ML20154P518

Insp Rept 70-7001/98-13 on 980721-0901.Violations Noted. Major Areas Inspected:Plant Operations,Main Surveillance, Engineering & Plant Support

ML20154P518
Person / Time
Site:	07007001
Issue date:	10/16/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20154P513	List: ML20154P510 ML20154P514 ML20154P518
References
70-7001-98-13, NUDOCS 9810230005
Download: ML20154P518 (32)

Text

_ _ . _ . ,._ _ . ~ . . . . -. _ _ __ _ _. .__ ___. ___ .-_ ._. _ . _ _ _ . _ .

, ~ . .

L l

t i

U.S. NUCLEAR REGULATORY COMMISSION REGIONlli l~

Docket No: 70-7001 Certificate No: GDP-1 l Report No: 70-7001/98013(DNMS)

I Facility Operator: United States Enrichment Corporation .

Facility Name: Paducah Gaseous Diffusion Plant l

l Location: 5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 L

Dates: July 21 through September 1,1998 L Inspectors: K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident Inspector Approved By: Timothy D. Reidinger, Acting Chief

, Fuel Cycle Branch l- Division of Nuclear Materials Safety t

l l

l 5

1 i

n 9810230005 981016

~

t PDR ADOCK 07007001 l .C PDR .

'I #

EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC Inspection Report 70-7001/98013(DNMS)

Plant Operations

. The inspectors concluded that an apparent violation occurred on August 26,1998, when the Number 2 Normetex Pump in Building C-315 (Tails Withdrawal) tripped while running onstream following an inadvertent closure of the discharge block valve.

Following the event, the plant staff determined that the safety system design was inadequate to ensure that the Safety Limit would not be exceeded for the design basis accident. As a result, all other Normetex Pumps were shut down. However, further review indicated that the release consequences of the specific design basis accident were not significant and that another safety system existed which would mitigate the '

release consequences to within limits specified for all design basis accidents involving a failure of the pump discharge piping. Based upon the reviews and given the implementation of other compensatory actions and restrictions, the NRC issued a Notice of Enforceme1t Discretion permitting resumption of Normetex Pump operations pending a proposed Technical Safety Requirement change. (Section 01.1)

The inspectors determined that some communications, conducted during the inspection period, between area control room operators in the process buildings and the plant shift superintendent's office did not fully convey to all responsible personnel the current

< equipment status or the latest operations guidance. (Section 01.2)

. The Inspectors identified that two operability determinations, documented for issues

, described in assessment and tracking repcits, did not fully address the issues raised in

) the reports and did not provide a clear line of logic, using inform'ation in the Safety Analysis Report and Technical Safety Requirements, to demonstrate system operability.

The determinations also did not provide a clear basis for understanding or tracking the issues to resolution. (Section 01.3)

. The inspectors identified a violation of 10 CFR 76.68(a) in that the Plant Operations Review Committee approved changes to plant operations as described in the Safety Analysis Report for the Normetex Pumps without performing a written safety evaluation.

- (Section 01.4)

Maintenance and Surveillance

. The inspectors identified a weakness in the implementation of the work control process I in that signatures for certain steps either were not present or were not sequenced in the order designated in the work package. (Section M1.1)

Enaineerina Plant management developed and implemented a clarified reporting policy for nuclear criticality safety incidents which appeared to result in clearer safety evaluations and a j more consistent and safety-focused determination of when a nuclear criticality safety

~

2

i. . .

.. _ _ _ _ _ - _ _ _ _ _ _ _ _ a

approval violation was reportable pursuant to the Safety Analysis Report requirements and Bulletin 91-01. (Section E1.1)

The incpectors identified a violation of 10 CFR 76.93 in that the Quality Assurance Plan did not include all of the basic and supplemental requirements of NQA-1-1989, as required by the regulation. Subsequent actions by the certificatee were taken to revise j the Quality Assurance Plan to ensure full conformance with the requirements of -

NQA-1-1989. (Section E1.2)

The inspectors identified an Unresolved item related to the implementation and completeness of plant processes for the identification, assessment, and reporting of defects and noncompliances involving augmented quality class components. In addition, the inspectors noted that engineering management's failure to resolve or elevate similar concems raised in a 1997 problem report represented a weakness in implementation of the corrective action system. (Section E1.3)

The inspectors determined that Safety Analysis Report change packages reviewed during the inspection period were approved in accordance with the goveming procedures and 10 CFR 76.68. Corrective actions identified by the plant staff and involving the sequence of reviews for change packages, appeared to have been effective in that packages reviewed by the inspectors were approved in accordance with the goveming procedures. (Section E1.4)

Plant Suooort The inspectors identified a weakness in the nuclear criticality safety approvals for some laboratory operations in that uranlur.1-233 was classified as a non-fissile material. The inspectors also determined that a weakness in some health physics and laboratory staff's knowledge of the nuclear criticality safety controls for fissile material control areas contributed to a weakness involving the improper use of a radiological waste disposal bag. The plant management implemented prompt corrective actions to correct and prevent recurren::e of similar problems. (Section R1.1)

. The inspectors documented two Non-Cited Violations which involved the plant staff's identification and prompt response to security events associated with the inadequate control of unmarked, classified materials. For each of the certificatee identified, non-recurring events, plant management developed appropriate long-term corrective actions to prevent similar problems. (Section S1.1) 3

Rooort Detalla I. Operations 01 Conduct of Operations O1.1 Normetex Pumo Pressure Transient

a. Insoection Scooe (88100)

The inspectors reviewed the circumstances surrounding a Normetex Pump trip on August 26,1998, which resulted in a pressure transient that exceeded the pump discharge bellows Safety Limit.

b. Observations and Findinas On August 26,1998, at 2:04 a.m. (Central Time), the Number 2 Normetex Pump in Building C-315 tripped while running in Mode 2 (Withdrawal). An operator, present in the area control room (ACR) at the time of the trip, noted that the resultant pressure transient, as displayed on an ACR computer display screen, reached approximately 46 pounds per square inch absolute (psla). The 46 psia peak pressure exceeded the Technical Safety Requirement (TSR) 2.3.2.1 Safety Limit maximum pressure of 45 psia for the discharge bellows. The transient lasted only a few seconds and was decreasing when an operator opened a vent line from the pump discharge back to the cascade.

Following the pump trip, the Plant Shift Superintendent (PSS) declared the Number 2 Normetex Pump inoperable. The plant staff also made a voluntary notification of the event to the NRC on August 27 and planned to submit a written report within approximately 30 days when the event investigation was finished (Event No. 34693).

During an initial investigation of the incident, the plant engineering staff determined that the pump discharge block valve inadvertently closed while the pump was operating onstream. Subsequent to the discharge block valve closure, a nonsafety-related interlock on the discharge block valve was energized sending a shutdown signal to the pump. The engineering staff also performed an analysis of the event and another similar event that occurred on July 7,1998. During the July 1998 event, the discharge pressure reached a peak pressure of approximately 43 psia,2 psia less than the Safety Limit of 45 psia. The analysis was documented in Engineering Evaluation No. EV-C-821-98-018, Revision 0, dated August 26,' 1998, and concluded that the total pressure transient (integrated response) that would be experienced by the pump discharge piping (including the bellows), following inadvertent closure of the discharge block valve and during pump coastdown, would be 14.0 pounds per equare inch (psi) for the Building C-315 Pumps, and 8.33 psi and 9.14 psi for the East and West Normetex

~

Pumps in Building C-310, respectively. The large discharge pressure transients were due to the positive displacement design of the pump and to the small length of the discharge piping between the pump and the block valve.

Subsequent to the event, the inspectors reviewed the Safety Analysis Report (SAR) and noted that Section 4.3.3.1.1 stated that the high discharge pressure safety system (HDPSS) was designed to " trip the pump at 42 psia to prevent exceeding the 45 psia pressure rating of the discharge bellows." The inspectors also noted that the 4

i ,

TSR 2.3.3.1 Basis Statement repeated the performance requirements for the HDPSS and referenced Section 4.3.3.1.1 of the SAR. Based on the plant engineering staff's calculated pressure transient of 8 to 14 psi following an inadvertent closure of the discharge block valve and given the TSR-specified Limiting Control Setting (LCS) of 42 psia for the HDPSS, the inspectors questioned if the safety system could perform the intended safety function, that is, ensure the pump discharge pressure did not exceed 45 psia. The inspectors discussed the findings with plant management and on August 27, plant management concluded that a reasonable assurance of operability for the HDPSS, as required by TSR 2.3.3.1, did not exist. As a result, the plant staff placed all the Normetex Pumps in Mode 3 (Standby) or Mode 4 (Not in Use) and withdrawal operations were ceased.

Following the shut down of all of the pumps, the plant engineering staff performed further reviews of the SAR-described accidents associated with the pumps and the safety systems identified to either prevent or mitigate the individual accident consequences. Based upon the reviews, the plant management determined that a failure of the HDPSS to shut down the pump, before a pipe rupture, could result in an approximate 3- to 5-pound release of uranium hexafluoride (UF.) to the immediate area of the pump. This estimate was based on the amount of UF. material that could be trapped between the pump suction and discharge valves following a pump shut down.

The engineering reviews also concluded that a second safety system existed, the process gas leak detection (PGLD) system, which was designed to mitigate the consequences from all causes of discharge piping failures to less than 250 pounds.

Th6refore, the plant engineering staff determined that the safety analysis limit for all failures of the pump discharge piping (including the bellows) was more appropriately described as 250 pounds of UF. versus the 5 pounds associated with a potential HDPSS failure. At the time of the Safety Limit exceedance, the PGLD system was available, operable, and could have limited a release from the pump discharge piping to less than the maximum assumed accident consequence of 250 pounds of UF..

Finally, the engineering staff investigated the actual pressure rating cf the discharge bellows associated with the Normetex Pumps, the assumed weak,lir,k in the discharge piping and the most likely source of a system integrity failure following an overpressure event. The investigation was undertaken based upon the plant staff's belief that the actual pressure rating of the bellows, the basis for the original Safety Limit during regulation of the facilities by the Department of Energy, was greater than that specified in the original engineering and purchase documents. Results of the investigations indicated that the pressure rating of the installed discharge bellows were greater than assumed during initial setting of the Safety Limit. Specifically, plant staff discussions with the individual bellows manufacturers and calculations indicated that an additional minimum safety margin of at least 20 psi existed for all of the Normetex discharge bellows beyond the 45 psia. As a result, the safety significance of exceeding the Safety Limit during the transient by 1 psi was considered minor.

Based upon: (1) the significant excess design safety margin of the installed discharge bellows; (2) the existence and availability of a second safety system to mitigate the release consequences of an inadvertent discharge valve closure; and (3) the limited release consequences from a discharge pipe rupture following a pressure excursion during a HDPSS failure, the certificatee requested and was granted enforcement discretion, by the Office of Nuclear Material Safety and Safeguards (NMSS) on 5

. O e

! August 28. A written Notice of Enforcement Discretion (NOED), dated September 1,

1998, was issued by the NRC to the certificatee. The NOED allowed the plant i management to resume withdrawal operations, with specific compensatory actions and i restrictions, pending the submittal of a TSR change. In issuing the enforcement

discretion, the NRC noted that continued operations of the plant in a recycle mode appeared to result in an increased potential for other significant safety concems without i a commensurate safety benefit.

The specific compensatory actions and restrictions required by the NOED to ensure that

. the Normetex Pump discharge pressure remained below 45 psia for all Modes, following i an inadvertent discharge block valve closure, included: (1) lowered operationallimits on i the suction and discharge pressures for the Normetex Pumps; (2) stationing an operator

to monitor pump pressures to ensure the pressures were maintained within the limits prescribed; and (3) reclassifying, testing, and controlling the discharge valve closure nonsafety pump trip as a safety-related trip to ensure the trip circuit would remain

reliable and available.

. The NOED also required the certificatee to submit a certificate amendment request to i the NRC by September 11,1998. The request proposed deleting the TSR 2.3.2.1 j Safety Limit and TSR 2.3.3.1 LCS. The certificatee indicated in the request that another

safety system, the PGLD system for the Normetex Pumps, was also credited with l maintaining a UF release from the rupture of the pump discharge line (including the 4

bellows) from fatigue or blockage to below 250 pounds. The 5 pounds of UF, which was the maximum calculated for release from the accident described in Section 4.3.3.1.1 was 25 to 50 times less than the rupture of the discharge line from fatigue ec blockage.

l During a followup review of the event, the inspectors concluded that a cause for the event appeared to be an inadequate original safety system design. Specifically, the HDPSS trip LCS of 42 psia was not low enough to preclude a discharge pwssure transient from exceeding the Safety Limit of 45 psia. in addition, the system design would not have allowed the plant staff to operate the pumps with an LCS in the 30-35 psia pressure range, as would have been required based upon the calculated pressure i transients. Operations with an LCS in the 30-35 psia range would have precluded the l pump from achieving efficient compression ratios without numerous safety system actuations. As indicated previously, the safety system design, and the associated TSR,  ;

were transferred from the Department of Energy Final Safety Analysis Report and Operational Safety Requirements without modification. The TSR-required surveillance tested the ability of the system to trip the pump at 42 psia, but would not have identified that the positive-displacement pump coastdown time was not fast enough to prevent exceeding 45 psia upon the closure of the discharge valve. l TSR 2.3.2.1 specified that the Normetex withdrawal pump discharge bellows pressure shall not exceed the Safety Limit of 45 psia for all Modes. The rise in discharge bellows pressure for the Number 2 Normetex Pump in Building C-315 to 46 psia, as the pump transitioned from Mode 2 (Wdhdrawal) to Mode 3 (Standby) upon closure of the discharge valve on August 26,1998, is an Apparent Violation (eel 70-7001/98013-01).

6

l 4

c. Conclusions The inspectors concluded that an apparent violation occurred on August 26,1998, when the Number 2 Normetex Pump in Building C-315 (Tails Withdrawal) tripped while running onstream following an inadvertent closure of the discharge block valve.

Following the event, the plant staff determined that the safety system design was inadequate to ensure that the Safety Limit would not be exceeded for the design basis accident. As a result, all other Normetex Pumps were shut down. However, further review indicated that the release consequences of the specific design basis accident were not significant and that another safety system existed which would mitigate the release consequences to within limits specified for all design basis accidents involving a failure of the pump discharge piping. Based upon the reviews and given the implementation of other compensatory actions and restrictions, the NRC issued an NOED permitting renewed Normetex Pump operations pending a TSR change.

01.2 Normetex Pumo Procedure Chanaes

a. Inspection Scope (881001

~

The inspectors reviewed the following revised procedures and 10 CFR 76.68 plant change request (PCR), and attended an associated Plant Operations Review Committee (PORC) meeting, as part of the followup to the Safety Limit violation discussed in Section 01.1:

1. Procedure CP4-CO-CN2021 A, Revision 0, " Operation of the C-310 Normetex Pump," approved August 28,1998;

2. Procedure CP4-CO-CN2021B, Revision 0, " Operation of the C-315 Normetex Pump," approved August 28,1998; and

3. PCR No. PCR-C-98-1240, Revision 0, approved August 26,1998

b. Observations and Findinas i

Following the Building C-315 Number 2 Normetex Pump trip on August 26, operations and systems engineering staff developed changes to the pump operating procedures designed to limit the suction and discharge pressures such that the TSR 2.3.2.1 Safety Limit (45 pala) for the discharge bellows would not be exceeded during future pump trips due to the inadvertent closure of the discharge block valve. The procedure changes specifically identified inlet and outlet pressures and required an operator or first-line manager to be stationed to monitor the pressures to ensure that the maximum pressures were maintained within the limits specified (suction pressure limits from 2.5 to

, 3.7 psia and discharge pressure limits of 29.5 to 33.5 psia, depending on the pump).

i- The inspectors reviewed the PCR associated with the procedure changes. The PCR stated that the procedure changes were: "being implemented to preclude the 45 psia Safety Limit from being exceeded. This system [high discharge pressure] is e nonconforming given that tne 45 psia limit was exceeded on C-315 No. 2 Normetex Pump. Until this nonconformance is resolved, the procedure changes . . . will ensure i the 45 psia limit is not exceeded.' The PCR, concluded that the changes did not require approval by the PORC, General Manager, or the NRC because plant staff had 4

determined that the procedure revisions did not change operations as described in the SAR or the basis for any TSR.

7 a

At a PORC meeting held on August 27 and prior to declaring the Normetex Pumps inoperable, the PORC reviewed and approved procedure revisions to incorporate the  !

operating pressure limits necessary to preclude exceeding the Safety Limit in the '

event of an inadvertent discharge valve closure. The PORC did not review the PCR.

During discussions with the inspectors, the PORC members indicated that the procedure changes were approved, in part, based upon a mistaken interpretation that 10 CFR 76.87 allowed enforcement discretion and renewed plant operations, using revised administrative controls, following the exceedance of a Safety Limit. Following a review of the regulations and after discussions with the NMSS project manager, the inspectors informed plant managemer't that this section of the regulations applied to development of the TSRs during the application process and was not intended to be i i used to grant relief from the TSRs during operations.

After reviewing the procedure changes, the PCR, and the SAR, the inspectors noted I that the new operating limits imposed pressure restrictions which were not described in Section 3.4.2 of the SAR, "Normetex Pumps." Section 3.4.2 of the SAR indicated that I l Normetex Pump suction pressures could range from 1 to 6 psia and discharge i pressures could range up to 39 psia before a pump operational trip would occur. In l addition, Section 4.3.3.1.1 of the SAR stated that the "HDPSS system will trip the pump

! at 42 psia to prevent exceeding the 45 psia pressure rating of the discharge bellows"in the event the " pump discharge valve were to fait closed on an on-stream pump."

TSR 2.3.3.1 also required that the Normetex Pump HDPSS be operable prior to entry  ;

into Mode 2 (Withdrawal) for any of the Normetex Pumps in Buildings C-310 or C-315. i l The inspectors determined that the changes approved by the PORC modified the l operating limits for the Normetex Pumps that were previously assumed as a part of the definition of the HDPSS and were described in the SAR. Such a change required a safety evaluation and consideration of the need for NRC prior approval.

The regulations in 10 CFR 76.68(a) permit the Corporation to make changes to the plant's operations as described in the SAR provided, in part, that a written safety analysis is conducted. The failure to perform a written safety evaluation for operating l procedure changes which modified the operating limits for the Normetex Pump and were assumed as a part of the HDPSS as described in SAR Sections 3.4.1 and

! 4.3.3.1.1 is a Violation of 10 CFR 76.68(a) (VIO 70-7001/98013-02). The inspectors noted that a similar violation was previously documented in Inspection Report 70-7001/97007.

l l c. Conclusions The inspectors identified a repeat violation of 10 CFR 76.68(a) in that the PORC ,

approved changes to plant operations as described in the SAR for the Normetex Pumps without performing a written safety evaluation.

l 01.3 Operations Staff Communications

a. Inspection Scooe (88100)

< During the inspection period, the inspectors reviewed ACR logs and had discussions with operators to assess the operations staff understanding of the current status of

equipment and operations in various process buildings.

8

b. Observations and Findinas The inspectors reviewed ACR operator logs and the PSS logs to assess the flow of information between the various process buildings, control room operators, and the PSS. The inspectors did not identify any safety issues as a result of the review.

However, the inspectors noted that information gaps were sometimes present in the ACR operators knowledge of current plant status or ongoing operations issues. For example, a control room operator in the Building C-335 ACR was not aware that the -

Unit 4 Cell 8 datum had been declared inoperable by the PSS. The inspectors also noted there was no notetion in the operator's log to indicate the datum was inoperable.

The first-line manager was aware that the datum had been declared inoperable and the cell was not in service, but the information had not been adequately communicated to the operator responsible for the equipment. The inspectors also noted that the operator was not aware of a requirement to notify the PSS if tarps were hung in the building during the seismic modification process to ensure that the high-pressure fire water sprinkler system was not inadvertently made inoperable. The PSS had issued guidance to the ACRs in response to the discovery of a subcontractor hanging tarps without full operations staff awareness and full consideration of the potential effect on the fire water safety system.

After the inst ectors informed plant management of the observations noted above, the plant staff identified additional concerns with operators' knowledge of the night orders on the backshift. Although none of the issues resulted in an immediate safety concem, the issues did indicate that the flow of information from the operators performing activities up to the PSS and back to the operators was not always rigorous,

c. Conclusions The inspectors determined that some communications during the inspection period between area control room operators in the process buildings and the plant shift superintendent's office did not fully convey to all responsible personnel the current equipment status or the latest operations guidance.

O1.4 Plant Shift Superintendent Operability Determinations

a. Inspection Scope (88100)

The ~ spectors reviewed selected assessment and tracking reports (ATRs) filed by plant sim.' during the inspection period to assess the PSS and shift engineering resolution of operability issues.

b. Observations and Findinas During the inspection period, the inspectors noted that, in general, ATRs with potential operability issues were properly brought to the attention of the PSS for review and an operability determination. Out of the dozens of operability determinations made during the inspection period, the vast majority appeared to be appropriate and supported by the SAR am! TSRs. However, the inspectors noted that the operability determinations for two A~i.ls, filed in response to a self-assessment of Building C-360 operations, were not fully supported by the justification documented on the ATR form.

9

l The first ATR identified a potential operations weakness which could have allowed an overhead crane used to handle cylinders to be stationed so as to block the closure of ]

the building containment system structures. The operability determination by the PSS 1 stated that the system remained operable because the accident scenario was not credible. A review of the SAR by the inspectors indicated that the accident scenario l (UF release from various operations in the building) was not characteriz 3d as  ;

incredible, but did not take credit for the building containment function in mitigating the l accident. As a result, the inspectors concluded that the system was not required to be )

operable since the system was not relied upon, but the rationale documented in the ,

operability determination was not correct nor supported by the SAR accident description.

The second ATR involved the identification of pressure switches for the emergency valve closure systems for the Building C-360 autoclaves and transfer station which were not calibrated in accordance with the QAP. The operability determination concluded that the autoclaves remained operable because the emergency valve closure system was a  ;

" defense-in-depth" system, not a TSR-required system for the autoclaves, and did not l require a test of the system. The transfer station system, which wa.s a TSR-required l system, was not addressed in the ATR. TSR 2.1.4.2.a required a test of the emergency valve closure system. As a result, the operability determination documented in the ATR .

appeared to be missing an important component. The inspectors were aware that the I transfer station had not been in service for an extended period of time for maintenance l and other issues. However, the ATR operability discussion did not appear to provide a basis for clearly tracking the calibration issue to resolution before the transfer station was made operable at some future date.

At the conclusion of the inspection period, operations management indicated that an l effort was underway to provide individual and group training to improve the approach I used by the PSS for making and recording operability determinations.

c. Conclusions The inspectors identified that two operability determinations, documented for issues described in assessment and tracking reports, did not fully address the issues raised in the reports and did not provide a clear line of logic, using information in the SAR and TSRs, to demonstrate system operability. The determinations also did not provide a clear basis for understanding or tracking the issues to resolution.

08 Miscellaneous Operations issues 08.1 Certificatee Event Reoorts (90712) i The certificatee made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concerns indicated at the time of the initial verbal notification. In the case of retracted notifications, the inspectors reviewed the basis for the certificatee's retraction of the notification at the time of the retraction. The inspectors will evaluate the associated written report for each of the events following submittal.

10

Number Status Illig 34556 Open Records within the records management database (Retracted- were marked as unclassified and thought to Close) contain classified information. However, a fu-ther review of the records determined that the information was not classified and the report was retracted.

l

. 34577 Open Tarps installed near the ceiling in Buildings C-331 l and C-335 for project work would have obstructed

l. the spray pattern of sprinkler heads in the affected L areas.

l 34625 Open Chlorine release detection system alarm in Building C-615. Approximately 30 pounds of chlorine was released.

l 34693 Open Normetex Pump in Building C-315 tripped while l running on stream. A discharge pressure of

( 46 psia was observed which is greater than l Technical Safety Requirement Safety Limit.

08.2 Bulletin 91-01 Reoorts (97012) l The certificatee made the following reports pursuant to Bulletin 91-01 during the inspection period. The inspectors reviewed any immediate nuclear criticality safety l concerns associated with the report at the time of the initial verbal notification. Any significant issues emerging from these reviews are discussed in separate sections of the report.

Number Qatg ))Mg 34559 7/21/98 Nuclear criticality safety violation due to boundary l control station bags used in Building C-310A are l alllarger than 5.5 gallons.

f 34573 7/23/98 Multiple assay verifications performed which do not comply with the double contingency principle.

, 34628 8/10/98 A uranium-233 solution was spilled in a sink.

L Containment area was established and a radiological waste bag was setup to collect the L

j waste. Collection of waste in a radiological waste l bag was not approved per the nuclear criticality I safety approval. (See Section R1.1) f 34670 8/21/98 Potentially fissile waste being generated in a l

>- fissile material control area was not being collected in approved maximum 5.5 gallon waste drums.

I 11

, i ,

Number Date Ilyg .

34724 9/1/98 Pre-filter was discovered on the Building C-360 UF , sample cabinet ventilation system. The nuclear criticality safety evaluation for this operation does not include analysis for the use of a pre-filter.

08.3 (Closed) Certificatee Event Report 34034: Discovery of the Building C-720 criticality accident alarm system (CAAS) inoperability in Building C-300 Central Control Facility.

The 10 milliroentgen per. hour light and alarm bell in Building C-300 did not function as designed during a quarterly test of the CAAS. The root cause of the failure was determined to be a J-7 Amphenol connector that was missing a retaining ring which allowe J safety-related wires to become disconnected. After the discovery, the connector was replaced and all the associated connectors in plant stores were inspected. No additional problems were identified. Based on the inventory inspection and the lack of any additional problems of this nature, the inspectors concluded the certificatee's corrective actions were reasonable and considered the event report closed.

08.4 (Closed) Certificatee Event Reoort 34507: Loss of power to the Building C-720 CAAS waming beacons. The loss of power occurred as a result of a breaker trip due to a lightning strike nearby to protect the electrical system from the power surge. The certificatee reset the breaker and concluded that no additional corrective actions were warranted based on the nature of the root cause. The inspectors concluded the certificatee's root cause analysis and corrective actions were reasonable and considered the event report closed.

08.5 (Closed) Violation 70-7001/98006-01: Failure to verify by test the adequacy of the Building C-720 CAAS hom design under conditions that simulate the most adverse design requirements. The violation was identified as a result of a failed functional test which demonstrated that the 24-volt hom channel would not sound the horns for the required 2 minutes due to a time-delay relay which was in the circuit. A modification of the circuit was made to remove the time-delay relay. Subsequent testing was performed to ensure both independent channels (24 volt and 48 volt) worked properly.

The certificatee also provided lessons leamed to design engineering personnel to improve the understanding of the design verification process required by the Quality Assurance Program for modifications to safety sydems. The inspectors concluded the certificatee's corrective actions were reasonable and considered the item closed.

08.6 (Closed) Certificatee Event Report 34446: Trip of 48-volt direct current (DC) breaker in the Building C-300 Central Control Facility causing loss of control power to numerous CAAS plant-wide. The DC breaker trip was subsequently traced to the failure of a relay.

On June 28,1998, the subject relay was replaced and there were no subsequent events of this type. The inspectors concluded the certificatee's corrective actions were i reasonable and considered the item closed.

08.7 (Closed) Certificatee Event Report 34483: Actuation of the water inventory control i system in Autoclave 1 East in Building C-337A. The steam controller for the autoclave 1 was inadvertently reconfigured to the ' manual" mode by a system engineer while attempting to exit the " read" mode. The " read" mode was used by the system engineer to check a recently changed gain setting. By placing the controller in manual, the 12

, - 4 ,

4 controller was not able to adequately track steam demand as the triple point for the UF, in the cylinder was reached. This caused excessive condensate buildup in the drain line and subsequent actuation of the safety system. In response to the event, the Engineering Department issued interim guidance to prevent system engineers from querying steam controllers while an autoclave !s operating. The Operations Department also provided additional training to the operations staff to enhance awareness and reiterate expectations on control of activities in the process buildings to prevent challenging safety systems. The inspectors concluded the certificatee's corrective actions were reasonable and considered the event report closed.

08.8 (Closed) Certificatee Event Report 34483: Drop of minimum plant air capacity below i 11,250 standard cubic feet per minute (scfm) due to an outage of the Building C-335 air plant because of a lightning strike. Plant staff subsequently performed an engineering evaluation vehich demonstrated that a reduction of the air capacity from 11,250 scfm to 11,000 scfm would not have impacted the ability of the air system to supply sufficient air to sound the CAAS homs onsite for the required 2 minutes. As a result, plant staff retracted the event report. The inspectors concluded that the certificatee's evaluation was reasonable and had no further questions.

08.9 (Closed) Certificatee Event Report 34469: Building C-310A high-voltage process gas leak detector above the side accumulator alarmed and remained in alarm for approximately 30 minutes, locking in the visible and audible alarms in the Building C-310 control room. Subsequent investigation by the plant staff, including sampling, identified that no UF, release had occurred in the area. The detector was subsequently reset and test fired prior to being declared operable. The plant staff subsequently retracted the event report based on an operator being stationed to monitor the status of the local signal conditioner in Building C-310A for additional incoming alarms while the detector was inoperable. As such, the certificatee concluded that the safety function had been met by a redundant means and the event was not reportable. The inspectors concluded i that the certificatee's evaluation was reasonable and had no further questions.

08.10 (Closed) Certificatee Event Reoort 34492: Safety system actuation of the Building C-315 No. 2 HDPSS. The pump discharge pressure reached approximately 43 psia during a pressure transient following the pump trip. The investigation by the plant staff identified that the pump trip occurred as a result of a nonsafety signal associated with the closure of the pump discharge valve. As such, the event was not reportable and the certificatee retracted the event report. The inspectors concluded that the certificatee's evaluation was reasonable and had no further questions.

08.11 (Closed) Certificatee Event Report 34496:' Building C-315 PGLD over the No. 2  ;

Withdrawal Position alarmed. A subsequent evaluation by the plant staff identified that during the time operators were responding to the alarm, any additional PGLD alarms would have been annunciated on the local signal conditioner in the control room. An operator was stationed to observe the signal conditioner and alert other personnelif an additional alarm came in. As such, the certificatee concluded that the safety function had been met by a redundant means and the event was not reportable. The inspectors concluded that the certificatee's evaluation was reasonable and had no further j questions.

08.12 (Closed) Violation 70-7001/97003-02: Failure to properly control access to areas under I Limiting Condition of Operation (LCO) Action Statements because of inoperable CAASs.

13

On several different occasions, individuals entered LCO exclusion zones without the proper dosimetry or a radio required by the LCO Action Statements. As corrective actions, the plant staff provided additional training and issued an employee bulletin to re-emphasize the LCO requirements, in addition, public address announcements were made each time a CAAS was declared inoperable. The plant staff also installed permanent flagging for building exclusion zones to be used in lieu of cones during a CAAS inoperability. Since the initial exclusion area violations in the spring of 1997, the inspectors were not aware of any significant additional issues of individuals not following the LCO Action Statements. As a result, the inspectors concluded the certificatee's corrective actions were reasonable and considered the violation closed.

08.13 (Closed) Violation 70-7001/97003-01: Failure to monitor temperatures and pressures of cascade cells in Building C-310 (Product Withdrawal) during a planned period of CAAS inoperability. In response to the identification of the violation, the plant staff immediately began monitoring temperatures and pressures in accordance with TSR 2.4.4.2.b. The i violation resulted when operators failed to implement a second CAAS TSR in the Enrichment Cascade Facilities Section of the TSRs (Building C-310 included both cascade and withdrawal operations). To preclude a recurrence, the plant management issued a TSR clarification which reminded operators that both the Cascade and Withdrawal TSRs applied to Building C-310 in the event of a CAAS inoperability. The plant management also requested a TSR change b cross-reference the cascade and withdrawal TSRs for CAAS to ensure the cascade TSR would not be overlooked.

Finally, the plant management revised the procedure used by the PSS for tracking inoperable equipment to ensure the PSS and front-line manager discussed the required LCO actions prior to making a safety system inoperable for planned work. The inspectors were not aware of any further violations of this nature. As a result, the

. Inspectors concluded the certificatee's corrective actions were reasonable and

. considered the violation closed.

08.14 (Closed) Violation 70-7001/97002-02: Two instrument mechanics performing safety-related duties worked more than 16 consecutive hours, excluding shift turnover time, without preauthorized approval, in violation of TSR 3.2.2.b. In response to the violation, the plant management issued an hours of work procedure which included guidance on meeting the TSR requirements on work limitations, in addition, a computer program to track hours of work and process overtime requests was placed into service.

Adc;itional training on the hours of work policy was provided to the plant staff and management. Finally, a performance indicator to track compliance with the work hours requirements in TSR 3.2.2.b was developed. The inspectors concluded the certificatee's corrective actions were reasonable and considered the violation closed.

II. Maintenance and Surveillance M1 Conduct of Maintenance and Surveillance M1.1 Work Packaae imolementation

a. Inspection Scooe (88103)

The inspectors reviewed selected maintenance and construction activities for conformance with requirements in associated work packages. In particular, the inspectors reviewed the following work packages:

14

1. Work Package K2PCWP5108, 'Ceti Floor Bracing"; and

2. Work Package K2PCWP5112," Cell Fbor Bracing.'

b. Observations and Findinas The inspectors identified several problems with implementation of the work packages which were mod to perform seismic modifications in Building C-335. The problems included performing steps out of sequence or bypassing certain steps, and sign-offs which were not timely or not performed by the correct individuals. The seismic modifications involved removal of cell floor concrete and installation of steel braces.

Following identification of the problems, the inspectors discussed the findings with the project engineer (PE) responsible for the seismic modifications and for oversight of the subcontractor performing the actual work. Subsequent to the discussions, the PE conducted a complete review of all outstanding work packages in use by the subcontractor. Results of the 100 percent review indicated several additional inconsistencies in the work package documentation.

Based upon a review of the individual errors, the inspectors concluded that only one of the errors, involving the installation of temporary structural bracing, appeared to be of potential safety significance. The PE and the inspectors performed further reviews of the possible impact of the error and determined that appropriate engineering evaluations had been completed to ensure that the areas of the building requiring temporary bracing were identified. in addition, none of the work packages that wore improperly completed involved areas requiring temporary bracing.

In response to the issue, the PE initiated a work standdown to provide additional training to ensure a common understanding existed between the plant staff and subcontractor personnel of the requirements and methods used to direct work activities at the site.

Subsequent to the above described findings, the inspectors identified similar problems with work performed on a supply breaker for some nonsafety-related equipment.

Specifically, the work package did not include documentation of required reviews of the lockout and tagout requirements during the pre-job briefing. In addition, the work package did not include signatures for starting and stopping the work for the time period between when the modification was initially installed and when revisions were made to ensure National Electrical Code requirements were incorporated in the modification.

Also, drawings used to initially install the modification were not maintained es a part of the work package. Instead, the original drawings were replaced after additios'al modifications were made to ensure conformance with the National Electrical Cede.

While neither of the issues identified by the inspectors appeared to have immediam safety significance, the inspectors were concemed that the weaknesses wore not m! dressed promptly and comprehensively to ensure that a trend did not develop. The mspectors reviewed the immediate corrective actions taken by plant management to resolve the specific issues and to elevate the sensitivity of all staff to the need for increase attention-to-detail and rigor during the implementation of work packages. The corrective actions appeared reasonable and the inspectors had no further questions.

The failure to follow work control practices during the implementation of some work packages, is a violation of minor significance which is not subject to formal enforcement action.

15

I

c. Conclusions The inspectors identified a weakness in the implementa*.'on of the work control process I in that signatures for certain steps either were not present or were not sequenced in the order designated in the work package.

~

111. Enaineerina E1 Conduct of Engineering E1.1 Reoortina Nuclear Criticality Safety Events I

' a. insoection Scooe (88100) m '

The inspectors reviewed several recent nuclear criticality safety (NCS) incidents and  !

assessments performed by plant staff to determ!ne whether or not the incidents were reportable under Bulletin 91-01.

b. Observations and Findinos -

I During the inspection period, several NCS incidents were reviewed by the NCS engineers and the PSS for reportability. The assessments were documented in Criticality Safety incident Reports. Examples of the types of incidents involved included unsafe volume bags brought into a fissile material control area, the collection of waste generated in cleaning up a uranium-233 spillinto an unapproved container, and a filter for a negative air machine which was not replaced when the differential pressure limit in the associated nuclear criticality safety approval (NCSA) was reached.

In assessing the reportability of the incidents, the plant staff recently documented and implemented a policy statement which defined what constituted a violation of the double contingency principle (Criterion AA.a of Table 1 of Section 6.9 of the SAR). The policy statement documented that reporting would be required when the double contingency principle was violated, i.e., where one of the process conditions (or parameter limits) relied upon to satisfy double contingency was violated. For example, if double contingency was predicated upon not bringing more than 5.5 gallons of fissile material into an area and someone entered the area with a container of potentially fissile materials greater than 5.5 gallons, the incident would be reportable. However, if the process condition (or parameter limit) was not violated, i.e., a container of greater than 5.5 gallons which did not contain potentially fissile material was brought into the area,

' the incident would not be reportable. The " control" identified in the NCSA or

. Implementing procedures (not bringing a container greater than 5.5 gallons into the

- area) would have been violated and tracked for resolution in the Corrective Action Program, but the control violation would not be reportable if the process condition

(5.5 gallons of potentially fissile material) was not violated.

. The inspectors noted that the plant policy statement appeared to address the safety significance requiring reporting to the NRC as described in the SAR and Bulletin 91-01.

The assessment process focused on ensuring the as-found NCS condition was appropriately evaluated, documented, and reported to NRC. The process appeared to add:ess the significance threshold in Bulletin 91-01 by clarifying for plant staff what constituted a " violation of the double contingency principle.' The inspectors noted that 16

,.,.n, ,-,.~ . . - ... _-

l i

i the assessments of reportability reviewed were performed in accordance with the guidance outlined above'and yielded clearer, more consistent safety evaluations of as-found NCS conditions. The inspectors noted the assessments appeared to have ,

i been performed in accordance with the NCS position and the SAR requirements and '

had no further questions.

c. Conclusions Plant management developed and implemented a clarified reporting policy for nuclear criticality safety incidents which appeared to result in clearer safety evaluations and a more consistent and safety-focused determination of when a nuclear criticality safety approval violation was reportable pursuant to the SAR requirements and

- Bulletin 91-01.

E1.2 O'uality Assurance Plan issues l

a. Insoection Scope (88'100)

The inspectors performed a followup review of the certificatee's actions to resolve an Unresolved item (URI 70-7001/97009-01). j

b. Observations and Findinas The inspectors reviewed intemal assessments, conducted by plant and corporate staff,

, to determine the completeness of precertification efforts to incorporate both the basic l- and supplemental requirements of American Society of Mechanical Engineers (ASME)

Standard NQA-1, " Quality Standards for Nuclear Facilities," into the QAP and associated procedures. Previously, the inspectors had questioned in Inspection Report i

70-7001/97009 the QAP's adequacy during a sampling review of the QAPs. The inspectors noted that information gathered during the intemal assessments indicated that all of the requirements of NQA-1 were not incorporated into the QAP or associated procedures as required by 10 CFR 76.93. Specifically, the intemal assessment results l documented that some NQA-1 supplemental requirements associated with design L control and measuring and test (M&TE) equipment were not expressly included in the QAP. However, the plant staff also documented in the assessments that most of the requirements were already included in and implemented by plant procedures.

On November 17,1997, January 23,1998, and February 27,1998, the certificatee sent letters to the NRC which communicated the results of their QAP intemal assessments and proposed corrective actions to resolve the identified deficiencies. The corrective l actions included a QAP revision, which was submitted on February 27,1998, and

. included the previously omitted requirements, and a commitment to revise procedures

associated with the QAP to ensure full implementation of the QAP changes. The

! Inspectors noted that the letters did not include a date by which the procedure changes would be made. The failure to specify in the letters to the NRC the date by which the procedures would be revised to fully implement the QAP changes was considered a weakness.

Because the certificatee's letters to the NRC did not specifically state the date by which

- the revised QAP requirements would be fully incorporated into plant procedures, the inspectors reviewed the status of the associated procedure changes. The inspectors 17 l

[ . - _ . - ~ _ , , - -

. determined that most of the required procedure changes had been implemented; however, plant records indicated that some procedure changes associated with the l M&TE requirements were not schedule for completion until early 1999. l The inspectors discussed the procedure revisions required to incorporate the new QAP l design change requirements with the responsible plant engineering staff and reviewed 1 the current plant procedures. The engineering staff indicated that new QAP l requirements were incorporated into the current plant procedures during initial development of the procedures using NOA-1. However, the procedures requirements  ;

were not cross-referenced to specific QAP requirements since some of the NQA-1 ,

l supplemental requirements were not included in the QAP. The inspectors performed a l

check of some of the new QAP requirements against the current procedures and did not identify any deficiencies. As of the tr# of the inspection period, the plant staff were developing an evidence file to demoi.sta the previous adequate incorporation of the new QAP requirements into current plan. .rmdures.

The M&TE changes to the QAP and plant procedures involved the addition of .

' requirements specified in NQA-1 Supplement 12S-1. The inspector discussed the published plant schedule for incorporation of the new requirements with plant staff involved with the M&TE program. The instrumentation manager indicated that the scheduled dates were chosen to facilitate an overall improvement in the procedures in addition to making the revisions necessary to document the conformance of the current procedures to the new QAP requirements. The inspectors performed a review of some current plant procedures against the new QAP requirements and noted that the current procedures appeared to include the NQA-1 Supplement 12S-1 requirements. However, the procedures did not include notations used to cross-reference the individual procedure steps to the requirements included in the QAP, As of the end of the inspection period, the plant staff were developing an evidence file to document that the new M&TE QAP requirements were properly incorporated into current plant procedures.

During review of the procedure changes required to implement the new QAP requirements, the inspectors noted that the Compliance Plan included several issues which were related to QAP implementation. The inspectors also determined that previous Compliance Plan quarterly status reports indicated that the work required to resolve the original QAP implementation issues was completed. However, the above referenced correspondence clearly indicated that procedures changes may be required to achieve fullimplementation of the new QAP requirements. The inspector determined that the plant staff's failure to ensure that the status of Compliance Plan-related issues, as communicated in the Compliance Plan routine quarterly report and letters associated with the QAP, were consistent was a weakness in the certificatee's process for communicating information with the NRC. However, the weakness had no safety or regulatory significance in this instance since the NRC was formally notified of the status of QAP implementation in a timely manner.

Title 10 of the Code of Federal Regulations, Part 76.93," Quality Assurance," requires, l In part, that the certificatee shall establish a QAP satisfying each of the requirements of ASME NQA-1-1989, " Quality Assurance Program Requirements for Nuclear Facilities,"

j or acceptable attematives. The failure to establish a QAP that incorporated ASME Standard NQA-1-1989 supplemental requirements associated with design control and measuring and test equipment is a Violation of 10 CFR 70.93 (VIO 70-7001/98013-03).

18

l l

Because the certificatee had proposed, formally communicated to the NRC, and implemented corrective actions to resolve the violation, as discussed previously, no response to the violation is required. In addition, the Unresolved item (URI 70-

. 7001/97009 01) opened to document the inspectors' initial concerns regarding completeness of the QAP is considered closed,

c. Conclusions The inspectors identified a violation of 10 CFR 76.93 in that the QAP did not include all of the basic and supplemental requirements of NOA-1-1989, as required by the regulation. However, subsequent actions were taken by the certificatee to revise the l QAP to ensure full conformance with the requirements of NQA-1-1989.

E1.3 Reportina Reauirements for Auamented Quality (AQ) Class Components and Systems

a. inspection Scope (88100) l L

The inspectors reviewed the current plant policies and procedures used to identify, assess, and report defects and noncompliances associated with AQ quality components and systems,

b. Observations and Findinas The inspectors determined that several engineering procedures and staff guidance documents assigned responsibility and provided instructions for the identification, assessment, and reporting of defects and noncompliances involving safety-related equipment and services in accordance with Title 10 of the Code of Federal Regulations (CFR), Part 21. The inspectors noted that the procedures and staff guidance 1 documents clearly stated a management expectation that defects and noncompliances associated with all safety-related equipment (Quality, Augmented Quality - Nuclear Criticality Safety, and Augmented Quality classes) had to be identified and assessed for safety impact and regulatory reportability. Engineering was assigned responsibility for )

identifying components as safety-related and for determining if a defect or i noncompliance of the components with defined critical characteristics could have a significant safety impact and thereby be reportable.  !

. During discussions with engineering management and staff, the inspectors concluded that some engineering management and staff were not aware that the defect and noncompliance assessment and reportability process applied to AQ quality class components, in addition, the inspectors determined that the current procedures and staff training did not appear to include criteria by which to determine the critical characteristics of AQ quality class components. The procedures also did not provide a method by which to determine if the consequences of an AQ quality class component were safety significant and thereby satisfied the minimum criteria for inclusion in the process.

In order to assess the plant staff's implementation of the current defect and noncompliance process for AQ quality class components, the inspectors reviewed a j sampling of recent nonconformance reports. The nonconformance reports documented

_ instances when AQ quality class equipment failed receipt inspections or during use.

! The inspectors noted that each nonconformance report was evaluated to determine if 19

t the failure represented a significant safety hazard and if the failure was reportable.

However, the individual evaluations were not always documented using the recommended forms and did not always include a full explanation of the bases for the 2

conclusions reached. Therefore, the inspectors could not independently conclude that the final decision for each rejection or failure was correct without further reviews. At the end of the inspection period, engineering management was reviewing a sampling of the problem reports to ensure that the conclusions were correct and properly documented.

The inspectors also identified that a 1997 problem report (nonconformance report) had been filed to document a previous concern, raised by the plant quality assurance organization, with a lack of proper application of the defect and noncompliance process to AQ quality class components.

At the time of the inspection, plant staff actions to address the 1997 problem report referenced concerns had not been completed; however, an initial management response was on file. The inspectors reviewed the management response and noted the response appeared to conflict with plant procedures and the underlying regulatory requirements. The inspectors further discussed the problem report with engineering management and determined that the issues raised in the problem report had not been resolved due to differences in interpretation of the underlying regulations by the staffs at the two gaseous diffusion plants. Engineering management also indicated that the differences had not been highlighted to the current plant engineering manager, regulatory affairs manager, the plant general manager, or the corporate regulatory affairs manager for further action and to ensure a timely resolution of the concem. At the end of the inspection period, engineering management was conducting a review of the initial management response to the problem report and of the current policies and procedures to ensure a proper application of the defect and noncompliance reporting process to AQ quality class coroponents. Management's failure to resolve or elevate to a higher level of management the concems raised in the problem report for over a year was considered a weakness in implementation of the problem reporting system.

Pending completion of the inspectors' review of the plant staff's bases for dispositioning previous problem reports involving AQ quality class component defects or noncompliances and managements' resolution of the 1997 problem report, the adequacy of the plant processes for the identification, assessment, and reporting of AQ quality class component noncompliances will be tracked as an Unresolved item (URI 70-7001/98013-04),

c. Conclusions The inspectors identified an URI related to the implementation and completeness of the plant processes for the identification, assessment, and reporting of defects and noncompliances involving AQ quality class components. In addition, the inspectors noted that management's failure to resolve or elevate similar concerns raised in a 1997 problem report represented a weakness in implementation of the problem reporting system. .

20

l E1.4 Aoolication Chance Process Review

a. Insoection Scooe (88100)

The inspectors reviewed selected aspects of changes to the SAR, including a review of the following procedures:

1. Procedure UE2-OP-RR1034, Revision 0, " Control and Maintenance of the NRC Certification Documerits," approved August 27,1996;

2. Procedure UE2-RA-RR1036, Revision 0, "10 CFR 76.68 Plant Change Reviews,"  :

l approved August 29,1996; and  !

l 3. Procedure UE2-EG-NS1030, Revision 0, "Unreviewed Safety Question l Determination," approved August 29,1996. l The inspectors also reviewed selected SAR change packages and attended PORC and  ;

Nuclear Safety Subcommittee (NSS) meetings.

b. Observations and Findinas The inspectors noted that the SAR change packages reviewed contained reasonable analyses as to why the changes did not require NRC approval, including PCRs documenting the review of certification documents and unreviewed safety question determinations (USQD) and safety evaluations. The inspectors also noted that the NSS and PORC reviews attended were characterized by a questioning attitude and safety-focused discussions. The meetings were conducted in accordance with the PORC and NSS procedures.

The inspectors determined the five SA.R change packages reviewed during the inspection period were approved in accordance with the requirements in the controlling procedures noted above. However, the inspectors also noted that in June 1998, the plant staff identified that certain Requests for Application Change (RACs) for SAR changes had not been reviewed in the exact sequence outlined in the three procedures.

Specifically, the Nuclear Safety Manager had not reviewed and approved the safety evaluations, as evidenced by signature dates on the ch'sck sheets in the procedures, prior to the evaluator completing Section 18.1 of the PCR. Step 6.2.10 of Procedure UE2-EG-NS1030 required the safety evaluation to be submitted to the Nuclear Safety

- Manager for review, approval, and signature as part of the completion of the USQD process. The safety evaluations were reviewed and approved by an independent reviewer. The safety evaluation was then to be used by the evaluator in completing the PCR.

The inspectors noted that the procedural requirements for the RAC process were somewhat complex in that the process was govemed by three procedures and required the Nuclear Safety Ma ager to make two reviews, one at the time of the safety

. evaluation development and one to review the PCR (and its associated USQD) after the subject matter expert preparing the package completed his or her review. As a result, on some packages, the Nuclear Safety Manager had completed review of the safety evaluation and PCR at the same time. In addition, the package signoffs did not always L clearly indicate that comments incorporated in the package during the review were fully reviewed by all the involved staff. The failure to obtain a review of the safety evaluation 21

.. +- , _ , m - -.

...--..v.-

l by the Nuclear Safety Manager before signoff of Section 18.1 of the PCR constitutes a violation of minor significance and is not subject to formal enforcement action.

In response to the issues raised by the plant staff and documented in three ATRs, the Nuclear Regulatory Affairs Department issued an e-mail to personnel generating RACs which provided a step-by-step signature sequence to coalesce the requirements of the three procedures. The e-mail also identified that changes were to be reviewed by the same organizations that performed the original review. The ATR response also included an action to review and revise, as needed, the SAR change process by October 30,1998, to improve the process.

I In response to the SAR change packages which were identified with the reviews completed out of sequence, the NSS Chairman issued a memorandum dated June 16, 1998, that specified the procedural requirements should be followed in all cases, but that the procedures did not clearly address the exact sequence for re-reviewing changes made during the comment resolution cycle and the NSS could not resolve the issue. l The memorandum also stated that if packages arrived at NSS for review with signatures which were out of sequence due to the review of comments, an ATR should be initiated to document the problem, but that the NSS would perform the technical review and make a recommendation to the PORC for approval or disapproval based on the technicalissues while identifying the re-review sequence problem. Procedure CP2-EG-NS1038, Revision 0, " Plant Operations Review Committee: Nuclear Safety Subcommittee," approved July 29,1997, required that the NSS notify the PORC Chairman, NSS, and write a problem report when safety concerns were identified.

Thus, the inspectors concluded that the procedural requirements for NSS review had been met, but that the memorandum endorsing NSS recommendations for RAC packages which did not have the necessary sequence of signatures documented appeared to be non-conservative in that changes made during the review cycle may not have been fully evaluated by all concerned parties prior to PORC review. Additional discussions with various members of the PORC indicated that the expectation was that tne procedural requirements be followed in preparation of RACs with the emphasis being that the package reviewed and approved by PORC be completely reviewed by all the responsible parties. I

c. Conclusions The inspectors determined that SAR changs packages reviewed during the inspection period were approved in accordance with the goveming procedures and 10 CFR 76.68. ,

Corrective actions for a minor violation, identified by the plant staff and involving the sequence of reviews for change packages, appeared to have been effective in that packages reviewed by the inspectors were approved in accordance with the governing procedures.

E8 Miscellaneous Engineering issues E8.1 (Closed) Insoection Followuo item 70-7001/97002-16: NOED GDP97-1 issued for lack of a TSR Design Requirement for hoist brakes on two feed facility cranes. The certificatee was granted an NOED to allow continued use of the feed facility cranes after the plant staff discovered that the cranes did not have two direct-current rectified shoe brakes as required by TSR 2.2.5.2. However, the cranes did have two hoist brakes meeting the requirements of American National Standard B30.2,1990 Edition. The 22

certifcatee i subsequently submitted and received a TSR amendment which allowed the usa of a brake other than a rectified shoe brake. The inspectors concluded the certificatee's corrective actions were reasonable and considered the item closed.

E8.2 (Closed) Insoection Followuo item 70-7001/97002-14: Cylinders filled to TSR limits could have liquid instead of vapor UF. above the cylinder valve contrary to assumptions made in the associated accident scenario. The certificatee revised the current procedure for inspecting UF, cylinders scheduled to be heated to include a requirement to ensure that the mass of UF In the cylinder volume would not expand when liquified to a level above the cylinder valve. As such, the assumption of the accident analysis would remain valid. The inspectors concluded the approach was reasonable and considered the item closed.

IV. Plant Suncort R1 Conduct of Radiation Protection Activities R1.1 Cleanuo of a Minor Soill of Fissile Material

a. Insoection Scooe (88100)

The inspectors reviewed the health physics (HP) staff's response to and cleanup of a spill of fissile material in a plant laboratory room.

b. Observations and Findinas During a routine review of ATRs, the inspectors identified a situation involving a spill of fissile materials that appeared to be reportable per the requirements of Bulletin 91-01.

Specifically, an HP technician brought a radiological waste disposal bag, with a volume of greater than 5.5 gallons, into a fissile material control area (FCA) in violation of a NCSA for operations within the FCA. The inspectors noted that the ATR filed to document that the situation did not involve a loss of either of the relied upon double contingencies and was therefore not reportable. The ATR was completed by the PSS with additional guidance provided by NCG staff.

The inspectors discussed with the PSS and NCS staff the reportability decision. During the discussions, the inspectors were informed that the isotope of uranium involved in the

spill, uranium-233, was considered to be non-fissile by the NCS program. Therefore,

- the placement of wastes, developed during cleanup of the spill, into a volume greater than 5.5 gallons, a double contingency volume limit specified in a NCSA for the FCA, was not a violation of the double contingency. In addition, the NCS staff indicated that the amount of uranium-233 involved in the spill and subsequent cleanup was insignificant from an NCS perspective.

While the immediate safety significance of the it, sue appeared minor, the inspectors were concerned with the appropriateness of the process by which the non-reportability decision was reached. Specifically, the inspectors were concemed that NCS and plant management had revised, through the NCS program, the definition of fissile materials to exclude uranium-233 and thereby indirectly obviated the reportability of an issue that appeared to involve the loss of a single contingency. Subsequent to the discussions between the inspectors and the plant staff, the plant management chose to report the 23

l situation ae a loss of a single contingency. The report was made consistent with the requirementt of Bulletin 91-01 and within the required 24-hour reporting timeframe (Event No. 34628). The plant management also initiated a reevaluation of the spill, the applicable NCSAs, and the general concept of treating uranium-233 as nonfissile material.

As a followup to the ATR reportability review, the inspectors discussed the spill with HP staff, laboratory staff, and HP management. During the discussions with the HP staff and management, the inspectors and HP management noted several apparent weaknesses in the HP staff's knowledge of some laboratory-specific NCSA l requirements and with the generic NCSA incident response protocol. An additional l weakness was identified with the laboratory staff's knowledge of some of the laboratory-specific NCSA requirements. Specifically, some laboratory staff incorrectly believed that )

a greater than 5.5 gallon volume container could be brought into an FCA, provided the l container was constantly attended. Each of the weaknesses identified during the I discussions was documented by the HP management in an ATR and specific immediate and long range corrective measures were developed. The immediate corrective actions ,

included staff briefings on laboratory-specific NCSA requirements and on generic NCS incident response protocols. In addition, plant management had previously initiated a program to review the process for developing the NCS requirements, with an intent to simplify and make consistent the requirements for similar operations, and an intent to heighten the plant staff's awareness of NCS violations through the development and use of an NCS Error Training Lab.

The inspectors also reviewed the NCSAs associated with laboratory operations in the area of the spill and the FCA. The inspectors determined that an individual would have to be familiar with four NCSAs in order to properly implement the specified controls for handling of fissile materials in the FCA. The inspectors also determined that one of the NCSAs improperly excluded uranium-233 enriched material from consideration as fissile material. However, the inspectors concluded that another NCSA properly considered uranium-233 a fissile material and applied two NCS controls on the allowed mass of the materialin order to ensure proper application of the double contingency principle.

Based upon an independent review of the involved NCSAs, the inspectors determined that the addition of the uranium-233 contaminated wastes to the radiological waste disposal bag did not violate the specified double contingency principle controls for the involved NCSAs. Specifically, the mass controls relied upon for nuclear criticality safety of the uranium-233 materials were not violated and the volume controls for other fissile materials, as specified in other applicable NCSAs, were not violated because no other fissile materials were added to the radiological waste disposal bag. However, the HP and laboratory staff's use of the bag on two occasions within the FCA was a violation of the procedures developed for FCA operations.

The HP and laboratory staff's failure to properly limit the volume of a container, a radiological waste disposal bag, brought into the FCA was a violation of minor safety l

significance of the procedural controls developed for FCA operations and is not subject to formal enforcement action.

l l

c. Conclusions The inspectors identified a weakness in the NCSAs for some laboratory operations in that uranium-233 was classified as a non-fissile material. The inspectors also 24

l .

determined that a weakness in some health physics and laboratory staff's knowledge of the nuclear criticality safety controls for fissile material control areas contributed to a minor procedural violation involving the improper use of a radiological waste disposal bag. The plant management implemented prompt corrective actions to correct and preclude recurrence of the minor violation.

L S1 ' Conduct of Security and Safeguards Activities S1.1 ' Classified Information Control Incidents l

a. insoection Scooe (88100)

The inspectors reviewed the circumstances surrounding two security events reported to the NRC during the inspection period.

b. Observations and Findinas On August 5, the security staff identified that an unclassified document, developed by combining information from different sources was, in fact, classified. The document had been sent to selected individuals in the Department of Energy (DOE) outside the controlled access area. The event appeared to have been caused when an authorized derivative classifier (ADC) brought the document to a site classification officer for review, but did not infom. the officer of the ADC's concem that certain information in the document might be classified. The classification officer, who was familiar with unclassified documents containing similar information, did not perform a rigorous review of the new document in response to the event, the plant staff retrieved most of the documents sent to the DOE individuals and verified that the personnel receiving them were properly cleared to receive the classified information. For those documents not retrieved, the plant staff ensured that the documents were reclassified and properly marked. In addition, the plant management initiated corrective actions to ensure that both ADCs and the classification officer independently reviewed the classification status of newly created documents and communicated the review resuits to each other. The lessons leamed were also communicated to the DOE. This non-repetitive, certificatee-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/98013-05), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

On August 17, the plant staff identified that a package, which had been removed from the classified materials storage vault the previous Friday, August 14, contained a K classified document that was not property marked. When the documents were removed u "

. from the vault, the plant staff member who removed the materials believed that the package contained only unclassified information. However, the inspectors noted that the materials were placed in the vault during a earlier site-wide classified material sweep

l. because a potential existed for the package to contain improperly marked classified l . Information.

Following removal from the vault on Friday, the materials were provided to an ADC for a classification review. At that time, the ADC was not informed that the materials were previously stored in the classified materials storage vault or that the materials had been gathered as a part of the previous site sweep efforts, in addition, the ADC was not informed that the materials had to be returned to the vault prior to the end of the

. business day. At the end of the business day, the plant staff member that chetked the 25 l .. . - . . - .~ - . . -_. .- . - - -

,c .

i a

i materials out of the vault did not retrieve the materials from the ADC and return them to the vault.

I Plant management reviewed the issue and identified weaknesses in the process for

checking out and reviewing documents to the classified materials storage vault which

could potentially contain classified information. The event investigation also concluded that the materials had not been accessible to any uncleared individuals over the j weekend and had remained within the controlled access area at all times, in response i to the findings, the plant staff promptly developed corrective actions for the incident

, which included process changes to ensure that potentially classified items stored

in the vault were reviewed prior to removal from the vault. This non-repetitive, j certificatee-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/98013-06), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

l c. Conclusions i

The plant staff promptly responded to two security events involving inadequate i identification and control of unmarked, classified materials and developed Icng-term

! corrective actions to prevent similar problems in the future.

S8 Miscellaneous Security lasues i

!- S8.1 Certificatee Security Reoorts (90712)

The certificatee made the following security-related one hour reports pursuant to

10 CFR 95 during the inspection period. The inspectors reviewed any immediate

! security concems associated with the reports at the time of the initial verbal notification.

M M j-2 8/4/98 Additional document containing classified information was discovered

~j in the records management database. This constituted a possible compromise of classified information.

1 S/5/98 An improperly marked document was distributed outside the plant

controlled access area. This constituted a possible compromise of

classified information.

8/17/98 An improperly marked document was discovered inside the Controlled Access Area during an Authorized Document Classifier review. This

. constituted a possible compromise of classified information.

S8.2 (Closed) Violation 70-7001/97002-31: Failure to control classified matter in an area i accessible to uncleared individuals. Subsequent examples of the violation resulted in

> the issuance of a Severity Level 111 violation (Enforcement Action 97-431). The plant staff's corrective actions for this and similar violations are documented in NRC

! Inspection Report 70-7001/98011. The corrective actions were reasonable and the

violation is considered closed.

1 r

26

- -. -. -. . _ _ - _ _ _ _ _ . .- - - - . . . _ . . _ - . - . - . . . - . . ~ . . .

V. Manaaement Meetinas X1 Exit Meeting Summary The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on September 1. The plant staff acknowledged the findings ,

presented. The inspectors asked the plant staff whether any materials examined during the I inspection should be considered proprietary. No proprietary information was identified. )

I i

1 i

27

l 1 1

PARTIAL LIST OF PERSONS CONTACTED

! Lockheed Martin Utility Services

• M. A. Buckner, Operations Manager

• L. L. Jackson, Nuclear Regulatory Affairs Manager

• S. R. Penrod, Enrichment Plant Manager l

• H. Pulley, General Manager i 1

United States Department of Enerav G. A. Bazzell, Site Safety Representative l l

United States Enrichment Corooration

• J. A. Labarraque, Safety, Safeguards and Quality Manager

.J. H. Miller, Vice President - Production l

U.S. Nuclear Reaulatory Commission '

• J M. Jacobson, Resident inspector l l K. G. O'Brien, Senior Resident inspector

• Denotes those present at the September 1,1998 exit meeting.

Other members of the plant staff were also contacted during the inspection period. l lNSPECTION PROCEDURES USED lP 88100: Plant Operations IP 88103: Survelliance Observations IP 90712: In-office Review of Events

, 28 l

l

.i .

l ITEMS OPENED, CLOSED, AND DISCUSSED Opened 70-7001/98013-01 eel Building C-315 Number 2 Normetex Pump Safety Limit exceeded following inadvertent closure of the discharge block valve.

70-7001/98013-02 VIO Plant Operations Review Committee approved changes to the Safety Analysis Report (SAR) and the Technical Safety Requirements (TSR) without a safety analysis or prior NRC review and approval.

l 34577 CER Tarps installed near the ceiling in Buildings C-331 and C-335 for l project work would have obstructed the spray pattem of sprinkler heads in the affected ' areas.

34625 CER Chlorine release detection system alarm in Building C-615.

Approximately 30 pounds of chlorine was released.

34693 CER Normetex Pump in Building C-315 tripped while running on-stream. A discharge pressure of 46 psia was observed which is greater then TSR Safety Limit.-

70-7001/98013-03 VIO Failure to establish a quality assurance program that incorporated all of the basic and supplemental requirements of ASME NQA 1989, " Quality Assurance Program Requirements for Nuclear Facilities.'

70-7001/98013-04 URI Plant processes for the identification, assessment, and reporting of AQ quality class component noncompilances may not comply with 10 CFR 21.

7001/98013-05 NCV A loss of control of classified information as a result of a non-rigorous review of the unclassified documents that were combined and sent to offsite organizations.

7001/98013-06 NCV A loss of control of classified information as a result of weaknesses in the methods used to checkout and return materials to the classified materials storage vault Closed 34556 CER Records within the records management database that were marked as unclassified were thought to contain classified information. A further review of the records indicated that the information was not classified and the CER was retracted.

34034 CER The Edilding C-300 alarm for the Building C-720 criticality accident alarm system (CAAS) discovered inoperable.

-34507- CER Loss of power to the Building C-720 CAAS warning beacons.

29 l

. ~ . - .. _

ITEMS OPENED, CLOSED, AND DISCUSSED (cont'd) 70-7001/98006 VIO Failure to verify by test the adequacy of the Building C-720 CAAS hom design under conditions that simulate the most adverse design requirements.

34446 CER A trip of the 48-volt direct current breaker in the Building C-300 Central Control Facility caused a loss of control power to numerous criticality accident alarm systems plant-wide.

34483 CER Actuation of the water inventory control system for Autoclave 1 East in Building C-337A.

34483 CER inoperability of the plant CAAS due to a drop in the minimum plant air capacity to below 11,250 sfem as the result of an outage in the Building C-335 air plant system following a lightning strike.

34469 CER A Building C-310A high-voltage process gas leak detector above the side accumulator alarmed and remained in alarm for approximately 30 minutes, locking in the visible and audible alarms in the Building C-310 control room.

34492' CER A safety system actuation of the Building C-315 Number 2 Normetex High Discharge Pressure System.

34496 CER The Building C-315 process gas leak detector over the Number 2 Withdrawal Position alarmed.

70-7001/97003-02 VIO A failure to properly control access to areas under Limiting Condition of Operation (LCO) Action Statements during inoperability of the CAASs.

70-7001/97003 4 1 VIO A failure to monitor temperatures and pressures of cascade cells in Building C-310 (Product Withdrawal) during a planned period of CAAS inoperability.

70-7001/97002-02 ViO Two instrument mechanics performing safety-related duties worked more than 16 consecutive hours, excluding shift tumover time, without preauthorized approval, in violation of TSR 3.2.2.b.

~ 70-7001/98013-03 VIO Failure to establish a quality assurance program that incorporated all of the basic and supplemental requiremeats of ASME NQA 1989, " Quality Assurance Program Requirements for Nuclear Facilities."

70-7001/97009-01 URI Quality Assurance Plan may not incorporate all of the basis and supplemental requirements of ASME NOA-1-1989.

30

j ITEMS OPENED, CLOSED, AND DISCUSSED (cont'd) 70-7001/97002-16 IFl Notice of Enforcement Discretion (NOED) GDP97-1 issued to allow for operation of two feed facility cranes pending modification of a TSR Design Requirement to be consistent with current American Nuclear Society Standards.

70-7001/97002-14 IFl Cylinders filled to the TSR limits could have liquid instead of vapor UF above the cylinder valve contrary to assumptions made in the associated accident scenario.

70-7001/98013-05 NCV A loss of control of classified information as a result of a non-rigorous review of the unclassified documents that were combined and sent to offsite organizations.

70-7001/98013-06 NCV A loss of control of classified information as a result of weaknesses in the methods used to checkout and return materials to the classified materials storage vault.

70-7001/97002-31 VIO A failure to control classified maiter in an area accessible to uncleared individuals.

[ % u sd None 31 I

Il  : LIST OF ACRONYMS USED I

ACR- ' Area Control Room ADC- Authorized Derivative Classifier -

L ASME American Society of Mechanical Engineers ATR~ Assessment and Tracking Report

! AQ ' Augmented Quality .

CAAS Criticality Accident Alarm System CER Certificatee Event Report CFR Code of Federal Regulations

~DNMS Division of Nuclear Materials Safety l DOE- Department of Energy -

FCA Fissile Materials Control Area HDPSS High Discharge Pressure Safety System .

HP- Health Physics IFl Inspector Followup Item LCO Limiting Condition for Operation LCS Limiting Control Setting

.M&TE Measuring and Test Equipment NCS Nuclear Criticality Safety-NCSA Nuclear Criticality Safety Approval NCV- Non-Cited Violation NMSS . Nuclear Material Safety and Safeguards NOED: Notice of Enforcement Discretion NQA-1 National Quality Association NRC- Nuclear Regulatory Commission- .

NSS. . Nuclear Safety Subcommittee PCR- Plant Change Request -

PDR' Public Document Room

'PGLD Process Gas Leak Detection PORC Plant Operations Review Committee PSI Pounds Per Square Inch PSIA Pounds Per Square Inch Absolute PSS- Plant Shift Supervisor QAP Quality Assurance Plan RAC. Request for Application Change SAR Safety Analysis Report scfm Standard Cubic Feet Per Minute TSR Technical Safety Requirement UF. . Uranium Hexafluoride URI Unresolved item USEC United States Enrichment Corporation USQD Unreviewed Safety Question Determination VIO Violation L

l.

32

-. -- - - . , , , .