ML20206B570

Insp Rept 70-7002/99-06 on 990322-26.Violations Noted.Major Areas Inspected:Plant Operations,Maint & Surveillance, Engineering & Plant Support (Emergency Preparedness)

ML20206B570
Person / Time
Site:	Portsmouth Gaseous Diffusion Plant
Issue date:	04/22/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20206B564	List: ML20206B561 ML20206B565 ML20206B570
References
70-7002-99-06, 70-7002-99-6, NUDOCS 9904290296
Download: ML20206B570 (25)

Text

,. .

U.S. NUCLEAR REGULATORY COMMISSION REGIONlli Docket No: 70-7002 Certificate No: GDP-2 Report No: 70-7002/99006(DNMS)

Facility Operator: United States Enrichment Corporation i

Facility: Portsmouth Gaseous Diffusion Plant Location: 3930 U.S. Route 23 South P.O. Box 628 Piketon, OH 45661 Dates: March 22 through 26,1999 ,

inspectors: Kenneth G. O'Brien, Senior Resident inspector, Paducah John M. Jacobson, Resident inspector, Paducah Alphonsa Gooden, Radiation Specialist, Region ll Approved By: Patrick L. Hiland, Chief Fuel Cycle Branch Division of Nuclear Materials Safety 9904290296 990422 PDR ADOCK 07007002 C PDR

f EXECUTIVE

SUMMARY

United States Enrichment Corporation Portsmouth Gaseous Diffusion Plant NRC inspection Report 70-7002/99006(DNMS)

Plant Operations e The plant staff were provided additional training on the use of the area control rooms as recalllocations after t' December 9,1998, event. The training focused on the use of the area control rooms a locations from which to provide additional information to plant staff in the building during an emergency. The plant staff did not consider the control rooms to be " safe havens." The control rooms were to be evacuated by all plant staff in accordance with the "see and flee" policy, including operations staff who might have air-purifying respirators stored there, if conditions worsened. (Section O1.1) e The inspectors identified two violations: 'a violation for failing to implement certain immediate actions in the off-normal procedure for compressor damage and a violation for failing to develop alarm response procedures for cell panels and auxiliary panels in the cascade area control rooms. The review indicated that procedural guidance for properly responding to the initial load alarm and indications of unusual compressor surging on December 9,1998, was available in various procedures. However, the Building X-326 operations staff did not reference the procedures, nor was the guidance readily accessible (ss in an alarm response procedure) to the operations staff when conditions were rapidly deteriorating after the initial load alarm for Cell 25-7-2.

(Section O3.1) e The inspectors determined that operations staff training provided guidance on important aspects of the normal and off-normal operations of the Building X-326 Side Purge Cascade; however, training on centrifugal compressor surging and loading was limited.

A new training module, for responding to off-normal conditions resulting from compressor overload or surging, was developed after the event to improve operations staff understanding of and clarify expectations regarding response actions. -

(Section 5.1)

Maintenance and Surveillance e The inspectors identified a violation, in that, the plant staff had not developed or implemented corrective actions to ensure the proper application of those portions of the maintenance and equipment history program associated with the identification of equipment failure causes. An August 1998 corrective action plan, developed to address inadequate implementation of the equipment history program, did not ensure that all known inadequacies in the program's implementation were resolved. (Section M1.1)

Enaineerina e The inspectors identified a violation, in that, an anomalous condition report, developed for the conditions present after the December 9,1998, fire, did not correctly evaluate some nuclear criticality safety aspects of the conditions that resulted from a fire in Cell 25-7-2 on December 9,1998. As a result, the presence of an unanalyzed condition was not identified, the potential safety significance of the conditions were not properly 2

.. . i assessed, and the nuclear criticality safety controls, relied upon and lost, were not properly identified. (Section N1.1) e The inspectors id+ntified a violation, in that, the plant staff did not perform a timely and rigorous evaluaion of the reportability of the nuclear criticality safety status of Cell 25-7-2 following the December 9,1998, fire. As a result, the Plant Shift Superintendent failed to make timely and correct reports to the NRC on December 9, 10, and 11,1998. A corrected report was submitted to the NRC in March 1999.

l (Section N1.2) '

e The inspectors identified a violation, in that, operations staff did not ensure the timely and correct implementation of nuclear criticality safety-related compensatory and corrective measures, specified by procedures, following a large air inleakage to the cascade. As a result, the operation staff did not properly tag or log the status of valves controlled for nuclear criticality safety purposes and did not initiate temporary repairs specified for moderation control. (Section N1.3)

Plant Suooort (Emeraency Preoaredness) e The inspectors determined that the Building X-300 staff pro-actively reviewed a procedure for responding to building fires during the early stages of the emergency response on December 9,1998. However, the inspectors also identified a performance weakness, in that, the Plant Shift Superintendent Manager decided not to remotely isolate the Unit 25-7 lubricating and hydraulic oil system without a first-hand understanding of the Building X-326 emergency conditions and without communicating the decision to the incident Commander. (Section P1.1) e The inspectors identified an Apparent Violation, in that, the Plant Shift Superintendent did not classify, as an Alert, the fire involving Cell 25-7-2 in Building X-326 on December 9,1998, initial corrective actions to resolve the cause of the failure to classify the event as an Alert were effective for fire emergencies. However, the inspectors identified a violation, in that, the corrective actions were not effective at correcting other inconsistencies between the Emergency Plan and the Emergency Plan implementing Procedures for other types of emergencies. (Section P3.1) e The inspectors determined that the emergency response training program for operations and emergency response organization personnel was appropriate to ensure that the personnel were knowledgeable of site emergency response activities. However, nuclear criticality safety training provided to fire fighters was noted to be only minimally adequate and appeared to contribute to a delay in the staff's completion of fire fighting activities on December 9,1998. Revised fire fighting training, developed and

' implemented following the fire, was noted to be significantly improved and included both general and specific response guidance. (Section P5.1) 3

l 1

Report Details

1. Operat'9ng 01 Conduct of Operations 01.1 Resoiratory Protection Policy for Operations Staff

a. Inspection Scooe (88100)

The inspectors reviewed the storage and use of air-purifying respirators prior to and during the event of December 9,1998.

b. Observations and Findinas The plant staff had historically issued air-purifying respirators to qualified operators for j use in routine activities where the radiation work permit or safety and health permit required such respirators. The respirators had to be retumed for cleaning and inspection after 30 days. Not all of the operations staff in the process buildings were required to or qualified to use respirators in their routine duties. Operators having assigned respirators were also allowed to take them as a precaution for escape-use only during investigations of certain process alarms. Prior to the event of December 9, 1998, operations staff approved to use respirators regularly stored their respirators outside the Area Control Room (ACR) for ease of retrieval when performing assigned duties. The respirators were not intended nor approved for use for event response and

. were only to be used for escape if readily available. The "see and flee" policy, specified in Procedure XP2-SH-SH5030, " Actions to be Taken During A UF., HF, F, or CIF3 Release," required that personnel evacuate an area upon smelling or observing any active release of hazardous materials. In addition, plant staff were not to enter or cross any such area when on recall to the control room.

The Augmented Inspection Team (AIT) documented in NRC Inspection Report 70-7002/98019(DNMS) that some operations staff in ACR-6 delayed their exit from the ACR due to their respirators being stored outside the control room and not readily accessible. Some operations staff responded to ACR-6 with respirators during the initial stages of the event. In addition, an operator responded to the cell floor to investigate and left the area when he observed the smoke from the fire, closing the valve for the cell lube oil during the departure. The inspectors were not able to identify any actions which were clearly not in accordance with the "see and flee" policy.

However, the inspectors noted that the availability of air-purifying respirators near the ACRs should not lead the operations staff to believe the respirators were available for emergency response for hazardous materials releases.

To clarify the use of the ACRs during an emergency and reinforce the "see and flee" policy after the event, the plant staff conducted additional training on the use of the ACRs as recall areas. The training emphasized that use of the ACR as a recall area during an emergency was simply a method for disseminating additional information to personnelin the building and the ACRs were not to be considered " safe havens" (since the ACRs were not positively pressured relative to the rest of the building). If the emergency caused conditions to worsen in the ACR such that the "see and flee" policy would apply, the plant staff were to evacuate from the ACR via the most accessible 4

route. The plant staff in the ACR could use their respirators during the evacuation as an additional precaution, but the respirators were not intended to delay any plant staff from leavirty the ACR. Iri addition, the plant staff changed the policy of storing respirators outside the ACR and moved the respirator storage cabinets inside for better accessibility to the operations staff.

c. Conclusion The plant staff provided additional training on the use of the area control rooms as recall locations after the December 9,1998, event. The training focused on the use of the area control rooms during recall as a location from which to provide additional information to plant staff in the building during an emergency. The plant staff did not consider the control rooms to be " safe havens." The control rooms were to be evacuated by all plant staff in accordance with the *see and flee" policy, including operations staff who might have air-purifying respirators stored there, if conditions worsened.

03 Operations Procedures and Documentation O3.1 Review of Ooerational Procedures

a. Insoection Scope (88100) l The inspectors reviewed the procedures associated with the normal and off-normal operation of the Portsmouth Side Purge Cascade (SPC) and the actions taken by operations staff during and following the fire in Cell 25-7-2 on December 9,1998. The reviewincluded: '

e Procedure XP4-CO-CN2410 Revision 0, " Side Purge Cascade," effective date of August 24,1998;

• Procedure XP4-CO-CN2102C, Revision 0, " Cell Evacuation and Shutdown in X-326," effective date of June 10,1998;

• Procedure XP4-CO-CN2021 A, Revision 0, " Cell Startup in X-326," effective date of December 12,1997; e Procedure XP4-CO-CA3900C, Revision 0, " Control of Damaged Centrifugal Compressors," effective date of December 31,1997; and e Procedure XP2-SH-SH5030, Revision 1, " Actions to be Taken During a UF., HF, F,, or CIF, Release," effective date of May 7,1998.

In addition, the inspectors reviewed the certificatee's procedures policy, Technical Safety Requirements (TSR), and Section 6.11 of the Safety Analysis Report (SAR) containing the site requirements for procedure development and use.

b. Observations and Findinas initial Resoonse to Comoressor Suraina and Fire The inspectors reviewed the initial response to indications of off-normal operations in Cell 25-7-2 on December 9,1998. The AIT report and certificatee's Event Report 98-17 (Revision 1) detailed the instrument indications observed by an operator in 5 1

Building X-326 ACR-6. At approximately 6:05 a.m., a load alarm sounded when the ammeter measuring the current load for the Stage 2 motor in Cell 25-7-2 indicated a load increase to greater than 70 percent of full scale. The ACR-6 operator notified a first line manager (FLM) in training that a " coolant bubble" appeared to be entering the SPC and throttled the SPC vent control valve in an attempt to drive the bubble back out of the SPC. As identified in the AIT report, however, the surging was not due to a coolant bubble, but rather to a probable compressor problem (such as rubbing) either leading to or caused by an exothermic reaction in Stage 2. In fact, a coolant bubble in the cell would have caused a load decrease, not a load increase, because the coolant (R-114) has a lower molecular weight than the uranium hexafluoride normally present.

At approximately 8:06 a.m., the ammeter again deflected and retumed to normal. At approximately 6:07 a.m., the ammeter deflected to full scale and Cell 25-7-2 tripped on instantaneous overcurrent.

In response to the trip, the operator depressed the " Cell-Off-Split" button in an attempt to isolate the cell from the rest of the cascade. However, because of the uniqueness of Cell 25-7-2 which had an input stream to the middle of the cell at Stage 4, depressing this button did not fully isolate the cell. A manual block valve (AB2S4) remained open.

The on duty ACR-6 FLM reached the control room shortly after Cell 25-7-2 tripped. The FLM verified that the SPC vent had been isolated. The FLM also reported that a cell coolant alarm was sounding at approximately the time when the Plant Control Facility (PCF) was receiving reports of heavy smoke on the upper (cell) floor of Building X-326. At approximately 6:19 a.m., the Building X-326 Section Manager, having responded to ACR-6 with a respirator, finally isolated the cell by closing the first motor-operated valve beyond the manual block valve (AB2S4).

The inspectors noted that Procedure XP4-CO-CA3900C for damaged compressors included entry conditions and immediate actions to be taken in such situations. In particular, two of the entry conditions in Section 1.0 of the procedure were " excessive stage overioad" as indicated on a motor ammeter and an " unexplained rise in motor amp load." Section 2.0, "Immediate Actions," included Step 2.1 which directed the operator to stop affected cell motors from the fastest location (pushbutton in ACR, breaker at local control conter, or pushbutton in PCF). Step 2.2 directed the operator to take the cell offstream and referred to Procedure XP4-CO-CN2102C. Procedure XP4-CO-CN2102C referred the operator to Procedure XP4-CO-CN2410 which contained the guidance on how to isolate Cell 25-7-2 from the cascade. The AIT report and discussions with operations staff indicated that on the moming December 9,1998, the operations staff did not reference Procedure XP4-CO-CA3900C. As a result, immediate actions for the compressor surging and load alarms for Stage 2, which may have potentially prevented or mitigated the exothermic reaction, were not taken.

As part of the initial corrective actions after the avent, the plant staff developed and performed crew briefings and lessons learned. The topics included the steps necessary I to trip and isolate a cell and how to recognize cell surging and cell loading conditions requiring cell shutdown. In addition, the piant staff took actions to attempt to identify problem cells or compressors via weekly surveys of the onstream Top Purge Cascade. ,

Finally, the plant staff placed administrative controls in the Daily Operating Instructions >

to obtain vibration readings for cells with abnormal vibration upon startup and to refrain from starting a centrifugal compressor with uranium hexafiwride in it after the compressor was shut down due to high vibration 6

Technical Safety Requirement 3.9.1 requires, in part, that written procedures shall be prepared, reviewed, approved, implemented, and maintained to cover activiiies listed in

( Appendix A to SAR Section 6.11. Appendix A listed cascade cells as systems requiring I system procedures that address startup, operation, and shutdown. The failure to reference and take the immediate actions identified in Procedures XP4-CO-CA3900C, XP4-CO-CN2102C, and XP4-CO-CN24'.9 to trip and fully isolate Cell 25-7-2 after the unexplained cell load alarms for Stage 2 on December 9,1998, is an example of a Violation of TSR 3.9.1. (VIO 70-7002/99006 01a)

Alarm Response Procedures Section 4.0 of the AIT report identified that the initial response to the high load conditions and load alarm for Cell 25-7-2 by the operations staff was not guided by an alarm response procedure (ARP). Discussions with operations staff indicated that ARPs i had been developed for certain operations considered to be high-risk (systems involving liquid uranium hexafluoride, for example), but had not been developed for alarms associated with the cell panels, auxiliary equipment panels, or other cascade alarms which would normally occur in the ACRs such as ACR-6. As noted above, procedural guidance for responding to the load alarm for Cell 25-7-2 was available to the operations staff. However, the need to reference three separate procedures to trip and isolate the cell indicated the procedural guidance was not readily accessible for the event as conditions rapidly degraded. In fact, the Building X-326 operations staff indicated the procedures were not referenced during the event itself.

Event Report 98-17, Revision 1, dated March 19,1999, identified " inadequate procedures" as a contributing cause for the event. As part of the corrective actions for the fire, the certificatee committed to developing ARPs for the Top and SPCs by November 3,1999. However, the development and implementation of ARPs for other cascade ACRs, while planned, were not considered to be regulatory commitments, and no completion date was provided. The inspectors noted that development of appropriate alarm response procedures for systems similar to those in Appendix A to SAR Section 6.11 (which covered systems with alarms in cascade ACRs) was a regulatory requirement and could have aided the operations staff in the initial

, assessment and response to the event of December 9.1998. At the exit meeting on March 26, the plant staff indicated that the corrective action to develop and implement ARPs for the cascade ACRs would be modified to be a regulatory commitment.

Technical Safety Requirement 3.9.1 requires, in part, that written procedures shall be prepared, reviewed, approved, implemented, and maintained to cover activities listed in Appendix A to SAR Section 6.11. Appendix A listed cell load alarms and cell coolant )

alarms as examples of ACR alarms requiring written procedures for " abnormal )

operation / alarm response." The failure to prepare, review, approve, and implement alarm response procedures for cascade ACR alarms such as cell load and cell coolant alarms is a Violation of TSR 3.9.1. (VIO 70-7002/99006-02)

c. Conclusion

The inspectors identified two violations: a violation for failing to implement certain immediate actions in the off-normal procedure for compressor damage and a violation for failing to develop alarm response procedures for cell panels and auxiliary panels in the cascade area control rooms. The review indicated that procedural guidance for 7

c, properly responding to the initial load alarm and indications of unusual compressor surging on December 9,1998, was available in various procedures. However, the Building X-326 operations staff did not reference the procedures, nor was the guidance readily accessible (as in an alarm response procedure) to the operations staff when conditions were rapidly deteriorating after the initial load alarm for Cell 25-7-2.

05 Operator Training and Qualification 05.1 Cascade Operations Trainina

a. Insoection Scope (88010)

The inspectors reviewed training modules and held discussions with operations staff to determine the scope and content of training for the operations staff involved with Building X-326 operations of the Side Purge and Top Purge Cascades. The review included:

e Training Module OCA02.01.08, " Side Purge Operations," dated May 16,1997; e Training Module OCA02.01.07, " Top Purge Operations," dated May 16,1997;

• Training Module OCA02.13.25, "Off-Normal / Emergency Operations," dated May 30,1097; e Training Module OCA02.13.18, " Axial Compressor Surging and Deblades," dated March 16,1995; and e Training Module OCA 30.99.01, *SAR/TSR Required Actions for Cell Trips / Isolation," dated March 16,1999.

b. Observations and Findirigg The training provided to Building X-326 operators provided an adequate overview of the operation of the side purge and top purge cascades and likely off-normal conditions, including centrifugal compressor overload and surging, fires, freon leaks, etc. However, the training provided prior to the December 9,1998, event, did not include any detailed guidance on when to take action in response to a compressor surging or overload condition. Operators interviewed by the NRC inspectors and plant staff after the event exhibited an inconsistent understanding of what constituted " excessive stage overload,"

one of the entry conditions for the off-normal procedure for compressor damage. Also, the training for off-normal and emergency operations tended to focus on operations in Buildings X-330 and X-333 where the large axial compressors were located, with limited discussion of the differerices for the centrifugal compressors used in Building X-326.

The training provided a discussion of likely consequences for compressor failures and the need to be attentive for exothermic reactions, but did not provide specific action levels for taking action to prevent such a reaction from occurring or to limit the extent of the reaction. -

As part of the corrective actions for the event, the plant staff recently developed a new training module addressing cell trips and isolation, and compressor surging and overload. The inspectors noted that the module was very detailed and provided a thorough discussion of off-normal conditions and indications, alarm response actions, and pertinent design basis accidents from the SAR. In particular, the module provided better-defined criteria for taking actions to trip and isolate a cell based on the ammeter indications for one or more stage motors. A cell was expected to be immediately tripped 8

s v .

when an overload condition caused the ammeter to deflect full scale er when compressor surging caused the ammeter to deflect to 90 percent of full scale. The plant staff had yet to provide the training to cascade operations staff, but had provided some initial training on the criteria in crew briefings held after the event.

c. Conclusion The training provided to operations staff provided guidance in the various modules on the important aspects of the normal and off-normal operations of the Building X-326-.

Side Purge Cascade, although training on centrifugal compressor surging and loading was limited. A new training module for responding to off-normal conditions resulting from compressor overload or surging was developed after the event to improve operations staff understanding of and clarify expectations regarding response actions.

M1 Conduct of Maintenance Activities M1.1 Eauioment History and Failure Analysis Processes Imolementation

a. Inspection Scone (88103)

The inspectors reviewed the plant siaff's implementation of the equipment history and failure analysis processes for maintenance conducted on Cell 25-7-2 prior to the December 9,1998, fire and for other safety-related equipment,

b. Observations and Findinos The NRC AIT report documented that corrective maintenance was performed on Cell 25-7-2 during the months preceding the fire, in part, to correct high vibration conditions being experienced with Stages 2 and 4 of the cell. The report further documented that the work packages, used to perform removal and replacement of the Stage 2 and 4 compressors, did not include as-found or as-left vibration analysis and did not require a failure analysis of the compressors prior to restart of the cell. Subsequent to the fire, the plant staff observed the removed compressors and noted signs of a previous hot metal reaction and a general failure of portions of the compressor impellers.

The inspectors discussed the plant program and procedures for conducting vibration monitoring of rotating equipment, including cascade compressors with operations, maintenance, and engineering staff. The inspectors were informed that the plant currr,ntly does not have a formal vibration monitoring program. Some vibration monitoring was performed, for cause, by operations staff using instructions provided by Procedure XP4-CO-CA6770, " Vibration Surveys." Additional less formal, weekly vibration surveys were conducted by the engineering staff on equipment in the Top Purge Cascade. Neither of the vibration monitoring activities appeared to require the use of calibrated equipment and the data was not formally trended.

The inspectors reviewed the plant staff's application of the equipment history and failure analysis processes for safety-related maintenance activities. The processes were described in Procedure, XP2-GP-GP1040,

• Equipment History Program," Revision 0, effective date September 14, G97, and were implemented by reference through Procedure XP2-GP-GF1038, " Maintenance Program." However, the inspectors noted 9

u. .

]

that corrective maintenance was implemented using Procedure XP2-GP-GP1030,

" Work Control Process," which did not reference or incorporate the equipment history and failure analysis requirements.

The inspectors discussed implementation of the equipment history program with the maintenance manager. The manager indicated that currently, the program was not well integrated within the overall corrective maintenance process. As a result, the causes of equipment failures or malfunctions, important to safety or production, may not be promptly determined, evaluated, corrected, and recorded as specifed in Sections 6.9 and 6.12 of Procedure XP2-GP-GP1038. As a corrective measure following the fire, the maintenance staff developed several modifications to equipment-specific maintenance procedures to ensure that the as-found and as-left conditions were documented and the cause of the malfunction or failure was properly evaluated. The manager also noted that a corrective action plan had been developed in August 1998 to address deficiencies in the equipment history program implementation. The corrective action plan was developed in response to NRC inspection findings documented in NRC Inspection Report 70-7002/98013(DNMS).

During review of the August 1998 corrective action plan and the equipment history procedure, the inspectors noted that the corrective action plan was initiated by the Reliability Engineering Manager (REM) and addressed only one aspect of the equipment history program, the computerized maintenance management system (CMMS). The CMMS was a computer data base which was used to track equipment failures and work efforts. In addition to the management of the CMMS, the equipment history program tasked the REM with responsibility for identifying, in work packages, those failures and malfunctions which required failure analysis and a determination of the failure cause. The manager indicated that the corrective action plan scope was limited to implenentation of a formal trend analysis process. The manager indicated an awareness that other aspects of the equipment history program were not being fully implemented. However, the manager felt that changes to the program, as specified in the corrective action plan, were necessary prior to the staff addressing other program implementation deficiencies.

The inspectors questioned the manager's assessment that a proper implementation of other equipment history program requirements was dependent upon a successful completion of the corrective action plan. Specifically, the inspectors noted that several of the program requirements related to reliability engineering conducting pre-work reviews of proposed corrective maintenance activities to determine the need for an inspection during repair and replacement of the failed equipment and the need for a failure analysis of the equipment. These activities did not appear to depend on the formal trend analysis process. The application of such an upfront review of proposed corrective maintenance activities and the nead for a failure analysis may have resulted in the plant staff identifying in October 1998 the degraded Cell 25-7-2 compressors prior to retuming the cell to service and the fire on December 9,1998. The manager acknowledged the inspectors' observations and noted that reliability engineering had not performed pre-work reviews of corrective maintenance activities since the equipment history program was instituted. The manager also concurred that the current corrective action plan would not assure that aspects of the equipment history program, unrelated to the formal trend analysis process, were properly implemented.

10 L

T. .

Title 10 of the Code of Federal Regulations, Part 76.93, " Quality Assurance," requires, in part, that the cutificatee shall establish, implement, and maintain a Quality Assurance Program. Section 2.16, of the Quality Assurance Program requires, in part, that conditions adverse to quality shall be corrected as soon as practical. The failure to develno a corrective action plan which addressed all known conditions adverse to quality assoc Xf with implementation of the maintenar:ce and equipment history program requirem.,,Js for activitien which affected safety-related equipment is an example of a Violation (VIO 70-7002/99006-03a).

Based upon the inspectors efforts discussed above, inspection Followup Item IFl 70-7002/98013-03 is closed. The inspectors will conduct a further review of the issues discussed in the IFl as a part of the NRC's assessment and closure of VIO 70-7002/99006-03a.

c. Q_onclusions .

The inspectors identified a violation, in that, the plant staff had not implemented nor developed corrective actions to ensure the proper application of those portions of the maintenance and equipment history program associated with the identification of equipment failure causes. An August 1998 corrective action plan, developed to address inadequate implementation of the equipment history program, did not ensure that all known inadequacies in the program's implementation were resolved.

N1 Conduct of Nuclear Criticality Safety Activities N1.1 Analysis of the December 9.1998. Cell 25-7-2 Anomalous Condition

a. Insoection Scooe (88020)

The inspectors reviewed the nuclear criticality safety (NCS) anomalous condition report developed, following the Cell 25-7-2 fire on December 19,1998, to assess the NCS status of the cell and to assist the Plant Shift Superintendent (PSS) in deterrrdning the reportability of the event.

b. Observations and Findinas On the afternoon of December 9,1998, the plant staff documented in a non-conformance (problem) report a determination that controls, specified in the cascade operations nuclear criticality safety approval (NCSA) and applicable to Cell 25-7-2, could not b6 Implemented. Specifically, the plant staff noted thet the cell could not be pressurized with a dry gas buffer within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after being shut down. As a followup to the problem report, the NCS staff began development of an anomalous condition report for the situation. The anomalous condition report was completed at 8:30 p.m.

The inspectors reviewed the anomalo is condition report and noted that item 3.a of the report indicated that the as-found condition of Cell 25-7-2 did not violate the safety basis of the nuclear criticality safety evaluation (NCSE) for the cascade. This conclusion appeared inconsistent with the presence of several large holes in the cascade piping concurrent with the plant staff's inability to pressurize the cell with dry air. Specifically, the cascade NCSE safety basis assumed that the cascade piping could 11

f. .

serve as a pressure boundary for the dry air used for moderation control. The inspectors also determined that the anomalous condition procedure would have required, based upon an affirmative response to item 3.a. the development of a new or rowsed NCSE for an as-found condition that violated the current safety basis. The NCS staff did not initiate a new or revised NCSE for Cell 25-7-2 until almost 3 days after the fire.

The inspectors also noted that answers to several questions, focusing on an assessment of the condition's reportability, included either incorrect or non-conservative information. Specifically, an assessment of the potential safety significance of the event did not consider the possibility of a deposit being present, following the fire, as a result of the cell conditions which preceded the fire. The presence of even a moderate size deposit within the cell prior to the event could have resulted in a greater-than-minimum '

critical mass being present following the fire and an increased safety concem. The inspectors also noted that the answer provided for the question of " controlled parameters" included incorrect information. Specifically, the answer indicated that two parameters were controlled, mass and moderation. However, normal cascade operations were defined in the SAR as singly contingent, relying exclusively on moderation control. As a result of the holes in the cascade piping created by the fire, moderation control was no longer possible. The inspectors also observed that the report was not developed until approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the fire was extinguished and was not independently reviewed, i.e., the NCS manager both developed and approved the report.

The inspectors discussed the findings with the NCS manager. The manager concurred with the inspectors findings and noted that changes to the anomalous condition report procedure were being considered. The manager confirmed the inspectors observations that the condition was unanalyzed and that the potential for inleakage into the cell, prior to the fire with the resultant creation of a deposit, had not been considered. The inspectors also were informed that the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> gap between the fire and development of the anomalous condition report was due, in part, to the NCS staff's past reliance on a problem report as the initiating condition for such an evaluation. Subsequent to the discussions, the NCS manager completed a revised evaluation which addressed a number of the above described findings.

Technical Safety Requirement 3.9.1 requires, in part, that written procedures shall be implemented for activities listed in the SAR Section 6.11, Appendix A. Appendix A listed " nuclear criticality safety" as an activity requiring written procedures.

Procedure XP4-EG-NS1-25, "NCS Response to Anomalous Conditions," Revisions 0 Change B, effective date November 30,1998, required, in part, that the NCS staff shall:

1) determine if an anomalous condition involved an unanalyzed condition; 2) assess the safety significance of an as-found condition; 3) identify the NCS controls affected by the anomalous condition; and 4) complete the anomalous condition report within the reportability timeframe for the condition. The failure to: 1) determine that the anomalous condition resulting from the Cell 25-7-2 fire involved an unanalyzed condition; 2) incorporate the potential presence of a deposit into the safety evaluation;

3) properly identify the NCS controls affected by the anomalous condition; and

4) complete the anomalous condition report within the reportability timeframe (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) for the condition is an example of a Violation of TSR 3.9.'t. (VIO 70-7002/99006 01b) 12

c. Conclusions

~ The inspectors determined that the plant staff failed to properly evaluate the nuclear criticality safety aspects of an anomalous condition resulting from the fire in Cell 25-7-2.

As a result, the presence of an unanalyzed condition was not identified, the potential safety significance of the conditions was not properly assessed, and the nuclear criticality safety controls relied upon and lost were not properly identified.

N1.2 Bulletin 91-01 Reportino of Cell 25-7-2 Fire

a. Insoection Scoos (88100)

I The inspectors reviewed Bulletin 91-01 reports made by the plant staff as a result of the {

fire in Cell 25-7-2.

l

b. Observations and Findinas On the moming of December 9,1998, the PSS, acting as the incident Commander (IC),

was informed by the plant fire fighting staff of holes in the cascade piping and some cascade components associated with Cell 25-7-2. The information was provided to the PSS as a direct result of the fire fighters requesting guidance, from the NCS staff, as to necessary fire fighting limitations as a result of the holes. Following a review of the fire fighters observations, the NCS staff provided guidance, through the PSS, for continued fire fighting activities and for the restoration of moderation control for Cell 25-7-2. The fire fighters informed the IC of the observations of holes in the cascade at approximately 7:30 a.m. The NCS staff provided verbal and written guidance to the PSS on proper fire fighting techniques and post-fire corrective actions by approximately 8:00 a.m.

At approximately 12:00 p.m., the Building X-326 Section Manager toured the Cell 25-7-2 area and observed the holes previously identified by the fire fighters in the cascade piping and components. Shortly after touring the area, the Section Manager informed -

both operations and plant management of the presence of holes in the cascade piping and components.- Based upon the Section Manager's observations, the plant management activated the emergency operation center (EOC) to serve as a focal point for addressing the emerging issues resulting from the fire.

At 4:30 p.m., the PSS Manager documented in a problem report a recognition that the cascade NCS controls, associated with the shutdown Cell 25-7-2, could not be implemented due to the holes in cascade piping and components caused by the fire.

The problem reoort documentation also included a request for the PSS to determine the reportability of the current condition. The NCS staff, at 6:20 p.m., completed a preliminary review of the problem report and determined that the failure to implement the NCS controls for the shutdown cell constituted a loss of all double contingency controls. The PSS made the initial Bulletin 91-01 report to the NRC at 10:17 p.m.

Subsequent to the initial Bulletin 91-01 report made on December 9,1998, the plant staff made three revisions to the report. The revisions were made on December 10, 1998, December 11,1998, and March 25,1999. The first revision proposed the change of the reporting timeframe for the notification from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, based upon new survey data which indicated that deposits within Cell 25-7-2 were smaller than the 13

f. . ,

always-safe mass limit. The second revision was made after the plant staff discussed the first two reports with the NRC AIT inspectors and determined that the first two reports were not based upon the applicable reporting criteria. The third revision was made after the inspectors identified and the plant staff concurred that the first three reports were all based upon an incorrect assumption that cascade operations were doubly conUngent. On the moming of December 9,1998, when moderation control was lost for Cell 25-7-2, the system was a singly contingent operation that depended exclusively on moderation control for NCS.

The inspectors reviewed plant Procedure UE2-RA-RE1030,

• Nuclear Regulatory Event Reporting," Revision 2, Change C, effective date March 3,1997. The procedure required the plant staff to report abnormal conditions through the problem reporting system and to repost conditions requiring immediate attention directly to the PSS. The procedure further required the PSS to determine whether an ev(nt or condition was reportable to the NRC according to the criteria listed in Appendix D of the procedure.

Appendix D, criteria A.3.a., c(1), and c(3) specified, in part, that a report shall be made to the NRC, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from initial observation, for operations that do not comply with the double contingency principle [i.e., operations that are singly contingent], for

' which moderation is used as the primary criticality control and that involve: 1) the occurrence of any unanalyzed event for which the safety significance of the event or corrective actions to re-establish the approved controls are not readily identifiable; or

2) the controlled parameter and the control on the parameter cannot be re-established within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initial observation of the event.-

Based upon the sequence of events associated with reporting for the Cell 25-7-2 fire on December 9,1998, the inspectors determined that the staff did not report the loss of moderation control for Cell 25-7-2 within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after being initially observed by the fire fighters, at approximately 7:30 a.m. The plant staff also did not report the loss of moderation control within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the condition was observed by the Building X-326 Section Manager at 12:00 noon. The plant staff did begin an assessment of the reportability associated with Cell 25-7-2 at 4:30 p.m. However, this evaluation was conducted for the failure to implement an NCS control within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the cell was shut down, not for the initial loss of moderation control which occurred esi1y in the moming. Preliminary results from the evaluation begun at 4:30 p.m., were completed at 6:20 p.m., and a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> report was made to the NRC at 10:17 p.m.

However, this report was not made for the initial condition of loss of moderation control

' due to holes in the cascade.

The inspectors also determined that revisions made to the initial Bulletin 91-01 report of December 9,1998, which corrected or provided additional technical information were appropriate. However, the revisions made to the initial report which modified the reporting time frame (i.e., from a 4-hour to a 24-hour Bulletin 91-01) were inconsistent with the Safety Analysis Report, Procedure UE2-RA-RE1030, and NRC Bulletin 91-01, Supplement 1, dated July 27,1993. Specifically, the plant staff were required to report, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after initial observation, the occurrence of any anticipated or unanalyzed event for which the safety significalice of the event or corrective actions to reestablish control were not readily identifiable. Therefore, the plant staff's subsequent determination that a %ss than the always-safe mass existed in Cell 25-7-2 had no bearing on the reporting time frame, since this information was unavailable at the time the initial report was required.

< 14 1

4

The inspectors discus'sed the findings with plant operations, regulatory affairs, and NCS staff. The inspectors were informed that the plant staff had historically relied upon information supplied to the PSS, via the plant problem report system, as the initiating point for evaluating the reportability of a condition or event. Since the PSS was informed of the presence of holes in the cascade piping and equipment, an indication of the loss of moderation control, as a part of an emergency response, the normal

, reportability process was not begun. Additionally, although the PSS and the NCS staff were aware of the Section Manager's observations of holes in the cascade components, no reportability evaluation was begun, in part, because a problem report was not initiated.

The NCS staff indicated that the NCS anomalous condition evaluation, provided to the PSS to support an evaluaten of the reportability of a condition or event, was normally initiated by a problem report. Therefore, though the NCS staff were aware of Cell 25-7-2 conditions early on the moming of December 9,1998, which indicated that moderation control had been lost, an anomalous condition evaluation was not begun until a problem report was filed at approximately 4:30 p.m. The NCS staff also noted that a lack of rigor during the development and review of the anomalous condition report significantly contributed to the multiple errors in reporting of the event. As noted in Section N1.1., the inspectors determined that the anomalous condition report failed to identify that normal cascade operations were a singly contingent operation. As a result, the PSS evaluated the condition's reportability assuming the operation was doubly contingent.

Technical Safety Requirement 3.9.1 requires, in part, that written procedures shall be .

- implemented for activities listed in the SAR Section 6.11, Appendix A. Appendix A identified " investigations and reporting" as an activity requiring written procedures.

Procedure UE2-RA-RE1030, " Nuclear Regidatory Event Reporting," Revision 2, Change C, effective date of March 3,1997, required, the PSS to determine whether an event or condition was reportable to the NRC according to the criteria listed in Appendix D of the procedure. Appendix D, criteria A.3.a., c(1), and c(3) specife' d, in part, that a report shall be made to the NRC, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from initial observation, for operations that do not comply with the double contingency principle [i.e., operations that are singly contingent), for which moderation is used as the primary criticality control and that involve: 1) the occurrence of any unanalyzed event for which the safety significance of the event or corrective actions to re-establish the approved controls are not readily identifiable; or 2) the controlled parameter and the control on the parameter cannot be re-established within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initial observation of the event. The failure to notify the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the initial observation of the loss of moderation control for Cell 25-7-2 on the moming of December 9,1998, is an example of a Violation of TSR 3.9.1. (VIO 70-7002/99006 01c)

c. Conclusions The inspectors determined that the plant staff failed to perform a timely and rigorous evaluation of the reportability of the nuclear criticality safety status of Cell 25-7-2 following the December 9,1998, fire. As a result, the Plant Shift Superintendent failed to make timely and correct reports to the NRC, a Technical Safety Report violation.

Specifically, the Plant Shift Superintendent: 1) failed to make a report to the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initial observation that moderation control was lost to Cell 25-7-2; and

2) made reports to the NRC on December 9,10, and 11,1998, that did not accurately 15

reflect the single contingency status of Cell 25-7-2. The Plant Shift Superintendent made a corrected report to the NRC in March 1999.

N1.3 Imolementation of Initial Nuclear Criticality Safetv-RelatM Corrective Actions

a. Inspection Scooe (88020)

The inspectors reviewed the initial NCS safety-related corrective actions implemented by the Building X-326 operations staff following the fire on December 9,1998.

b. Observations and Findinas Following the fire fighter's extinguishing of the Cell 25-7-2 fire on the morning of December 9,1998, some operations staff retumed to Building X-326, ACR-6 to assess the status of the cascade and to take appropriate corrective measures. The implemented corrective actions were described, in part, in the NRC's AIT Report and included the silencing of alarms, isolating cells that had tripped, performing leak rate checks of shutdown cells, ensuring that recirculating cooling water was isolated from all shutdown cells, and sho+dng down cells that were suspected of experiencing inleakage to the cascade.

During discussions with the operations staff of the actions taken on the moming of December 9,1998, the inspectors were informed that the operator's focus, in taking the actions, was to stabilize the cascade. Actions were also taken later that -day to ,

implement those NCS related control measures required by the NCSA for cascade '

operations. The operations staff further indicated that most of the actions implemented were specified in several operations procedures including: 1) Procedure XP4-CO-CA2182, " Control of Large Air inleakage," Revision 1, Change C, effective date February 10,1997; 2) Procedure XP4-CO-CM9709, " Classifying and Handling Equipment Containing Uranium Deposits," Revision 2, effective date July 17,1998;

3) Procedure XP4-CO-CN2102C, " Cell Evacuation and Shutdown in [ Building] X-326,"

Revision 0, Change D, effective date February 10,1997; and 4) Procedure XP2-SH-IS1034, " Accident Prevention / Equipment Control Tags," Revision 0, Change A, effective date July 31,1997.

The inspectors reviewed the NCS related actions taken by the operations staff and those specified in the referenced procedures. The inspectors determined that the operations staff only implemented some of the actions specified in tne procedures.

Those actions not immediately implemented were associated with: 1) tagging (controlling) and logging the status of valves and piping spool pieces positioned to preclude the inadvertent addition of recirculating cooling water to a cell containing a uranium deposit, and 2) compensatory and corrective measures specified for events involving a potential exothermic event, including making temporary repairs and providing a dry air buffer to the affected equipment. During subsequent discussions with the ,

operations staff, the inspectors were informed that the errant logging and tagging of the i recirculating cooling water valves was identified during their followup of a similar valve I control problem in February 1999. The operations staff indicated that the NCS related temporary repairs, as specified in Procedure XP4-CO-CA2182 and referenced in the cascade NCSA, were not implemented in a timely manner, in part, because the staff did l not refer to the procedure. The inspectors noted that each of the' procedures mentioned j by the operations staff were designated as a "generai intent" or an "information use" 16

s procedure. Therefore, the staff were not required to review the procedure as the related work was implemented. However, the procedure requirements were required to be accomplished in each case.

Technical Safety Requirement 3.9.1 requires, in part, that written procedures shall be implemented for activities listed in the SAR, Section 6.11, Appendix A. Appendix A identified *NCS" as an activity requiring written procedures. Procedures XP4-CO-CA2182, " Control of Large Air inleakage," Revision 1, Change C, effective date February 10,1997, and XP2-SH-IS1034, " Accident Prevention \ Equipment Control Tags," Revision 0, Change A, effective date July 7,1997, required in part, that the plant staff shall take specific actions to control (tagging and logging) the recirculating cooling water supply to shutdown cells and shall implement specific temporary repairs for events which result in large inleakages to the cascade. The failure of plant staff to tag and log the status of valves controlled for NCS related purposes and to implement temporary repairs to the cascade following the December 9,1998, fire is an example of a Violation of TSR 3.9.1. (VIO 70-7002/99006-01d)

c. Conclusions The inspectors identified a violation, in that, operations staff did not. ensure the timely and correct implementation of nuclear criticality safety related compensatory and corrective measures, specified by procedures, following a large air inleakage to the cascade. As a result, the operations staff did not properly tag or log the status of valves controlled for nuclear criticality safety purposes and did not initiate temporary repairs specified for moderation control.

P1 Conduct of Emergency Preparedness Activities P1.1 Isolation of Hydraulic and Lubrication C/, to the Cell 25-7-2 Fire

a. Inspection Scope (88050)

The inspectors reviewed the plant staff's actions to isolate hydraulic and lubricating oil to Cell 25-7-2 during the fire on December 9,1998,

b. Observations and Findinas During discussions with the PSS Manager of the emergency response activities that transpired on December 9,1998, the inspectors were informed that staff within l Building X-300, the main plant control room, pro-actively reviewed the plant procedure j for responding to building fires and considered the need to shut down and isolate the lubricating and hydraulic oil supplies to Cell 25-7-2 and Unit 25-7. However, the PSS Manager also made decisions regarding the isolation of hydraulic oil to Cell 25-7-2 that ,

were not communicated to the IC. Specifically, during the early stages of the emergency response to the fire, the PSS Manager determineu that hydraulic oil to Cell 25-7-2 should not be isolated by isolating the hydraulic oil supply to the entire groups of cells within Unit 25-7.

The PSS Manager informed the inspectors that at the time the decision was made in the main control room not to isolate hydraulic oil to Unit 25-7, the Building X-300 staff were aware of the ICs desire to isolate the hydraulic oil to Cell 25-7-2 in order to decrease the 17 L_ ~

u .

i 1

amount of flammable materials available to the fire. However, the PSS Manager and the Cascade Coordinator (CC) determined that the procedure did not require the action to be taken since, in their estimation, the unit lube oil system was not in imminent danger. In addition, the PSS Manager assessed that other, more significant safety and operational consequences could result from a shutdown of the hydraulic oil to Unit 25-7, j which included both the Side and Top Purge Cascades.

The inspectors reviewed the applicable procedure, the safety and operational concerns considered by the PSS Manager, and a time-line of events for the morning of December 9,1998. The inspectors determined that the procedure structure did not ensure that the IC had a complete summary of the available options for isolating the hydraulic oil to a cell, group of cells, or a unit. Specifically, the procedure structure did not indicate the available means to accomplish a particular crucial evolution. Instead, the procedure provided specific recommended actions based upon conditional entry statements. As a result, the IC would only know all of the available emergency response actions once the final stages of a lube oil fire were encountered. In addition, the inspectors determined that some of the PSSs were not aware of the capability to isolate the hydraulic oil from the main control room.

The inspectors noted that the safety and operational issues considered by the PSS Manager and the CC in making the decicion to not isolate oil to Unit 25-7, while generally valid, were incomplete. Specifically, the PSS Manager's assessment process did not include a comprehensive, first-hand assessment of the conditions present at the emergency, scene and did not consider the time remaining before the unit cells would automatically be shut down as a result of low oil pressure due to the ongoing loss of oil from the system. An operations staff, post fire review of the combined lubricating and hydraulic oil system status indicated that the system was depleted of oil and that a significant number of the unit cells had shut down due to a loss of oil pressure. Based upon the system capacity, the inspectors determined that the system could b3 emptied within approximately 30 minutes of a break in a hydraulic oil supply line to the cell valves.

c. Conclusions The inspectors identified that Building X-300 staff pro-actively reviewed the plant l d

procedure for responding to building fires during the early stages of the emergency response on December 9,1998. However, the inspectors also identified a weakness, in that, the Plant Shift Superintendent Manager's decision not to remotely isolate the Unit 25-7 lubricating and hydraulic oil system was not based on a first-hand understanding of the Building X-326 emergency conditions and was not communicated to the incident Commander.  !

P3 Emergency Preparedness Procedures and Documentation P3.1 Emeroency Plan and Ims'ementina Procedures

a. Inspection Scope (88050) i The inspectors reviewed the implementation of the Emergency Plan (EP) and Emergency Plan implementing Procedures (EPIPs) relative to event classification, emergency response organization (CRO) activation, notifications, protective actions, and ,

18 i

J

F, .

organizational control for the December 9,1998, fire in Building X-326. The adequacy of information conta!ned within the building emergency packets was also reviewed .

b. Observations and Findinas The inspectors noted a major inconsistency between the event classification guidance included in the EP and the details included in EPIP XP2-EP-EP1050, " Emergency Classification," Revision 2, effective date June 16,1998, which appeared to contribute to the plant staff's failure to classify the fire of December 9,1998, as an Alert. Section 3.0 of the EP stated that significant emergencies were classified as either Alerts or Site Area Emergencies (SAE). Section 3.1.1 of the Plan defined an Alert as an incident that has led or could lead to a release to the environment of radioactive or hazardous material. Further, Section 2.1 of the EP stated that fires, a nuclear criticality event, or severe natural phenomena could also require an emergency declaration and/or response. in contrast, EPIP XP2-EP-EP1050, Action Step 6.1.2.D included the following guidance for classification of events:

• " Events or conditions that do not meet the criteria for Alert or SAE such as fire, bomb threat, natural phenomena, and others are considered to be Operational Emergencies and may be reportable to NRC and Department of Energy. Refer to applicable event reporting procedures for guidance."

The inspectors noted that the December 9,1998, fire could have led to a release to the environment of radioactive or hazardous material. Specifically, at approximately 6:30 a.m., the fire fighters reported a substantial fire in Building X-326. At approximately 7:30 a.m., the fire fighters reported that the flames had been extinguished and that holes were visible in the process gas cascade piping and components. (These components normally contained uranium hexafluoride, a radioactive material.)

However, the EPIP for emergency classification lacked an initiating condition for fires which contributed to the PSS's failure to classify the event in accordance with the EP requirements for an Alert condition.

Title 10 of the Code of Federal Regulations, Part 76.91, required, in part, that the certificatee shall establish, maintain, and be prepared to follow a written EP. Section 3 of the EP, Revision 26, dated November 6,1998, stated, in part, that significant emergencies are classified as either Alerts or SAEs. Section 3 of the EP further defined an Alert, in part, as an emergency situation that has led or could lead to a release to the environment of radioactive or other hazardous material, or could have a direct effect on the health and safety of plant personnel. The failure to classify as an Alert the Building X-326, Cell 25-7-2 fire on the morning of December 9,1998, an emergency that led or could have led to a release of radioactive material or could have had a direct effect on the health and safety of plant personnel, is an Apparent Violation (eel 70-7002/99006 04).

Subsequent to the event, the plant staff ini'Jated corrective actions to remove the inconsistencies in the event classification between the EP and EPIP, a condition adverse to quality. The corrective actions were also intended to result in an inclusion of appropriate emergency action levels (EALs) for other emergency conditions, consistent with the information presented in NRC Regulatory Guide 3.67, " Standard Format and Content for Emergency Plans for Fuel Cycle and Material Licensees," dated January 1992.

19

Vf .

Following the plant staff's implementation of the corrective actions, the inspaMors reviewed the revised classification procedure and determined that the Procedure XP2-EP-EP1050, Appendix B, Section 3 information was inconsistent with the discussion included in the EP and examples included in the regulatory guide for the Alert and SAE classifications. Specifically, the revised procedure included examples of severe wind and security conditions that would be classified at the Alert level. However, similar )

examples in the regulatory guide and the EP discussion would be classified at the SAE 1 level.

The inspectors also assessed the adequacy of the procedural guidance, which described the initiating conditions for a natural phenomena emergency, during discussions with some of the PSS, individuals designated to classify events under the EP. During discussions with two PSS individuals, the inspectors noted that the PSSs were unable to determine if the EAL for the severe natural phenomena had been satisfied for the case of onsite sustained wind speeds in excess of 75 miles per hour.

Through discussions with the PSSs, the inspectors determined that the PSS's difficulty in determining if the EAL had been met was due to a lack of specific guidance within the procedure. In response to the inspectors' observation's, the plant staff documented the findings in a problem report and included interim compensatory measures to address the EALs.

Title 10 of the Code of Federal Regulations, Part 76.93, " Quality Assurance," requires, in part, that the certificatee shall establish, implement, and maintain a Quality Assurance Program. Section 2.16, of the Quality Assurance Program requires, in part, that conditions adverse to quality shall be corrected as soon as practical. The failure to correct a condition adverse to quality as soon as practical, that is, to resolve inconsistencies (classification levels and initiating conditions for severe wind and security emergencies) between the EP and EPIP XP2-EP-EP1050 following the December 9,1998, Building X-326 fire is an example of a Violation (VIO 70-7002/99006 03b).

The inspectors also reviewed the emergency packets for several buildings and l determined that the current informational content was adequate. The inspectors noted j that changes to emergency packets were issued to controlled copy holders in a timely manner; however, in some cases Facility Custodians had not maintained the packets current and up to date (3.g., Building X-333). In addition, the site staff were reviewing the emergency packet content to assess the need to include written details regarding I the location of the hydraulic control oil valves and the inclusion of this information in operator training materials.

The inspectors determined that procedures governing evacuation (XP2-EP-EP1031) and accountability (XP2-EP-EP1030) were periodically tested for adequacy through the perfo:mance of drills. During 1998, the plant staff conducted evacuation drills on May 1 and on September 29. In addition to the evacuation drills, which normally involved only a limited number of individuals, the plant staff, on three different occasions during 1998, conducted plant-wide accountability drills which were completed within an hour.

l i

20 j

7

c. Conclusions The inspectors identified an apparent violation, in that, the Plant Shift Superintendent did not classify as an Alert the fire involving Cell 25-7-2 in Building X-326 on December 9,1998 Initial corrective actions to resolve the cause of the failure to classify the event as an Alert were effective for the case of fire emergencies. However, the inspectors identified a violation, in that, the corrective actions were not effective at correcting other inconsistencies between the Emergency Plan and the Emergency Plan Implementing Procedures for other types of emergencies.

P5: Staff Training and Qualification Emergency Preparedness P5.1 - Trainina and Staffina of Emeroency Oraanization

a. Insoection Scope Training for Building X-326 operations, ERO, and fire fighting personnel were reviewed to determine if response efforts were negatively impacted by deficiencies in training; and to verify that training was provided in accordance with the SAR, Section 6.6.1 and the EP, Section 7.2.

b. Observations and Findinos Ooerations and Emeroency Resoonse Oroanization Personnel The inspectors did not identify any operations or emergency response organization training deficiencies. Several examples were noted of operations personnel, assigned to Building X-326, that had failed to retrain on specific job related modules (e.g., crane operations). However, the inspectors determined that, for each of the examples reviewed, administrative actions had been taken to restrict the personnel from work assignments for which their training had expired.

The inspectors reviewed 1998 training documentation for individuals assigned as primary or altemate to key positions on the EOC roster. Based on the training attendance sheets, and interviews with personnel responsible for tracking training, no deficiencies were noted.

The inspectors assessed the effectiveness of EAL training through interviews with two PSSs. The EP assigned the PSS responsibility for activation and impicinentation of the EP. Each PSS was presented postulated accident conditions involving a fire and high winds (>75 miles / hour) which required classification and were asked to describe the appropriate response, including the basis for their decisions. Both interviewees were very prompt and made the correct classification for the fire event. However, the interviewees failed to classify a postulated accident involving severe wind. Based upon further discussions with the PSSs, the inspectors determined that the interviewees failed tu properly classify the event based upon a lack of guidance regarding a wind speed action limit or trigger point rather than inadequate training. During the interviews both individuals demonstrated a good familiarity and understanding of their roles and responsibilities in prompt recognition and classification of events, EP implementation, and activation of the ERO.

21

[+ ..

During review of the EP training requirements, the inspectors noted that the )lan did not specify the retraining frequency for personnel assigned to the ERO. Howevi r, the retraining frequency was specified in the Training Development and Adminis rative Guide. Title 10 of the Code of Federal Regulations, Part 76.91(j) requires th i EP retraining frequency to be specified in the EP. The certificatee indicated that the failure to include the retraining frequency in the plan was an administrative oversigt : and committed to submitting an EP revision by May 1999. The failure to specify t 1e retraining frequency for emergency personnel in the EP is a Violation of Mil or Safety Significance not subject to formal enforcement action, consistent with lection IV of the NRC Enforcement Policy (NUREG-1600, Revision 1).

Fire Fiohtino Personnel Section 4.0 of the NRC's AIT for the December 9,1998, fire, indicated that ome of the fire fighter's response actions were delayed as a result of a lack of clear gu' Jance on the proper fire fighting techniques for events involving fissile materials, spe ificaliy holes in the cascade equipment. The report identified that the fire captain's actic '. , upon observation of the holes, were appropriate; however, additional training ap eared necessary.

The inspectors reviewed the training module used to provide NCS trainin< . for fire fighters at the time of the Building X-326 fire. The inspectors noted that' ae module included a basic summary of NCS controls and how the controls were a' plied to normal activities. However, the module did not include specific information on ',ow the fire fighters should apply the information to expected fire fighting scenarior involving the plant operations. As a result, the fire fighters may have had a basic u ederstanding of the fundamentals of NCS, but lacked specific training on how and wl sn to apply the information. The lack of training of specific response actions was cr asistent with the staffs request for additional NCS guidance during the December 9 1998, fire.

Subsequent to the fire, the plant fire protection engineer conduct' d a review of existing training for fire fighting activities involving fissue materials and d veloped a completely revised training module. The inspectors reviewed the module ad noted that the document included significantly improved guidance and direct .,n for the fire fighters on how to apply the fundamentals provided in the previous module. The revised module also included background information against which the fire fighters could assess the current techniques. As of the end of the inspection period, all of the fire fighters had received the revised training.

c. Conclusions The inspectors determined that the emergency response training program for operations and emergency response organization personnel was appropriate to ensure that the personnel were knowledgeable of site emergency response activities. However, nuclear criticality safety training provided to fire fighters was noted to be only minimally adequate and appeared to contribute to a delay in the staffs completion of fire fighting activities on December 9,10?8. Revised fire fighting training, developed and implemented following the fire, was noted to be significantly improved and included both general and specific response guidance.

22 L

V. Management Meetinas X1 Exit Meeting Summary The inspectors presented the inspection results to members of the facility management on March 26,1999. The plant staff acknowledged the findings presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered

. proprietary. No proprietary information was identified.

l l

l 23

y .

PARTIAL LIST OF PERSONS CONTACTED Lockheed Martin Utility Services

• T. Brooks, Nuclear Safety Manager

• D. Couser, Manager, Training

'S. Fout, Operations Manager

• P. Musser, Enrichment Plant Manager

• M. Redden, Emergency Management Manager

• M. Wayland, Maintenance Manager

• K. Zimmerman, Fire Services Manager United States Enrichment Corporation

• J. Adkins, USEC Vice President, Production

• J. Brown, General Manager

• L. Fink, Safety, Safeguards & Quality Manager State of Ohio L. Grove, Radiological Branch Chief

• Denotes those present at the exit meeting on March 26,1999, INSPECTION PROCEDURES USED IP 88010: Operations Training IP 88020: Nuclear Criticality Safety IP 88050: Emergency Preparedness IP 88100: Plant Operations IP 88103: Maintenance Observations ITEMS OPENED, CLOSED, AND DISCUSSED Opened 070-7002/99006-01 VIO Failure to implement procedures for operations, nuclear criticality safety, and event reporting.

070-7002/99006-02 VIO Failure to develop alarm response procedures for the cascade area control room alarms.

070-7002/99006-03 VIO Failure to implement corrective actions for conditions adverse to quality associated with the equipment history / maintenance program and the emergency plan implementing procedures.

070-7002/99006-04 eel Apparent violation for failure to classify as an Alert the fire in Building X-326 en December 9,1998.

l 24

) ..

I Closed i

070-7002/98013-03 . IFl Failure to fully implement the equipment history program procedure.

Discussed None LIST OF ACRONYMS USED

)

ACR Area Control Room AIT Augmented Inspection Team ARP Alarm Response Procedure CC Cascade Coordinator CMMS Computerized Maintenance Management System DNMS Division of Nuclear Material Safety EAL Emergency Action Level eel Escalated Enforcement issue EOC Emergency Operations Center EP Emergency Plan EPIP Emergency Plan implementing Procedure ERO Emergency Response Organization FLM First Line Manager IC incident Commander *'

IFl Inspection Followup Item NCS Nuclear Criticality Safety NCSA Nuclear Criticality Safety Approval NCSE Nuclear Criticality Safety Evaluation NRC Nuclear Regulatory Commission PCF Plant Control Facility PSS Plant Shift Superintendent R-114 Freon Coolant REM Reliability Engineering Manager SAE Site Area Emergency SAR Safety Analysis Report SPC Side Purge Cascade

.TSR Technical Safety Requirement USEC United States Enrichment Corporation VIO Violation i

i 25 m >