ML20207H511

Insp Rept 70-7002/99-05 on 990406-0514.Violations Noted. Major Areas Inspected:Operators Response to Small UF6 Release in Bldg X-330,which Was Effective & Consistent with Guidance Provided in Alarm Response & off-normal Procedures

ML20207H511
Person / Time
Site:	Portsmouth Gaseous Diffusion Plant
Issue date:	06/11/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20207H504	List: ML20207H500 ML20207H505 ML20207H511
References
70-7002-99-05, 70-7002-99-5, NUDOCS 9906170098
Download: ML20207H511 (32)

Text

F l .

J l U.S. NUCLEAR REGULATORY COMMISSION REGION 111 Docket No: 70-7002 Certificate No: GDP-2 Report No: 70-7002/99005(DNMS)

Fac;iity Operator. United States Enrichment Corporation Facility Name: Portsmouth Gaseous Diffusion Plant Location: 3930 U.S. Route 23 South P.O. Box 628 Piketon, OH 45661 Dates: April 6 through May 14,1999 Inspectors:- T. Reidinger, Acting Senior Resident inspector C. Blanchard, Resident inspector R. Krsek, Fuel Cycle Safety inspector Approved By: P. L. Hiland, Chis Fuel Cycle Branch Division of Nucle: Materials Safety l

1 l ,

r i

~ l A

C L

EXECUTIVE

SUMMARY

United States Enrichment Corporation Portsmouth Gaseous Diffusion Plant NRC inspection Report 70 7002/99005(DAMS)

Ooerations e The inspectors noted that the operators' response to a small uranium hexafluoride release in Building X-330 was effective and consistent with the guidance provided in the alarm response and off-normal procedures. (Section 01.1) e The inspectors identified a violation regarding the implementation of the "see and flee" procedure by an operator. (Section 01.2) e The inspectors identified a non-cited violation regarding an inappropriate cell load alarm deactivation by an area control room operator. The inspectors noted that the certificatee took appropriate action to address the unauthorized disabling of the cellload alarm.

(Section O1.3) i e The inspectors concluded that a cascade pressure transient and loss of a nuclear I criticality safety control resulted from the plant staff's failure to affect proper corrective action to a known deficiency, in addition, the inspectors identified a violation, in that, the certificatee's failed to tag inoperable equipment as required. (Section O2.1) e The inspectors raised several questions regarding the difference in information contained in the Accident Analysis and System Description Sections of the Safety Analysis Report regarding requirements for operability of the smoke detection system in Building X-330.

(Section O2.2)

• The inspectors identified a violation for a failure to implement approved plant procedures i with regard to the required documentation of vibration monitoring by operations staff. .

The inspectors also identified a violation for an incomplete and inadequate procedure for vibration monitoring by engineering staff, and a failure to ensure the operations procedure for vibration monitoring prescribed measures, appropriate to the circumstances, to ensure operations were satisfactorily accomplished. (Section O2.3)

Maintenance and Surveillance e The certificatee properly responded to the suspended liquid cylinder in Building X-343 on May 4. However, the inspectors identified a violation, in that, work control activities for maintenance on the Building X-343 North Crane, following the May 4 safety system actuation, were not performed in accordance with the applicable lockout and tagout program. (Sections M1.1 )

l 2

Plant Sucoort e The certificatee's response to the Switchyard X-533 transformer failure was an adequate demonstration of the certificatee's capabilities to implement its emergency plans and procedures. The crisis manager (CM ) ensured that the emergency event was properly classified in a timely manner, utilizing the emergency action level procedure. Offsite notifications made by the EOC were adequate. (Section P.1) e The inspectors identified a violation, in that, several plant staff failed to perform respirator seal checks appropriate to the respiratory protective equipment prior to performing maintenance and work activities. (Section R1.1) l 3

Report Details

1. Operations

. 01. ' Conduct of Operations 01.1 Buildino X-330 Emeroency Resoonse Observations

a. Insoection Scone (88100)

The inspectors observed the plant staff's response to a uranium hexafluoride (UF.)

release in Building X-330.

b. . Observations and Findinas -

On April 9, the Building X-330 Area Control Room (ACR) operators received a smokehead alarm at the Tails Station. The operators responded to the Tails Station and informed the ACR that " smoke" was not visible in the area. The operators looked inside some heated housing covers and identified a small amount of visible powder, uranylfiuoride (UO F 2), in the immediate area of a valve. Based upon the visible powder, the ACR manager directed that the area be evacuated and notified the Plant Shift Superintendent (PSS) of the event. The PSS initiated an emergency squad response to the scene.

During the emergency squad response, which lasted approximately 70 minutes, the PSS, acting as the Incident Commander (IC), directed several actions, including:

• The sheltering of all building personnel, as appropriate; e The mon;toring and assessment of airborne UF hydrolyzation products such as uranyl and hydrogen fluorides; e The coordinating, with the front line manager (FLM), of actions required to isolate the leaky valve and to determine that the leak was minor in nature; and, '.

e The reentry into the building, based upon negative air sampling results.

During the response and monitoring activities, the inspectors identified an issue regarding the donning of equipment used for respiratory protection by the emergency responders (See Section R1.0). Following the event, the inspectors reviewed operations alarm response and off-normal procedures relative to the event. The inspectors noted that the operators' actions were consistent with the procedures.

c. Conclusions The inspectors noted that the operators' actions were effective and consistent with the guidance provided in the alarm response and off-normal procedures for a small UF.

release.

4 l

01.2 ' ' Buildina X-342 Emeroency Response Reying a.' Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding the plant staff's response to a minor outgassing from the Autoclave No.1 in Building X-342.  ;

Observations and Findinas b.

. On May 9, an operator observed smoke emitting from Autoclave No.1 in Building X-342

, . after conducting quarterly pressure decay testing. During the test, the autoclave was pressurized to verify the containment integrity of the autoclave shell and associated ,

isolation valves. After the autoclave was retumed to atmospheric pressure, the operator j opened the shell and observed a smoky haze. In addition, the operator observed a i dusting of s' yellow-green colored material which coated the entire interior of the autoclave shell and a filter assembly installed for the test.

During normal depressurization of the autoclave, small amounts of uranium bearing material (solid or gaseous UF, or UO2 F2 particulate) could be entrained in the air flow if present in the UF, piping that penetrated the autoclave. The filter assembly was used to trap and contain any potential airbome contamination in the piping and prevent contamination of the autoclave interior. The piping was required to be isolated at the first boundary valve outside the autoclave shell and then evacuated to ensure that uranium bearing material was eliminated from the piping prior to conducting the pressure decay test.'

After the operator's observation of a smoky haze emitting from the autoclave, the operator, who was wearing respiratory protection, closed the filter assembly isolation valve inside the partially opened autoclave (opened approximately 2.5 feet). The operator then actuated the emergency closure button for the autoclave shell, manually positioned the locking ring vent valve as a secondary mechanical lock for the autoclave, and exited the area, in discussions with the inspectors, the operator indicated that the actions were taken to prevent spread of the contamination outside of the autoclave. However, the inspectors concluded that the actions were not consistent with the "see and flee" procede;e, which required immediate evacuation from the area when visible smoke was observed.

Technical Safety Requirement (TSR) 3.9.1, requires, in part, that written procedures shall j be implemented for activities described in Appendix A, to Safety Analysis Report,  !

Section 6.11. Appendix A described administrative activities, including chemical safety,  ;

as activities for which procedures shall be implemented. Paragraph 5.0 of Procedure XP2-SH-SH5030, " Actions To Be Taken During a Uranium Hexafluoride (UF.), Hydrogen Fluoride (HF), Fluorine ( F ) or Chlorine Trifluoride (CIF3 ) Release, Rev. No.1, dated March 22,1996, stated, in part, that operators encountering any visible sign of a release, j no matter how minor, shall immediately flee the area ("see and flee"). The failure of the i

operator to immediately flee the autoclave shell area upon encountering the visible j release was identified as a Violation of TSR 3.9.1 (VIO 70-7002/99005-01a).

5

. l In response to the inspectors' observations that the operator failed to follow the "see and flee" procedure, the certificatee developed a corrective action plan to resolve the identified deficiency. The corrective actions included the following: 1) commitment to clarify the specific steps in the "see and " flee" procedure by June 1999; 2) commitment that shift briefings will be conducted for plant staff in the immediate future; and,

3) training guidelines regarding the "see and " flee" procedure will be provided to plant staff for immediate reference.

On May 10, the plant management established an action plan to determine the amount of uranium (U23s) mass released inside the autoclave shell. Preliminary nondestructive assay measurements of the autoclave shell indicated that less than 20 grams (gms) of Us 23 was present in any localized portion of the autoclave. Later, a Nuclear Criticality Safety (NCS) engineer calculated that the maximum amount of U,33 mass which could have been introduced inside the autoclave shell, under worst case conditions (i.e., piping and connection filled with gaseous UF, and filter completely plugged), was 755 gms.

This amount was below the always safe mass limit of 800 gms and well below the subcriticallimit of 1640 gms of U 23s at 5.0 weight percent enrichment. The inspectors reviewed the analysis and determined that the calculations and assumptions were reasonable. The certificatee then safely opened the autoclave for decontamination and inspection. The certificatee determined that the root cause of the event was the plugged filter and, as corrective action, placed a restriction on the number of tests that the filter could be used.

c. Conclusions The inspectors identified a violation regarding the failure to follow the "see and flee" procedure by the operator. The inspectors determined that the NCS calculations and assumptions used in determining the potential U233 mass released in the autoclave shell were reasonable and the calculated uranium release was below the always safe mass limits.

l 01.3 Disablina of Cell Motor Load Alarm  !

a. Insoection Scope (88100)

The inspectors followed up on an incident involving the disabling of a cascade cell motor  !

load alarm.

b. Observations and Findinas On February 3,1999, the certificatee discovered tape between the contacts of the motor i load alarm relay for Cell 25-7-12, Stage 6, which defeated the alarm function. The relay 1 was located behind a panel in ACR No. 6 in Building X-326. The inspectors noted that  !

the motor load alarms were designed to alert operators of an abnormal change in electrical power consumption which was symptomatic of equipment failure or a transient condition in the cascade. The significance of the alarm was that the Safety Analysis  :

Report (SAR) accident analysis credited operator actions in mitigating analyzed accidents, and the alarms were the primary mechanism for alerting the operators.

i 6

l l

. The certificates immediately initiated an investigation which included a check of all similar relays in the plant. No other problems were identified. Early the next day, the certificatee determined the identity of the responsible individual, an assistant ACR operator.

During interviews with the operator, the inspectors determined that electrical maintenance staff were adjusting the alarm set-points on the relays and the operator was -

apparently aware of the maintenance activity. The operator taped over the contacts to disable what the operator considered a " nuisance alarm" when the maintenance staff was on break, without notifying operations management. The inspectors noted that Procedure XP3-US-FO1203, " Alarm Deactivation and Control," Rev. O, dated July 31, 1997, required notification of the cognizant first line manager (FLM) prior to initiating an alarm deactivation.

As a corrective action, operations management held discussions with operators te verify that expectations were clearly understood regarding alarm deactivation and overall I

conduct of operations. As the incident appeared to be an isolated incident and of minor significance, the certificatee-identified procedural violation is being treated as a Non-Cited Violation (NCV), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

c. Conclusions The inspectors identified an NCV regarding alarm deactivation by an operator. The certificatee took appropriate action to address the isolated incident involving the unauthorized disabling of the cellload alarm by the operator.

O2 Operation Status of Facilities and Equipment O2.1 Inocerable Recirculatina Coolina Water Control (RCW) Valve

a. Inspection Scope (88100. 88010)

The inspectors reviewed circumstances surrounding the unexpected process pressure increase associated with the start up of Cell 33-3-8.

b. Observations and Findinas On April 8, the plant operators attempted to restart Cell 33-3-8 after the cell tripped due to the failure of Transformer 309. The failure of Transformer 309 tripped Bus 309 which supplied power to seven cells including Cell 33-3-8 in Building X-333 (See Section P1.1).

After power was restored to Bus 309, the first bank of cell motors were energized on the cell  ;

and the operators observed normalindications. The operations staff then energized the  ;

second bank of cell motors and immediately observed that the cell pressure started to  !

increase. In response to the cell pressure increase, the operation staff opened the cell A-outlet valve to maintain pressure within operating limits. The operators observed that l Cell 33-3-8 continued to feed the cascade with UF material. The material introduced resutted in an increase in the amount of down-stream (B-stream) material flow. As a result of the increased B-stream flow, the pressure increased in the B-stream piping and intermediate surge drums which were connected to the cascade. One hour after the pressure increase was identified, the operators restored the cascade to normal parameters.

7

The inspectors reviewed the operating status of the cascade during the transient. The inspectors noted that the maximum cascade pressure did not exceed the 25 pounds per square inch (psia) limit allowed by TSR Section 2.2.3.13. However, the cascade's intermediate surge drums maximum pressure of 19.6 psia did exceed the 17 psia limit -

specified in Nuclear Criticality Safety Analysis (NCSA) Plant 033.A1. The basis for the requirement was to limit concentration in the drums and was one of the two controls used to satisfy the double contingency principle of NCSA Plant 033.A1. The other control, moderation, was maintained throughout the event. In response to this loss of one control, the plant staff issued Event Report PTS-1999-027 (NRC No.35568).

The plant staff determined that the cause of the pressure transient was the failure of an RCW control valve (CV) for Cell 33-3-8 to automatically close upon cell shutdown (loss of power). The failed open RCW CV allowed RCW to cool the process gas in the cell and drew material from the other six shutdown cells before the other cells were isolated from the cascade. Although, the plant staff evacuated Cell 33-3-8 prior to stad-up, some UF.

material remained in the cell. During the cell start-up, the heat of compression caused the remaining UF. In the cell to sublime to the cascade. For approximately 25 minutes, operation staff intermittently throttled the cell AB-2 outlet valve to control the amount of UF, that entered the cascade and also to verify that the cell pressure did not exceed 25 psia, The inspectors reviewed the root cause of the operators' failure to isolate the RCW flow to

- Cell 33-3-8 condenser within four hours as required by NCSA-0333_015.A03, " Cascade Operations in the X-333 Building," Requirement 14. The cedificatee reported the loss of the single NCS control to the NRC as required. The X-333 Building Manager explained that operators have always relied upon the RCW CV position indicator instrumentation at the LCC to verify that the RCW CV was closed. As a result, the inspectors learned that the operators did not verify that the RCW CV was closed by visually inspecting the RCW valve stem position.

During followup, the inspectors noted that on February 22,1999, the plant staff issued PR 99-1097 that identified the RCW CV for Cell 33-3-8 would not close unless plant air was manually isolated from the CV. On April 8, the operators observed that the CV position indicator instrumentation at the LCC indicated that the RCW CV was closed for Cell 33-3-8.

On the following day, the inspectors identified that the operators had not tagged the defective RCW CV for Cell 33-3-8 or the CV position indicator instrumentation at the LCC to alert the operators that RCW CV would not automatically close when actuated.

As a corrective action, plant management required that caution tags be applied to all defective components in the process buildings and initiated crew briefings and required reading to address tagging requirements. The crew briefings and required reading addressed the circumstances surrounding the incident, along with a review of the plant's tagging program. In addition, the plant staff issued PR 99-2017 which was characterized as a significant condition adverse to quality (SCAQ) on April 9. The inspectors noted that the plant staff committed to conducting a tap root investigation, developing a corrective action plan, and conducting an end point assessment for PR 99-2017 as required by the corrective action program.

Technical Safety Requirement 3.9.1, requires, in part, that written procedures shall be implemented for activities described in Appendix A, to Safety Analysis Report, Section 6.11.

Appendix A described administrative activities, including equipment control, as activities for which procedures shall be implemented. Paragraph 6.0 of Procedure XP2-SO-IS1034, 8

" Accident Prevention / Equipment Control Tags," Revision 0, dated July 31,1997, required, in part, that the plant staff shall place a caution tag on defective equipment. Specifically, the plant staff's failure to place a caution tag on a previously identified defective RCW CV for Cell 33-3-8 as required by Procedure XP2-SO-IS1034 was identified as a Violation of TSR 3.9.1 (VIO 70-7002/99005-01b). l

c. Conclusions 4 Inspectors concluded that the plant staff's failure to administratively control a defective component resulted in a cascade pressure transient and the loss of a single NCS control.

02.2 Buildina X-330 Computer Automated Data Processina Uranium Hexafluoride Smoke Detection System

a. Inspection Scooe (88100)

The inspectors reviewed the circumstances surrounding the operability of the <

Building X-330 smoke detection system in Cell 31-3-1. The inspection consisted of interviews with plant operations and maintenance staff, a review of applicable documents, and walkdowns of the Computer Automated Data Processing (CADP) UF, smoke detection system,

b. Observations and Findinas The CADP system monitored process variables such as temperature, process gas (UF.)

smoke detection, and various instrument and electrical conditions in the cascade buildings.

The UF. smoke detection system consisted of detectors (smokeheads) in various locations in the cascade. The smokeheads alarmed to the area control rooms upon various signals, including hardware alarms and process gas releases. Technical Safety Requirement 2.2.3 described the parameters required for operability of the CADP UF, smoke detection system for cascade cells which operated above atmospheric pressure.

On May 2, at approximately 8:30 p.m., Smokehead S-13 in Cell 31-3-1 alarmed and cleared on a process gas leak alarm. The operations staff responded to the alarm per the appropriate procedure, and no unusual conditions or process gas leaks were noted. At the time of the alarm, Smokehead S-14 in Cell 31-3-1 was inoperable. The operations staff <

later filed Problem Report PR-PTS-99-02480 documenting that Smokehead S-13 alarmed and cleared, Smokehead S-14 was inoperable, and Smokehead S-13 had been "in and out" of a hardware alarm. Smokeheads S-13 and S-14 were located in the same half of  ;

Cell 31-3-1. The inspectors noted the PSS justification for continued operation documented on the problem report was as follows: 1) "FLM [ front-line manager) prefers to keep  !

smokehead operable pending maintenance assessment"; 2) "3 other smokeheads are operable in [ Cell] 31-3-1"; and 3) "TSR compliance maintained."

On May 3, at approximately 7:30 a.m., the operations staff filed Problem Report PR-PTS-99-02823 which documented that Smokehead S-13 in Cell 31-3-1 went into a hardware alarm and the Smokehead S-14 was inoperable. The inspectors noted the PSS justification section of the problem report declared Smokehead S-13 inoperable, documented that TSR compliance was maintained because 50 percent of the smokeheads in Cell 31-3-1 were operable, and initiated the TSR 2.2.3 Limiting Condition for Operation (LCO) as a conservative measure.

9

)

The inspectors walked down the CADP UF. smoke detection system with operations staff and management in Building X-330. The inspectors noted that some cells, including Cell 31-3-1, appeared to be divided in half on system diagrams and drawings. Operations staff confirmed that certain cells in Building X-330 were internally restricted, although not completely isolated, between two halves of a cell. Operations staff also discussed previous operational history, in which an actual small release of UF. several years prior had only alarmed the smokeheads on one half of the cell. Operations management indicated that the TSR LCO required that 50 percent cf the smokeheads in a cell were operable, but as a conservative measure, plant staff initiated the LCO when both smokeheads on the same half of a cell were inoperable.

The inspectors' review of the CADP UF smoke detection alarms revealed that from 11:30 a.m. until 8:30 p.m. on May 2,10 hardware alarms were received for Smokehead S-13 in Cell 31-3-1. In addition, from 8:30 p.m. on May 2, until approximately 8:00 a.m on May 3,15 additional hardware alarms were received for Smokehead S-13 in j Cell 31-3-1. Operations staff indicated that smokeheads were generally declared inactive  !

when so many hardware alarms were received. A review of operator logs and round sheets documented that Cell 31-3-1 in Building X-330 was operating above atmospheric pressure '

on May 2 and 3. The inspectors noted that no criteria appeared to be available for operations staff to determine the operability of the smoke detection system during a hardware alarm.

In follow-up discussions with the PSS office, the inspectors determined that the certificatee was actively addressing the justification statement on Problem Report PR-PTS-99-02480 which referenced a front-line manager's (FLM) preference to keep the smokehead operable.

However, the inspectors questioned if the smokeheads were operable during hardware alarms, and why Smokehead S-13 in Cell 31-3-1 was kept operable with the numerous hardware alarms received on May 2. In addition, the inspectors inquired about the basis for i not formally entering the TSR LCO when only one smokehead in a half cell in Building X-330 was operable on May 2. The PSS requested an engineering evaluation to determine the operability of a smokehead with a hardware alarm.

The PSS determined, based on conversations with the shift and system engineers, that Smokehead S-13 in Cell 31-3-1 was considered inoperable with the numerous hardware alarms on May 2. The PSS initiated a reportable event notification as required by 10 CFR 76.120(c)(2), Event Notification No. 35683 (Section 08.1). Engineering Evaluation EVAL-OS-1999-0278, Revision 0, dated May 6,1999, documented definitive criteria for operations staff to use to determine whether or not smokeheads were functional or non-functional, based on system trouble alarms. The evaluation documented that any smokehead prone to frequent failures was not considered reliable. In addition, the evaluation established a general rule that any smokehead which fired more than twice per shift should be considered non-functional.

Technical Safety Requirement 2.2.3.3, "CADP UF. Smoke Detection System," required, in part, that for Cascade Operational Mode ll, above atmospheric pressure, the Limiting Condition for Operation was that 50 percent of the installed CADP UF6 smoke detection heads shall be operable within each cell, bypass housing, tie line and booster station operating above atmospheric pressure. The LCO was defined as the lowest functional capability or performance level of structures, systems, components, and their support systems required for normal safe operation of the plant. Safe'.y Analysis Report Section 3.1.1.11, stated that operation of a cell above atmospheric pressure required that at 10

e least one active detector per half cell in Building X-330 for CADP smoke detection monitoring to be valid; otherwise, it was necessary to post human spotters on the cell floor or reduce process pressures below atmospheric. However, Safety Analysis Report, Accident Analysis Section 4.1.1.3, " Sources of UF, Releases," states, in part, that the number of detectors required to be operational to detect the releases postulated is one per cell housing. The certificatee's resolution of the differences in the Safety Analysis Report sections and guidance to plant staff regarding operability criteria for the smokeheads will be l tracked as an unresolved item (URl) (URI 70-7002/99005-02). l In addition to the corrective actions discussed previously, the plant staff initiated the j following additionalinterim corrective actions; 1) Required reading issued to note the SAR  !

and TSR statements; 2) Daily operating instruction issued to take smokeheads out of l service if a hardware alarm is experienced, ensure prob!em report is issued, take i appropriate TSR actions, and submit work requests to fix problems; 3) Procedure  !

development form issued to revise Procedure XP4-CO-CA2245, " Operation and Testing of I the Smoke Detection Portion of the CADP System," to clarify the procedure on CADP trouble alarms; 4) Evaluation initiated to determine necessary TSR and SAR changes for i this issue; and 5) entered issues in the site Corrective Action Program and initiated a i significant condition adverse to quality investigation.

c. Conclusions l

The inspectors raised several questions were raised regarding the difference in information  !

contained in the Accident Analysis and System Description Sections of the Safety Analysis Report.

02.3 Buildina X-330 Tails Withdrawal Station Comoressor Motor Failure

a. Insoection Scope (88100)

The inspectors followed up on a Building X-330 Tails withdrawal station compressor motor failure which occurred on May 4. The inspection consisted of interviews with the operations and engineering staff, reviews of the applicable procedures, documentation, and operator logs, and walkdowns of the system with operations staff.

b. Observations and Findinas On May 4, operations staff responded to a CADP UF, smoke detection system alarm at the 30-WB-1 Tails Withdrawal Station Compressor. Upon arrival at the compressor, the operator observed a 5 to 6-inch white flame coming from the bearing area of the compressor motor. The operator immediately shutdown the compressor and valved off the oil to the motor, at which point the flame went out. The following morning the inspectors toured the area and discussed the system with operations staff.

Operations staff indicated that over the past two weeks Motor 30-WB-1 was noted to have been making more noise than usual, and that engineering staff had taken motor vibration readings the week prior, per operations staff request. Operations staff noted that the data from engineering staff's readings was not yet available, but that, operator logs indicated readings were taken by operations staff on April 22.

11

The inspectors reviewed Procedure XP4-CO-CA6770, " Vibration Surveys," which was used by r'perators to take vibration readings in the cascade buildings when equipment was suspected of having unusual vibrations. The operator logs and tails operator shift check sheet for April 22 indicated that the reading taken was within the procedure limits; however, the location the reading was taken on Motor 30-WB-1 could not be determined. The inspectors then requested the vibration survey sheet (Form A-686) which was used to document the readings. Section 8.2 of Procedure XP4-CO-CA6770 required that operators record readings to the nearest 0.1 mil in the appropriate space on Form A-686, " Vibration Survey Sheet." Operations staff indicated that the Form A-686 was not used for the vibration readings, and the location of the vibration reading taken on April 22 could not be determined.

Technical Safety Requirement 3.9.1, requires, in part, that written procedures sha" be implemented for activities described in Appendix A, to Safety Analysis Report, Section 6.11.

Safety Analysis Report, Section 6.11, Appendix A, described administrative activities, including cperations and equipment control, as activities for wnich procedures shall be )

implemented. Procedure XP4-CO-CA6770, Section 8.2, required, in part, that operations staff record readings to the nearest 0.1 mil in the appropriate space on Form A-686,

" Vibration Survey Sheet," a quality record. The failure to utilize the vibration survey sheet for vibration readings taken on Motor 30-WB-1, which would have allowed the location of the vibration reading to be better determined, is a Violation of TSR 3.9.1 (70-7002/99005-01c).

Operations staff informed the inspectors that the vibration readings taken by engineering staff on April 28, at the request of operations staff, were evaluated on the morning of April 5. The readings taken on the motor were high, the maximum reading on Motor 30-WB-1 was 1.2 inches per second (ips). This reading exceeded the Action Level ll limit (the highest action level) in Appendix A of Procedure XP4-CO-CA6770. If the readings had been reported to the operations staff in a timely manner on April 28, operations staff would have been required to perform the following in accordance with Procedure XP4 CO CA6770: 1) limit personnel access to the area and erect boundaries; 2) evaluate the need to continue operation of the vibrating equipment; 3) initiate operations monitoring shiftly until equipment was repaired; and 4) if operation cannot be justified as safe take the equipment offstream and shutdown. However, the inspectors also noted that although operations staff on April 27 continued to suspect the 30-WB-1 motor had unusual 1 vibrations, no operations vibration surveys were documented for Motor 30-WB-1 from April 27 until the motor failed on May 4.

The inspectors discussed the vibration monitoring program with the vibration engineer. The vibration engineer stated that vibration readings were taken on various pieces of equipment throughout the plant by the Engineering Organization. Once engineering staff evaluated the ,

readings, the results were provided to operations staff for operations' use. The Safety l Analysis Repot, including Chapter 4, " Accident Analysis," specifically discussed the use of J periodic vibratan checks to prevent hazardous situations from developing i (e.g., Section e.1.2.7,

• Effects of High Speed Equipment Missiles"). In addition, since the  !

December 9,1998, exothermic chemical reaction in the Building X-326 Side Purge  !

Cascade, the tertificatee has expanded the vibration monitoring program. Engineering staff performed the weekly vibration checks of the Top Purge equipment and provided the results i to operations staff. The inspectors noted the Engineering Organization did not have a -

procedure for the taking of vibration measurements instead, the engineering organization I relied upon the use of Operations Procedure XP4-CO-CA6770 to evaluate data. As stated 12

I J previously, engineering staff routinely took vibration measurements, evaluated the data, and  !

provided an evaluation of the data for operations use.

in reviewing Procedure XP4-CO-CA6770 with the vibration engineer, the inspectors noted that certain sections of the procedure did not ensure measures were in place, appropriate to the circumstances, to ensure that vibration monitoring operations were satisfactorily accomplished. Certain motors throughout the plant, such as the WB-30-1 Tails Withdrawal Station Compressor Motor, have built-inspeed increasers. Operations staff were required by Procedure XP4-CO-CA6770 to take vibration readings in " mils," a measure of

, displacement, The "mi's" reading was converted to an inches per second unit. The unit l conversion of " mils" to "ips" was dependent on the speed of the equipment in revolutions l per minute (rpm). The inspectors noted that Appendix A of Procedure XP4-CO-CA6770 did not list a " mils" entry for motors at 10,000 or 14,400 rpm. This could result in an inaccurate

! evaluation by operations staff of vibration on motors which have built-inspeed increasers.

Specifically, if vibration readings were taken on the high speed shaft end of the motor, and the motor section of Appendix A was used, an incorrectly high limit would be allowed based on the 3,600 rpm listed, instead of the appropriate 10,000 or 14,400 rpm. In follow-up discussions with operations staff responsible for taking motor vibration readings, operators stated that when taking readings on the withdrawal motors, the 3,600 rpm number was l used, per the procedure. In the review of the operator logs from April 22, the inspectors l could not determine if the reading taken on Motor 30-WB-1 was on the high speed end of i the motor.

10 CFR 76.93, " Quality Assurance," required that the Corporation shall establish, maintain, and execute a quality assurance program satisfying each of the applicable requirements of

ASME NQA-1-1989, " Quality Assurance Program Requirements for Nuclear Facilities."

Quality Assurance Program Appendix A, Section 2, "AQ [ Augmented Quality)- Other SSCs," Section 2.5, " Instructions, Procedures, and Drawings," states, in part, that Section 2.5, " Instructions, Procedures, and Drawings," of the Quality (Q) Program applies.

Section 2.5.1, " Instructions, Procedures, and Drawings," requires, in part, that measures are in place to ensure that activities affecting quality are prescribed by documented procedures and instructions, appropriate to the circumstances, and are accomplished in accordance with these documents. These documents also include quantitative and qualitative acceptance criteria to ensure that important operations have been satisfactorily accomplished. Safety Analysis Report, Accident Analysis Section 4.1.2.7," Effects of High Speed Equipment Missiles," states, in part, that vibration checks [of the Top and Side Purge

. Cascade) are performed periodically to prevent a hazardous situation from developing, in case of excessive vibration, the cell is shut down and the faulty equipment replaced. Safety Analysis Report Section 3.8.2.2, "Q and AQ Structures, Systems and Components," states, in part, that the AQ function of UF, process piping and equipment is to provide a containment boundary for UF, during the enrichment process. Prior to May 7, measures were not in place to ensure that vibration monitoring of UF, process equipment by engineering staff, an activity affecting safety and quality, was prescribed by documented procedures and instructions, appropriate to the circumstances. In addition, Operations Procedure XP4-CO-CA6770, <" Vibration Monitoring," did not ensure measures were in place, appropriate to the circumstances and including quantitative and qualitative acceptance criteria, to ensure that important operations have been satisfactorily accomplished.

Specifically, Procedure XP4-CO-CA6770 did not include acceptance criteria for motors with built-in speed increasers with final resultant speeds of 10,000 or 14,400 revolutions per minute, whose vibration affects the AQ boundaries for the uranium hexafluoride enrichment process. The failure to establish a procedure for vibration monitoring by engineering staff, 13

i and to ensure the operations procedure for vibration monitoring prescribed measures, appropriate to the circumstances, to ensure operations were satisfactorily accomplished is a {

Violation of 10 CFR 76.93 (VIO 70-7002/99005-03). )

Upon identification of the issues discussed in this section, the certificatee took various immediate and long term corrective actions for the issues identified. The corrective actions for the violation concerning the failure to follow Procedure XP4-CO-CA6770 during vibration j monitoring included the following: 1) ensured immediate operator understanding cf need to '

implement approved procedures through required reading and crew briefs; and 2) entered the issue into the site Corrective Action Program. The corrective actions for the violation concerning the failure to establish a procedure for vibration monitoring by engineering staff I and an inadequate operations procedure included the following: 1) work instruction developed and issued by the Engineering Organization consisting of vibration monitoring instructions and record keeping requirements; 2) Engineering Evaluation written to further analyze and determine revised Action Levels for vibrating equipment; 3) provided reasonable assurance justifying continued operation for equipment operating in Action Level ll; 4) issued a daily operating instruction to PSS, Cascade Coordinators, and Buildings X-326, X-330, and X-333 front line managers requiring notification of Engineering staff if equipment enters Action Level ll vibration and issuance of a problem report;

5) ensured operations staff were aware of issues regarding vibration monitoring for motors with built-inspeed increasers; and 6) entered issues into the site Corrective Action Program. l In addition, the Engineering Organization issued two memoranda which re-iterated the importance of assuring necessary communications of engineering information to the field occurs and directed that vibration measurements be processed and the results disseminated to the Group Manager, Section Manager, and the PSS as soon as practical, but in no case later than twelve hours after being taken.

c. Conclusions 1

The inspectors reviewed the vibration monitoring program for uranium hexafluoride process equipment and followed up on the May 4 Tails withdrawal compressor motor failure. An example of a violation for the failure to implement approved plant procedures was identified '

with regard to the required documentation of vibration monitoring by operations staff. In addition, the inspectors identified an additional violation regarding the failure to establish a procedure for vibration monitoring by engineering staff, and the failure to ensure the operations procedure for vibration monitoring prescribed measures, appropriate to the circumstances, to ensure operations were satisfactorily accomplished. The inspectors determined and documented that the certificatee initiated the necessary immediate and long-term corrective actions to prevent recurrence of the violations.

08 Miscellaneous Operations issues (92702) 08.1 Certificatee Event Reports (90712)

The certificatee made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concerns indicated at the time of the initial verbal notification. The inspectors will evaluate the associated written reports for each of the events following submittal, as applicable.

14

Number Date Status Title 35556 04/08/99 Open Switchyard X-533A transformer fire was declared an Alert with oil runoff resulting in courtesy Office of Environmental Protection Agency notification. (Section P1.1) l 35576 04/12/99 Open Safety System Actuation, Building X-344 I Autoclave No. 2 High Condensate Level i Shutoff. I N/A 04/23/99 Open inbound UX-30 Overpack was received with water identified inside. (10 CFR 71.95 Report).

35643 04/27/99 Open Safety System Actuation, Building X-330 Tails Smokehead SSWE.

35673 05/04/99 Open Safety System Actuation: Building X-343 north overhead crane brakes activated upon loss of power, liquid cylinder suspended greater than one foot above Autoclave No. 5.

(Section M1.1) 35683 05/05/99 Open Safety System Failure in Building X-330, I Cell 31-3-1, cell housing smokeheads not maintained operable, no redundant heads available. (Section O2.2) 08.2 pulletin 91-01 Reports (97012) i The certificatee made the following reports pursuant to Bulletin 91-01 during the inspection I period. The inspectors reviewed any immediate NCSA concerns associated with the report ,

at the time of the initial verbal notification. Any significant issues emerging from these l reviews are discussed in separate sections of this report or in future inspection reports.

Number Date Title 35563 04/09/99 4-Hour Report - Building X-333, Cell 33-3-8 RCW control valve was not closed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in violation of NCSA requirements.

35568 04/09/99 24-Hour Report - Building X-333 intermediate surge drum exceeded its pressure limit in violation of NCSA requirements.

1 35607 04/20/99 4-Hour Report - No NCSA in place for Building X-342 and i Building X-343 abandoned in place cold traps. l 35695 05/09/99 4-Hour Report - Building X-347, Autoclave No.1, UO,F, l observed inside autoclave after pressure decay test with loss of one NCS contingency not re-established within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

15

08.3 (Closed) VIO 70-7002/97004-01: Two examples regarding failure to maintain written procedures to cover operator actions to prevent or mitigate the consequences of accidents described in Chapter 4 of the SAR.

The first example was that Procedure XP4-CO-CA2380, " Operations of the Tails Station,"

included a reference to high pressure vent panels that were not completely installed. The certificatee determined that the root cause was a historical weakness in the configuration management program. In response, the certificatee corrected errors in the SAR description and the applicable operating procedures.

The second example was that Procedure XP4-CO-CN2116(C), " Cell Treatments in Building X-330," did not require that safety screenings be conducted for changes b the normal valve line up for cell treatments to verify that the ability to evacuate a cell in an emergency was maintained as described in the SAR. The certificatee concurred that the root cause was inadequate procedural guidance. As a corrective action, the certificatee l revised Procedure XP4-CO-CA2228, " Valving Orders," to provide guidance in preventing )

the initiation of valving orders which could result in a UF. release, violate a NCSA or link systems containing gases which could potentially react in an exothermic manner This violation is closed.

08.4 (Closed) VIO 70-7002/97010-04: Failure to have Plant Operations Review Committee approve changes to NCSAs as required by TSR 3.10.

The certificatee determined that the root cause was misapplication of the use of engineering notices. As a corrective action, training on the proper use of engineering notices was provided to engineering personnel. In addition, the certificatee revised Procedure XP2-EG-EG1042, " Engineering Notices," to clarify that notices can not constitute a change to the plant or plant operations as defined in 10 CFR 76.68. The inspectors reviewed the active engineering notices and did not identify any issues. This violation is closed.

08.5 (Closed) VIO 70-7002/97012-02: Failure to make verbal notifications to the NRC within the required time limitations.

The certificatee determined that the root cause was that the PSSs and NCS personnel did not perform a rigorous review of the events and did not adopt a conservative reporting approach. As a corrective action, the certificatee implemented a lesson plan to train the PSSs on reporting requirements and revised Procedure XP4-SF-SF1110, " Plant Shift Superintendent Actions on Problem Reports," to include some of the " lessons learned." In addition, the certificatee revised Procedure XP2-EG-NS1025, "NCS Response to ,

Anomalous Conditions," to provide guidance to NCS personnel regarding their role in I providing support to the PSS for reportability determinations. The inspectors noted that a repeat violation was identified in inspection Report 70-7002/99006. The inspectors will use that item to track additional actions taken to prevent recurrence. This item is closed.

08.6 ' '(Closed) VIO 70-7002/97008-04: Failure to take effective action to prevent recurrence of unauthorized TSR overtime exceedences.

The certificatee determined that the root cause for the violation was inadequate administrative controls used to manage employee overtime. As a corrective action, the certificatee enhanced the computerized system for monitoring hours of work and overtime 16

n ,

canvassing. The inspectors noted that the actions have been effective in preventing recurrence. This item is considered closed.

08.7 - (Closed) VIO 70-7002/98007-02 and CER 70-7002/98-08: Actuation of smokeheads in l X-330 Tails area due to UF, release l On May 8,1998, a pressure transmitter failed resulting in the release of UF. in the Tails area and the actuation of the smokeheads. The transmitter ruptured after heat was restored to a " frozen" UF line following a steam outage. The certificatee determined that j the root cause of the event was inadequate planning and procedures for monitoring,  ;

controls to prevent the Tails Station from freezing out during a steam outage, and guidance  !

to assure line clarity prior to restoring steam. As a corrective action, the certificatee revised l the applicable plant procedures to provide appropriate operator actions during steam '

outages. The inspectors reviewed the actions and had no further issues. The violation is closed.

08.8 (Closed) URI 70-7002/99001-03: Shipment of empty cylinder with radiation levels in excess of NRC transportation limits on February 10,1999.

The certificatee determined that the primary root cause was a staff performance error associated with the shipment of the cylinder prior to completion of the procedurally required 30-day " cooling" period. As a corrective action, the certificatee added a feature to the '

automated scheduling system to generate an error message if the 30-day cooling period was not met prior to the scheduled shipping date. In addition, applicable plant procedures I were revised to require notification of Health Physics staff for evaluation prior to shipping a cylinder with contact readings exceeding 100 millirem / hour (mrem /hr). The significance of the event was minimal as the " hot spot" was not readily accessible during transportation.

Technical Safety Requirement 3.9.1, requires, in part, that written procedures shall be implemented for activities described in Appendix A, to Safety Analysis Report, Section 6.11.

Appendix A described administrative activities, including radiation protection, as activities for <

which procedures shall be implemented. Paragraph 6.5, Procedure XP4-TE-EA1807,

" Receipt of Natural and Paducah Product Feed and Shipment of Feed Containers," Rev. 2, dated March 3,1997, required that a cylinder must be stored for a period of not less than 30 days after emptying, (to allow for cooling) prior to return shipment to the supplier. On February 10,1999, the certificatee's failure to store a recently emptied cylinder for 30 days prior to shipping the cylinder offsite to a supplier was identified as a Violation of TSR 3.9.1 (VIO 70-7002/99005-01d). This unresolved item is closed.

08.9 (Closed) VIO 70-7002/97013-L(01123). M(01133). N(01143). O(01153). and P(01163):

Multiple examples of failure to implement NCSA controls.

The certificatee determined that the root cause of the violation was that NCS controls were confusing and inadequate. As a corrective action, the certificatee initiated a plant-wide NCS stand-down, including an error lab, to emphasize importance of compliance with NCS requirements. In addition, NCSAs were being reviewed as part of the NCS Corrective Action Plan to address inadequate or confusing NCS requirements. The inspectors noted that the actions have been effective in reducing the number of non-compliances. This violation is closed.

17

p 08.10 (Ocen) URI 70-7002/98012-01: lasue regarding an apparent regulatory noncompliance for

.the first autoclave upgraded as a part of Compliance Plan issue No. 3.

~

This issue dealt with Compliance Plan lasue No. 3, Noncompliance item No. 9, which stated, in part, that .UF cylinders were not provided with pressure relief protection. The certificatee submitted to the NRC, a correspondence which addressed the use of the American Society of Mechanical Engineers (ASME) Code Case 2211 to resolve the issue.-

The submittal from USEC was stiH under review by the NRC at the time of this inspection.

The inspectors will continue to follow-up on the resolution of this issue pending the NRC's response conceming the use of ASME Code Case 2211 for UF, cylinder pressure relief.

08.11 (Closed) VIO 70-7002/98016-01: Failure to establish a system to control and calibrate instruments and other measuring and testing devices used to test time for quality components and to ensure equipment performance was maintained within the limits specified in the Safety Analysis Report.

l The inspectors reviewed the immediate and long-term corrective actions taken to resolve l

the violation. These actions included a comprehensive review of inspection and test procedures to determine if other test equ:pment used on Q, AQ, or AQ-NCS safety system components needed to be included in the Calibration Program. The review identified additional equipment which needed to be included, and the certificatee was finalizing the l revisions to procedures to incorporate necessary changes. The inspectors concluded the certificatee's actions were comprehensive to prevent recurrence and no new issues were identified. This violation is closed.

l

11. Maintenance and Surveillance M1 Conduct of Maintenance and Surveillance ,

M1.1 Lockout /Taaout Proaram

a. Inspection Scooe (88100 and 88103) l The inspectors observed the May 4 response to the Building X-343 north overhead crane  ;

brakes actuation upon loss of power, with a liquid cylinder suspended approximately one foot above Autoclave No. 5. In addition, the inspectors observed maintenance mechanics

! installing a replacement hoist motor on the Building X-343 north crane.

l

b. Observations and Findinas l

On May 4, the inspectors observed the certificatee's response to a suspended liquid cylinder in Building X-343. During the movement of a fullliquid cylinder in Autoclave No. 5, the north overhead crane lost power, and the crane hoist brakes actuated, as designed, suspending the liquid cylinder approximately one foot above the autoclave floor grating.

The inspectors observed the certificatee respond to the suspended cy'inder per Procedure XP2-TE-TE5030, " Suspended UF, Cylinder." The inspectors noted that the overall response was adequate. During the response building management secured the area, stopped all unnecessary work in the area, and limited the number of personnel in the area to a minimum. In a follow-up critique, the plant staff identified several areas of i

improvement for Procedure XP2-TE-TE5030 and entered the issues into the plant 18 L___

l a

Corrective Action Program. In the interim, the plant staff issued a daily operating instruction addressing the significant areas in the procedure which needed improvement. The plant staff also initiated an investigation into the cause and previous maintenance history of the north overhead crane. The inspectors did not identify any additional issues.

In response to the issues associated with the crane, the plant staff initiated maintenance i activities to trouble shoot and resolve the crane issues. On May 10, the inspectors i observed maintenance mechanics attempting to install a hoist motor on the Building X-343  !

north crane per Work Package Instruction (WPI) 9915952-02, "Holst Motor Replacement."

Prior to the installation, the inspectors observed that the hoist motor was staged on a wocd pallet with no foreign material exclusion (FME) provisions. The inspectors observed that debris had collected onto the motor electrical windings and greased shaft. In addition, the I WPl failed to include the applicable torque requirements for the hoist motor mounting flange bolts. In response to the inspectom' observations, the Crane FLM explained that WPl was later revised to address FME and torque requirements.

The inspectors identified that the crane's hoist motor electrical power junction box was not locked out or tagged (LOTO) by the mechanics. The WPl required the mechanics to use a personal tag for single source electrical isolation du.ing the hoist motor replacement, in discussions with the inspectors, the mechanics explained that the motor's electrical power was isolated from the hoist by an air gap and that the crane electrician had locked out the power to the crane. The inspectors noted that the crane rails were still energized as the rails provided power to another operating crane, and that the electrical power breaker enclosure for the crane hoist needed to have a LOTO installed prior to performing work activities. In response, the mechanics immediately placed the appropriate LOTO on the electrical power breaker enclosure for the crane hoist.

As a corrective action, the plant management temporarily halted all maintenance activities that required LOTO and initiated crew briefings and required reading that reinforced single source LOTO. The crew briefings and required reading addressed the circumstances surrounding this incident, along with a review of the plant's LOTO program. In addition, the plant staff issued a PR 99-2703 (SCAQ) on May 10.

Technical Safety Requirement 3.9.1, requires, in part, that written procedures shall be implemented for activities described in Appendix A, to Safety Analysis Report, Section 6.11.

Appendix A described administrative activities, including equipment control, as activities for which procedures shall be implemented. Paragraph 6.4 of Procedure XP2-SO-lH1042, j

" Instruction For Lockout /Tagout," Revision 0, dated June 31,1997, required that authorized i employees performing maintenance on a de-energized piece of equipment shall install a personal tag and lock to secure the energy isolation device. On May 10 the inspectors observed mechanics performing a maintenance activity on the de-energized Building X-343 l north crane hoist without the installation of a personal tag and lock to secure the electrical power hoist breaker enclosure. Specifically, the failure of the mechanics to install a LOTO l on the electrical power hoist breaker enclosure prior to performing maintenance activities on the Building X-343 north crane hoist motor was identified as a Violation of TSR 3.9.1 (VIO 070-7002/99005-01e). l l

19

c. Conclusions The inspectors observed the certificatee's response to the suspended liquid cylinder in Building X-343 on May 4, and noted no issues. However, the inspectors identified a violation in that work activities to repair the crane were not performed in accordance with the applicable LOTO program.

IV. Plant Suonort P1.0 Emergency Preparedness P1.1 Performance in Emeraency Event

a. Inspection Scope (88050)

On April 8, the certificatee responded to an emergency condition in the Switchyard X-533A that resulted in the activation of major portions of the onsite emergency response ,

organization and facilities. The inspectors evaluated performance of the emergency response personnelin the following areas.

• Plant Control Facility (PCF) e incident Commander (IC) and Command Post (CP) e Emergency Operations Center (EOC) e EOC Technical Support Room o Field Response Teams The inspectors assessed the certificatee's recognition of abnormal plant conditions, classification of emergency conditions, notification of offsite agencies, development of protective action recommendations, command and control, communications, and the overall implementation of the Emergency Plan (EP). In addition, the inspectors attended the post-emergency critiques in each of these areas to evaluate the certificatee's self-assessment of plant performance in implementing the EP and mitigating the emergency event.

b. Observations and Findinas Plant Control Facility (PCF)

On the morning of April 8, the plant experienced a temporary loss of power from two transformers located in Switchyard X-533A. Two gas circuit breakers and two air circuit breakers tripped causing a loss of power to transformers T308 and T309. Power was interrupted to various facilities supported by the transformers including specific equipment located in Building X-333 (See Section O2.1).

An FLM from the power operations staff investigated the loss of power by checking the relay targets on the circuit breakers in Switchyard X-533A. During the investigation, the FLM discovered that the main tank of transformer No. 309 had ruptured approximately three feet up from the bottom of the tank. The FLM informed the PSS that approximately 9,500 gallons of mineral oil spilled out of the transformer and onto a bed of cobblestones around the transformer base. The transformer oil was expected to drain to the X-230 J-6 environmental holding ponds.

20

Further reports by the FLM to the PSS confirmed that there were no indications of a fire or potential ignition sources in the immediate area of the oil spill. Approximately 10 minutes later, the inspectors noted that the PSS activated the paging system that notified the appropriate emergency response cadre in accordance with Procedure XP2-EP-EP1034,

" Activation of the Emergency Response Organization," Rev.2, dated June 29,1998. The inspectors noted that the PSS evaluated the emergency action level (EAL) classification guidelines and determined that the oil spill was not specifically identified as an EAL requiring an " Alert" classification. The PSS, in consultation with management and staff located in the PCF, determined that the transformer oil leak constituted an event for which the Emergency Operations Center (EOC) needed to be activated for technical support but did not require classification as an " Alert."

The inspectors reviewed Procedure XP2-EP-EP1050, " Emergency Classification," dated March 19,1999. Paragraph 3.1.1 stated, in part, that PSS/ Crisis Manager (CM) have the discretion to classify an " Alert"if adverse conditions existed that potentially or actually compromised plant safety systems or result in a release of non-radiological hazardous material. The PSS informed the inspectors that plant safety systems were not compromised due to the transformer oil leak nor did the released oil pose significant safety or health hazards; hence, the event did not warrant classification as an " Alert."

The Site Utility supervisor reported to the PSS that spilled oil had drained through the switchyard drainage system and was collecting in the X-230 J-6 environmental holding ponds. The PSS directed the Site Utility Supervisor to implement immediate actions required in response to the oil spill. The PSS conducted a shift turnover with the assistant plant shift supervisor (APSS) before going to the accident scene. The PSS relinquished the duties of PSS and assumed the dual duties of incident commander (IC)/CM at the scene in accordance with the EP.

Incident Commander (IC) and Command Post (CP)

The IC met the emergency response teams at the location of the ruptured transformer shortly after leaving the PCF. A briefing was conducted regarding the approximate size of the oil leak and general direction of the oil leak to the X-230 J-6 environmental holding ponds. The IC appropriately established the Command Post (CP) location in the immediate vicinity of the oilleak in progress. l The inspectors observed that the IC appropriately set up a 25 feet exclusion zone around the ruptured transformer to minimize access to the area. The inspectom observed the IC directing fire services staff to position a small drum to catch the oil dripping out of the transformer and lay down oil absorbent pads to aid in cleanup activities. The inspectors observed that the SFC appropriately positioned the fire trucks with sufficient staffing at the perimeter security boundary entrance in order to support any potential fire fighting activities.

The inspectors noted that the fire trucks had adequate capacity to combat an electrical or oil fire at the transformer. The inspectors noted that the Security Protective Force (SPF) coordinated with the IC appropriately in preventing access past established roadblocks during the oil release.

Later that morning, the IC relocated the CP to an area approximately 10 yards west of the X-230 J-6 environmental holding ponds to direct oil recovery and containment activities.

During the relocation briefing with the CP staff, the inspectors questioned whether the fire watch had looked inside a underground cable vault positioned approximately nine feet away 21

F i

1 .

l from the oil release point to determine if any accumulation of oil occurred in the vault. The l IC immediately directed that the steel door be removed from the top of the vault and determined that oil accumulation in the vault was minimal and not a potential fire hazard.

l Throughout the oil recovery activities at the X-230 J-6 environmental holding ponds, the IC generally demonstrated effective command and control of the emergency responsa activities. The inspectors observed that the IC directed the field activities for oil containment 4 and recovery; staging area for vacuum pumper trucks, and positioning of appropriate oil l containment equipment. However, the IC failed to conduct periodic briefings with the sector

]

[ officers and technical staff to confer on current issues, prioritize tasks, or develop and <

! manage the evolving accident mitigation strategies as oil recovery activities were being L

conducted, l

As a result, the inspectors noted that the one of the sector officers (SFC) failed to establish

, a continuous fire watch for the purposes of monitoring for conditions of fire or potential L

explosion in the area of the X-230 J-6 environmental holding ponds. In addition, several technical staff conducting recovery activities were not prevented from smoking in the immediate vicinity of the X-230 J-6 environmental pond area. The inspectors immediately j requested that the RSO ensure safety measures were appropriately implemented to prohibit l ignition sources (smoking) in the hazard area. The inspectors noted that the IC was made i aware by the EOC technical staff that approximately three inches of oil covered the surface of the X-230 J-6 environmental ponds (approximately 6,000 gallons of oil). The failure of the SFC to establish the fire watch in the immediate vicinity of the pond area was identified as a weakness in emergency plan implementing procedures (EPIPs).

Qrisis Manaaement - Emeraet u Ooerations Center (EOC) l l Shortly after the Site Utility Supivisor reported to the PSS that spilled oil was draining into the X-230 J-6 environmental holding ponds, the PSS activated the paging system which notified the appropriate emergency response organization cadre to respond as required to I the EOC. Transfer of command and control of emergency responsibilities from the IC/CM to the EOC Crisis Manager (CM) was orderly and timely. The CM made a formal announcement, assuming command and control of the emergency response activities when sufficient staffing was available to declare the EOC operational.

Later, based on additional information from the IC regarding the potential offsite transformer oil release, the CM classified the event as an " Alert." Although, the CM conducted periodic and effective briefings with EOC staff, the inspectors noted a weakness in that the CM failed to make any public address (PA) announcements to plant staff of the declared emergency and abnormal plant conditions.

l Throughout the emergency, the CM demonstrated effective command and control of the

! activities of EOC personnel. The CM and the response manager frequently met to confer l on the event status to prioritize tasks and to develop and manage the evolving accident '

mitigation strategies as new information became available from the IC. The EOC status boards were maintained in a timely, accurate, and detailed manner by the EOC Director and staff as required by Procedure XP2-EP-EP1032, " Plotting EOC Status Boards," Rev.1, dated July 6,1998. Status board information included the following: major events; higher priority tasks and associated completion status; Building X-333 equipment affected by the loss of power; status of the oil leak; significant issues; status of onsite protective actions; meteorological data; environmental safety and health concerns; status of required initial and i

22 L

L

i j

follow-up notifications to offsite agencies. The status board information was readily visible to the EOC Cadre and to EOC staff maintaining open line communications with the NRC's

Operations Center (NRC Headquarters) and Department Of Energy's (DOE) Oak Ridge l Office response center. The CM supplemented the status boards' information with accurate l and concise briefings at approximately 40 minute intervals and as requested by the EOC Cadre.

The inspectors observed that a dedicated communicator maintained an "open line" with the NRC's Operations Center. The communicator provided detailed information based on status board entries and the CM's periodic briefings, and responded to questions posed by the NRC Operations Center's communicator. An Event Historian generated an "EOC Log" based on the status boards and briefings and transmitted the "EOC Log" to preplanned offsite locations.

The EOC Notification Advisor completed sufficiently detailed notifications to Pike County and the Ohio Emergency Management Agency within 15 minutes of the Alert declaration.

However, the inspectors determined that notification to the DOE's Oak Ridge Operations Office exceeded the 15 minute notification guideline. The EOC emergency director explained that the local emergency notification was affected by the lack of a timely response by the local emergency management agency and that the EPIP required a sequence of actions that impacted the untimely notification to DOE. The inspectors determined that the untimely notification did not have a negative impact, as informal communications were established earlier during the emergency event between the EOC emergency director and DOE staff. Initial notifications to the Nuclear Regulatory Commission (NRC) and the United States Enrichment Corporation's (USEC's) Headquarters were completed well within the j 60 minute regulatory time limit. Public Information Officers (PlOs) in the EOC developed several press releases containing accurate information which the CM and USEC EOC staff approved during the emergency. The EOC's PIOS also maintained communications with counterparts in the USEC EOC.

The Response Manager, after appointment as the Recovery Manager (RM), used the EOC's PA system to broadcast an acceptably detailed list of major onsite recovery tasks and the name of the individuals responsible as the lead for each major task. Recovery planning was well demonstrated at the end of the emergency event, utilizing the appropriate procedures. Short and long term planning and recovery operations were appropriately addressed. In addition, the inspectors observed that the recovery team identified various issues during the recovery phase for additional actions.

EOC Technical Supoort Room (EOC TSR) l The inspectors observed effective communication and team work by the EOC TSR staff.

The TSR Coordinator briefed the staff at frequent intervals. Procedures and checklists were effectively utilized. Recommendations made by the EOC TSR staff included calculations regarding potential quantities of transformer oil collected in the X-230 J-6 environmental holding ponds. The SAR and TSR documents were appropriately utilized.

The EOC staff used a " white board,"i.e., status board, to appropriately focus attention on priority technicalissues.

23

l Field Response Staff The emergency response staff, which included the Field Team Coordinator (FTC), SFC, SPF, RSO and associated technical support staff, responded rapidly to the accident scene and assisted the IC in setting up the CP at the ruptured transformer area and later at the X-230 J-6 environmental holding ponds. The Environmental Compliance Officer and technical staff were directing oil containment activities on the scene at the X-230 J-6 environmental holding ponds using Procedure PE 14.3.2, "Containing Oil Spills in X-533,"

dated April 12,1993. The inspectors noted that immediate actions were appropriately implemented in establishing oil containment and recovery activities. The immediate actions involved the following: 1) installation of a dam on the primary pond; 2) installation of an inflatable sealin the discharge piping of the secondary pond; 3) installation of oil booms on both ponds; 4) rotating the schedules of the vacuum trucks to ensure that oil recovery was continuous; and 5) installation of a dike by a bulldozer downstream of the ponds to prevent any potential offsite release if either environmental holding pond was breached by forecasted rain.

Osti_QWff Critiques were held in which the plant staff who participated in the emergency event were actively encouraged to identify positive and negative issues. Issues of significance were documented in problem reports and entered into the corrective action system. The inspectors concluded that post-emergency self-assessment critiques were effective.

c. Conclusions The emergency event was an adequate demonstration of the certificatee's capabilities to implement emergency plans and procedures. Accident information was quickly passed to the PCF, and the PSS/IC rapidly responded to the accident scene as appropriate. Overall PCF performance was effective. Transfer of command and control was appropriately coordinated between the IC and the EOC. The CM ensured that the emergency event was properly classified in a timely manner, utilizing the emergency action level procedure.

Offsite notifications made by the EOC were adequate. The emergency response organization was promptly activated.

The inspectors identified two weaknesses in the implementation of emergency procedures.

On several occasions, the inspectors noted that the CM neglected to make public address announcements for the declared emergency. On another occasion, the inspectors noted a weakness regarding failure by the RSO and SFC to control ignition sources at the X-230 J-6 environmental holding pond area.

R1.0 Operator Training and Qualification R1.1 Resoiratorv Protection Trainina

a. Insoection Scoos (88010)

The inspectors observed the implementation of the respiratory protection program through direct observation of maintenance activities requiring respiratory protection, interviews with staff who frequently used respiratory protection equipment, and a selective review of certain aspects of the respiratory training program.

24

F 4 .

b. ' Observations and Findinos On April 27, during the emergency response and monitoring activities for the outgassing event in Building X-330, the inspectors observed the emergency responders donning protective equipment and respiratory protection prior to making an entry to investigate the source of the outgassing. Specifically, two health physics (HPs) staff were donning full-face negative pressure respirators while two fire department (FD) personnel were donning positive pressure-demand self-contained breathing apparatuses (SCBAs).

The inspectors observed that the FD personnel failed to perform the negative SCBA face mask seal check prior to making entry into the Building X-330 In addition, the inspectors observed that although the HP staff conducted negative pressure seal checks, the inspectors noted that the HP staff failed to conduct positive pressure seal checks after donning respirators prior to entering Building X-330. Paragraph 6.16 of Procedure XP2-SO-lH1037, " Respiratory Protection Program," Rev. O, dated June 11, 1997, required that respirator wearers shall inspect and perform a user seal-check for respirators prior to use. Paragraph 6.7.11 required, in part, that the respirator wearer verify the respirator seal each time the respirator is donned by performing a positive or negative pressure seal check appropriate to the respiratory protective equipment. Specifically, the procedure required, in part, that the respirator wearer conduct both a positive and negative pressure seal check for negative pressure air purifying respirators and a negative pressure seal check for positive pressure, SCBA type respirators.

On April 28 the inspectors observed operation activities that were conducted in Building X-344. The inspectors noted that an operator failed to conduct positive and negative pressure fit checks prior to using a negative pressure, air purifying respirator for the task of manually disconnecting a " pigtail" from a full liquid cylinder. Later, the inspectors questioned the operator involved and determined that although the operator was aware of the requirements for the positive and negative pressure fit checks associated with the proper donning of respiratory protective equipment, the operator failed to demonstrate all the appropriate fit checks after being asked by the inspectors to repeat the donning procedure.

As immediate response to the inspectors' observations, the certificatee performed bioassay analysis on those individuals who did not perform the proper fit teste. All results were negative. The certificatee also developed a plan to resolve the identified deficiencies in the respiratory protection program, which was communicated to plant staff by memorandum, dated May 14. The proposed and completed corrective actions identified in the memorandum included the following: 1) commitment that a " Lessons Learned" training session will be conducted with respirator users in May; 2) revised test bank questions to include proper respirator donning techniques; 3) revised FTC checklist to ensure that emergency responders conduct appropriate respirator pressure checks; 5) commitment that safety "standown" meetings will be conducted for plant staff in the immediate future; and,

6) commitment to conduct self-assessments as appropriate after refresher training has been conducted to ensure that respiratory protection requirements were followed by plant staff.

Technical Safety Requiiement 3.9.1, requires, in part, that written procedures shall be implemented for activities described in Appendix A, to Safety Analysis Report, Section 6.11.

Appendix A described administrative activities, including chemical safety, as activities for which procedures shall be implemented. Paragraph 6.1.6 of Procedure XP2-SO-lH1037, 25

" Respiratory Protection Program," Rev. O, dated June 11,1997, required that respirator wearers shall inspect and perform a user seal-check for respirators prior to use.

Paragraph 6.7.11 of the procedure required, in part, that the respirator wearer verified the respirator seal each time the respirator was donned by performing a positive or negative pressure seal checks appropriate to the respiratory protective equipment. The failure of five plant staff on April 27 and 28 to verify the respirator seal each time the respirator was donned by performing a positive or negative pressure seal check appropriate to the respiratory protective equipment was identified as a Violation of TSR 3.9.1 (VIO 70-7002/99005-01f).

Discussions with the Environmental, Safety and Health Manager (ESHM) and training support personnel indicated that maintenance staff, operators, and supervisors received training instructions on safe work practices, safety and health, and chemical hazards (including UF.) through the General Employee Training and Respiratory Protection Training.

Qualification and training requirements for HP staff, operators, and maintenance staff were outlined in the respective Training Development and Administrative Guides (TDAG) and the Training Requirements Matrix (TRM). The Training Division ensured that the required training (NRC, OSHA, EPA, etc.) was conducted and documented at the proper frequency.

The inspectors compared the TDAG qualification and training requirements with the current training records for selected supervisors, HP staff and maintenance staff and determined that the training and documentation was consistent with the respective TDAG requirements.

The module was developed from procedures or regulatory guides by trainers or subject matter experts. The inspectors also reviewed the video training guidance associated with the proper donning of respirators that was given to plant staff. Both the module and video training contained sufficient detail to provide instruction or reinforce the students' understanding of the subject material. Specifically, the respirator training module and video provided clear directions in performing the required negative and positive pressure fit checks. In addition, the module and video provided plant management's expectations that proper respirator use required the positive and negative pressure fit check required prior to use. The inspectors reviewed the test question bank associated with the respirator use and noted that although the test questions were well developed for various topical areas in the  !

respiratory protection module, no test questions were written to address the required l negative and positive pressure fit checks prior to respirator use. In response, the inspectors were provided additions to the test bank that outlined specific test questions on appropriate pressure checks required for respirator users.

As a follow-up to the inspectors' observations, the ESHM indicated that further reviews and spot evaluations would be conducted of other related training areas to improve training effectiveness,

c. Conclusions During plant maintenance activities, the inspectors noted numerous examples of the incorrect implementation of a site specific respiratory protection program. Specifically five plant staff were observed donning respirators without conducting the positive or negative pressure fit checks, as required by the respiratory protection program. One violation was identified.

26

I l V. Manaaement Meetinos X1 Exit Meeting Summary The inspectors presented the inspection results to members of the facility management on May 14, 1999. The facility staff acknowledged the findings presented and indicated concurrence with the facts, as stated. The inspectors asked the plant staff whether any materials examined during the j inspection should be considera? oroprietary. No proprietary information was identified. l l

27

rc  ;

1 L

' PARTIAL LIST OF PERSONS CONTACTED l United States Enrichment Corooration j *M.' Brown, General Manager j' *P. Musser, Enrichment Plant Manager .

• S. Casto, Work Control Manager

• D. Couser, Training Manager

• M. Wayland, Maintenance Manager

• S. Fout, Operations Manager

• L'. Fink, Safety, Safeguards & Quality Manager

• P. Miner, Regulatory Affairs Manager

• Denotes those present at the exit meeting on May 14,1999.

INSPECTION PROCEDURES USED IP 88050 Emergency Preparedness ,

IP 88010 Operator Training I l

IP 88100 Plant Operations  ;

l IP 88102 Surveillance l lP 88103 Maintenance ,

IP 90712 In-office Reviews of Written Reports on Non-routine Events j l'

28

)

\

ITEMS OPENED, CLOSED, AND DISCUSSED Opened I

j 70-7002/99005-02 URI Track the certificatee's resolution of the apparent differences in the Safety Analysis Report sections regarding the Building X-330 smoke detection system.

35556 CER Switchyard X-533A transformer fire was declared an Alert with oil runoff resulting in OEPA notification.

35576 CER Safety System Actuation, Building X-344 Autoclave No. 2 High Condensate Level Shutoff.

N/A CER Inbound UX-30 Overpack was received with water identified inside.

(10 CFR 71.95 Report).

35643 CER Safety System Actuation, Building X-330 Tails Smokehead SSWE.

35673 CER Safety System Actuation: Building X-343 south overhead crane brakes activated upon loss of power, liquid cylinder suspended greater than one foot above Autoclave No. 5.

35683 CER Safety System Failure in Building X-330, Cell 31-3-1, cell housing smokeheads not maintained operable, no redundant heads available.

Closed ,

070-7002/98-08 CER Actuation of smokeheads in Building X-330 Tails area due to UF, release 070-7002/97004-01 VIO Two examples regarding failure to maintain written procedures to cover operator actions to prevent or mitigate the consequences of accidents described in SAR Chapter 4 70-7002/97008-04 VIO Failure to take effective action to prevent recurrence of unauthorized TSR overtime exceedences.

70-7002/97012-02 VIO Failure to make verbal notifications to the NRC within the required time limitations 70-7002/97013-L- P VIO Multiple examples of failure to implement NCSA controls 70-7002/97010-04 VIO Failure to have plant operations review committee approve changes to NCSAs as required by TSR 3.10 070-7002/98007-02 VIO Inadequate procedure for Tails operation during steam outage 070-7002/99001-03 URI Shipment of empty cylinder with radiation limits in excess of NRC transportation limits 29

070-7002/98016-01 VIO Failure to establish a system to control and calibrate instruments and other measuring and testing devices used to test time for quality components and to ensure equipment performance was maintained within the limits specified in the SAR

, 70-7002/99005-01a VIO The failure of the operator to immediately flee the autoclave shell area

~ upon encountering the visible release.

7002/99005-01b VIO The plant staff failed to implement tagging and lockout /tagout equipment controls.

70-7002/99005-01c VIO The failure to follow the procedure for vibration surveys performed by operations on cascade equipment.

70-7002/99005-01d VIO The certificatee's failure to store a recently emptied cylinder for I 30 days prior shipping to the Paducah Site.  :

l 70-7002/99005-01e VIO A maintenance mechanic performing a maintenance activity on the de-energized Building X-343 North Crane Hoist failed to install a personal tag and lock to secure the electrical power hoist breaker enclosure.

70-7002/99005-01f VIO The failure of plant staff to implement the " Respiratory Protection Program" requirements.

70-7002/99005 VIO The failure to prescribe documented procedures for implementation of vibration monitoring by engineering organization, in addition, failure to prescribe measures, appropriate to the circumstances, in operations' vibration monitoring procedure to ensure satisfactory completion of activities.

Discussed 070-7002/98012-01 URI lssue regarding an apparent regulatory noncompliance for the first autoclave upgraded as a part of Compliance Plan Issue No. 3.

30

.es, LIST OF ACRONYMS USED ACR Area Control Room APSS Assistant Plant Shift Superintendent CA Corrective Action

'CFR Certificate Event Report CAR- Code of Federal Regulations CIF 3 Chlorine Trifluoride CM Crisis Manager CP. Command Post CV Control Valve DNMS Division of Nuclear Material Safety DOE Department of Energy EP Emergency Plan EPIP _ Emergency Plan implementing Procedure EOC Emergency Operations Center EOC TSR - Emergency Operations Center Technical Support Room E-Squad Emergency Squad

'F Degrees Fahrenheit F, Fluorine FD Fire Department FLM Front-Line Manager FME Foreign Material Exclusion FTC Field Team Coordinator

'HF Hydrogen Fluoride HP Heath Physics IC Incident Commander IFl Inspection Follow-up item IP inspection Procedure ips inches per second LCC Local Control Center LOTO Lockout /Tagout mrem /hr millirem / hour NCS Nuclear Criticality Safety NCSA Nuclear Criticality Safety Approvals NCV Non-Cited Violation NMSS Office of Nuclear Material Safety and Safeguards NRC Nuclear Regulatory Commission No. - Number PIO - Plant Information Officer PA Public Address PCF Plant Control Facility _

PR Problem Report psia . pounds per square inch absolute PSS Plant Shift Superintendent RCW Recirculating Cooling Water RM Recovery Manager RSO Response Safety Officer SAR Safety Analysis Report SCAQ Significant Condition Adverse to Quality SCBA Self-contained Breathing Apparatus 31

p i .I O.

SFC Shift Fire Commander

-SPF Special Security Force SO Safety Officer SS&Q Safety Safeguards & Quality TDAG Training Development and Administrative Guide TRM Training Requirement Matric TSR Technical Safety Requirements UF, Uranium Hexafluoride UO2 F, Uranylfluoride URI Unresolved item USEC United States Enrichment Corporation VI Violation -

WPl Work Package Instruction 32