GCPS 2013 __________________________________________________________________________

Process Safety Considerations for New DOE Depleted Uranium Hexafluoride Conversion Plants

Peter M. Burban, Ph.D. Department of Energy Portsmouth Paducah Project Office Peter.Burban@lex.doe.gov

Prepared for Presentation at American Institute of Chemical Engineers 2013 Spring Meeting 9th Global Congress on Process Safety San Antonio, Texas April 28 May 1, 2013 UNPUBLISHED

AIChE shall not be responsible for statements or opinions contained in papers or printed in its publications

GCPS 2013 __________________________________________________________________________

Process Safety Considerations for New DOE Depleted Uranium Hexafluoride Conversion Plants
Peter M. Burban, Ph.D. Department of Energy Portsmouth Paducah Project Office Peter.Burban@lex.doe.gov Keywords: depleted uranium hexafluoride, dry conversion, fluidized bed, uranium oxide, hydrofluoric acid, layers of protection, independent safety system, defense in depth, basic process control system, HF detectors, passive safety systems, Department of Energy

Abstract
The Department of Energy (DOE) OH & KY depleted uranium hexafluoride (DUF6) facilities are first of a kind operating plants designed to convert DUF6 into a safer form for reuse and/or disposal. Safety played a lead role in process design with HAZOP results guiding implementation of layers of protection to reduce risks associated with several materials including UF6, H2 and HF. A stand-alone independent safety control system functions to provide independent monitoring and control capability for those processes that have significant safety considerations.

1. Introduction
The Department of Energy Piketon, OH and Paducah, KY DUF6 facilities, Figure 1, are new fluid bed operating plants designed to convert approximately 700,000 metric tons of depleted uranium hexafluoride into a safer form for reuse and/or disposal. Depleted uranium hexafluoride has been generated in the United States since the mid-1940s as a byproduct of enriching uranium for both civilian and military applications at three gaseous diffusion plants located near Oak Ridge, Tennessee; Paducah, Kentucky; and Piketon, Ohio. This paper will highlight important process safety design considerations implemented that are critical to ongoing operations. Key aspects of the process hazards analysis and some lessons learned will be shared regarding chemical hazards associated with HF.

GCPS 2013 __________________________________________________________________________

Figure 1. Portmouth (top) and Paducah DUF6 facilities

2. DUF6 Conversion Process and Safety Considerations

2.1 Process Description The source DUF6 material, stored at both plants in approximately 63,000 large steel cylinders, is fed direct from the storage cylinders. A DUF6 feed cylinder, heated in a specially designed autoclave, vaporizes DUF6 which is fed with steam and hydrogen, blended with nitrogen, to a high temperature fluidized bed reactor for conversion to uranium oxide powder and hydrofluoric acid vapor. Some elements of the chemical process are described by Urza [1] and a general schematic of the process is given on the internet [2]. The uranium oxide powder transfer system loads powder into modified feed cylinders. The HF recovery system condenses the water and HF vapors in the process offgas, producing aqueous HF acid which is temporarily stored in tanks and later loaded for shipment to HF vendor facilities. The environmental green aspects of this approach include reuse of the feed DUF6 cylinders, regeneration of KOH used in scrubber operation and recovery of aqueous HF for commercial sale. 2.2 Overall Process Safety A major safety advantage of the conversion process is low pressure reactor operation. The dry conversion process uses superheated steam and nitrogen diluent to ensure safe reactor hydrogen concentrations. Administrative control of the feed cylinders ensures only depleted UF6 is processed, eliminating any nuclear criticality event.

GCPS 2013 __________________________________________________________________________

Hazard evaluations were performed to develop accident scenarios with the potential for exposure to HF, the greatest chemical hazard. Unmitigated consequences and risks were estimated for the credible events and compared to DOE risk guidelines. This paper focuses how safety significant engineered features and administrative controls are integrated in layers of protection to prevent or mitigate accidents associated with the major HF risks [3]. An Integrated Control System (ICS) controls and monitors the facility automated systems and associated components during normal operations. The system also mitigates accidents involving the conversion process and any of the systems or activities that have an interface with the process. The ICS consists of BPCS (Basic Process Control System) and ISS (Independent Safety System) subsystems. The purpose of the BPCS is to provide monitoring and control for normal operations from the Control Room and/or local operator workstations. The purpose of the ISS is to provide independent monitoring and control capability for those processes that have significant safety considerations. The ISS does not rely on the ISS human machine interface or BPCS to perform interlock actions.

3. Safety Features
3.1 Feed System Safety Features

A major component of the feed system is the autoclave, which serves to vaporize DUF6. The autoclave also serves as a pressure containment boundary (at several multiples of the supply pressure) to mitigate the consequence of an accidental release of DUF6 from a breached feed cylinder/piping in the autoclave. Since UF6 reacts with atmospheric moisture to generate HF vapor, both HF and UF6 releases have similar hazards classifications. In the event of an over pressurized autoclave leading to activation of the pressure relief, the vent gases are directed to a controlled plenum. Automatic interlocks shut off DUF6 flow and/or electrical power to the cylinder heating system for an autoclave high pressure condition, as well as the following abnormal operating conditions: cylinder overtemperature, DUF6 header high-pressure, and an open autoclave door. The ISS monitors UF6 and HF detectors located in the autoclave room which, upon alarm, terminate DUF6 flow to the downstream piping via an autoclave isolation valve. Additional administrative controls lead to shutdown of the reactor system. These layers of protection provide defense in depth to reduce worker exposure from an abnormal UF6 feed cylinder/system release. 3.2 Reaction System Safety Features

Each reactor serves as a primary containment boundary for reactants and products including DUF6 and HF. The ISS monitors UF6 and HF detectors located in the reactor system room and adjoining HF condenser room which, upon alarm, terminate DUF6 flow to the downstream piping via the autoclave isolation valve. The BPCS in-line process

GCPS 2013 __________________________________________________________________________

oxygen monitors alarm on detection of oxygen in the process off gas. Additional administrative controls lead to shutdown of the reactor system. Upon significant UF6 or HF leak detection, specific administrative controls instruct control room operations to terminate hydrogen flow via an automatic hydrogen feed isolation valve (a redundant manual isolation valve is also closed). Additional administrative controls lead to shutdown of the reactor system. These layers of protection provide defense in depth to reduce worker exposure resulting from breach of the reactor system. 3.3 HF Recovery System Safety Features

Off gases from each reactor pass through individual partial condensers which produce an aqueous HF stream collected in individual primary receivers located in the HF recovery room. Off gases continue flowing to first a water and then to a KOH scrubber. All scrubber outlet streams merge and flow to a final backup KOH scrubber prior to venting out the facility stack. Multiple scrubbers reduce the likelihood of stack HF emissions. A secondary overflow HF receiver for each primary mitigates primary receiver level control problems. The HF recovery system units are skid mounted and reside in a common secondary containment dike mitigating the effect of HF leaks. The ISS monitors several HF detectors located in the HF recovery room which, upon alarm, terminate DUF6 flow to the specific reactor via the autoclave isolation valve. The ISS also monitors HF detectors located in the HF recovery area for HF leaks in the HF transfer line which, upon alarm, terminates flow from the HF receiver tanks. Upon significant HF leak detection, specific administrative controls instruct control room operations to terminate DUF6 and hydrogen flow via an automatic hydrogen feed isolation valve (a redundant manual isolation valve is also closed). Additional administrative controls lead to shutdown of the reactor system. These layers of protection provide defense in depth to reduce worker exposure resulting from breaches in the HF recovery system. An important series of lessons learned include proper maintenance of HF process lines to eliminate chronic leaks. In addition, care was taken for stress relief of all piping flange connections, and modifications were made to address piping areas experiencing vibration. The use of HF vapor highly sensitive paint was helpful to identify the onset of leaks. Additional isolation valves were installed to improve the safety and ease of corrective maintenance. 3.4 HF Storage Tank Farm Safety Features

The HF storage area includes several passive, active and administrative safety controls. Each HF storage tank is situated in a secondary liquid dike that can hold the entire capacity of the 10,000 gallon tank in case of a leak. The tanker truck and rail loadout areas have a gravity drain equipped with a pumping system to transfer spilled HF to

GCPS 2013 __________________________________________________________________________

either a containment dike or a storage tank. This minimizes the spill area to reduce the potential on and off site consequences of an HF leak. The ISS also monitors HF detectors located in the HF storage area which, upon alarm, terminates flow via the HF storage tank automated isolation valve. In addition, the ISS terminates HF flow from the HF receiver tanks. Specific administrative controls instruct an operator to be in required attendance for all transfers. This operator observes each HF storage tank to mobile tanker transfer and can terminate the transfer via an emergency button which stops HF transfer flow even before HF detection by the ISS. Upon alarm, following administrative control, the operators in the control room isolate the HF recovery system and then shutdown the reactor system. These layers of protection provide defense in depth to reduce worker exposure resulting from leak accidents at the HF storage tank system. 3.5 Additional Safety Features

Several fire suppression systems minimize the likelihood of a fire causing a cylinder breach and release of HF and/or DUF6. Strategically placed vehicle barriers add defense in depth to reduce consequences associated with collision with storage tanks and staged feed cylinders. Safety design elements were also incorporated for natural event accident initiators so that process buildings and equipment meet design criteria for forces such as seismic and high winds. Safety management requires the use of appropriate personal protection equipment for all work activity with potential HF exposure. These layers of protection provide defense in depth to reduce worker exposure resulting from HF leak accidents in various systems described above.

4.

Discussion

The process safety approach at the DUF6 facilities blends active, passive and specific administrative controls. Considering the other chemical and radiation hazards at the facility, the ability to maintain a safe operation depends on reliable machines and human performance of required operator actions. A rigorous preventative maintenance program is administratively controlled to maintain the reliability of all active safety systems at the facility in line with DOE safety requirements. The Integrated Safety Management Program at the DUF6 facility includes systematic approach to training for Operations. Training includes preparing each individual with the toolbox needed to address all specific administration controls, responses to alarms and recovery from abnormal operating conditions. Monitoring of human performance is an essential element for maintaining safe operations and continuous improvement. Major facility start up challenges included accurate procedure development and updates, initial training and continuous training as the Operations knowledge base grew. Unique

GCPS 2013 __________________________________________________________________________

lessons were learned for operations in the four season climates of Ohio and Kentucky, necessitating adaptation of procedures, and emphasis on minor equipment changes to minimize the need for corrective maintenance. Both sites have had a good start to their multiple decade operations campaigns built on the cornerstone of a defense in depth process safety approach.

5. References
[1] [2] [3] Urza, Inaky J., Conversion of uranium hexafluoride to uranium dioxide US Patent 4,830,841 The DUF6 Process, www.bwconversionservices.com, accessed on Feb. 11, 2013 DOE, Final Environmental Impact Statement for Construction and Operation of a Depleted Uranium Hexafluoride Conversion Facility at the Portsmouth, Ohio, Site, DOE/EIS-0360, prepared by Argonne National Laboratory for U.S. Department of Energy- Oak Ridge Operations, Office of Environmental Management, Oak Ridge, Tenn. June 2004. energy.gov/nepa/downloads/eis-0360final-environmental-impact-statement