than normal quantities of agent to be left in each weteye bomb to establish the environmental permit feed limits to the furnace. This would further increase risk levels over the preliminary level in the risk assessment. Second, delaying weteye processing will allow time for a review of the SAIC calculations and the development of processing strategies to prevent molten aluminum-agent interaction. Assumptions developed between the QRA team and the Program Manager for Chemical Demilitarization will be the basis for the risk assessment and processing strategy development. Weteye Bomb Handling and Inventories The QRA found that weteye bombs increase risks significantly because they contain GB and are relatively thin-walled. The QRA developed a sensitivity study to determine the number of bombs to be loaded on a truck during transport. Additional analysis in the QRA may indicate the number of weteye bombs that should be stored in the container handling building to minimize the risk. Seismic Anchorage of the Liquid Propane Gas Tank The facility review of equipment fragilities during an earthquake indicates the liquid propane as tank anchorage has some seismic vulnerability despite its construction to seismic zone three requirements. Failure of this tank during an earthquake contributes significantly to seismic risk at the facility. The information provided by the QRA team will be used for evaluating the need for additional bracing for this tank. Tooele Risk Assessment The Army selected SAIC to perform an accident QRA for the TOCDF and the stockpile. That risk assessment follows the general approach of NUREG-1150 as suggested in committee guideline RISK-4 of the letter report on the CSDP risk management process (NRC, 1993a), i.e., an assessment of risk from accidents at the site. But there is more to the risk assessment recommended by the committee than an accident QRA, although previous experience indicates that the principal risk to the general public comes from accidents. At the present time, the Army's risk assessment of the TOCDF has three components: Accident quantitative risk assessment. This assessment quantitatively analyzes the probability and consequences of accidental releases of agent at the TOCDF and the chemical stockpile from all conceivable accidents at the Tooele Army Depot. Both acute and latent effects of acute releases are calculated for both workers and the general public. This work is in progress and the analysis has been completed for campaigns 1 and 2. The accident QRA will be described in detail in the following section. Health risk assessment. This assessment quantitatively analyzes, generally following Environmental Protection Agency (EPA) guidelines, the possible doses to the general population due to normal operations of the disposal facility. An assessment of the impact on agriculture will also be included (St. Pierre, 1995c). The state of Utah will conduct this analysis. It is anticipated that the assessment will use the approach developed by the Army in the analysis of the Anniston Chemical

OCR for page 55
--> Activity (U.S. Army, 1995d). The health risk assessment is not yet available for review and is not discussed further in this report. Reconfiguration risk assessment. After the risk from accidental releases of agent during continued storage is calculated, alternative storage configurations will be considered and the risk from each compared. The management structure for this work is not currently in place. The committee has several concerns about the current constitution of the TOCDF risk assessment. First and foremost, the studies are being performed as separate projects under diverse management with no obvious coordination. The committee believes that a single ''TOCDF Risk Assessment Summary Report" can be prepared to present the risk assessment in an integrated fashion as a single, all-encompassing document to the public. From a summary report, people with diverse expectations can easily identify where and how concerns have been addressed. Furthermore, planning for an integrated document will require identifying areas where management's attention is required to permit useful combining of results. State and Army management teams ought to agree on the key issues that must be properly handled in each risk assessment element. For example, each element should be consistent in all parameters at the Tooele site that can affect risk, e.g., design, operation, weather, and demographics. Accident Quantitative Risk Assessment The accident QRA of the TOCDF and the Tooele Army Depot stockpile is being performed for the Army by SAIC, a company whose analysts have extensive experience in quantitative, probabilistic risk assessment. The workplan for the QRA is presented in an overview document (Brandyberry, 1994). In some areas, SAIC has engaged subcontractors with special expertise, e.g., analysis of seismic hazards, structural mechanics, latent health effects of agent, and munitions fragility (if dropped). As discussed earlier, the QRA team is essentially independent of outside influence. Risk management activities with respect to scenarios identified in the analysis are performed by the Army in consultation with the QRA team. The goal of the study is to consider all possible upset conditions during normal and special operations that could lead to release of agent, both within the site boundaries and outside. The analysis is known as a level 3 analysis, because it will calculate acute and latent health effects of agent exposure for workers and the general public. A level 1 analysis focuses on the probability that equipment and human failures can create the potential for a release. A level 2 analysis characterizes the release, and a level 3 analysis calculates the consequences. As discussed earlier, the Army has engaged an independent panel to review and ensure the quality of the QRA. Methodology The accident QRA is being performed using a modified form of the standard fault tree/event tree QRA modeling techniques originally developed in the reactor safety study of Rasmussen (Rasmussen, 1975). Details are presented in a methodology manual (U.S. Army, 1994e). Process accident flowchart models, called process operational diagrams (PODs) in the QRA, have been devised as the mechanism for encoding process information. Upsets are identified in the POD as demonstrated in figure 6-3. A POD is described in the Army manual (U.S. Army, 1994e): A POD is a step-by-step search for events and upsets... By asking a set of what-if questions after each successive operational step, a thorough assessment of potential upsets can be generated. During this process, existing analyses are referenced to ensure that previously suggested events are covered... [Start by] listing the major steps of the normal operations... Given each normal step, it is necessary to consider all deviations that could occur during that step or if that step did not happen properly...The PODs are used to document the steps in the process and allow efficient review by operational staff. This format is understandable to engineers and operators familiar with the process who may not be versed in QRA modeling techniques. To illustrate POD modeling, figure 6-4 traces the major activities in each of the disposal processes. The off-normal events and potential upsets that could occur at each process step are described in a rectangle and given a name in a rectangle below the description, separated by a bold line. The name is used to track the event through the solution process.

OCR for page 55
--> Figure 6-3. Identifying upsets. Source: U.S. Army, 1994e. In the example of figure 6-4, the rockets in overpacks, called "pigs," are treated differently for some steps of the process than rockets not packed in pigs. An alternate path is indicated by a three-pronged connector and a new vertical path of rounded rectangles to the right of the diagram midline. In the case illustrated in figure 6-4, the alternative path tracks the pigs from Station 3 in the unpack area into the explosive containment vestibule by way of the bypass line. The empty on-site container ends up at the same point as containers from the main path in the process operational diagram (see U.S. Army, 1994e). The steps in the QRA process are laid out figure 6-5. The POD follows the plant process step by step to identify upset conditions. The QRA may quantify the likelihood of particular upset conditions with fault trees. Upset event trees define the initial outcomes of each upset in terms of the type of upset (e.g., spill, vapor leak, fire) and identify the location, agent, and quantity (i.e., the factors that define the release source term). Fault trees are used to quantify how likely various branches are. For initiating events that could cause multiple upsets, the analysts use global event trees to consider simultaneous releases. Accident progression event trees continue to track the upset to evaluate the effectiveness of barriers to release (e.g., mitigation systems such as HVAC filters) to determine public risk. Data analysis and systems analysis using fault trees follow standard techniques. Source term evaluation is automated through a set of "bins" according to rules that assign event tree sequences to source term "bins" that characterize the nature of the release based on information in the trees (e.g., the type and condition of munition, the agent, the location, the condition of barriers). Consequence analysis and external events (e.g., earthquakes, fires, tornadoes) are carried out in standard fashion. Details of all these modeling tools are provided in the methodology manual (U.S. Army, 1994e).

OCR for page 55
--> Figure 6-4 Sample portion of a rocket handling process operational diagram. Source: U.S. Army, 1994e. Independent Review Committee Role and Evaluation Detailed review of the accident QRA is being provided by a group of five experts (the Expert Panel, whose qualifications are discussed in an earlier section of this chapter) brought together under contract with MITRE and operating independently of project management. One member of the Stockpile Committee has been invited to monitor the Expert Panel review meetings and has been able to question individual analysts about details of the QRA. The Expert Panel held its first meeting on November 1–2, 1994, at Edgewood, Maryland, and continued on November 3–4, 1994, at the TOCDF. The panel toured the Chemical Demilitarization Training Facility and TOCDF and were briefed on the demilitarization program and the QRA approach. At the TOCDF they met with the science advisor to the governor of Utah and the chair of the Utah Citizens Advisory Commission, as well as with site personnel and managers. Several members of the Expert Panel met with the QRA team at Edgewood on January 5–6, 1995, to review several technical aspects of the analysis in more detail. The Stockpile Committee monitoring of the review process began with the second full meeting of the Expert Panel on February 1–2, 1995. The panel also met on March 16–17 and May 11–12. The Expert Panel selects a member to chair each meeting and prepares minutes on the meeting and a report summarizing comments and recommendations. The Army responds to each report in writing, explaining how they will address each comment. At later meetings, the Army presents and discusses work resulting from responses to the Expert Panel's suggestions. See table 6-1 for details of reports generated during the review process. Analysts performing each phase of

OCR for page 55
--> Figure 6-5 Schematic drawing of process operational diagram development. Source: U.S. Army, 1994e. the work brief the panel. When meetings are held in Edgewood, specific analysts can attend the meeting when questions arise on their work. Table 6-2 details briefings to the Expert Panel. The panel also meets in executive session to decide how to carry out its functions and to discuss recommendations. The Stockpile Committee finds that the review process is thorough and effective. The members of the panel are well qualified and are clearly independent. They probe deeply into the analysis and have received excellent cooperation from the Army and its contractor SAIC. The committee believes that the most valuable aspect of the review is the panel's focus on omissions rather than on the quality of the existing analysis. Unlike nuclear reactor quantitative risk assessments, which have been performed for many plants over many years, this is the first site-specific, full-scope quantitative risk assessment of a chemical disposal facility. Without the advantage of previous analyses and reviews, it seems more likely that there may be omissions. The search for what is not there is difficult, but the Expert Panel has the combined QRA experience and chemical process experience to provide a good second check on completeness of the analysis with respect to risk relevant scenarios. Results The second draft of the QRA for TOCDF campaigns 1 and 21 has been released and reviewed. The published version of the report will be released in the first quarter 1   Tooele Chemical Agent Disposal Facility Quantitative Risk Assessment: Campaigns 1 and 2, SAIC-95/1006, prepared for U.S. Army Chemical Demilitarization and Remediation Activity, June 1995.

OCR for page 55
--> Table 6-1 Reports Associated with the Expert Panel Review of the Tooele Chemical Agent Disposal Facility Quantitative Risk Assessment Report and Author(s) Date Quantitative TOCDF Risk Assessment, minutes of the Expert Panel meeting (S. Seth) November 1–4,1994 Draft recommendations, comments, and questions of the Expert Panel on TOCDF Risk Assessment (based on the first Expert Panel meeting, November 1–2, 1994) (G. Apostalakis, R.J. Budnitz, P.O. Hedman, G.W. Parry, R.W. Prugh) January 15, 1995 Discussion of most significant comments from draft Expert Panel comments of the November meeting (SAIC) February 1, 1995 Notes on the subcommittee meeting held at the SAIC office in Abingdon, January 4 and 5, 1995 (G. Parry) January 12, 1995 Minutes of the second Expert Panel meeting, February 1–2, 1995 (S. Seth) February 1995 Summary responses to comments from draft Expert Panel comments of the February meeting (SAIC) March 17, 1995 Letter report on agent combustion and molten aluminum-agent reactions (P.O. Hedman) March 21, 1995 Second report of the QRA Expert Panel (G. Apostalakis, R.J. Budnitz, P.O. Hedman, G.W. Parry, R.W. Prugh) March 1995 TOCDF Risk Assessment: Minutes of the third Expert Panel meeting, March 16–17, 1995 (S. Seth) March 1995 Third report of the QRA Expert Panel (G. Apostalakis, R.J. Budnitz, P.O. Hedman, G.W. Parry, R.W. Prugh) April 1995 Comments from Meeting 2 (including clarifications from Meeting 3) (SAIC) May 10, 1995 TOCDF Risk Assessment: Minutes of the fourth Expert Panel meeting, May 11–12, 1995 (S. Seth) May 1995 Fourth report of the QRA Expert Panel (G. Apostalakis, R.J. Budnitz, P.O. Hedman, G.W. Parry, R.W. Prugh) May 1995 of 1996 and is expected to be the same in substance as the draft report, with improved presentation. The TOCDF QRA analyzes the acute and latent risks of both lethal and mild injuries to the public and site workers from accidental releases of agents. Thus the effects of normal operations like routine stack emissions are not included in this report. The impact of permitted stack releases will be evaluated in the health effects risk assessment that is being performed by the state of Utah. The current report is limited to the first two campaigns at TOCDF and includes risks associated with handling and transportation required for the two campaigns as well as processes within the TOCDF. The first campaign is a co-processing campaign, in which both M55 rockets and ton containers filled with nerve agent GB will be destroyed. The second campaign involves M55 rockets and spray tanks filled with nerve agent VX. All M55 rockets at Tooele will be destroyed during campaigns 1 and 2. The purpose of the QRA for campaigns 1 and 2 is to support early use of risk insights for potential improvements prior to the start of the first two campaigns.

OCR for page 55
--> Table 6-2 Presentations to the Expert Panel Review of the Tooele Chemical Agent Disposal Facility Quantitative Risk Assessment Organization Presentation Date U. S. Army Risk and Surety Management Division       CSDP Risk Management February 1–2, 1995 Science Applications International Corporation       TOCDF QRA Expert Panel Briefing November 1–2, 1994   Handouts for Agenda Item: Preliminary Insights Fires Aircraft Impact Seismic Analysis Tornadoes Transportation February 1–2, 1995   TOCDF Risk Management Plan March 16, 1995   Preliminary QRA Insights for the First Campaign March 16, 1995   Determination of Energetic Initiation and Leak Probabilities from Drops March 16, 1995   Aging Effects on Rockets Explosive Components March 16, 1995   Accident Progression Event Tree Update May 12, 1995   Uncertainty Analysis May 12,1995   Update on Mechanistic Analysis Issues May 12, 1995   Filter Desorption May 12, 1995   Data Analysis and Synopsis of JACADS Experience May 11–12, 1995 Significant safety improvements are being incorporated as a result of the QRA. The QRA examines all potential causes of agent release during the two campaigns, including handling accidents (drops and impacts), mechanical failure, aircraft crashes, and severe environmental hazards such as earthquakes and fires. The report presents a number of other risk measures that are averages over selected parameters of the risk. On the basis of the expected (average) number of fatalities, comparisons show that the risk of the two campaigns is small compared to the risk of continued storage. When the full QRA is completed in 1996, more thorough and more meaningful comparisons will be available. The results of the analysis are explained from various perspectives. One of the most useful identifies the sources of the highest frequency contributors to risk of lethalities (in terms of the expected number of lethalities). The effects of earthquakes dominate both the risk of processing and the risk of continued storage. Although severe seismic events are unlikely (4 x 10-5 per year, or once every 25,000 years), they are one of the few kinds of events or failures likely to cause significant release of agent. This is because agent is processed in very limited quantities at any given time. The risk to workers and the public combines the chance that an initiating event occurs with the chance that a significant release occurs given that

OCR for page 55
--> event. Although the chance of a severe earthquake is low, it can cause significant damage and release. Other more likely events have little chance of causing significant release. The analysis shows that about 99 percent of the risk of processing comes from seismic events. Risk management activities now under way for TOCDF may further reduce the likelihood of release from seismic events and hence reduce overall risk from processing. Of the remaining 1 percent of the risk, about 94 percent is from accidents in handling in the storage yard. Because of substantial uncertainties in the modeling of handling accidents, additional work is being done to better characterize these events. The current draft of the QRA for campaigns 1 and 2 presents results. The final report on the complete TOCDF QRA will present details of the calculations and models that led to these results. The bases for much of that information have been reviewed during the Expert Panel review sessions. At this writing, the analysis techniques appear to be thorough and properly applied, and the results appear to be reasonable in light of those methods. It is important that documentation of the analysis be completed in a timely fashion. NRC Evaluation of the Accident Risk Program An important element for ensuring the quality of the QRA is the review by the Army's independent Expert Panel. The Stockpile Committee is satisfied that the Expert Panel is well constituted to perform its role and that meetings are held frequently enough and with sufficient time to provide adequate review. The committee is pleased to monitor the review meetings and have the opportunity to raise technical questions directly with the analysts performing the work. Because this QRA is the first of its kind, the committee would like to see the panel place even more emphasis on possible omissions from the assessment. The committee is especially pleased that the Army and the QRA team are responding thoroughly to issues raised by the Expert Panel. The methods and depth of examination in the QRA appear to be appropriate. Follow-up with detailed engineering analysis and convening expert groups when difficult technical issues arise also appear to be thorough. The committee finds the current risk management process appropriate for resolving issues uncovered by the QRA. When a possible problem with agent-aluminum interaction was identified, the Army responded with additional engineering analysis to determine if the problem was the result of conservative modeling or was a real issue. When calculations could not eliminate concern, modifications to the operating plans and the system were developed to ensure that the chance of damage to the furnace and injury to nearby personnel would be reduced and would represent a very small contribution to total risk. As discussed earlier, the committee has several concerns about the current constituent parts of the TOCDF risk assessment. Foremost among them is the concern that the studies are being performed as separate projects under diverse management with no obvious coordination. Accordingly, the committee believes that a single ''TOCDF Risk Assessment Summary Report" should be published to present integrated results of the studies.