In a plant dedicated to transforming natural uranium, some uranium tetrafluoride (UF4, green radioactive salt) needed to be transferred from the site’s production furnaces to storage silos via a pneumatic system.

This transfer operation began by an automated vacuum sequence, which was normal practice for a process restart with no product, when an automatic valve became stuck around 11:40 pm at the silo outlet. The pressure of the silo subsequently rose. When the pressure surge reached 50 mbar, a safety valve was supposed to be activated and the excess substances was supposed to be injected into a watertight chamber. But the silo’s rupture disc, despite being set at 100 mbar, burst early at 40 mbar. In the control room, a high pressure alarm tripped at 40 mbar, generating a fault on the pipeline screen.

Since the ruptured disc was not directly visible when observing the top of the silo dome, plant employees noted no anomaly or UF4 presence. The pipeline technician acknowledged the fault triggering the alarm and manually forced open the valve recently found to be locked. As of 1 am the next day, 2 successive UF4 transfers were completed before another alarm sounded notifying the absence of silo pressure changes. An in-depth verification revealed the presence of UF4 at the rupture disc outlet. The silo was locked out and maintenance personnel responded immediately to replace the disc. The UF4 release could be discharged and the zone decontaminated. Radioactivity measurements removed all threat concerns.

Inspectors of classified facilities noted the presence of UF4 both on the dome and at the silo base subsequent to disc replacement, plus the absence of primary confinement at the disc outlet and missing tags on the silos and permanent silo level monitoring systems. A programming error was also discovered on the automated controller supervising the automatic transfer: the suspect automated valve position was being controlled by 2 distinct programmes (1 for each storage silo), one causing the valve to close the second returning the valve to the open position. The loading procedure had anticipated a manual supervision of automatic valve position; however, the technician decided to switch vacuum transfer to automated mode. The disc was appraised; poor assembly had caused it to burst prematurely.

The plant operator and technicians revised the basic application of the loading procedure by implementing a formalised procedure for the acceptance and assembly of silo rupture discs and by improving the programming of the automated UF4 silo transfer controller (a single programme controlling the suspect valve, silo level and pressure monitoring, detection of ultimate safety device actuation, especially rupture discs).