Write a half-page summary and in no more than a half page, list at least three things that were clearly wrong and provide a suggestion on how to mitigate each .

NRC REVIEW OF THE

TOKAI-MURA CRITICALITY

ACCIDENT

APRIL 2000

DIVISION OF FUEL CYCLE SAFETY AND SAFEGUARDS

OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS

US NUCLEAR REGULATORY COMMISSION

NRC REVIEW OF THE TOKAI-MURA CRITICALITY ACCIDENT

1. INTRODUCTION

The Nuclear Regulatory Commission (NRC) staff reviewed the available information, on the September 30, 1999, criticality accident at the Tokai-mura fuel cycle facility, to identify lessons learned that could be applied to U.S. commercial fuel facilities, and to determine whether improvements in the NRC’s existing safety oversight programs were necessary.

2. SUMMARY:

The NRC staff agrees with the Government of Japan’s conclusion that the general root causes of the accident were: (1) inadequate regulatory oversight; (2) lack of an appropriate safety culture; and (3) inadequate worker training and qualification. The staff was able to identify one or more elements in NRC’s regulatory oversight program that would have prevented the identified deficiencies from occurring if they had been in effect at the time of the accident. Based on the review the staff determined that the current NRC oversight program at commercial U.S. nuclear fuel fabrication, conversion and enrichment facilities makes a similar accident unlikely, and no revisions to NRC’s oversight program are needed as a result of the lessons learned.

3. BACKGROUND:

The staff reviewed the official reports from the Japanese regulatory authorities and other groups, including:

• Nuclear Safety Commission’s (NSC) “Urgent Recommendations - Interim Report,” dated November 5, 1999.

• NSC provisional translation entitled “A Summary of the Report of the Criticality Accident Investigation Committee,” dated December 24, 1999.

• International Atomic Energy Agency’s (IAEA’s) “Report on the Preliminary Fact Finding Mission Following the Accident at the Nuclear Fuel Processing Facility in Tokai-mura, Japan,” conducted on October 13 - 17, 1999.

• U.S. Department of Energy (DOE) Trip Report, dated February 29, 2000.

Additionally, staff members obtained information provided by the STA at the October 12, 1999, NEA Steering Committee Meeting, by the Japanese Atomic Energy Research Institute (JAERI) and at the IAEA’s International Nuclear Safety Advisory Group meeting on March 1, 2000, and at other meetings, such as the American Nuclear Society Winter Meeting in November 1999.

Attachment 1

2

The Japanese government reports provided a detailed chronology of the event and the emergency response actions taken by the Japanese government. Briefly, the event involved dissolution of over 16 kilograms (kg) of uranium oxide enriched to about 18.8 percent U-235 in several 2.4 kg batches and their subsequent addition into an unfavorable geometry vessel (precipitation tank). This action resulted in a high concentration of U-235 that was sufficiently moderated for the geometry of the vessel to achieve and sustain a quasi steady-state nuclear chain reaction for about 20 hours after the initial pulse. The actual processing operation violated the operating procedures that were required and approved by the regulatory authorities. Because there are indications that the company developed multiple sets of procedures to increase production efficiency without obtaining the approval of the regulatory authorities, the Government of Japan has initiated a criminal investigation.

For reference, the seven enclosed figures (figures 1-6 are from the IAEA Report) show: (1) the location of Tokai-mura; (2) the 10 kilometer zone around the site; (3) the site layout; (4) the conversion building at JCO; (5) the uranium processing flowsheet; (6) a diagram of the precipitation vessel; and, (7) a table of the doses to workers and members of the public.

4. ACCIDENT CONSEQUENCES

The three operators who were nearest to the precipitation tank in the Conversion Building at the time of the accident received estimated radiation doses of 1-4.5 gray equivalent (GyEq), 6.0-10 GyEq, and 16-20 GyEq. The first operator (supervisor, most distant from the precipitation tank) has been released but is under medical supervision; the second operator is still in the hospital; and the third operator died on December 21, 1999. A briefing by the JAERI indicated that the 24 JCO workers involved in recovery operations to terminate the criticality received individual doses up to about 48 millisieverts (mSv). JAERI also estimated that a total of 436 persons, including local residents, were exposed to radiation from the accident (mostly below 50 mSv).

The IAEA fact finding mission concluded that the accident did not involve widespread contamination of the environment and that there was little risk off site once the accident was brought under control. The team further concluded that the accident was essentially an “irradiation” accident and not a contamination accident, because it did not result in a significant release of radiological material. Only trace amounts of noble gases and gaseous iodine escaped from the building. The Japanese government noted that the gaseous releases caused exposure rates at site boundary that totaled only about several micro Gy/h for only a brief period of time and that the level of each radionuclide found in the environment after the accident was very insignificant. The Japanese government concluded that the release did not affect public health or the environment.

Notwithstanding the above, the accident did have substantial psychological and economic impacts on the local population. During the accident, about 310,000 people were ordered to remain sheltered and residents living within 350 meters of the facility were evacuated. News sources report that JCO expects to pay at least $93 million in compensation to nearby residents and businesses.

3

5. NRC REVIEW OF THE GENERAL CAUSES

The staff agrees with the conclusions drawn by the investigations conducted by the Government of Japan that there were three general root causes involved with the Tokai-mura criticality accident: (1) inadequate regulatory oversight; (2) the lack of an appropriate safety culture at the JCO facility; and (3) inadequate worker training and qualification. Each general root cause is discussed below.

1. Regulatory Oversight

The regulatory oversight program for the Tokai-mura fuel processing facility failed to establish and maintain an adequate safety margin. The licensing review incorrectly concluded that there was “no possibility of criticality accident occurrence due to malfunction and other failures.” Consequently, no criticality accident alarm was required or installed and the facility was not included in the National Plan for the Prevention of Nuclear Disasters. This conclusion relied heavily on the use of administrative controls that were subject to human error.

The resultant belief that a criticality accident was not credible complicated the recovery process. First, there was initial confusion as to whether a criticality had occurred, followed by further uncertainties as to whether the system was still in a critical state. This may have led to three emergency workers receiving an unplanned exposure during their response to the event and, under slightly different circumstances, could have led to recovery personnel being exposed to any subsequent criticality pulses that could occur. Secondly, since the fuel processing facility was not included in the National Plan for the Prevention of Nuclear Disasters, there was a significant delay in development and communication of emergency protection measures for the public. Several workers at a nearby lumber yard were not told to evacuate the area until approximately 3:00 p.m., although the event began at 10:30 a.m., and officials knew that the system was still critical and causing significantly elevated exposure rates near the facility.

In addition, the regulator did not conduct periodic inspections of this process to confirm that it was being operated safely and in accordance with the regulations. In 1997, an opportunity was missed to correct this flaw following a fire and chemical explosion that occurred in another nearby nuclear facility. At that time, the regulator decided that it did not need to conduct any inspections at the JCO facility because there had not been any reportable events. Lack of an independent inspection program resulted in the regulator not having an early indication of developing adverse performance trends and emerging problems at the facility.

2. Safety Culture

In the Japanese regulatory framework, as in NRC’s, the licensee is ultimately responsible for the safe operation of nuclear facilities. Deviations from the approved operating procedure began to occur several years before the company developed a second operating procedure for use. That second operating procedure was approved by the manufacturing and quality assurance divisions without the review and approval of the safety management division. This was apparently done to improve production efficiency.

4

Company spokesmen stated to the media that they did not submit this second operating procedure to the regulator because the company knew that the regulator would not approve it. Within the year prior to the accident, company profits dropped significantly because of competition, and the company laid off about one-third of its work force. Subsequent to the layoff, the company received an order for the 18.8 percent enriched speciality fuel, which is produced in small amounts on an infrequent basis, and the company was under pressure to meet the order schedule.

Because of the infrequent use of this special process and the recent layoffs, there were no experienced operators available to operate the system. The operators either did not know or did not heed the unique safety limits applicable to this process because it involved uranium enriched to 18.8 percent U-235. Furthermore, there was no procedure verification and validation process nor were there operator training and qualification checks required by management before authorizing restart of a process that had not been operated for about 3 years. In total, these company actions represent a significant lack of a safety culture. As a result of the accident, the regulator revoked JCO’s business license.

3. Worker Training and Qualification

If the operators would have been given the fundamental safety knowledge that certain actions could result in a criticality, this event, in all likelihood, would not have occurred because the operators would have understood the importance of adhering to the safety limits for the process. The training should have stressed the safety controls for this process to protect against inadvertent criticality.

The philosophy of the regulator was that the system was safe if it was operated in accordance with the approved procedures. In addition, the company did not believe that a criticality accident was a credible event and there were no specific operator training requirements for criticality safety. The operators were also allowed to deviate from the approved procedures to improve production efficiency. Had the operators understood the difference between the safety limits for the 3-5 percent enriched uranium that they usually handled, and the 18.8 percent enriched material involved with this process, they likely would not have taken the shortcuts that resulted in the criticality. The people most vulnerable to the consequences of a failure to implement significant safety controls must be provided with the appropriate safety information.

6. ROOT CAUSES IDENTIFIED BY THE JAPANESE REGULATORY AUTHORITIES AND NRC REVIEW FOR APPLICABILITY TO U.S. COMMERCIAL FUEL CYCLE FACILITIES

The NSC Investigation Committee identified seven major root causes of the accident. The staff reviewed each item for applicability to U.S. commercial fuel fabrication, conversion, and enrichment facilities and the NRC oversight program as follows:

1&2. The workers exceeded the mass safety limit for the precipitation tank because the operational procedure used was not appropriate.

5

Both the mass and concentration limits were exceeded for the precipitation tank because of a number of human factors. The operation was conducted in violation of the approved safety procedures. The operational procedures actually used by the operators had not been reviewed by the safety division or the Japanese regulatory authorities to assure that it could be performed as written or that it would maintain the required criticality safety controls. Apparently, there was no review and approval process provisions for verification and validation of the procedure to assure that the procedure could be performed as written and that the operators interpreted the procedural steps in a manner consistent with the plant’s safety function. There was no hardware failure that contributed to this event. Had the system been operated as designed, the criticality accident would not have happened. The Government of Japan initiated a criminal investigation for possible wrongdoing.

Based on the NRC staff review, the NRC determined that the licensing and certification regulations in 10 CFR 40.32, 70.22, and 76.35 require use of procedures to protect health and to minimize the danger to life or property. These provisions are further defined in specific license commitments and requirements to ensure the safe processing, handling and storage of licensed material. The NRC licensing process includes an NRC determination that each licensee is capable and committed to control operations through development, review, control, and implementation of written procedures, which will protect the workers, the public and the environment. Staff guidance is contained in draft NUREG- 1520, “Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility,” Section 11.4, Procedures. Further, independent NRC inspections are conducted routinely during start-up and operations according to the provisions of NRC Inspection Manual Chapter 2600. Applicable fuel cycle inspection procedures contain requirements for inspectors to review operator knowledge and adherence to plant safety procedures, and the licensee’s procedure review and control process, including the internal oversight activities by the Safety Review Committee.

The NRC requirements also address (1) posting of notices to workers for raising safety concerns (NRC Form 3, “Notice to Employees,” is required by 10 CFR 19.11 to be prominently posted at each site), (2) deliberate misconduct at fuel cycle facilities (10 CFR 40.10, 70.10 and 76.10), (3) and whistle blower protection (10 CFR 40.7, 70.7 and 76.7). The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

3. There was a breakdown in the operational management of field operations and supervisory oversight and approval of liquid transfers.

Plant management failed to provide the workers with the appropriate education and training, and to rigidly enforce the material transfer authorization requirements (criticality safety requirement). Consequently, the safety controls provided by implementation of the “double-contingency principle” were compromised and lost.

The NRC analysis provided under Root Cause 1 also applies to Root Cause 3. In addition, training and qualification requirements for NRC fuel cycle licensees are found in 10 CFR 19.12, 40.32, 70.22, and 76.35, and require license applications to describe the technical qualifications, including training and experience of the key personnel. Training

6

and qualification requirements for personnel who handle licensed material are found in the licenses. Site-specific criticality safety requirements to meet the double-contingency principle, including any supervisory authorization of material transfer operations, are developed by the licensee’s criticality safety program and flow down through approved postings and procedures. Specific license requirements address the use of approved procedures for all activities involving the handling, storage and processing of licensed material. Implementation of these requirements is a management function and is reviewed by NRC during licensing review and as part of the core inspection program. The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

4. There was a failure to establish the proper technical management control over the preparation and approval of technical manuals and instructions.

The original manual (operational procedure) approved by the regulator was adequate to ensure safe operations. The unapproved revision developed by the company was internally reviewed and approved by the manufacturing and quality assurance divisions, but not the safety management division. It is also apparent that operators departed further from the revised procedures as the operators tried to be more efficient in response to financial pressures felt throughout the company (one-third of the workforce had been laid off within the past year due to budget reductions-necessitated by foreign competition). It is not clear at this time whether senior site management was aware of these deviations from approved procedures. The government of Japan has initiated a criminal investigation into the accident. However, NSC did note that the internal and parent company audits have been ineffective. Altogether, the company failed to establish an adequate safety culture at the facility.

The NRC licensing review process ensures the adequacy of the procedure development, review, and approval process, including safety reviews by the criticality safety function. License provisions also include internal and external audits of facility operations as a quality element of the licensee’s safety management program (see draft SRP Section 11.5, “Audits and Assessments,” for the program acceptance criteria). The core inspection program described in MC 2600 reviews both the implementation of various procedures and activities in the field and also reviews the licensee’s audit and assessment programs. NRC inspection findings are periodically aggregated and reviewed for each fuel cycle licensee per Manual Chapter 2604, “Licensee Performance Review,” to provide an overview of the licensee’s performance and to provide a basis for adjusting the NRC inspection program focus. The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

5. There was inadequate business management control of the operations performed in the nuclear fuel processing building.

The company did not pay full attention to the process involved in the accident because it involved the small-scale manufacture of a specialty product on an infrequent basis. The fuel for the JOYA breeder reactor was last produced at the JCO site about 3 years before the event. Of the three operators involved, two had never operated this process, and the third had only had several months of experience. No other safety oversight or

7

management restart authorization reviews of the JOYA fuel production run were required or conducted. It should be noted that the accident occurred with the first production run of the process to fulfill the new order. This is another indication that there was not an appropriate safety culture established at the facility, especially for non-routine operations.

Each license issued by the NRC defines the authorized activities. Any significant changes to those authorized activities require NRC approval before implementation. For example, one NRC licensee who predominately processes HEU in solution form requires NRC licensing approval before the restart of processes that have been shut down or inactive for more than 2 years. The NRC has typically conducted multi-discipline operational readiness reviews of those processes as part of its startup approval process under Manual Chapter 2601, “Team Assessments of Fuel Cycle and Materials Licensees.” Regardless of when a process was last run, all fuel cycle licensees that process quantities of special nuclear material greater than critical mass quantities are required to operate with appropriate criticality controls in place. The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

6. The [regulatory authority’s] licensing procedures did not result in an adequate safety review.

The re-dissolution process did not receive an adequate safety review by the regulatory authority in that it did not identify normal system operational conditions, possible deviations from those conditions, the consequences of potential accidents, and the impact of the maximum credible accident.

NRC license applications are reviewed in accordance with the draft SRPs (NUREG-1520 and NUREG-1671) and the staff issues a safety evaluation report that documents the basis for the staff’s conclusion that a facility can be operated safely and in accordance with NRC requirements. The license review process assures that licensees establish a process to conduct criticality safety evaluations and maintain the evaluations up to date. Additionally, licensees are required to evaluate credible upset conditions and accidents and establish appropriate emergency plans if the projected off-site consequences exceed defined limits. These emergency plans are also reviewed as part of the licensing process (see SRP Section 8, “Emergency Management,” for acceptance criteria) and are inspected as part of the core inspection program. NRC staff compared the accident at Tokai-mura with design basis accidents used by NRC licensees to evaluate the safety of operations and plans for responding to emergencies (cf. Nuclear Fuel Cycle Facility Accident Analysis Handbook, NUREG/CR-6410). Based on the comparison, the staff concluded that the Tokai-mura accident was bounded by the design basis accidents used for licensed fuel cycle facilities. The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

7. The regulatory authorities failed to perform adequate oversight to ensure compliance with

the safety rules.

Before this event, the operator and regulator believed that a criticality accident could not happen at this type of facility. The safety review determined that there was “no possibility of criticality accident occurrence due to malfunction and other failures,” and no criticality

8

accident alarm was required or installed. Further, the regulator had not conducted any inspections since 1992, when resources were redirected toward other priorities. No routine or periodic inspections were performed following startup of the facility. As a consequence, the regulator had no established mechanism to monitor the facility’s performance or to provide a timely warning of pending performance problems or developing adverse performance trends.

Each NRC licensed facility is periodically inspected in several functional areas, including operations and criticality safety (the U.S. conversion facility does not receive a criticality inspection because it only processes natural uranium). Criticality accident alarm systems are required by regulation (10 CFR 70.24 and 76.89) and periodically inspected by NRC as part of the core program. Both announced and unannounced inspections are conducted and the inspection findings are periodically reviewed as part of the Licensee Performance Review process. NRC develops a Master Inspection Plan to schedule the inspections and provide any focused inspection activities specified in the Licensee Performance Reviews. In addition, reactive inspections are conducted as warranted, to follow up on reportable events (including those reported under Bulletin 91-01). The NRC staff believes that no changes to the NRC oversight program are required to address these root causes.

7. EMERGENCY RESPONSE ISSUES

The NSC Investigation Committee identified several areas for improvement in emergency response, including:

1. No existence of a criticality accident alarm system.

The report notes that the effects of the accident were increased because of the extended time required by the responsible officials to determine whether the criticality accident was still ongoing or had been terminated.

NRC requires criticality accident alarms at fuel cycle facilities in 10 CFR 70.24 and 76.89. Operability and performance of these systems are periodically checked by each licensee (detector actuation tests are preformed at least annually and alarms are generally tested on a monthly frequency). In addition, NRC routinely inspects the criticality accident alarm system on an annual frequency as part of the NRC core inspection program (IP 88020) to confirm that appropriate alarm set points are maintained and that the licensee has performed maintenance and testing for the entire alarm system.

2. Timely communication of recommendations to local residents.

JCO made its first report of the accident at 11:19 a.m. on September 30, 1999. However, local authorities did not take action to evacuate the local residents until about 3:00 p.m. on that date.

NRC requires the immediate reporting (within one hour) of any accidental criticality (10 CFR 70.52 and 76.120) to the NRC Emergency Operations Center. In addition, licensees are required to develop emergency plans per 10 CFR 70.22(i) and 76.91 that

9

include commitments and descriptions of the means to promptly notify offsite response organizations and coordinate emergency actions (see SRP Chapter 8 for acceptance criteria in NUREG-1520). Licensees also conduct periodic drills with local emergency organizations and invite the state and local governments to participate to practice and maintain response capability, and drill critiques are held to identify areas for improvement. The NRC core inspection program periodically reviews the licensees’ emergency response program commitments, including those for event reporting and notification.

3. Interface roles between the national, local and municipal governments.

The National Emergency Preparedness for Nuclear Disaster Law in Japan did not include fuel fabrication facilities, such as the JCO plant. Consequently, difficulties were experienced regarding the communication of general information to the public. The mayor of Tokai-mura recommended evacuation of the local residents without the benefit of guidance or advice from the central and prefectural governments. A number of other interface problems occurred that could have been surfaced and resolved through the conduct of routine drills.

NRC licensee emergency plans contain provisions for notification of off-site authorities in the event of a site emergency. Regulatory Guide 3.67, “Standard Format and Content for Emergency Plans for Fuel Cycle and Materials Facilities,” provides guidance on the information to be included in emergency plans. Specific topics include the classification and notification of accidents, provisions for local offsite assistance to the facility, and coordination with participating government agencies. It is the responsibilities of the local and state authorities to make appropriate evacuation or sheltering recommendations to the public.

Licensees develop implementing procedures from the site-specific emergency plans, and conduct periodic drills in accordance with the commitments contained in the license conditions. Specific agreements for obtaining offsite emergency assistance are formalized through letters of agreement. Biennial drills are conducted whereby the local and municipal government organizations are invited to participate in order to exercise the interface roles and communications links between the licensees, national, local, and municipal governments.

NRC inspects licensee emergency preparedness at fuel cycle facilities under MC Inspection Procedure 88050 “Emergency Preparedness,” to ensure that the plans are maintained in a state of readiness, appropriate implementation procedures have been developed, appropriate training has been provided to plant personnel, the program is properly coordinated with offsite support agencies, drills and exercises are conducted, and emergency equipment and facilities are operable and properly maintained. The biennial licensee drills are observed and critiqued by NRC as part of the core inspection program. NRC also periodically participates in selected drills to ensure adequate coordination and interface with licensees, Federal and State agencies, and local and municipal governments.

10

4. Problems with the company’s communication and emergency response systems.

The NSC report faulted the company for being late in reporting the criticality accident to the government and for not telling the emergency workers who initially responded that the accident was a nuclear accident.

NRC licensee emergency plans include provisions for the immediate notification of off-site response organizations and the NRC operations center within 1 hour of an emergency declaration. Emergency Plans are required to ensure that exposure guidelines are clearly communicated to offsite emergency response personnel and to control and monitor their exposures. Licensees develop and maintain emergency plan implementation procedures, and train plant personnel who have emergency response responsibilities in use of those procedures. The licensees also conduct periodic drills and exercises that include the use of those procedures to maintain the proficiency level of their staffs. These areas are periodically inspected under the core inspection program (per MC Inspection Procedure 88050, discussed above).

8. STAFF ACTIONS

The staff issued Information Notice 99-31, to all licensed fuel cycle facilities, which discussed possible commingling of high-and low-enriched uranium; operator training; implementation of operating procedures; startup authorization for new processes or processes that have been shutdown for an extended period of time; recovery operations; and management oversight responsibilities. At facilities that handle or may have handled high-enriched uranium, the resident inspectors conducted special inspections under Temporary Instruction (TI) 2600/005. Issues the TI addressed included: (1) the potential to commingle inadvertently low and high-enriched uranium; (2) implementation of administrative controls over material transfer operations (including backshift operations), (3) implementation of operator training and on-the-job training activities; (4) licensee startup authorization controls; (5) maintenance of emergency response procedures and drills; (6) criticality accident alarm system functional testing; (7) verification that testing, maintenance and calibration of selected safety controls are current; (8) review and assessment of the consequence of any maintenance backlog for criticality safety items; and (9) review of any corrective action backlog. As a result of the inspections, NRC did not identify any significant safety issues that required prompt resolution to ensure adequate protection.

9. LONGER-TERM STAFF ACTIONS TO IMPROVE THE FUEL FACILITY OVERSIGHT PROCESS

Before the accident at Tokai-mura, the NRC started to revise the requirements of 10 CFR Part 70 and regulatory oversight program for fuel cycle facilities. These initiatives resulted from the staff’s self-assessments of the regulatory program and consideration of lessons learned from several NRC initiatives for improving regulatory oversight processes, including improvement of the power reactor oversight program. The staff is also considering the lessons learned from the Tokai-mura accident regarding the regulatory process and the importance of establishing and maintaining a suitable safety culture.

11

The NRC is striving to achieve more objective indications of licensee performance, increased stakeholder confidence in the NRC, increased regulatory effectiveness and efficiency, and a reduction in unnecessary regulatory burden. The NRC is currently working with the stakeholders to revise the fuel cycle facility oversight program to adopt: 1) a more risk-informed, performance-based approach to focus on the more significant risks at fuel cycle facilities; 2) more objective safety and safeguards performance indicators (PIs) with accompanying performance thresholds; and 3) risk-informed baseline inspections by NRC. Staff consideration of the PIs, and inspection findings, are intended to provide objective and reliable bases to determine if a fuel cycle facility is operated safely and securely, and to provide early indications of declining performance. The NRC staff plans to develop a licensee performance assessment process that will integrate information from PIs and inspection findings. The process will facilitate clear and objective characterization of safety and safeguards performance and facilitate NRC decisions regarding allocation of inspection resources and other regulatory actions. Related changes in the inspection significance determination process, licensee performance assessment process, and regulatory action (including enforcement) process, are also under consideration. The staff plans to use the lessons learned from fuel cycle accidents, including Tokai-mura, in validating the new oversight process.

In response to the nuclear criticality accident at Tokai-mura, the Nuclear Energy Institute (NEI) conducted a review of U.S. commercial fuel cycle facility criticality safety programs. The staff will review the NEI report (expected in early May 2000) and hold discussions with the NEI team regarding its findings and any insights that may have been identified during its site visits.

10. STAFF CONCLUSIONS

The staff has determined that it is unlikely that a similar event could occur at a U.S. commercial fuel cycle facility. The current NRC fuel facility oversight process adequately addresses the root causes of the Tokai-mura criticality accident. In addition, no changes to the proposed 10 CFR Part 70 are necessary to address the lessons learned.

The current inspection program, including the resident inspectors at the two high-enriched uranium facilities and two gaseous diffusion plants, along with periodic operational and criticality inspections, provides sufficient coverage of licensee operations involving criticality safety to confirm the adequacy of licensee programs. In addition, periodic licensee performance reviews conducted for each facility consider the significant inspection findings, operational events, and trends at each facility, as part of the Agency’s assessment of the licensee’s overall performance, strengths, weaknesses, and challenges. This allows the NRC to adjust the inspection effort to focus on dominant risks and licensees with weaker performance.

REFERENCE SYNOPSES

1. INTERNATIONAL ATOMIC ENERGY AGENCY (IAEA) “REPORT ON THE PRIMARY FACT FINDING MISSION FOLLOWING THE ACCIDENT AT THE NUCLEAR FUEL PROCESSING FACILITY IN TOKAI-MURA JAPAN,” CONDUCTED ON OCTOBER 13 - 17, 1999.

A team of three experts conducted a fact-finding mission at Tokai-mura from October 13 - 17, 1999. Their preliminary evaluation indicated that the accident clearly did not involve widespread contamination of the environment and that there was little risk off site once the accident was brought under control. The team concluded that the accident was essentially an ‘irradiation’ accident and not a ‘contamination’ accident, as it did not result in a radiologically significant release of radiological materials. Only trace amounts of noble gases and gaseous iodine escaped from the building itself. It appeared that the accident resulted primarily from human error and serious breaches of safety principles, and that the accident will most probably have implications for the regulatory regime, safety procedures, and safety culture at the JCO facility. Three areas identified as requiring an extensive investigation are: (1) the JCO facility, including its safety-related design aspects, managerial provisions, and operational matters, (2) regulatory control, including licensing and inspection, and (3) emergency preparedness and response.

2. SCIENCE AND TECHNOLOGY AGENCY REPORT, (STA) “BRIEFING BY JAPAN AT THE OCTOBER 12, 1999 NEA STEERING COMMITTEE MEETING.”

The briefing covered the accident at the conversion facility, including the event chronology, emergency countermeasures, and the cause of the accident, and outlined the safety regulations for nuclear facilities. This preliminary presentation was not able to go into the details of the root causes or provide insights into what long-term corrective actions would be taken, because of the need for additional time for the government to conduct a thorough investigation.

3. NUCLEAR SAFETY COMMISSION (NSC) INVESTIGATION COMMITTEE “URGENT RECOMMENDATIONS - INTERIM REPORT,” DATED NOVEMBER 5, 1999.

This interim report contained broad and far-reaching observations and recommendations in response to the accident. Identified causes of the accident were: (1) the actual operation was conducted outside the scope of the government-approved operating procedure and did not use all the approved hardware safety features; (2) the workers did not understand the different safety limits (low-enriched vs. intermediate- enriched uranium) and were under production pressures; and (3) there were human factor problems, with the system design, that led to ”workarounds”. Significant accident response issues were: (1) timely communications to the local residents; (2) interface and roles between the national, local, and municipal governments; and (3) problems with the company’s communication and emergency response systems.

Enclosure to Attachment 1

2

One of the most significant safety issues involved the operating procedure. The company issued a revision to the procedure without obtaining government approval in 1997. The revision was approved by the Manufacturing and Quality Assurance Divisions, but had not been reviewed by the Safety Management Division. The workers may have further deviated from the 1997 revision without management approval.

The report noted the internal and parent company audits had not functioned properly and that the company was under significant financial pressure (about one-third of the staff had recently been laid off).

Another significant issue the report touched on was the prior belief that an accident could not happen there. The safety review judged that there is “...no possibility of criticality accident occurrence due to malfunction and other failures...,” and no criticality accident alarm was required or installed. Further, the regulator had not conducted inspections since 1992, when resources were redirected toward other priorities.

4. NSC REPORT “A SUMMARY OF THE REPORT OF THE CRITICALITY ACCIDENT INVESTIGATION COMMITTEE,” DATED DECEMBER 24, 1999 (PROVISIONAL TRANSLATION).

This report concluded that there was no significant off site impact on the health of the public nor the environment from radiation or the release of radioactive materials because the amount was so small (releases resulted in exposure rates to several micrograys per hour at the highest point) and the short half-life of the radionuclides released. The off-site doses to several members of the public who were near the JCO fence for several hours ranged from 6.4 millisieverts (mSv) to 15 mSv. The three JCO workers received from 1 to 4.5 gray equivalent (GyEq), 6.0 to10 GyEq and 16 to 20 GyEq (this last individual died on December 21, 1999). Film badges and dosimeters indicated that other workers received from 0.03 to120 mSv. Not all of the workers were wearing film badges at the time of the accident.

The report addressed the causes of the accident, which included: (1) human factors issues; (2) procedure verification and validation; (3) operational management deficiencies related to operational control, operator training and qualification, and approval for transfer of nuclear material (supervisory authorization of solution transfers); (4) technical management of the preparation, review and approval of operating procedures (specifically highlighting the failure to require and obtain approval of the safety management group); (5) business management in that the company did not pay full attention to a process involving the manufacturing of special products in small quantities on an irregular basis; (6) a licensing process that did not consider a criticality accident to be credible; and (7) the safety regulation process, which did not include appropriate inspections.

Accident response lessons learned emphasized the need to: provide the capability to detect a continuing criticality; provide more stringent safety measures for facilities that handle uranium solutions enriched to the 20 percent level; disclose and provide information in a timely manner; and transmit information to foreign countries promptly.

3

The NSC made broad recommendations concerning reassessment of the regulatory system, needed changes to the safety culture of the regulators and industry, and information management. The report called for a reassessment of the nuclear disaster prevention policy, which omitted facilities like JCO. During the initial response, problems were encountered with communications from both the company and regulatory authorities, notification of off-site responders that the accident was a nuclear accident, inadequate disaster-management facilities, and coordination difficulties between the national, local governments, and municipalities.

The report also acknowledged the fact that the accident had a very significant social impact.

5. THE DEPARTMENT OF ENERGY (DOE) “TRIP REPORT OF VISIT TO TOKYO AND TOKAI-MURA, JAPAN, ON OCTOBER 18-19, 1999" (ISSUED MARCH 2000).

A three-member DOE team exchanged preliminary information with Japanese Government officials concerning the event and the possible lessons learned that could be applied to DOE facilities. The information contained in the report has already been updated by the subsequent STA and NSC reports, referenced above. However, the report noted that the apparent root causes of the accident at Tokai are similar to causes of other nuclear criticality accidents in the worldwide history of nuclear material use.

Fig 1. Location of Tokai-mura

Fig. 2. Regional map outlining 10 Kilometer sheltering zone

Fig 3. JCO general site layout.

Fig. 4. JCO Conversion Building.

Fig. 5. Uranium processing flow diagram.

Fig. 6. Precipitation tank dimensions.

GROUP NUMBER OF PEOPLE EXPOSED

ESTIMATED DOSES

JCO Workers at Precipitation Tank

3 Total A B C

16 - 20 (gray equivalent) 6 - 10 (gray equivalent) 1 - 4.5 (gray equivalent)

JCO Workers during Recovery Operations

24 Total maximum 48 mSv

JCO Workers and Others involved in Countermeasures

104 Total maximum 8 mSv

Other JCO Workers onsite.

96 Total 1 3 92

15 - 20 mSv 5 - 10 mSv <5 mSv

Non-JCO Workers near site

7 Total 2 2 3

15 - 20 mSv 10 - 15 mSv 5 - 10 mSv

Members of the Public

207 Est. 1 4 15 180

24 mSv 10 -15 mSv 5 - 10 mSv <5 mSv

Fig. 7. Estimated doses to workers and members of the public.