ML20132D699
| ML20132D699 | |
| Person / Time | |
|---|---|
| Site: | Paducah Gaseous Diffusion Plant |
| Issue date: | 12/16/1996 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20132D683 | List: |
| References | |
| 70-7001-96-06, 70-7001-96-6, NUDOCS 9612200074 | |
| Download: ML20132D699 (21) | |
Text
_ _ _ _ _
at,
U.S. NUCLEAR REGULATORY COMMISSION REGION III I
Docket No.
70-7001 Observation Report No.
70-7001/96006 (DNMS)
Facility Operator:
United States Enrichment Corporation Facility Name:
Paducah Gaseous Diffusion Plant l
Location:
5600 Hobbs Road P. O. Box 1410 Paducah, KY 42001 j
Dates:
October 1 through November 18, 1996
}
Inspectors:
K. G. O'Brien, Senior Resident Inspector i
J. M. Jacobson, Resident Inspector l
Approved By:
Gary L. Shear, Chief Fuel Cycle Branca 1
4 4
i l
i 4
i a
t i
9612200074 961216 PDR ADOCK 07007001 i
C PDR
'f l
~
b 1
h EXECUTIVE
SUMMARY
United States Enrichment Corporation l
Paducah Gaseous Diffusion Plant NRC Observation Report 70-7001/96006 (DNNS)
Authority Statement: The Department of Energy (DOE) and the Nuclear Regulatory Commission (NRC) have agreed to cooperate to facilitate the NRC obtaining information and knowledge regarding the gaseous diffusion plants and the United States Enrichment Corporation's (USEC) operation thereof through observation / inspection activities during the interim period before the NRC assumes regulatory responsibility. This report is a summary of NRC observations for the period stated.
Each of the observations was communicated to the DOE Site Safety Representatives during and at the end of the l
observation period.
All items were discussed and reviewed with the DOE Site Safety Representatives-to allow for their future followup and evaluation, as they deem appropriate.
The inspectors determined that the facility continued to operate in a safe l
manner. An Executive Summary follows:
l Plant Operations e
An incomplete understanding, by some operations staff, of the ongoing plant status and the potential consequences of some response actions contributed to an exceedance of the allowed enrichment assay in a J
portion of building 333 and two safety system actuations.
An inadequate understanding, by the Plant Shift Superintendent and some e
operations staff, of requirements for the return to service of safety related equipment was demonstrated by the reinitiation of an interrupted cylinder heating cycle and by an inappropriate operability determination
.for the east Normetex pump.
Maintenance and Surveillance Weaknesses in operations and engineering staff's understanding of:
o (1) the autoclave containment system Technical Safety Requirement testing requirements; and, (2) the plant policies for development, review, and use of procedures, contributed to the premature return-to-service of the building 337A IE autoclave following corrective maintenance.
e The lack of a formal means for controlling spare parts for the fire protection system led to the installation of inappropriate test hardware which invalidated previous functional tests.
i 2
i
a Enaineerina Weak engineering design products and informal management tracking of e
Compliance Plan commitments led to the high pressure fire water pump refurbishment commitment date being missed.
In addition, a significant management 1-e-prioritization of activities was necessary to avert missing the Compliance Plan date for development and implementation of nuclear criticality safety evaluations and approvals.
Plant Sucoort e
An inadequate knowledge of security program requirements on the part of some plant staff led to an unauthorized access to the site restricted area and a breach of the security perimeter barrier.
3
a ':,
DETAILS I.
Doerations 01.
Conduct of Operations
- 01.1 General Comments The inspectors observed selected activities to confirm that' the facility was operated safely and in conformance with guiding programs and procedures. These activities were confirmed by direct observations, facility tours, interviews, discussions with management and staff, and-i reviews of facility records.
01.2 Conduct of Operations a.
Inspection Scone During the inspection period, the inspectors reviewed selected 1
issues surrounding the certificant's conduct of operations.
b.
Observations and Findinas 1.
Assay Exceedance in the 333 Process Building On.0ctober 1, 1996, the Cascade Coordinator (CC) discovered that building 333, unit 6, cell 2, stage I process gas assay was 1.009 weight percent (w/o) enriched in uranium-235 J
(U-235). This value was determined based upon laboratory analysis of a process gas sample.
Enrichment cascade Operational Safety Requirements (0SRs) for building 333, unit 6 limited the assay to less than 1.0 w/o U-235 due to a lack of criticality accident alarm system (CAAS) coverage for the area. At the time of discovery, the enriched product from the cell was routed from building 333 to l
building 331, unit 3 and then to the upper cascade in building 337. The enriched product alignment between C-331 and C-337 was designated as the bottom overlap (BOL) flow for the lower and upper cascades.
The building 333 assay exceedance was caused by a significant decrease in the BOL flow between building 331 and building 337. The decreased flow caused.caschde units below the BOL transfer point to enrich the produr.t stream to
' Topical headings such as 01, M8, etc., are used in accordance with the NRC standardized inspection report outline contained in NRC Manual Chapter 0610.
Individual reports are not expected to address all outline topics,.and the topical headings are therefore not always sequential.
j 4
m 1
J
\\
a greater percentage than normal and thus the assay exceedance in building 333.
Upon discovery of the assay exceedance, operators took actions to reduce the assay to below 1.0 w/o U-235 and entered the Limiting. Condition for Operation (LCO) action statement. The LC0 directed the suspension of movement of materials and maintenance operations involving UF enriched to greater than 1.0 w/o U-235.
A review of the CC's logs for the previous two weeks i
indicated that the BOL flow reduction had occurred I
continuously over the period. Although records of the actual and target BOL flow were kept, the CCs. indicated that no action levels or acceptance criteria existed for the difference between the actual and target BOL flow rates. As j
a result, plant staff did not identify in a timely manner the potential for a problem with the reduced flows. The BOL l
flow rates were recorded and reviewed on a daily basis.
i The inspectors also reviewed the Safety Analysis Report (SAR), Section 3.12.6, " Criticality Accident Alarm System."
SAR Table 3.12-1 listed the locations of CAAS clusters in i
the plant. The inspectors noted that cluster Z, in building
}
333, was identified as a permanent cluster. However, infield review of the area and discussions with staff f
indicated that the cluster has never operated. This fact may be included in a SAR note which states that three l
clusters were inoperable.
Following the event, the j
operations manager filed a problem report documenting the need to complete installation of the cluster and to ensure conformance with the SAR.
i
}
2.
Cascade Process Gas Leak Detection (PGLD) Safety System Actuations On October 20, 1996, a cascade PGLD system actuation i
occurred in a portion of the cascade operating above atmospherir, pressure. This system was a safety system and was required to be operable whenever the associated portion of the cascade was above atmosphere.
Following the actuation, operations staff:
(1) responded to the events in i
accordance with established alarm response procedures; t
(2) noted indications on the compressors of outgassing, and; (3) initiated actions to reduce cell pressures to sub-l.
atmospheric levels. The inspectors noted that these corrective actions were consistent with current protocol; however, they did not appear to preclude repeat events as evidenced by a similar event on October 21, 1996.
l During followup discussions with operations staff, the j
inspectors determined that some operating information may 3
5 l
i J
have foretold of the potential for these outgassings.
Specifically, prior to these occurrences, operations experienced problems with some of the cell compressor seal systems. As a standard response to these problems, operations took actions,which appeared to increase the potential for the outgassings. These actions included continued operation of the involved cells at above atmospheric pressures concurrent with placing cell operations in manual vice automatic mode. This approach limited the system's ability to respond to cascade perturbations and created an increased potential for outgassings.
Upon further review of the two outgassings and the current operations off-normal response procedures, operations management issued a long term order revising the standard operator actions. The order directed operations staff to take cell pressures sub-atmospheric, 5 instances of seal _
system problems. Also, the order was "xtended to cover both the involved and immediately adjacent cells. This latter aspect was important because it provided operations staff with a means to ensure that the cell pressures were maintained sub-atmospheric.
c.
Conclusions The operations staff at the plant did not identify nor respond, in a timely manner, to a significant decreasing BOL flow trend. As a result, the UF, assay exceeded 1.0 w/o in an area which did not have CAAS coverage. This appeared to be an OSR violation.
Similarly, the operations staff did not identify weaknesses in their response protocols for' cascade seal system problems. As a result, cascade outgassing occurred accompanied by safety system actuations.
01.3 Reauirements for Eauipment Return to Service or Re-start a.
Inspection Scope The inspectors reviewed an operability determination for the i
Building 310 withdrawal facility east Normetex pump and the i
circumstances surrounding a Technical Safety Requirement (TSR) violation.
i b.
Observations and Findinas 1.
East Normetex Pump Operability Determination On October 7,1996, the Plant Shift Superintendent (PSS) declared the east Normetex UF, withdrawal pump inoperable i
because a functional test was not completed. The test, 6
is.
involving the low oil flow switch, was a Nuclear Criticality Safety (NCS) required biannial surveillance specified in NCS approval 3974-04-01-02.
Prior to declaring the pump inoperable, the PSS requested that engineering perform an operability evaluation (0E) of the as-found condition. The OE could not technically support declaring the pump operable and was subsequently terminated. However, the OE stateri that the low oil pressure switch would provide the same level of assurance of operability as the low oil flow switch.
The PSS subsequently had the oil pressure switch functionally tested and declared the pump operable. This action was based on the terminated OE. However, the NCSA had not been formally revised to identify the pressure switch as an equivalent NCS control to the flow switch.
Based upon discussions at the plant status meeting the next morning, the inspectors determined that the operability determination was made without the knowledge of operations or engineering management. Management was also not fully aware that the pump had been declared operable until it was identified by the inspectors.
2.
Cylinder Heating TSR Violation On November 11, 1996, the building 333A 4N autoclave tripped due to a sensed high condensate signal condition. The high condensate safety system was designed to detect high levels of water in the 3-inch drain pipes below the autoclave.
Actuation of the system isolates the steam supply and the steam vent to limit the autoclave water inventory available for an exothermic reaction should there be concurrent UF, release in the autoclave. A review of the autoclave strip chart indicated that at the time of steam isolation, the cylinder temperature (or closed autoclave temperature) was i
184 degrees Fahrenheit.
In addition, the autoclave strip
)
chart indicated that the cylinder pressure had not been i
greater than 22 pounds per square inch absolute (psia) for a period of 20 minutes.
Following the trip, operations staff evacuated steam inside the autoclave through the associated jet station, opened the autoclave and performed corrective maintenance.
Subsequent to these activities, operations staff closed the autoclave and reinitiated steam heating the cylinder. The cylinder temperature at the time steam was reapplied was 132 degrees Fahrenheit.
TSR 2.2.4.11, " CYLINDER HEATING - VALVE CLARITY / HEATING CYCLE INTERRUPTIONS," required that cylinder valve clarity be established prior to heating a cylinder, following heating interruptions, for cylinders which have not been 7
.> 3 heated to greater than 170 degrees Fahrenheit and 22 psia for 20 minutes or which the closed autoclave temperature was less than 170 degrees Fahrenheit.
Establishing valve clarity entailed closing the cylinder l
valve, pressurizing the pigtail attached to the valve with l
nitrogen, and observing the pressure decrease when the cylinder valve was opened. The TSR basis statement indicated that the intent of the TSR was to ensure there have been no freezeouts of UF, in or around the cylinder valve while heat was removed.
After questions from the operations staff, the Nuclear i
Regulatory Affairs staff identified that the failure to l
perform a valve clarity check following an. interrupted heat 1
cycle was a TSR violation. Discussion with operations staff and TSR advisors indicated that they mistakenly believed the temperature requirement applied at the time of steam isolation, before opening the autoclave. The inspectors pointed out, however, that this logic would allow an autoclave to remain open indefinitely, with. subsequent solidification of the liquid UF..
This operations staff conclusion regarding when the temperature limit applied demonstrated an inadequate understanding of the TSR basis.
In addition to the TSR violation, the staff identified that the flowdown of the TSR requirements into the pertinent off-normal procedure was inadequate. This conclusion was based upon the absence of any instructions to the operators to perform a valve clarity check following the interruption of-the heat cycle.
c.
Conclusions The PSS operability determination, without an associated change to the NCS-required surveillance, and operations staff's failure to perform a valve clarity check, following. interruption of the cylinder heat cycle, indicated an incomplete understanding of the processes for ensuring that safety requirements are met.
In addition, plant management did not appear to be fully aware of the status of plant equipment and safety posture on a daily basis.
01.4 Operational Readiness Review Process a.
Insoection Scope
]
The inspectors evaluated the effectiveness of the plant's j
operational readiness review (ORR) process based on operational experience after transition to new operations or following 4
modifications.
8
i i
b.
Observations and Findinas Over a period of months, the inspectors noted that problems, identified after start-up of new or modified operations, indicated the plant's ORR process missed key issues. The ORR process was designed to provide management reasonable assurance that programs I
(procedures, surveillances, etc.) and equipment were in place and available, and that appropriate training was conducted, before start-up. For example, ORR evaluations were conducted prior to transitioning the feed facilities to TSRs and prior to beginning
" mock" operations for the high-assay upgrade project.
In both cases, the ORR process did not identify start-up requirements which had not been met.
In particular, the feed t
facility TSR transition ORR did not identify: 1) that a TSR-required smoke watch for an inoperable process gas leak detection (PGLD) head was not in place at the time of transition (Observation Report 70/7001-96005); 2).that an alarm response procedure (ARP) did not reference the correct off-normal a
procedure, and; 3) that the off-normal procedure did not provide guidance on checking for cylinder valve clarity after heating interruptions. This last example was a factor in a recent TSR violation (Section 01.3).. In addition, the ORR process did not identify that surveillances, required for operability of the building 310 east Normetex pump under high-assay operations, were j
not conducted.
a c.
Conclusions A recurring trend of unidentified problems, following successful ORR evaluations, indicated that ORRs were not conducted with the level of rigor necessary to ensure that all requirements were satisfied prior to transition to or implementation of new operating modes.
01.5 "See and Flee" Policy a.
Inspection Scope The inspectors reviewed the circumstances surrounding two minor UF. releases during the inspection period.
In addition, the inspectors had numerous discussions with plant staff concerning the understanding and implementation of the plant's "See and Flee" policy.
b.
Observations and Findinas On October 28, 1996, an operator checking a buffer system alarm in the building 310A withdrawal facility was involved in a minor release when he inadvertently opened a " peanut" valve as he moved by it. The operator, who was wearing gloves, closed the valve, left the area, and notified the Area Control Room (ACR).
9
j 7
1 l'
Subsequently, the building was evacuated and a hazardous materials j
entry was made to ensure that the release had been stopped.
)
On November 5, 1996, maintenance mechanics performing an i
L inspection of the discharge check valve for the west Normetex i
product withdrawal pump were involved with a release when they L
removed the valve flange. Discussions with plant staff present at j
the time indicated that the personnel were attired in full face i
i respirators and anti-contamination clothing. An industrial-l hygiene (IH) technician was also present.
Following the release, j
the mechanics replaced the flange and hand-tightened the bolts, l
prior to leaving the area. The IH technician sampled for 1
hydrofluoric (HF) acid and determined that the HF concentration j
was I part per million (ppm). The Occupational Safety and Health Administration (OSHA) permissible exposure level for HF was 3 ppm.
i i
i Based upon the above events and the apparent inconsistency between the observed response actions and the plant "See and Flee" policy, the inspectors held followup discussions with various plant staff.
These discussions indicated that the "See and Flee" policy was j
inconsistently understood and applied. The General Manager and 1
Enrichment Plant Manager indicated that they understood the "See and Flee" policy to mean that no actions were to be taken.by operators and mechanics upon identification of a release of d
hazardous materials.
This understanding appeared to be consistent with a recently developed building 360, Toll Transfer and Sampling Building, unreviewed safety question (USQ).
I j
The USQ involved a contradiction between the FSAR and SAR-1 statements that an operator involved with a release from a pigtail i
failure for a liquid UF, cylinder with the valve in the 3, 6, or i
9-o' clock position with the autoclave open would immediately flee j
the area and not re-close the cylinder valve under the "See and i
Flee" policy.
Given this course of action, the valve or autoclave could only be closed by a hazardous materials reentry team after a significant amount of time had passed with the likelihood that the entire contents of the cylinder would be released to the building 1
and environs. This was contrary to anther assumption in the SAR accident analysis which had the operator closing the valve and l
limiting the release to 20 pounds of UF..
Since the source term i
of the accident when considered concurrent with the "See and Flee" was greater than that analyzed in the SAR, the certificant j-determined that the issue was a USQ.
i Other staff, from operators to management, indicated that personnel could take limited reflexive actions prior to leaving i
the area..This was based on their understanding that the "See and Flee" policy did not prohibit staff from taking actions to mitigate the release as long as they believed they had an adequate understanding of the cause of the release (such as opening a valve and then closing it). A review of selected off-normal operating procedures for the feed facilities indicated that they contained 10
action steps which would require operators to take actions to close valves after a release of UF..
As noted in the events described above, personnel took actions to mitigate the release i
prior to leaving the area. This appeared contrary to the current plant policy.
1 c.
Conclusions The inspectors determined that plant staff, at all levels, had an inadequate and incomplete understanding of the "See and Flee" policy.
II.
Maintenance and Surveillance M1.
Conduct of Maintenance and Surveillance M1.1 General Comments l
l During routine tours of plant facilities, the inspectors observed the l
general material condition of plant equipment and some in-progress maintenance activities. The inspectors also reviewed some maintenance records and maintenance-related nonconformance reports. The focus of f
the observations was to assess the overall performance of maintenance activities relative to approved procedures, guides, and industry codes or standards.
M1.2 Repairs and Testina of an Autoclave Containment Boundary a.
Insoection Scope The inspectors reviewed maintenance activities, including post-maintenance testing, undertaken in response to leaks observed from the building 337A,1E autoclave steam control valve.
b.
Observations and Findinas On October 15, 1996, the operations staff observed steam leaking from the 1E autoclave steam control valve flanges. The leak was discovered during changeout of a recently fed cylinder.
In response to the event, the PSS declared the autoclave inoperable and initiated a maintenance request to repair or replace the valve. The valve body and flanges were a part of the autoclave containment safety system boundary.
On the morning of October 16, 1996, the inspectors noted that the IE autoclave had been repaired and declared operable. As a followup, the inspectors reviewed the scope of work performed, the post maintenance testing results, and discussed the evolution with the involved operations and engineering staff.
Through these reviews and discussions, the inspectcrs determined that the work involved replacement of the steam admission valve 11
and that post-maintenance testing was performed, in accordance with an engineering notice (EN). The inspectors reviewed the EN and observed that it had all of the attributes of a procedure; however,-engineering staff did not process the EN for formal a) proval as procedure.
In addition, the inspectors determined tiat the EN test methodology was not consistent with that described in the TSRs. Specifically, the EN directed the performance of a local leak test, while the TSR surveillance mandated a full system leak test.
The inspectors discussed their findings with both operations and engineering management. Following a further review of the work package, the EN, and the applicable TSRs, plant management declared the IE autoclave inoperable pending an acceptable full containment leak test. Subsequently, the full containment leak test was completed without incident and the system was returned to service.
c.
Conclusions Weaknesses in operations and engineering staff's understanding of:
(1) the autoclave containment system TSR testing requirements; j
and, (2) the plant policies for development, review, and use of procedures, contributed to the premature return-to-service of the building 337A IE autoclave.
M1.3 Installation of Inacorooriate Fire Protection System Sicht Glasses a.
Inspection Scope The inspectors reviewed the circumstances surrounding the installation of full-flow sight glasses in the fire protection system instead of the required restricted flow sight glasses. The fire protection system included different types of sight glasses to enable the performance of water flow alarms tests.
b.
Observations and Findinas During an infield review of completed maintenance work packages, plant fire protection staff identified that an inappropriate inspection test valve (ITV) sight glass had been installed in one section of the building 337 sprinkler system piping. The installed sight glass was a full-flow type and did not incorporate a flow restricting orifice designed to simulate flow from a
]
sprinkler head.
Both sight glasses were used to perform the annual surveillance of. the sprinkler system alarm which is required by the SAR specified fire protection program.
The restricted flow sight glasses were designed to be used inside buildings, where a sprinkler head could not be attached.
The full-flow sight glasses were designed to be used with runs of pipe leading to external sprinkler heads. The installation of the 12 4
-c 1
inappropriate sight glass would invalidate the test since the specified flow conditions would not be met.
'l After 'the initial identification of the problem, plant ' staff performed a walkdown of all other process buildings fire protection systems and. identified additional examples where incorrect sight glasses had been installed. The staff declared i
the affected systems inoperable and posted the required fire watches. These actions were relaxed once the correct sight i
glasses were installed and the appropriate functional tests were performed.
1 During followup discussions with the inspectors, fire protection and maintenance staff indicated that the fire department maintained a supply of sight glasses. These parts were not in safety system stores or under the controls of the certificant's developing configuration management program. Thus, when maintenance was performed on the sprinkler systems, the controls for ensuring that like-for-like parts were installed were not in place.
In addition, the work package for the latest replacement i
of a sight glass did not specify which type of sight glass was required. Although there were no identifiers on the sight glasses themselves, a significant difference existed in the appearances of the glasses.
Finally, this system maintenance was performed without fire protection staff input to the work control staff developing the work package. This type of review could have aided l
in ensuring the appropriate sight glasses were used.
The inspectors noted that this issue was previously identified in NRC Observation Report 70/7001-94001. Generic steps taken by the plant to resolve this issue were also pieviously noted; however, additional effort appeared warranted to ensure compliance with the Quality Assurance Program. This issue was included in the NRC 1
Compliance Plan as Issue Number 21, i.e., lack of a formal
-configuration management program.
c.
Conclusions The lack of a formal means for controlling spare parts for the i
fire protection system led to the installation of inappropriate test hardware which invalidated previous functional tests.
III.
Engineerina El.
Conduct of Engineering El.1 General Comments Throughout the observation period, the inspectors observed facility engineering activities, particularly the engineering organization performance of routine and reactive site activities, including identification and resolution of technical issues and problems.
13
i e
j El.2 NCS Comoliance Plan issue a.
Inspection Scope The inspectors reviewed the certificant's progress on the following Compliance Plan Issues:
f l
e Issue Number 5 - Nuclear Criticality Safety Approval Documents j
e Issue Number 6 - Nuclear Criticality Safety Approval Implementation j
e Issue Number 27 - Procedures Program
]
f b.
Observations and Findinas l
Issues Number 5 and 6 committed the certificant to preparing and
}
approving nuclear criticality safety evaluations (NCSEs) and j
nuclear criticality safety approvals (NCSAs) for certain i
operations existing at the time of Compliance Plan development.
These operations involved uranium enriched to greater than 1.0 w/o or 15 grams or more of U-235 and for which the NCSE/NCSA was incomplete or unavailable.
In addition, the certificant committed j
to flowdown the NCSA requirements into procedures and implementation of the requirements in the field for the specified operations. The scheduled completion date was December 2,1996.
Issue Number 27 is a more generic issue dealing with development and implementation of the procedures program.
In late October, plant staff identified to the inspectors a potential that the compliance plan dates for issues 5 and 6 may not be met. Although the bases for not meeting the date were not initially clear, further review by both plant staff and the-inspectors indicated that the delay in implementation was the result of insufficient management oversight of the process.
Specifically, management had not prioritized the NCS and other staff efforts to focus on achieving the Compliance Plan commitments.
Instead, NCS and other staff were focused on other activities, including -the high-assay upgrade project.
In response to these observations, management reprioritized the outstanding work load and focused the staff's attention on the upcoming Compliance Plan items. This effort concluded in the developnent of a schedule and means by which to meet the Compliance Plan commitments.
In addition, the staff also realized that Compliance Plan Issue 27 included a date for completing the NCS procedures by December 31, 1996. This time beyond the perceived end date of December 2, 1996, afforded the certificant some additional time to complete all the NCS procedures.
14
=-
t.
1 s
c.
Conclusions j
i Plant management did not become involved in assuring daily activities necessary to meet the NCS commitments in the Compliance Plan were met until the NRC was notified by staff that a potential problem may exist. This was similar to the failure to meet the Compliance Plan date for completion of the high pressure fire j
water pump refurbishment project of October 31, 1996 (Section E1.3).
3-E1.3 Hiah Pressure Fire Water System Modification a.
Inspection Scope The inspectors reviewed engineering products and their implementation in support of-modifications implemented to improve high pressure fire water system. reliability.
b.
Observations and Findinas During the observation period, the plant informed the NRC that work, scheduled to support completion of a Compliance Plan commitment, would not be completed on-time. This notification was sige.Uicant, in that, it came almost concurrent with the specified completion date for the item and was attributed to a surveillance testing failure which was not immediately understood by the plant staff.
As a followup to the notification, the inspectors reviewed the modification package and noted irregularities relative to the current engineering protocols. These included the handling of the project as a " refurbishment" vice a modification, engineering drawings and installation instructions which were inconsistent or incomplete, and limited post-modification acceptance testing information.
The inspectors determined that the handling of this project as a
" refurbishment" was significant, in that, few of the newly implemented or revised engineering controls were applied to
" refurbishment" projects.
Recently, engineering management identified several other performance problems with systems following the completion of " refurbishment" projects. Many appeared to be the result of incomplete or unperformed proof testing following completion of the work.
As a result of these combined items, management has initiated a project to review the status of all " refurbishment" projects.
This effort was to be an assessment of the need to "re-engineer" the projects to ensure a quality, functioning final product.
Irrespective of the project's designation as a " refurbishment" effort, the inspectors noted that many of the observed weaknesses 15
4 in electrical engineering documentation and instructions could still have existed under the current interim engineering controls.
Specifically, the inspectors determined that the interim controls did not specify a standard format for or minimum level of information content required in electrical engineering instructions.
In addition, there was not clear guidance on how certain routine functions were to be conducted, such as: 1) pre-job and post-job l
engineering walkdowns; 2) the designation, on electrical drawings, of lifted or landed leads; and, 3) the documentation of completed
.l l
craft electrical work. As a result, when the inspectors took the l
" completed" work package to the field, the craft could not consistently identify the leads involved or the work just performed. This observation was important, in that, the initial failed surveillance occurred as a direct result of a wiring inconsistency. This inconsistency could not be readily observed due to the weak modification instructions and to the very informal 1
or nonexistent independent verification process.
Discussions between the inspectors and involved craft also l
indicated that severai changes were made to the work package l
during the project. However, the inspectors could not independently discern this fact and in followup discussions with l
the engineering staff were informed that some were not fully documented.
Finally, the inspectors noted that the project would not have been completed in accordance with the Compliance Plan schedule, even without the surveillance failure.
Specifically, at the time of the failure, plant staff had yet to define the surveillance criteria and testing necessary to demonstrate operability.
This proof was a necessary item for completion of the Compliance Plan Issue.
i c.
Conclusions Some weak engineering controls and inadequate engineering products associated with the fire pump system " refurbishment" contributed to the untimely completion of a Compliance Plan commitment. Also, weak management tracking of the process and associated milestones contributed to the untimely project completion.
E3.1 Enaineerina Control of the PGLD Safety System a.
Inspection Scope The inspectors reviewed the current engineering controls and protocols relative to the PGLD system, a safety system.
16
.w<*
i 4
l b.
Qhservations and Findinas i
.During the observation period, the inspectors noted that operations staff did not maintain or control several portions of i
the cascade PGLD system in a manner similar to other plant safety systems. Through discussions with the operations staff, the inspectors confirmed that the staff understood the system's safety 4
purpose and when it was required to be operable. The inspectors l
also learned of a previous, long-standing practice not to maintain or control the system as a safety system for those portions of the l
cascade which were routinely operated at sub-atmospheric 4
pressures.
As a followup to these infield observations, the inspectors i
I reviewed the current system engineering controls and protocols.
The inspectors also discussed the issue with the DOE Site Safety Representatives (SSRs). The inspectors determined that plant l'
operation at the maximum authorized power levels and a normal pressure gradient would result in essentially the entire cascade operating at above atmospheric pressures. As a consequence,.
1 engineering had defined the entire cascade PGLD system as a safety system. However, engineering staff indicated that all of these
}
controls have not yet been fully implemented into plant i
operations, maintenance, and engineering procedures. This j
configuration control aspect was being pursued under a broader 3
Compliance Plan mandate.
l During discussions with the DOE SSR, the inspectors confirmed that the DOE also held that the PGLD system was a safety system for the entire cascade.
In addition, the DOE staff indicated that a violation was previously issued in response to cascade PGLD system maintenance that was performed without the benefit of safety system controls. The current status of engineering controls and operations / maintenance handling of.the system did not-appear to preclude a repeat of this previous violation. The inspectors raised these observations to management.
Late in the observation criod, the inspectors noted that operations had revised their daily equipment status listing to indicate that the cascade PGLD system was inoperable in those areas of the cascade being operated at sub-atmospheric pressures.
This action was taken in response to the previous weak engineering controls exercised over the system and was consistent with the designation of the system as a safety system.
In addition, the engineering configuration management group was continuing their work to bound the entire cascade PGLD system as a safety system.
This effort was expected to be complete consistent with the Compliance Plan December 31, 1996 deadline.
17
)
- p 1
A c.
Conclusions i.
L Engineering controls to ensure consistent treatment of the cascade j
PGLD system, as a safety system,.were not fully developed or i
distributed.
Improvements in the plant staff's sensitivity to the j
handling of this safety system were noted late in the period with the operations staff's declaration of the system as inoperable.
[
IV.
Plant Suonort l
l P2.
Status of Emergency Preparedness Facilities, Equipment, and Resources P2.1 Scheduled Maintenance on the Public Warnina System (PWS) i j
a.
Inspection Scope i
]
During the observation period, the plant performed routine,
[
periodic maintenance on the public warning system. The inspectors j.
reviewed controls and notifications made as a part of these j
efforts.
b.
Observations and Findinas i
a i
During a routine review of the Plant Shift Superintendent (PSS) logs, the inspectors noted that portions of the PWS were removed from service for routine preventative maintenance. The inspector, j
however, could not determine if local officials had been notified l
of the outage. Such a notification would normally be required if i
the system were discovered inoperable and could not be returned to service within four hours. The preventative maintenance outage j
lasted approximately two hours.
1 The inspectors discussed the observations with the on-duty PSS and I
was informed that plant staff re1 % upon the four hour window for notifications following discovery of an inoperable system as a i
basis for not making such notifications during routine preventive maintenance. This approach appeared inconsistent with the concept i
of keeping responsible offsite agencies informed of ongoing activities which could affect their response to an event.
L A subsequent management review of the practice identified a need to more clearly ensure that all potential emergency responder agencies are kept informed of the status of emergency equipment.
As a result, plant management issued a long-term order directing l
j that future equipment outages include a prior notification of the affected off-site agencies.
i
.c.
Conclusions i
An informal maintenance practice permitted the removal from service of the PWS without ensuring that off-site agencies, were
{
made aware of the planned outage.
Changes to the process were j
18 1
instituted to increase the availability of off-site agencies in the event of an emergency concurrent with planned preventive maintenance.
S1.
Conduct of Security and Safeguards Activities S1.1 Unauthorized Access to Restricted Area a.
Insoection ScoDe The inspectors reviewed the circumstances surrounding an individual gaining unauthorized access to the certificant's restricted area and the discovery of an unauthorized breach in the security perimeter fence.
b.
Observations and Findinas On November 14, 1996, an individual in an automobile gained unauthorized access to the restricted area through guard post 48.
The gate at the post had been opened and remained open to allow cement trucks working inside the gate to enter and leave. A security police officer posted at the gatehouse adjacent to the gate observed the car pass through the gate at approximately 30 miles per hour and reported the incident. The individual was finally stopped by the security police force near the building 400 decontamination facility, approximately half a mile into the restricted area of the plant. Upon questioning by the security police force, the individual indicated that she had never been to i
the plant, but had come to pick up her father's pay check and didn't realize she was entering a restricted area.
4 During initial followup discussions with the inspectors and the DOE SSR, various members of the security police forces indicated there was no prohibition on leaving vehicle gates open. However, the inspectors identified such a restriction during a review of Chapter III of the security forces " Post Duties." The failure of the security staff to close the gate after each vehicle passed through indicated a lack of knowledge of the certificant's security policies.
On November 17, 1996 and during routine rounds, a security police officer discovered construction work on piping traversing the fenceline near outfall number 17 which had resulted in a 5 foot by 2 foot rectangular hole in a pipe just inside the fence.
Inspection of the outside portion of the pipe indicated that there was no grating in the pipe to restrict access, as required by the plant's security program. A security police officer was immediately nosted in the area until the opening was secured. The unrestricted opening was a further example that plant staff were not fully aware of security program requirements. At the end of the inspection period, the certificant had begun an invest.igation to determine the cause of the breach.
19
r v-l 8 % 4
/
C c.
Conclusions I
These two incidents indicated that some plant staff did not have an adequate knowledge of all existing security program requirements and as a result, failed to adhere to them.
V.
Manaaement Meetinas XI.
Exit Meetina Summary The inspectors met with facility management representatives and the DOE Site Safety Representatives throughout the observation period and on i
November 18, 1996.
The likely informational content of the observation report with regard to documents or processes reviewed was discussed.
l Information highlighted during these meetings is contained in the Executive Summary. No classified or proprietary information was identified.
4 I
l l
l 20 l
,I
(
- q q
I PARTIAL LIST OF PERSONS CONTACTED Lockheed Martin Utility Services (LMUS)
S. A. Polston, General Manager 4
- H. Pulley, Enrichment Plant Manager j
W. E. Sykes, Nuclear Regulatory Affairs Manager
- T. B. Hudson, Plant Shift Superintendent Manager United States Enrichment Corocration
- J. H. Miller, Vice President - Production
- J. M. Brown, Engineering Manager
- J. A. Labarraque, Safety, Safeguards and Quality Manager United States Department of Enerav (D0E)
- G. A. Bazzell, Site Safety Representative Nuclear Reaulatory Commission (NRC)
- K. G. O'Brien, Senior Resident Inspector J. M. Jacobson, Resident Inspector
- Denotes those present at the routine resident exit meeting held on November 18, 1996.
Other members of the plant staff were also contacted during the observation period.
i ITEMS OPENED. CLOSED. AND DISCUSSED Opened i
None Closed 4
None Discussed None Certification Issues i
None y
21 i
j