ML20199B943

Insp Rept 70-1257/97-202 on 971006-10.Violation Noted.Major Areas Inspected:Criticality Safety Analyses,Chemical Safety Assessment,Chemical & Criticality Safety Controls,Active Engineering Controls & Administrative Controls Flowdown

ML20199B943
Person / Time
Site:	Framatome ANP Richland
Issue date:	11/07/1997
From:	NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS)
To:
Shared Package
ML20199B931	List: ML20199B927 ML20199B934 ML20199B943
References
70-1257-97-202, NUDOCS 9711190157
Download: ML20199B943 (23)

Text

<--

s.

u' 3 .

i

=

OFFICE OF NUCLEAR MATERIAL SAFLTY & SAFEGUARDS COMBINED NUCLEAR CRITICALITY SAFETY AND CilEMICAL SAFETY INSPECTION REPORT REPORT NO: 70-1257/97-202 DOCKET NO: '70-1257 LICENSE NO: SNM-1227 LICENSEE: Siemens Power Corporation LOCATION: 2101 llorn Rapids Road P.O. Box 130 Richland, WA 99352-0130 INSPECTION DATES: October 6 - 10,1997 INSPECTORS: J. R. Davis, Team Leader Inspection Section, Fuel Cycle Operations Branch W. M. Troskoski, Senior Chemical Engineer Inspection Section. Fuel Cycle Operations Branch K. J. liardin, SPC Project Manager Fuel Cycle Licensing Branch APPROVED BY: Philip Ting, Chief Operations Branch Division of Fuel Cycle Safety and Safeguards, NMSS 9711190157 971107-PDR ADOCK 07001257 Enclosure 2 C PDR

--____---_ _-_-- __---------_ - - _ - - - - - _ A

p * ' sNM 1227 . i 70-1257N7 2N YABLE OF CONTENTS EX ECUTIV E S U MM A RY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . ....... 1 I nt rod uc t io n ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Significant Positive Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Significant Conclusions Requiring Further Management Attention . . . . . . . . . . . . . . . . 1 RE PO RT D ETA I L S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1. OPERATIONAL READINESS REVIEW OF THE DCF B ac k g ro un d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Technical Adequacy and Bounding Accident Analyses . . . . . . . . . . . . . . . . . . . 3 Criticality Safety Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Chemical Safety Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . .... . 4 Reliability, Availability, and Control of Safety Features . . . . . . . . . . . . . . . . . . 6 Chemical and Criticality Safety Controls . . . . . . . . . . . . . . . ....6 Passive Engineered Controls . . . . . . . . . . . . . . . . ....... 6 Active Engineered Controls . . . . . . . . . . . . . . . . . . ......7 Administrative Controls . . . . . . . . . . . . . . . . . . . . . . . ....... 7 l

Mechanical Integrity and Equipment Aging . . . . . . . . . . . ......8 Criticality Accident Alarm System Monitoring . . . . . . . . . . . . . . . . . . . 10 Overall Readiness Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . .. ... 11 11 -GENERAL SAFETY CONCERNS APPLICABLE TO 91-01 REPORTING REQUllEMENTS I

Background .......... .. . . . . . . . . . . . . . . . . . .. 12 Issue ..... ............... . . . . . . . . . . . . . . . . . .. . 12 NMSS FCis s-m o

p* $NM.1227 li 70-1257/97 2f

o

- 111. 91-01 LOSS OF MODERATION CONTROL EVENT FOLLOW-UP Hackground Leading Up to Event . . . . . . . . . . . ...... ................ 14 September,1997 Loss of Moderation Control Event ................... 15 Adequacy of Licensee Response and Event Recovery . . . . . . . . . . . 15 Adequacy of Supporting Safety Authorization Bases . . . . . . . . . . . . . 16 Adequacy of Corrective Actions implementation and Lessons Learned .16 Impacts of Precursor Events and Management Programs . . . . . . . . . . . 17 ITEM OPENED, CLOSED, AND DISCUSSED . . . . . . . . . . . . . . . . . . . . . . . . . . ..... 18 M ANAGEMENT MEETINGS . . . . . . . . . . . . . ... ......... . ... ..... ..... 19 MEETING ATTENDEES . . . . . . . . . . . . . . . . ........ ... ............... .. 19 ACRONYMS USED ............. ......... ............. ...............)

NMSS t-( ts s' %

70 1257/97-202 g * ' WM 1227 I

, EXECUTIVE

SUMMARY

Intmduction The NRC perfomied an announced safety inspection at the Siemens Power Corporation (SPC) located in Richland, Washington, from October 6 - 10,1997. The objective of the inspection was to conduct a combined chemical / criticality safety Operational Readiness Review (ORR) of the new Dry Conversion Facility (DCF) and to review the root cause analysis and implementation of corrective actions following the September 17,1997, loss of moderation control at the Dry Conversion Pilot Plant (DCPP). As a result of the inspection, one violation, one generic safety issue, and two inspector fo!!ow-up items were identified. These specific findings and areas of review are divided into three major categories: 1) ORR of the DCF; 2) Generic Safety Concern Applicable to 91-01 Reporting Requirements; and 3) 91-01 Loss of Moderation Control Event Follow-up. These issues are fully developed in the Report Details; the major conclusions are summarized below.

Sienificant Positive Conclusions

1) The criticality safety analyses reviewed, meet the license requirements, are of appropriate depth and breath, consider credible normal and abnormal accident conditions, and are independently reviewed to ensure adequate worker and public safety. The overall quality was good. [I.B.l.c]

2) The licensee has established and implemented appropriate systems to identify and maintain criticality safety controls. Management systems also cover various chemical process safety controls and provide reasonable assurance that safety features will remain reliable and available. Control over the interlocks in the derivative control system (DCS) is a strength.

[i.C.2.c]

3) The licensee appropriately responded to the September nuclear criticality safety (NCS) loss of moderation control incident at the DCPP and instituted appropriate event recovery actions to ensure worker safety. [Ill.B.b.1]

4) Appropriate lessons leamed from the September incident were applied to the ace DCF.

[Ill.B.b.3]

Sicnificant Conclusions Reauiring Further Management Attention

1) The Process thizards Analysis was found to address the most significant potential hazards, but the relationships between competing risks could not be dete: mined due to the absence of an Integrated Safety Analysis. Further, a weakness was noted in the chemical safety program because not all of the mitigating features discussed in the Hazards Evaluation were installed.

[1.B.2.c]

NMM FCis

<" N hO

,o 0 ssu.i227 2 70 i257 97 202

2) Independent verification of passive engineered control dimensions and final calibration and

. functional testing of active engineered controls were still in progress at the time of the review, in addition, numerous inconsistencies in the flowdown of requirements into operating procedures were identified due to work still in progress. Management attention should be focused on this area to ensure adequate control prior to startup. [1.C.I.c]

3) Independent verification and documentation of the adequacy of criticality accident alami system (CAAS) detector coverage has not been completed to date for the new DCF.

Management should ensure that such actions will be completed prior to introduction of special nuclear rnaterials (SNM)into this system. [i.C.3.c]

4) The current practice of NLS barrier identification and control is of concern to the NRC in that the threshold of reporting may have been inadvertently raised so as not to meet the minimum expectations of NRC reporting requirements. Siace no formalized criteria exists to qualify parameter control selection, less robust controls can be substituted for more reliable controls and the loss of a significant control can thus go unreported to the NRC. [lI.B]

5) An inadequate inciderit investigation review and implementation of corrective actions was completed following the April loss of moderation ecntrol event at the DCPP. [Ill.B.b.4]

6) Prior to the introduction of SNM into the DCF, the Ihzards Analysis should be compared to the final engineering change notices and any deviationsidentified and approved by the startup council. [1.B.2.b]

REPORT DETAILS i

1. OPERATIONAL READINESS REVIEW OF Tile NEW DRY CONVERSION FACILITY The NRC ORR of tt. new DCF consisted of a vertical slice through several safety-related activities / programs and focused on the high risk criticality safety and chemical safety aspects of the Dry Conversion Process. These areas include: 1) the technical adequacy and bounding accident analysis ihr this process (both chemical and criticality safety);

2) availability, reliability, testing, and control of engineered and administrative controls supporting these safety areas; and 3) overall operational readiness.

A. Background

Dry conversion Phase I activities began in 1981 at the Siemens Power Corporation with the design of a conversion test facility. This equipment was installed in the Line 3 Conversion Area of the UO2 Building in 1982. Development testing with Phase i equipment demonstrated process feasibility, and gathered important data for scale-up.

Phase 11 equipment (Dry Conversion Pilot Plant) was installed in 1984 as a prototypical NMSs &Cls

• 70125W97 202 5NM 1227 3 scale development. Material produced by the DCPP was used for testing, qualifying, and b . demonstrating the UO2 product for customer acceptance. Based on the development work at SPC, a full-sized DCF was built in Germany, Successful operation of this plant led to the completion of the full scale DCF at SPC in the Spring of 1997. The operational readiness of this facility is the focus of this inspection.

B. Technical Adtquacy and Bounding Accident Analyses

1. Criticality Safety Analyses

a. Inspection Scope liigh risk Criticality Safety Analyses (CSAs) were reviewed to detennine the technical adequacy and demonstrable safety of plant operations in accordance with license conditions as specified in Section 4 of the License Application.

License conditions mandate that CSAs support the double contingency principle, evaluate nomial and credible abnormal process conditions, are performed by qualihed NCS specialists, are reviewed by an independent qualified NCS specialist, and the basic criterin, data, methods, and references are appropriately documented and retained.

! b. Observations and Findines The supporting analyses for the new Dry Conversion Facility are: 1) CS A-810 Dry Conversion Vaporization System; 2) CSA-820, Dry Conversion Powder Production; 3) CSA 830 Dry Conversion Powder Preparation; 4) CSA-840, Dry Conversion Liquid Effluent /liF Recovery; and 5) CSA-850,llVAC. The two highest risk CSAs considered by the inspectors were CSA-820 and CSA-840.

These analyses address areas where liquid moderators are available or are purposely injected to react the materials as part of nomial operations. The l inspectors also reviewed CSA-810 as time allowed.

The inspectors determined that the analyses were documented with sufficient detail, clarity, and lack of ambiguity to allow independent judgment of the results.

The computer models, geometry, cquipment dimensions, and postulated accident conditions were credible and far more conservative than is expected in the actual case. The analyses also incorporated sufficient factors of safety to require at least two unlikely, independent, and concunent changes in process conditions before a criticality accident is possible. liowever, the analyses utilized a unique triple contingency control method which allows the license to maintain safety by l ensuring any two of the three controls. Although control over more than two l parameters for safe operation is an acceptable practice, it is noted that problems can arise if the criteria to establish reliable, available, and robust controls is not Nms rcis

/~

0 sNWl227 4 70-1257N7 202

,s o

- formalized (i.e., substitution of a much less reliaide third control for one of the two primary controls). This concem is expanded in greater detail in Section 11 of this report.

c. Conclusions The analyses reviewed by the inspectors meets the license requirements as stated in Section 4 of the approved license application. The analyses are of appropriate depth and breadth, consider credible normal and abnormal accident condit ions, and are independently reviewed to ensure adequate worker and public safety. One potential safety issue was raised concerning the method of barrier control as applied by the licensee. This issue is discussed in greater detail further in the report.

2. Chemical Safety Assessment

a. Scope The inspectors reviewed EMF-1926, Dry Conversion llazards Evaluation, Revision 0, dated April 1997, and conducted walkdowns of th. Dry Conversion Facility to determine whether: 1) potential chemical hazards were identified;

2) the licensee's eva;uation methodology was appropriate for the process complexity and level of hazards involved; and 3) the results of the evaluation were translated into action items that were appropriately prioritized and tracked by a management control system for resolution in a timely manner.

b. Observations and Findings The new DCF is based on the technology of the previously licensed pilot plant which had its own hazards analysis. Using a multi disciplined review team, the pilot plant hazards analysis was reviewed for applicability to the new process and upgraded as necessary to account for the major process differences. The evaluation was conducted in the February to April 1997 time frame and utilized a modified hazards and operability (ll AZOP) analysis technique.

Specifically, the analysis considered the potential hazards for the operation of the conversion and powder preparation processes, and the effects of a loss of utilities (electrical, water, steam, ventilation, etc.). Major chemical systems / processes that were reviewed included uranium, hydrogen fiuoride and sodium hydroxide The report also contained a brief description of the radiation, pressure, thermal, fire and criticality hazards. Discussions with members of the evaluation team indicated that no significant recommendations were generated since the major potential hazards had already been considered during the initial design process.

NMNs FCis l

l' a %N\11227 5 70125M202

~

e

'Ihe inspectors selected several of the mitigating technical controls associated with

. the hydrogen fluoride (HF) system, as this system would contain the greatest bulk of hazardous material, and conducted several system walkdowns. As a result these walkdowns, the inspectors noted the following discrepancies between what was identified as a mitigating feature in the evaluation and what was currently installed in the field:

1. Section 4.1.2 of the evaluations stated that all IIF is either: 1) contained within ventilated process equipment; 2) contained in double encased piping with leak detection; or 3) enclosed in tanks and piping which is within a bermeti or diked containment area. Ilowever, the inspectors noted that a leak detection system had not been installed for the double encased ilF piping. Subsequent discussions with licensee personnel in ated that the plant experienced problems with the placement of conductivity probes through the double encased pipe, and the final status of the leak detection system had not been detennined.

2. Section 4.1.2 furtl. ;tated that a foaming system was accessible for mitigating the effects of a catastrophic HF tank rupture. The inspectors noted that such a system does not exist. Discussions with plant management indicated that a portable foaming system had been ordered, but delivery was not expected for about another month.

As .esult of the abow observations, the inspectors raised a concern with senior plant management regarding other safety and mitigation features which were identified in the evaluation but were not installed. Although the licensee had not agreed to perform an Integrated Safety Analysis (ISA) when their license was last reviewed, the inspectors did note that the evaluation appeared to be too limited in detail and would probably benefit from such an exercise. Further, since there were no recommendations that came from the analysis, any deviation from the report's assumptions should be reviewed and approved by the Startup Council prior to the introduction of special nuclear material (SNM)into the DCF.

At the exit meeting, plant management acknowledged the concern and committed to review the evaluation and have the Startup Council approve any identified deviation before DCF startup. The report would subsequently be revised and be maintained up-to-date.

The failure to install all of the mitigation features identified in the evaluation will not be cited as a violation since the licensee had not yet processed SNM and therefore, no immediate safety risk was evident. However, the licensee's corrective action will be tracked as Inspector Follow-up Item (IFI) 97-202-01.

N\tsS FCis

e 70-125?/97 20:

', ssu.i227 6 t

c. Conclusions The licensee conducted a hazards analysis for the new DCF that included the high risk chemical hazards associated with the process prior to completion of the facility. The analysis appeared to address the most significant potential hazards of the process. liowever, the relationships between competing risks could not be determined due to the absence of an Integrated Safety Analysis. A weakness was noted with the licensee's chemical safety program in that not all of the mitigating features discussed in the Dry Conversion liazards Evaluation were installed.

C. Reliability. Availability. and Control of Safety Features

1. Chemical and Criticality Safety Controls

a. Scops The inspectors reviewed the Dry Conversion llazards Analysis, the Criticality Safety Analyses (CSAs), and the standard operating procedures (SOPS) associated with the new facility and conducted detailed system walkdowns to determine whether the licensee had established reasonable assurance that the features relied upon for safety would be available and reliable,

b. Observations end Findings

1. Passive Engineered Controls Many of the system criticality controls are based on the favorable geometry of specific process components to reduce the risk of a criticality accident.

These dimensions are specified by the Nuclear Criticality Safety (NCS) group in the individual CSAs, summarized m Criticality Safety Specifications (CSSs), and incorporated as appropriate in various operating procedures. The inspectors conducted discussions with the NCS group and determined that they were in the process ofindependently verifying each critical dimension in the field and documenting their measurements on the new DCF system prints.

The inspectors independently measured the dimensions of several key components and noted that the liF receiver tank spacing appeared to be 1-inch closer than specified in the CSA. Discussions with NCS indicated  ;

that the tank wall thickness provided the additional spacing, since it was not considered in the computer model. No other discrepancies were identified.

NM% ttfis

/%

W)

8 5NM.1227 7 70 1257/97 202

2. Aglix.e Engineered Controls For the new DCF, derivative control system (DCS) interlocks provide a significant portion of the protection required for criticality and chemical process safety. Discussions with plant engineering and operations staff indicated that safety components were designed to " fail-safe"(i.e., actuate to the safe position upon loss of signal / power). To assure the availability and reliability of these interlocks, the licensee has developed a system to perform initial calibration and functional testing prior to system startup.

Periodic functional testing schedules were developed based on plant experience with similar components in the pilot plant. Modifications to the set points would be incorporated into plant procedures based on the experience gained through the successful test run of depleted uranium through Line 1. The final calibration and functional testing are scheduled for completion prior to the introduction of SNM into the system.

The inspectors selected a number ofinterlocks associated with the Line I system and verified that they were included in the DCS. Discussions with the plant operators indicated that they had participated in the selection of the various interlocks and understood their purpose. Control of the interlock set points was reviewed with the system engineer to assure that the correct set points were entered into the system and that unauthorized changes could not be made. The inspectors were informed of the security system in place and the configuration control of the DCS software as described in procedure EMF-MSQ-030-1, Revision 1. This procedure provides for maintenance of the interlock integrity, access control and security features, identification of criticality controls, and change control through ' erification and validation checks. No deficiencies were noted.

3. Administrative Controls Flowdown The inspectors reviewed the flowdown of administrative controls from authorizing documents such as CSAs to CSSs and to SOPS and operator aid postings. The following procedures were reviewed to determine the adequacy of control flowdown.

P66-1099, Dry Conversion Facility Steady State Operation P66-1129, Dry Conversion Facility Criticality Administrative Controls P66-1096, Dry Conversion Faciliv Calciner Product Receiver P66-1094, Dry Conversion Fa -

teactor Bed Loading & Downloading l P66-1098, Dry Conversion Facility Process Startup P66-1102, Dry Conversion Facility Process Shutdown P66-1100, Dry Conversion Facility HF Handiing

, P66-1095, Dry Conversion Facility Preparation and Ileatup suss reis s'

\.. ..

,e $NM 1227 8 70 1257/97 202 The inspectors determined that there were numerous inconsistencies, redundancies, and lack of specificity for the controls reviewed, which is characteristic of problems expected in preparation for startup of a new facility. Specifically, conflicting instructions, and redundant instructions were identified in P66-1095 and 1129; actual spacing limits were not given even though actions were specified for violating such requirements; and inconsistencies in the required interlocks table between CSS P97820, EMF-22, and P66-1099 were identified. In addition, very few operator aid postings were observed to be in place within this facility. Discussions with plant staffindicated that posting development was underway and a review of the problem identification log of procedural and functional testing demonstrated that adcquate steps were being taken to correct these inconsistencies. Therefore, although these items were still in progress at the time of the inspection, adequate management controls are in place to give reasonable assurance that such problems will be corrected prior to system startup.

c. Conclusions Independent verification of passive engineered control dimensions and final calibration and functional testing of active engineered controls were not completed at the time of the review.110 wever, plant personnel are currently independently field verifying each critical dimension and documenting their measurements on the new DCF system prints. Management controls and licensee recognition of their responsibilities gives reasonable assurance that all requirements will be met prior to system startup.

Although numerous inconsistencies in the flowdown of requirements into operating procedures were identified, a review of the licensee's corrective actions log for test-out of controls gives reasonable assurance that such problems will be corrected prior to introduction of SNM material into the DCF.

2. MechanicalIntegrity and Eauinment Aging

a. Insocction Scone The licensee's program for ensuring mechanical integrity and controlling equipment aging was reviewed to verify that their program requires the establishment of schedules for preventative maintenance, calibration, and periodic surveillance as determined through reliability evaluations and that replacement parts are acceptable for their intended use.

NNtsS FCIs e' N h)

' 701257N7-202

,D N 11227 9

b. Observations and Findings The inspectors reviewed the management controls and programs used by the licensee to maintain the mechanical integrity of systems that confine ,

radioactive or hazardous chemicals in the new DCF. A typical program required by the OSilA Process Safety Management (PSM) program for highly hazardous systems includes pressitte vessels and storage tanks; piping (and components such as valves); relief and vent systems and devices; emergency shutdown systems; controls (including monitoring devices and sensors and alanns); and pumps. Since the ilF produced by the process will be under 50%, the PSM Mechanical Integrity requirement does not apply and discussions with the licensee indicated that such a fomial program had not been developed for the liF system.

Notwithstanding the lack of a formal PSM program, the inspectors reviewed the measures taken by the licensee to ensure system integrity for 11F. The bulk of this hazardous material will be stored in two liF storage tanks located on a bermed pad that is lined with a llF resistant material. The pad was sized to hold the contents of a failed tank. These tanks were procured to ASTM D 1998-93 standards for HDPE tanks. An atmospheric pressure hydrostatic test was conducted (both tanks are operated at atmospheric pressure), and vent lines were sized to the requirements of the standard. Vendor records indicated that the material of construction was compatible with its intended use. Leak detection systems included HF detectors above the tanks and a conductivity probe in the bermed area. Discussions with the plant staffindicated that no further test or inspections of these tanks was required by the industry standards and therefore, none were planned. No other chemicals were stored in this location.

The liF sensors and conductivity probe were traced to ensure that they alarmed within the DCS. Within the process building, the licensee also provided other llF detection sensors. The inspectors determined that these also alarmed in the DCS and that these and other chemical detection systems were included in the calibration program. The inspectors also verified that selected ilF system interlocks (including uranium monitors) described in the licensee's hazard evaluation were also included as part of these maintenance programs.

c Conclusions The licensee has established and implemented appropriate systems to identify and maintain criticality safety controls. Passive systems are independently verified and documented by NCS. Management systems also cover the various chemical process safety controls, and provide reasonable assurance Nms ICis

l

, * ~ sNM . ',7 10 70-1257/97-202

. 1 that safety features will be reliable and available. Control over the interlocks

. in the DCS system appears to be a strength. The construction of the HF system appears adequate for its intended use and is consistent with the hazard evaluation with the exceptions as noted in Section I.B.2 of this report.

3. Criticality Accident Alarm System Monitoring

a. Inspection Scone The Criticality Accident Alann System (CAAS) was reviewed to determine the adequacy of system daign, placement, and performance requirements for the new Dry Conversion Facility as necessary to meet the requirements of 10 CFR 70.24 (a)(1).

b. Observations and Findings The inspectors performed an area walkdown to identify detector placement and reviewed associated analyses which established the spacing, alarm set points, and maximum tolerable shielding. The inspectors determined that only one detector module exists within the DCF. When questioned concerning the adequacy of alann coverage for this facility and the compensatory measures and indicators available to ensure system operability (especially during maintenance), the licensee stated that detectors in other facilities provided redundant coverage to this facility and that supporting facility procedures consider compensatory measures such as cessation of fissile material movement when system inoperability is determined. The alarm system also provides signal processing which is fed to an alarm status board which notifies management and technicians of system operability status.

When the inspectors further probed the analyses supporting alarm coverage determinations, it was determined that the analyses were not reviewed by a qualified specialist to ensure that the technician performing the calculations, adequately and correctly analyzed intennittent shielding, accident locations, alarm trip point settings, and that dose conversion factors and transmission factors for various construction materials were appropriately applied.

Ilowever, a review of other plant areas covered by the CAAS indicates that management controls are in place to ensure that similar actions will be taken for the DCF prior to startup. The licensee committed to ensuring that this analysis will be reviewed / approved prior to introduction of SNM into this process. Adcquacy of actions will be tracked as IFI 97-202-02.

The inspectors also determined that the licensee did not perform rigorous sound pressure level tests as recommended by American National Standards ANSI /ANS 8.3," Criticality Accident Alann System." to ensure that the alarms NMS$ FCIS

• " SNM 1227 11 70-12$t97 202 would be heard over typical ambient noise levels. Instead, the licensee

. positioned personnel in all nonnally manned locations to ensure adequate CAAS audibility. Although this action minimally meets license sequirements, the inspectors questioned the adequacy of " test" results when applied to the fully operational DCF facility in that ambient noise levels will be much higher.

ANSI /ANS 8.3 recommends that areas with very high audio background may require alarms to be supplemented with visual signals. Discussions with plant staffindicated that such conditions are periodically reviewed plutwide during emergency evacuation drills and corrections made as necessary. The licensee also indicated that verbal announcements are made over the Public Address (PA) system during simulated or actual emergencies. The licensee committed to ensuring that alarm signal audibility will be acceptable in all manned areas of the DCF once it is operational.13ased upon the NCS controls for this facility (specifically facility moderation control), the inspectors determined that adequate interim safety exists and that this safety issue will be reviewed again when IFl 97-202-02 is revisited.

c. _ Conclusions Independent verification and documentation of the adequacy of Criticality Accident Alarm System detector coverage has not been completed to date for the new dry conversion facility, llowever, a review of other plant areas covered by the CAAS indicates that management controls are in place to ensure that simihr actions will1,e taken for the DCF prior to startup. A review of the methodology for detemiining adequate alami coverage appears adequate in determining the location and spacing of detectors to meet 10 CFR 70.24 requirements.

Although sound pressure measurements were not conducted as recommended by ANSI /ANS 8.3, adequate system performance was demonstrated by alternate means. Reasonable assurance that the system will adequately support the intended safety ftmetion during the higher ambient noise levels expected of the fully operational facility is provided by routine plant audibility and performance checks.

D. Licensee Overall Readiness Review

a. Insnection Scone The inspectors reviewed the actions planned and taken by the licensee to assure that the DCF facility safety and licensing basis had been properly esta'olished prior to the introduction of SNM into the process.

i

O $N\t1227 12 70-1257 % 202

o b.- Obsenations and Findings Discussions with the Safety and Regulatory Affairs groups indicated that an NRC License Commitments Checklist had been established that sequentially numbered the license commitments for verification prior to the startup of the new DCF. The stated intent was to develop an af'rmative verification of completion or written explanation as to why a requirement did not apply. Each commitment was assigned to a responsible organization. A review of the file indicated that this issue had received periodic review by senior plant management. As of the date of the inspection, not all of the requirements had yet been verified.1lowever, completion of this checklist was required prior to the introduction of SNM into the process.

c. Conchtsions The licensee recognizes their responsibility to assure that all license requirements were met for the new DCF process prior to startup and has taken positive steps to assure implementation prior to the introduction of SNM. The involvement of senior plant management was evident.

11. GENERIC SAFETY CONCERN APPLICABLE TO 91-01 REPORTING REQUIREMENTS A. Rackground As a ru, ult of the May,1991 loss of double contingency control at the GE-NEP plant, the NRC issued Bulletin 91-01," Reporting Loss of Criticality Safety Controls," on October 18,1991. This bulletin requested that addressees evaluate their criticality safety criteria and procedures, modify them as appropriate to assure that events involving degradation of controls be promptly evaluated and repo:ted to licensee management and the NRC management as appropriate, and provide a description of their criteria and procedures to the NRC. As time passed, the NRC received numerous comments on the bulletin with a major concern being that the reporting criteria lacked appropriate specificity and required clarification. Although clarifications were subsequently made to the bulletin, experience has shown that the threshold of reporting has not been consistently implemented and problems still remain with individual licensee interpretation.

B. Issue The inspectors determined after reviewing several analyses and through discussions with plant staff that SPC utilizes a unique triple barrier control method which allows the licensee to maintain safety by ensuring any two of three controls. Although control over more than two parameters for safe operation is an acceptable practice it N\lss FCIS

-O $NM 1227 13 70-1257 %7 202 y

e

. is of concern to the NRC that the threshold of reporting may have been inadvertently raised so as not to meet the minimum expectations of NRC Bulletin 91-01. Since no formalized criteria exists at SPC which et n be used to quahfy parameter control selection, a safety concern is raised such th.t less robust controls can be substituted for more reliable controls and the loss of a sipificant control can thus go unreported to the NRC. Two examples oflicensee postulated upsets and mitigating c ntrols features are given below for clarification.

A Vaptwuation Konm Rcan Fxhaust Pnmary HEPA Fdters kenano Hi PA Giters contam a large accumulation of UO2 sa a smgle (dier with suf0 cent water and'or approsed water equivalent midshve innade mass is caused by major UF6 release.

Defense #1 Defense #1 Defense #3 Moderaima an.ded from Gre Autoclass integnty smoke detectors m hot tmes rire unhkety due to keeping bghtmg m toiwn detet:ts Uf 6 leak and shuts off combustible matenal storage Ul6 supply to a mmamum.

B Consersion Reactor kenano Accumulation of condensed hamd water m upper portion of sessel with sufficient 002 mass.

1. Wet powder loaded mte reactor Reactor bed is Ded matenal contams <l wt*. Bed matenal contams < l wt'e for bed matenal admmistranvely hmeted to a moisture as determined by a moisture as determmed by an subcntical mass pnmary method independent method 2 Hygrowopic adsorption of Operatmg controh and XX kgs of UO2F2 cannot Nonc provided monture after shutdown praess constraints thai hmit ady"b enough moi,ture to go resultmg in a umform higP denuty and sessel geometr> cnncal monture content such that leu than XX kgs can accumulate As can be seen in the first example, the primary control on mass is autoclave integrity. Ilowever should thic control fail, the smoke detectors as active engineered s

controls are to isolete the leak and control the amount of mass capable of escaping (i.e., this is the second control on mass). The third barrier is an attempt at moderation control, albeit somewhat nebulous, in that it controls the combustible material loading in the building which would act as a fire initiator having a finite probability that moderating materials would be used to control such ars event. However, the DCF has been designed to preclude moderation from entering the building by providing a double barrier penetration roof (with leak detection), prohibiting any water lines from en'ering rooms where SNM is processed ud by instilling a fundamental plant practice that fighting tires with water is prohibited unless absolutely necessary to save life.

Therefore, it can be argued that " moderation contro(" is really a facility design feature much like taking credit for the characteristics of a particular process. It is contended that the primary controls for this scenario are the two controls on mass and that the combustible material loading is really not a factor in determining system control. An autoclave integrity failure would be considered very siFnificant to the NRC and something that would be expected to be reported, yet the current description of banier control would allow this postulated incident to go unreported.

NM% FCl$

,m

o* SNM.1227 14 70 1257/97 202 Likewise, the first contingency associated with the second scenario allows the substitution of an administrative control on mass for the more robust engineered control of moisture determination. The second contingency associated with this scenario utilizes operating parameters and process characteristics to control mass.

The second control discusses the adsorption characteristics of this material as providing the barrier to criticality (i.e., the material saturation point [I1/U=16] does not provide sufficient moisture to reach a critical state). Ilowever, this control is not independent of mass and is very dependent upon vessel geometry. For instance, a change in slab width while conserving volume can result in a critical configuration with the specified material. Also, a change in material density (i.e., more mass) would reduce the ll/U ratio to below the saturation point. The inspectors therefore concluded that the doubL contingency control is provided by the multiple operating controls which limit density (i.e., mass) and the vessel geometry with slab thickness as the important parameter ensuring a suberitical state.

The important point is that such reporting requirements as described in NRC Bulletin 91-01 are required for the NRC safety mission in that generic issues may be identified for applicability to other licensees and expedient action can be assured by the NRC to preveat a reduction in the safety margins at these facilities. It is also important to the NRC to ensure that the licensee is providing adequate protection and safety to plant workers, is implementing reliable and sufficient corrective actions to preclude a repeat incident, and is appropriately applying lessons leamed to ensure that other similar control degradations plantwide do not occur.

C. Conclusions Although the limited review of this methodology by the NRC inspectors did not reveal any immediate safety concerns, there is a concern that reductions in safety margin could be effected by substitution ofless robust controls and the raised threshold of reporting requirements reduces the NRC's effectiveness in implementing its safety responsibilities. Therefore, this issue was brought to the attention of NRC senior management for review and further action may be warranted.

Ill. 91-01 LOSS OF MODERATION CONTROL EVENT FOLLOW-UP A. nackground Leading Un to Event At yproximately 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br /> on Monday, April 21,1997, liquid was discovered dripping from the lower end of the dry conversion screw conveyor at the DCPP. This conveyor is geometrically favorable and is used to transport uranium dioxide power from the reactor discharge to the calciner feed hopper. The reactor and calciner were subsequently shut down and an investigation into the cause of the event ensued. The incident investigation team concluded that under the right conditions. the reactor blower Nuss reis O

Gy)

t.

j,D* sNM.1227 15 70-1257 9 7-202 0

. wil produce enough vacuum to pull the calciner atmosphere over to the reactor. Their

. corrective actions recommendations were to: 1) install a pressure monitor in the conveyor; 2) revise the DCPP startup operations procedure to reflect that steam to the calciner would be tumed on last; and 3) to ensure that this condition will be precluded in the new DCF. Despite implementation of these corrective actions, a loss of moderation control event re-occurred at DCPP, September 17,1997, B. September 1997 Loss of Moderation Control Event Indications of operational problems began on September 15,1997, at approximately 1930 hours0.0223 days <br />0.536 hours <br />0.00319 weeks <br />7.34365e-4 months <br />. The differential pressure (DP) across the filter assembly was dropping and plugging of the UF6 inlet nozzle was suspected. After repeated attempts to clear the nozzle and with the DP failing to improve, the decision to shut down the reactor was made. During the shut down process, the calciner experienced about a dozen pressure spikes during the day while the reactor pressure frequently dropped to values below normal. A reactor intemal inspection on September 16th around 0440 hours0.00509 days <br />0.122 hours <br />7.275132e-4 weeks <br />1.6742e-4 months <br /> showed powder hung up in the top of the reactor that contained a large number of clumped material pieces indicative of problems with a clogged nozzle. As further clean-out of the associated equipment continued, the spool piece was found to have clumps of semi wet powder. The rotary valve at the bottom of the reactor vessel was found ftdl of wet powder and the conveyor was also found to contain moisture. Laboratory sampling determined that the highest moisture readings came from the calciner feed hopper area and contained more than 6 times the authorized limit. An incident review team was subsequently assembled to determine the root cause of the moisture control failure. The NRC was also notified of the loss of moderation control.

a. Insnection Scope Following this event the NRC made a decision to dispatch an inspection team to 9 e to review the circumstances surrounding the repeated loss of moderation control at the DCPP in let than five months and to determine why past corrective actions were not adequate in preventing this recurrence. The inspection team focus included a determination of: 1) adequacy oflicensee response and event recovery from this control failure; 2) adequacy of supporting safety authorization basis; 3) adequacy of corrective actions implementation and application oflessons learned (particularly with respect to the new DCFjust coming online); and 4) the role that past precursor events and management programs (e.g., QA, maintenance, etc.)

played in contributing to this failure.

Nuss scis

j O* $NM-1227 16 701257N7 202 C

. b. Observations and Findings

1. Adsfluacy of Licensee Resnonse and Event Recovery After experiencing problems with the UF6 inlet nozzle plugging and failed attempts to clear this nozzle, Licensee management made the decision to shutdown the reactor and determine the cause. Upon discovery that powder removed from this equipment contained elevated levels of moisture above authorized limits, management halted all clean-out operations and notified Nuclear Criticality Safety (NCS) at 2:45 a.m. on September 17,1997. A Criticality Safety Corrective Actions Report was initiated and an incident Investigation Board (118) convened. The eve. t was reported to the NRC Operations Center at 1:45 p.m. (PDT) on September 17,1997, about four hours aller the material moisture sample results were obtained, and the Licensee also promptly informed an NRC inspector who was onsite at the time of the event. The inspectora determined that the Licensee appropriately respended to this incident and instituted appropriate event recovery actions to ensure worker safety,

2. Adequacy of Supnorting Safety Authorization Bases The inspectors reviewed the supporting criticality safety analysis and conducted interviews with NCS and Senior Management Staff to determine the adequacy of the Licensee's safety basis. The inspectors determined through discussions and plant walldowns that the equipment consisted of interconnected favorable and non-favorable geometry components within this portion of the process. Due to this condition, the CSA required moderation control to prevent the condensation of steam passing through the system.

The inspectors determined that numerous controls and interlocks were identified in the analysis to prevent condensation of moisture during times when the steam flow to the reactor was below a certain temperature, during power catages, and during low reactor temperatmes, but no controls were established for the scenario in which the steam atmosphere in the calciner could carry over to the reactor vessel during certain operational modes.

According to the Licensee, this scenario was not considered credible because it was believed that a powder plug in the conveyor tube would eiTectively isolate the reactor from the rest of the system. Since the licensee has not conunitted to completing an Integrated Safety Analysis (ISA), the method by which credible scenarios are judged is somewhat less formal. According to the Licensee, the criticality safety analyst completes discussions with operations management in which possible scenarios are discussed.

NMSS FCIS s%

h)

y O* NNWl227 17 70-1257N7 202 o

3. Adequacy of Corrective Actions Implementation and Lessons I camed The inspectors reviewed the llB report, conducted discussions with board members, and walked down the new Dry Conversion Facility to ensure that adequate corrective actions had been made to the new system prior to operation. The inspectors determined that the IIB appropriately concluded that the principle ofisolating steam flow between the reactor and calciner vessels during certain reactor operating conditions had not been included in any of the Pilot Plant Standard Operating Procedures (SOPS). The IIB concluded that the controls were not properly identified, the SOPS were inadequate, and several assumed operating facts were incorrect.

The inspectors detemiined that appropriate lessons learned from this incident were applied to the new DCF in that a manual valve between the calciner feed hopper and conveyor was installed, a reactor temperature-calciner steam interlock was installed, and a reactor /calciner pressure-steam interlock was also installed to prevent future occurrences. The inspectors verified that these items were in place and appeared to provide reasonable assurance that a similar event would not occur in the new DCF. Although there are no plans to operate the pilot plant in the near future, the inspectors were informed that this operation would remain offline until the same or equivalent DCF safety features were installed. The CSA supporting this operation would also need to be revised prior to any new campaign. The inspectors also determined that corrective actions to this system were appropriately entered into the Licensee's corrective actions tracking system. The inspectors identified no further concems.

4. Imnacts of Precursor Events and Management Programs The corrective actions identified from the April 21,1997, loss of moderation control at the DCPP were not adequate in preventing a recurrence of control failure. Although corrective actions recommended by the !!B review included modifications to the startup procedure to reflect that steam to the calciner would be turned on last, and included installation of a pressure monitor, such changes failed to prevent the September event from occurring.

The inspectors determined that the IIB failed to detect a weakness within the CSA regarding the discovered moisture migration flowpath and failed to recommend review / revisions to the analysis such that appropriate and reliable controls could be identified and implemented. Approved License Application Section 4.1.5, Operational and incident Reviews, states that "all reported criticality safety violations, incidents, or abnormal conditions shall be reviewed and appropriate corrective actions taken " The failure to conduct an adequate and complete incident investigation contributed to the September loss of moderation control and is identified as Violation 97-202-03.

NMSS Fels A

C) $N 4 1227 is - 70-1257'97-202 y

9 The inspectors also reviewed the database of past criticality safety violations

, and associated corrective action reports to determine if adequate precursor information other than the April report was available to make this incident preventable. Although the inspectors determined that the backlog of corrective actions had increased somewhat due to attention being focused on startup issues related to DCF, no similar precursor information was found that could have id:ntified a potential problem with moisture control at the DCPP. However, the inspectors found that some backlog issues were overdue by as much as four months. A detailed review of this list indicated that none of the overdue items were of high safety significance, however, such evidence does not preclude safety significant items from being placed on the list and going uncorrected for extended periods of time. Management attention in this area will ensure that production is not inadvertently considered over safety.

c. Conclusions Although the inspectors determined that the licensee's initial response and event recovery following the September los3 of moderation control at the Dry Conversion Pilot Plant was adequate and appropriate, a lack of adequate and complete incident review following an earlier similar loss of moderation control event at this facility was a contributing factor to the September event.

ITEMS OPENED. CLOSED. AND DISCUSSED Opened IFI 97-202-01 Failure to install all of the mitigative features identified in the Dry Conversion Process Hazards Evaluation.

IFl 97-202-02 Lack ofindependent technical review and approval of CAAS coverage determinations.

VIO 97-202-03 Failure to conduct an adequate and complete incident investigation following the April 1997 loss of moderation control event at the Dry Conversion Pilot Plant.

NMss FCit O

W)

y O*' S MI1227 19 70-1257N7 202 MANAGEMENT MEETINGS Exit Meeting Summary Tht NRC Inspection Team met with SPC management throughout the inspection. An exit meeting was held on October 10,1997, Some items discussed were identified by the Licensee as proprietary. The following is a partial list of exit meeting attendees:

MEETING ATTENDEES Siemens Power Cornoration Bernie F Bentley, Acting Vice President of Manufacturing Loren Maas, Manager. Regulatory Compliance Ray Vaughan, Manager, Safety & Security John Phillips, General Supervisor, Chemical Operations Doug Killian, Manager, Manufacturing Engineering Tom Probasco, Manager, Safety Calvin D. Manning, Team Leader, Criticality Safety Andy McGehee, Criticality Safety Analyst Cliff J.Yeager, Senior Engineer, Manufacturing Engineering (DCF Project)

Nuclear Regulatory Commission Jack R. Davis, Team Leader and Criticality Safety Specialist, NRC Headquarters William Troskoski, Senior Chemical Engineer, NRC IIcadquarters Kimberly J. Ilardin, SPC Project Manager, NRC 1leadquarters m iss reis

1-

.e 6 S'46-SN41227 20 70-12$797 202.

.r ACRONYMS USED

- A N S L................... .... . . . . . . . . . . . . . . . . . . . . . . . . . . . - American Nuclear Society-

? ANSI - . . . . . . . . :. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . American National Standards Institute -

CAAS . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . Criticality Accident Alarm System

- -- CFR t .- . . . .. . . . . o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . Code of Federal Regulations -

- CSA - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Criticality Safety Analysis CSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Criticality Safety Specification DCF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . Dry Conversion Facility DCPP . . . . . . . . . . . . -. . . . . . . . . . . . . . . . . . . . . _ . . . . . . . . . . . . . . . Dry Conversion Pilot Plant DCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Derivative Control System

' l lDPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . l iigh Density Polyethylene llEPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . liigh Efficiency Particulate Air H F - . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . l lydrogen Fluoride

' ll B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Incident investigation Board .

- I S A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I ntegrated Safety Analysis -

NCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nuclear Criticality Safc ty ORR . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , Operational Readiness Review

- IIEPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . liigh Efficiency Particulate Air

- OSil A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Occupational Safety and llealth Association P DT . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pacific Daylight Time PSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Process Safety M anagement -

SNM . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Special Nuclear Materials SOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Standard Operating Procedure

. S PC . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . Siemens Power Corporation k-iNMSS rcis -

f lC - - -

W. _

-- - ._