On September 30, 1999, a criticality accident occurred at a uranium processing plant operated by the JCO Company, Ltd. in Tokai village, Ibaraki Prefecture, Japan. This report terms the occurrence as the Tokaimura event, or the Tokaimura accident.

Early information received from public sources reported that the Tokaimura event involved several factors of interest and concern to the uranium processing industry worldwide. Specifically, the criticality resulted in severe exposure to three individuals, involved the public and emergency planning considerations, and involved chemical processes that are in common use worldwide. In addition, the event was technically unusual in that it was of an extended duration, which required active intervention to terminate the criticality.

Senior managers responsible for the operation of commercial uranium processing facilities (facilities) in the United States met with the Nuclear Energy Institute (NEI) during the week of October 4, 1999. They concluded that it would be valuable to conduct on overall review of the facilities using experienced, independent observers in addition to any special or routine reviews done by the individual facilities. NEI was tasked with management of an industry initiative to review all U.S. facilities for susceptibility to the conditions understood to be factors in the Tokaimura event. There was no intention to develop an authoritative evaluation of the Tokaimura event. Rather, the intention was to use the early information available from public sources to develop a comprehensive assessment of U.S. facilities.

NEI discussed the industry initiative with the Nuclear Regulatory Commission (NRC) and with the Administration. Both agreed that the industry initiative was an appropriate response to the Tokaimura event. An expectation was set that the review would result in a publicly available report that describes the Team’s assessment of overall industry conditions in the relevant areas. This report is the fulfillment of that expectation.

The facilities covered by the assessment are the five low enriched uranium (LEU) fabrication facilities owned and operated by ABB Combustion Engineering, Framatome Cogema, Global Nuclear Fuels, Siemens and Westinghouse and the two high enriched uranium (HEU) fuel facilities owned and operated by BWX Technologies and Nuclear Fuel Services. These facilities are licensed by the NRC under 10CFR70. The two gaseous diffusion plants (GDP) owned and operated by USEC, which are certified by the NRC under 10CFR76, were also included. In addition, the uranium conversion facility owned and operated by Honeywell was included at Honeywell’s request. This facility is licensed by the NRC under 10CFR40. A brief description of each of these facilities is included in Appendix A.

The characteristics sought in the experienced, independent observers were focused on management level experience in operations, regulation and the conduct of assessments. After appropriate search and discussion with the facilities, a special assessment team (Team) was formed to conduct the facility review. The Team consisted of Mr. Robert M. Bernero, Mr. John C. Brons and Mr. James R. Clark. Resumes of the individual team members are in Appendix B.

The Tokaimura event involved the relatively infrequent handling of uranium enriched to the intermediate level of 18.8% U235. For U.S. commercial facilities, only the two HEU facilities are licensed for that level of enrichment. All other facilities are limited by their current licenses or certificates to lower enrichment levels. The Team concluded after a review of publicly available information that there were a number of other factors that were significant in shaping the environment for the Tokaimura event to occur appeared to be evident. They are:

1. A culture that permitted deviations from licensed procedures to respond to external pressures such as cost and schedule. At Tokaimura, a set of procedures defining the process involved in the accident was approved during the licensing of the facility. Had these procedures been followed, the likelihood of a criticality would have been substantially reduced. During the licensed life of the facility, pressures to reduce costs led to adoption of management sanctioned procedures that were not in accordance with licensed conditions. The adoption of these procedures reflected a culture that was willing to sacrifice safety and regulatory due process for commercial expediency. At the time of the accidental criticality, the workers in response to schedule pressures employed a further shortcut over the unlicensed procedures, which greatly increased the risk.
2. Tacit approval of procedural deviation by explicit involvement in unlicensed procedures and by routine willingness to deviate from "official" procedures. Management and supervision created the initial set of inappropriate procedures but by practice did not insist that even those procedures be followed. Reportedly, operators frequently employed practices that were deviations from the promulgated procedures. Procedural use evolved to an "ad hoc" situation at Tokaimura.

 

3. An insufficient criticality safety program, lacking appropriate use of the double contingency principle and maximum reliance on engineered controls. The double contingency principle means that a criticality can occur only if two unlikely, independent events occur. Controls to prevent occurrence of such events are typically applied in a hierarchy of preference that values engineered controls over administrative controls. Engineered controls may be either passive or active but in either case are controls that are embedded in process hardware and do not require routine human intervention. Controls involving human intervention are termed administrative. At Tokaimura buckets were authorized in place of process designed vessels to dissolve the U3O8 powder; this eliminated some designed-in mass and geometry control but maintained the use of geometrically safe storage columns. Actual practice avoided the use of the safe geometry storage columns through use of the precipitator tank to accumulate a large batch in a single vessel. Ultimately, the practices in place when the accident occurred avoided mass controls and geometry controls and added in an unfavorable reflection factor.
4. Insufficient administrative controls, including change control, procedures for starting/restarting infrequent operations and configuration management. Review of the Tokaimura event did not indicate any administrative method for management to assure themselves that the procedures in actual use were those that they had sanctioned. It is not clear that the administrative mechanisms provided the operators with a way to know whether or not the procedures in use were authorized either. The event also disclosed that the various changes involved (substitution of buckets, elimination of safe geometry vessels, shift to an operation performed very infrequently) did not receive any special review to ensure that intended safety margins were maintained.
5. Insufficient training to workers on the potential for criticality, the severe consequences of such an event and on adherence to procedures. The actions of the operators indicated that they did not appreciate the impacts of handling material enriched to 18.8%. Results of interviews with the injured workers that were made publicly available indicated that they did not understand what criticality was and that they did not understand that many of the steps they had taken systematically eliminated barriers to criticality. Lacking this understanding, it is not surprising that they felt free to innovate to respond to schedule demands. It is normally expected that the operators actually performing work on the shop floor have experience to guide them in their understanding of procedures. In the case of this accident, neither of the operators had worked with this material before.

 

6. Insufficient oversight, supervision or critical self-assessment, particularly with regard to inexperienced workers and unusual operations. It should be assumed in any organization that there may be times when the work force either misunderstands or for some other reason performs in a way that is contrary to management expectations. This assumption should result in the establishment of programs to oversee operations, to identify deficient equipment and practices, and to establish methods to ensure that effective action results from the observations. Although information regarding JCO’s internal practices was not available to the Team, it was assumed that a robust program of this nature would be a helpful feature to reduce the probability of failure and may not have been a part of routine practice prior to the event.
7. Insufficient instrumentation to monitor the potential for criticality or personnel radiation safety. At Tokaimura initial indications of the criticality were derived from off-site monitors. Worker dosimetry was insufficient to establish actual exposure during the criticality.
8. Inadequate emergency planning measures, particularly with regard to termination of an extended event, timely notification and care of exposed personnel. Communication between the facility and appropriate governmental agencies after the event was very difficult and in some instances, untimely. Actions between governmental agencies were uncoordinated, and termination of the extended criticality was made more difficult by failure to provide prior consideration for such an event. The management of emergency care for the severely irradiated individuals resulted in three moves before they reached a facility properly equipped to treat them.
9. Inadequate regulatory oversight. The regulatory agency associated with licensing of the facility did not conduct regular oversight activities. Visits were infrequent and not focused on licensed operations.

Based on these considerations, the foregoing statements identified in italics defined the scope and focus of the Team’s review. (Subsequent authoritative evaluations of the Tokaimura event did not disclose any additional areas for review.) The Team prepared a document entitled "Assessment of Nuclear Criticality Safety and Emergency Preparedness at U.S. Nuclear Fuel Plants" that provided this information to the industry. The Team also prepared a protocol for conducting the assessment at each of the facilities to ensure uniformity and thoroughness. Both of these documents were delivered to the industry by letter dated November 23, 1999. The documents are contained in Appendix C.

The individual assessments were conducted in accordance with the protocol. Each assessment consisted of off-site preparation by the Team and an on-site visit of 1 ½ days to all facilities except for the two HEU facilities where the on-site visit was two days.

Prior to the on-site visit, the Team requested and received an advance package of information from each site that was used to provide specific background in a number of areas to be reviewed while the team was on-site. In addition, the Team reviewed NRC inspection reports for the two-year period preceding the Team’s visit. These reports were available in the public document room.

The on-site portion of the visit was begun with a management presentation that covered a detailed list of questions and topics included in the protocol document. This presentation was conducted in a highly interactive format as the Team probed the information presented.

Following the management presentation the Team participated in a facility tour consisting of areas of interest from the standpoint of criticality safety and emergency planning. In addition, the Team conducted a number of individual interviews of facility staff, focusing heavily on operators and their immediate supervisors. Where possible the Team spoke to staff from more than one shift.

At the conclusion of the first day, based on its observations and interviews, the Team advised each facility of three or more topics that individual team members would pursue in depth the following morning. The in-depth reviews allowed team members to "pull the string" on key issues to validate observations or view the "details" behind items presented on the first day.

After the in-depth reviews were completed, the Team prepared and delivered a debrief to the facility management.

All uranium processing and fuel fabrication facilities in the United States are regulated by the NRC and committed to the same American National Standards Institute (ANSI) standards regarding the basic criteria for criticality safety. All of the facilities are committed to emergency planning under their specific regulations, 10CFR Parts 40, 70 and 76. The Team believes that these regulations and standards are observed and provide for fundamental safety. The Team was committed to report to senior plant management any conditions of safety urgency that required immediate attention observed during the course of the review. The Team did not observe any such conditions at any of the ten facilities. The Team concluded that the facilities reviewed are operating safely.

The assessment conducted by the Team was focused on nuclear criticality safety and emergency preparedness as defined and limited by contributing factors evident from public information about the Tokaimura event. The basis of the Team’s observation was not the threshold of regulatory compliance or standards compliance that provide an adequate safety baseline but rather a higher standard of "best industry practice."

At the outset of the review process, "best industry practice" was based on the Team’s collective experience. As the review process continued, "best industry practice" became totally grounded in superior performance actually observed in the industry.

Note: Text in italics indicates a contributing factor that appeared to shape the environment for the Tokaimura event. The text in italics is not reflective of the Team’s conclusions at U.S. facilities.

All of the facilities reviewed receive adequate regulatory oversight from the NRC. The regulatory presence varies appreciably from one facility to another. The two HEU facilities have a single resident inspector as well as periodic inspections by NRC headquarters and regional staff. The two GDP have two resident inspectors each, and are frequently inspected by NRC headquarters and regional staff. The five LEU fuel fabrication plants do not have permanent resident inspectors but are periodically inspected by NRC headquarters and regional staff in a consistent pattern with changes to reflect unique conditions such as start-up of a new process. The single uranium conversion plant receives more than adequate regulatory oversight, roughly equivalent to the level applied to a fuel fabrication plant. NRC oversight is responsive to special circumstances such as the installation of new processes or labor disputes.

A healthy, respectful relationship with the regulators was apparent at all of the plants reviewed, especially with the resident inspectors at the four plants that have them. The GDP seem to receive the most intense level of regulatory oversight. The Team recognizes that these very large facilities came under NRC regulation only in the past several years of their very long operating lives, a basis for intense effort to establish the regulatory system under Part 76, unique to these plants. With the management systems now in place at the GDP, the continued intensity of regulation may be disproportionate to risk.

The evolution of NRC’s licensing (and certification) process is evident. There is gradual adoption of ISA and the longer, 10-year license term. The scope and content of license conditions vary from plant to plant. Individual licensees are developing improvements in safety management systems, such as graded criticality safety limits, use of performance indicators, etc. The unique characteristics of these plants, even within a class, pose a challenge for evolution of a balanced regulatory regime that will require a continuing cooperative effort between the industry and the NRC.

The review process brought about by the Tokaimura event provided what appears to be a unique opportunity for a small group of people, the Team, to have full and very cooperative access to all commercial domestic fuel cycle facilities in one relatively short window of time. This was a unique opportunity to conduct a safety review at all of these facilities using the same scope and approach. The Team is quite conscious of the limited scope of its reviews and the short time for conducting each one. The typical review had the Team spending only about 15-20 hours in each plant. Nevertheless, this unique opportunity has enabled the Team to form some observations and conclusions that go beyond the scope of the review process itself. These additional observations are offered by the Team, conscious of our limitations, in the hope of providing further value to the ten facilities and to the NRC.

Portions of the industry were once a monopoly; the government run GDP were at one time virtually the only source of uranium enrichment. Other portions have long been independent competitors. The former monopoly portions are now challenged by available product from new sources, imposing competitive pressures where none previously existed. The competitive portions are participating in a global consolidation effort that provides new pressures. Overall, the industry is of strategic interest to the country. The time of transition is one for caution and clear focus on fundamentals.

Proprietary considerations have caused the facilities to be very guarded in sharing operating practices. To some extent that notion is reinforced by various securities and exchange rules in effect in the present context because of merger and acquisition activity. This report refers to a number of "best practices." It is interesting to note that each facility visited contributed in some way to the best practices mosaic. The Team believes that the best practices cited in this report do not have anything to do with proprietary processes.

The Team believes that competition, consolidation, efficiency, safety and the strategic national interest will be served well if the facilities can find some way to share best practices and permit benchmarking in ways that do not betray proprietary interests.

The fuel cycle facilities reviewed cover the front end of the nuclear fuel cycle from the receipt of natural uranium oxide (U3O8) at the conversion facility to the shipment of completed fuel assemblies to the reactor users.

The conversion facility converts the natural U3O8 to natural UF6; it does not handle enriched uranium (SNM). Although no risk of criticality exists, this facility was included in the review at its request because the chemical risks involved require emergency plan considerations. The other nine facilities accomplish the enrichment process, production of enriched uranium oxide powder, formation of the powder into ceramic pellets, loading of the pellets into fuel rods and, finally, assembly of the fuel rods into completed fuel assemblies for use in reactors. Facility product from the enrichment plants is typically in the form of UF6. Fuel fabricators may deliver product in powder, pellet or fuel assembly form. All must maintain careful batch control for the enrichment assay to meet customer specifications and to maintain close Material Control and Accounting (10CFR Part 74).

The fuel fabricators often hold substantial batches of material in interim storage for product blending and control. Product assay and quality receive great emphasis, as they should, but it takes additional effort to maintain comprehensive quality assurance for management and operations. These facilities are each a part of a worldwide network of nuclear fuel production that requires careful accounting for the condition of the supply materials received and the products shipped, as well as the containers used. The UF6 and other products must be shipped in certified containers that require close surveillance and testing to meet requirements.

The processes at these facilities are both chemical and physical. The conversion plant uses a chemical process to convert oxide to the UF6 form. The enrichment plants use a physical process of pumping for pressurized selective diffusion of the UF6 gas. The fabrication plants use chemical processes to produce the enriched oxide powder from the UF6, and a succession of mechanical processes thereafter. Many of these mechanical processes are highly automated and, when viewed step-by-step, are relatively simple. Human involvement at any given stage tends to deal with a focused, repetitive portion of the process and is provided mainly for safety oversight, quality oversight, dealing with process upsets and handling of process input and output materials.

The principal accident risks at the conversion plant lie with potential release of large quantities of hazardous chemicals. At the enrichment plants, the hot UF6 gas reacts vigorously with water, even moisture in the atmosphere, releasing hazardous chemicals, HF and UO2F2. If the UO2F2 particulate collects in one place, a critical mass may form. Criticality is avoided at these plants by controlling the size of the cylinders used to hold the UF6, by controlling the possible buildup of deposits within the enrichment process and by avoiding collection areas where accidental UF6 releases might collect. The fuel fabrication plants have risks associated with both the failure of the chemical processes and the possibility of criticality accident with large quantities of material in interim storage or the possible collection of process scrap residues to form a critical mass. Considering these risk characteristics and the layout of these plants, in the Team’s view, risk to the off-site public is low, and is typically process or chemical risk. The principal risk at these facilities is to the on-site workers, radiation risk mostly from accidental criticality and process safety risk mostly from chemical hazards. The harmful range of radiation from an accidental criticality is so limited that such an emergency can be managed at the site without major off-site protective measures. The risk profile is distinctly different from that of a nuclear reactor where risk to the off-site public from radioactive releases is the dominant concern.

The Team was surprised to find an apparent tendency to manage and to regulate these facilities as similar to reactors by both the management and the NRC. On the facility side, the Team observed emulation of reactor programs in administration of training and qualification, intentions for the use of procedures and elsewhere. On the regulatory side, the Team observed evidence of regulatory initiatives apparently modeled on reactor programs, such as the development of standard performance indicators. The regulatory process for these facilities is evidently evolving. The ISA is being introduced; license terms and application sequences are changing. Major licensee performance evaluations are being conducted by the NRC. Yet some of the licenses are still laden with special conditions as they were in the past. These license conditions are not always consistent. For example, some licensees are required to obtain a periodic external audit of their criticality safety program, while others are not. The direction and basis for risk informed regulation of these facilities is not yet clear. There is, however, a clear opportunity for the industry and the NRC working together to enhance the regulatory paradigm as the NRC moves into risk informed regulation in the fuel cycle area.

In the Team’s view, it is important that the facilities be recognized and treated as they are, unique facilities with low and unique risk profiles. Expectations and programs should be directed at the realities of the processes being employed. Efficiency and safety will both be enhanced if the imposition of elaborate measures better suited to other enterprises is avoided. As much as each of these facilities is similar to the others, it is also sufficiently unique so that few "one size fits all" solutions are applicable.

The Team did not observe any conditions during the course of its reviews or on-site visits of safety urgency requiring immediate attention.

During the course of its review the Team observed a number of instances at each facility where actual performance fell short of management expectations or of a standard that would be described as best practices. In each instance, the Team provided its observations to the facility involved for its consideration and potential resolution or adoption. Similarly, as previously noted, each facility visited contributed in some way to the virtual mosaic which ultimately could be described as the "Best Practice" facility. Shortcomings and strengths considered, the Team did not encounter any deviation, practice or condition that compromised the nuclear safety of the facility.

Throughout its review process the Team observed a common belief on the part of the regulators, the managers, the engineers and the operators that a criticality is possible and that it can happen "here." This is a positive contribution to continuing safety.

The prevailing view at the outset of this review was that the fuel cycle industry in the United States was regulated and operated on a firm safety foundation. Within the scope of its review as developed by a focus on the perceived contributing factors to the accident at Tokaimura, the Team affirms that view.