ML20207K309

Insp Rept 70-7001/99-01 on 990113-0223.No Violations Noted. Major Areas Inspected:Plant Operations,Maint & Surveillance, Engineering & Plant Support

ML20207K309
Person / Time
Site:	07007001
Issue date:	03/11/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20207K304	List: ML20207K301 ML20207K309
References
70-7001-99-01, 70-7001-99-1, NUDOCS 9903170129
Download: ML20207K309 (18)

Text

U.S. NUCLEAR REGULATORY COMMISSION REGION lil Docket No: 70-7001 Certificate No: GDP-1 Report No: 70-7001/99001(DNMS)

Facility Operator: United States Enrichment Corporation Facility Name: Paducah Gaseous Diffusion Plant Location: 5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 Dates: January 13 through February 23,1999 Inspector: Kenneth G. O'Brien, Senior Resident inspector John M. Jacobson, Resident inspector Approved By: Patrick L. Hiland, Chief Fuel Cycle Branch Division of Nuclear Materials Safety I

4 9903170129 990311 PDR ADOCK 07007001 C pog i

i

\

i

L .

l EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC inspection Report 70-7001/99001(DNMS)

Plant Operations e The inspectors initiated an inspector Followup item to track plant management's i assessment and resolution of issues identified following a spurious criticality accident I alarm system actuation. The issues included an s' asence of guidance for the control of equipment following the evacuation of plant buildings, and an absence of guidance and some plant staff's understanding of the appropriate evacuation routes. (Section 01.1)

Maintenance and Surveillance e The plant staff identified two maintenance evolutions that were performed without the timely completion of nuclear criticality safety non-destructive assay verifications. The failures were of pasticular concem because the requirements to perform the assays were contained in "in-hand" procedures. The plant staff appeared to take appropriate l corrective actions to address the immediate and long-term issues for ongoing l maintenance activities. (Section M1.1) e The inspectors determined that a Non-Cited Violation occurred when the plant staff identified and promptly resolved the inadequate surveillance testing of some criticality accident alarm systems as a result of a previous improper change to the controlling procedure. The proper testing requirements had been removed from the procedure in February 1998 and were not identified during plant change reviews because of a lack of detail provided in the change package. (Section M1.2)

Engineering i e The inspectors quostioned the plant staff's evaluation and non-reporting of a loss of one

! control for a fissile material operation in Building C-310 involving the removal of a pump subassembly within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The plant staff subsequently revised the reporting guidance for nuclear criticality safety engineers, reported the initial event, and properly reported a similar event within the 24-hour timeframe specified in NRC Bulletin 91-01.

(Section E1.1) e The plant staff performed appropriate pressure monitoring instrumentation modifications and tests to support retuming the Building C-337A Autoclaves 3 East and 3 West to

, service after a number of years ofinoperability. (Section E1.2)

Plant Support e The inspectors idetitified that the plant staff did not fully record or generically apply l lessons leamed, as a result of events in September and December 1998, to all the shippers of empty cylinders to the Paducah Plant. As a result, a cylinder was received at the Paducah Plant with radiation ;...;. :.; mas of the allowed procedural and regulatory limits. (Section T1,1)

. 2

e The inspectors determined that a Non-Cited Violation occurred as a result of a human performance error, facilitated by a lack of an independent review process, that permitted the incorrect handling of classified information. The loss of control was not considered to be significant in that the potential that the information was or could have been compromised was very small. Implemented or planned corrective actions, to preclude a recurrence of the loss of control, appeared approprie.te. (Section S1.1) l l 3

r e

i Report Details I, Operations l . 01 Conduct of Operations 01.1 Sourious Criticality Accident Alarm System Actuation

a. Insoection Scope (88100) -

The inspectors reviewed the plant staff's response to the spurious activation of a Building C-337A ciiticality accident alann system (CAAS).

l . b. Observations and Findinos l

On January 20, at approximately 10:30 p.m., the plant staff in Building C-300, the main control room, received a high radiation alarm (greater than 10 milliroentgens per hour) from the Building C-333A CAAS. The alarm was initiated by CAAS Cluster AB on the north wall of the Building C-333A feed facility. Conmrrent with the alarm, the radiation homs and lights for Building C-333 and C-333A actuated. In addition, the plant staff actuated the building evacuation homs and made a criticality alarm actuation announcement over the sitewide public address system.

in response to the alarms, the plant staff located in Buildings C-333 and C-333A evacuated the buildings and reported to a pre-designated assembly point near Building C-304, in addition, the plant emergency squad reported to the assembly point and initiated an accounting of the plant staff assigned to the area, conducted personnel monitoring, and took other actions, as necessary, to confirm that an actual criticality event had not occurred. One of the other actions was to evaluate the status of a second CAAS cluster which was located within 20 feet of the alarming cluster, - At 10:55 p.m.,

the Plant Shift Superintendent (PSS) concluded that an actual criticality event had not occurred and declared an "all-clear" on the emergency response initiated by the CAAS l high radiation alarm.

On January 21, the inspectors reviewed the plant staff's actions in response to the alarm. During discussions with the plant staff, the inspectors were informed that a i Building C-333 cascade cell, operating off-stream when the alarm was received, was shut down. The feed autoclaves and other cascade systems in the affected buildings were allowed to continue operating during the time the buildings were evacuated. No l other alarms were initiated by the operating equipment during the time the buildings were evacuated. The inspectors reviewed off-normal and alarm response procedures for the buildings and deterr.aned that the procedures did not direct a shutdown of the cell operating off-stream and did not provide other directions for the continued operation or shutdown of equipment during expected evacuation scenarios.  ;

I

- The inspectors discussed the findings with plant management and an initial engineering l l

review, of the circumstances present at the time of the CAAS alarm, was conducted. j l '

~ The initial review indicated that the continued operation of the involved plant systems l was appropriate for the conditions present at the time of the alarm. At the exit meeting, plant management indicated that a further engineering and operations review of -

operator actions during evacuation scenarios was underway to identify equipment 4

)

_ shutdown needs and to ensure that appropriate guidance was included in plant procedures and operations training.

1 The inspectors also reviewed the evacuation routes and assembly points used by plant '

staff during the alarm response. Through discussions with operations staff and a review 4

- of some emergency response guidance documents, the inspectors determined that the 1 plant staff may not be exiting the area of a criticality accident alarm in a manner that minimizes the potential for exposure. The inspectors noted that general employee

- training did not stress the need for personnel evacuating an area and relocating to an assembly point to do so in a manner that maximized the individual's distance from plant buildings. In addition, the inspectors noted that a recent change to the plant interior boundaries, through the installation of a fence immediately south of Building C-333A, may preclude the Building C-333 and C-333A plant staff from evacuating the area in the most dose-minimizing manner.

The inspectors discussed the findings with plant management and was informed that management had taken actions to immediately clarify evacuation expectations to all plant staff. In addition, the emergency response manager was initiating changes to the general employee training and the building emergency plans to better define the evacuation routes and techniques. Finally, plant management informed the inspectors at the exit meeting that the engineering staff was performing a review of dose impacts to evacuating personnel due to the recently constructed fence.

Following the spurious actuation of Cluster AB, the PSS declared the system inoperable and had the cluster detection and alarm circuits disconnected. Over the next few days, the system engineer monitored the system and noted that the cluster recorded a second spurious high radiation event. Following the second spurious high radiation event, the system engineer replaced the cluster. During a subsequent inspection of the cluster electronics, the plant staff identified a small nick in a high voltage electrical wire that was believed to be the cause for the alarms. l 1

The inspectors will track management's actions to address ths issues identified as a i result of the January 20 spurious activation of the Criticality Accident Alarm System Cluster AB in Building C-333A as an inspector Followup item (IFl 70-7001/99001-01).

c. Conclusions The inspectors initiated an Inspector Followup item to track plant management's assessment and resolution of issues identified by the inspectors during a review of a ,

spurious criticality accident alarm system actuation. The issues included: 1) an  !

absence of guidance on the appropriate operational status of equipment following an evacuaJan of plant buildings as a result of an emergency alarm; and 2) an absence of  ;

complete guidance and some plant staff's understanding of the appropriate evacuation routes from the buildings to assembly points following a criticality accident alarm system actuation. The inspectors also noted that a recent plant change may have incorrectly modified an evacuation route.

5 1

08 Miscellaneous Operations issues 08.1 Certificatee Event Reports (90712)

The certificatee made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concems indicated at the time of the initial verbal notification. In the case of retracted notifications, the inspectors reviewed the basis for the certificatee's retraction of the notification at the time of the retraction. The inspectors will evaluate the associated written report for each of the events following submittal.

Number Status Title 35387 Open Safety System Actuation of Water inventory Control System on Building C-360 Autoclave Number 4.

08.2 Bulletin 91-01 Reports (97012)

The certificatee made the following reports pursuant to Bulletin 91-01 during the inspection period, The inspectors reviewed any immediate nuclear criticality safety concems associated with the report at the time of the initial verbal notification. Any significant issues emerging from these reviews are discussed in separate sections of the report.

Number Date Title 35316 1/25/99 Loss of a Single Control When a Second Non-destructive Assay Measurement was not Obtained Prior to the Penetration of Cascade Piping.

35317 1/26/99 Loss of a Single Control When a Second Non-destructive Assay Measurement was not Obtained for Potentially Fissile Equipment Removal Activities.

08.3 (Closed) Certificatee Event Report. dated Febre3rv 10.1999 (not numbered): Incoming survey of a 14-ton cylirdm' on February 10 identified a radiation level on contact that exceeded the Department of Transportation limit of 200 millirem per hour. (See Section T1.1) for further discussion. This event report is considered closed.

08.4 (Closed) Certificatee Event Report 35377: Incoming survey of a 14-ton 46G cylinder identified removable contamination slightly above 22 disintegrations per minute per square centimeterin violation of Department of Transportation regulations. The cylinder was shipped to Paducah after it was emptied of depleted uranium hexafluoride at a processing facility in South Carolina. The plant staff notified the carrier and the shipper and halted further shipments from the facility until appropriate corrective actions were in place. The inspectors notified NRC Region 11 of the event. This event report is considered closed.

6 l

p '

i

1. Maintenance and Surveillance M1 Conduct of Maintenance M1.1 Missed Non-Destructive Assavs for Maintenance Activities

a. Insoection Scope (88103)

The inspectors reviewed the circumstances surrounding two incidents in which independent non-destructive assay (NDA) measurements of uranium mass for cascade maintenance activities were not obtained within the required timeframes. The incidents were reported to the NRC under NRC Bulletin 91-01 as a loss of a single criticality safety control (Event Reports 35316 and 35317).

b. Observations and Findinas ,

On January 12,1999, the plant staff discovered that a pump subassembly for Building C-310 Cell 1 Stage 3 had been removed from the cascade for maintenance on January 8,1999, and had not received a post-removal NDA scan. The purpose of the NDA scan was to independently verify that the uranium mass remaining in the equipment was below an always-safe-mass level. Technical Safety Requirement (TSR) 2.5.4.2, " Post-Removal Examination," and Nuclear Criticality Safety Approval (NCSA) GEN-10, ' Removal of Uranium Process Equipment," required a followup NDA scan (or complete visual inspection) within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The NDA scan taken before the pump subassembly removal indicated that the mass of enriched uranium remaining in the equipment was below an always-safe-mass level for the maximum 2.0 weight ,

percent enriched uranium hexafluoride which could be present at this location of the l cascade. The failure to perform the second NDA within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> meant that one of the i double contingencies was lost as NCSA GEN-10 had two controls (2 independent NDAs i or visual inspections) on one criticality parameter (mass).  !

In reviewing the plant staff's response to the issue, the inspectors noted that an entry in the PSS log indicated that the Action Statements for TSR 2.5.4.2 were entered at

. approximately 9:00 a.m. on January 12,1999. Condition A of the Action Statements i applied when the uncomplicated handling (UH) or less-than-safe-mass categorization  !

was not properly verified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The Action Statements contained immediate ,

requirements that equipment openings be covered or closed and a dry atmosphere be i established and maintained within the equipment. The inspectors noted that there were 1 additional log entries which indicated that plant staff had difficulty implementing the action statemer.1 for providing a dry atmosphere for the subassembly. The difficulties involved whether industrial hygiene or radiation protection concems were created by applying a buffer line and flow to an assembly wrapped in plastic. 'The inspectors noted l that these difficulties had not been evaluated ahead of time since the plant staff had  !

always dealt with equipment which had openings which could be covered and intemally l buffered under the equipment removal scenario (for example, an entire pump with a subassembly and casing). Approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> later, at the time a second independent NDA scan demonstrating that the subassembly mass was below the always-safe-mass level was obtained, the plant staff had not resolved the issues with i applying a dry atmosphere to the equipment. However, at this point, the plant staff was i .able to exit the Action Statements and treat the subassembly as a normal piece of UH equipment which did not require a buffer. The inspectors noted that the difficulties I

7

fl ]

4 J

experienced and the log entries indicated that the plant staff lacked a well-understood methodology for implementing an immediate Action Statement for some types of l equipment covered by TSR 2.5.4.2. The plant staff agreed and documented the issue in an assessment and tracking report for resolution.-

l On January 25, the plant staff discovered that a second required NDA had not been performed. The NDA was required before the plant staff penetrated cascade piping containing potentially fissile materialin Building C-337 Unit 4 Cell 2. Nuclear Criticality Safety Approval GEN-10-02 required the independent NDA verification of less-than-safe-mass in the cascade equipment. Upon discovery, the plant staff immediately  !

buffered the cell with dry air and obtained a second NDA which verified that the amount of enriched uranium in the equipment was significantly below the always-safe-mass level.

Both of the incidents discussed above involved failures to implement an in-hand procedure which contained steps for handling uranium-bearing process equipment and outlined the requirements for obtaining independent NDA measurements to verify the .

mass of enriched uranium present fcr equipment in cascade areas operating above 1 1.0 weight percent enrichment. The plant staff indicated that maintenance staff did not l follow through with a request for a second NDA in one case and did not reference the

~

procedure in the second case. In addition, the inspectors noted that technical support staff did not appear to have a questioning attitude in following up on the requests for the initial NDAs since most maintenance evolutions of this nature required that additional NDAs be performed.

The plant staff wrote assessment and tracking reports for both incidents and developed corrective actions.- The corrective actions included: 1) refresher training for a maintenance staff on the requirements for in-hand procedure usage and handling of potentially fissile materials; 2) initiating a procedure revision to enhance the checksheet used with the in-hand procedure to require clear documentation of initial and verification NDAs or inspections, as copropriate; and 3) additional management oversight of field activities to reinforce maintenance crews' attention to detail and use of procedures. As a result of the prompt followup by plant staff, this certificatee-identified and corrected l violation is being treated as a Non-Cited Violation (NCV 70-7001/9900142), consistent i with Section Vll.B.1 of the NRC Enforcement Policy.

c. Conclusions A Non-Cited Violation resulted when the plant staff identified that second verification non-destructive assays for two maintenance evolutions had not been obtained within the required timeframe. The failures were of particular concem because the requirements were contained in "in-hand" procedures. ' The plant staff appeared to take appropriate corrective actions to address the immediate and long-term issues for ongoing '

maintenanco activities.

M1.2 Criticality Accident Alarm Quarterly Surveillance Procedure a; inspection Scope (88102)

The inspectors reviewed the circumstances surrounding the plant staff's entry into TSR 1.6.3.3 for failing to perform a surveillance requirement within the maximum 8

i

allowed time interval. The surveillance involved testing the criticality accident alarm system (CAAS) audibility function (homs and lights) with all three logic combinations for the three detector modules of each CAAS cluster.

b. Observations and Findinos l On January 20, the CAAS system engineer discovered that the quarterly surveillance procedure used to test the CAAS audibility function did not include testing all three combinations of the modules. Each CAAS cluster contained three detector modules and a two-out-of-three logic to place the cluster into alarm. The basis l statements discussing the surveillance requirements in the CAAS audibility TSRs for the i facility (Surveillance Requirements 2.1.4.5b-1,2.2.4.3b-1,2.3.4.7b-1,2.4.4.2b-1, l- and 2.6.4.1b-1) stated that each module combination was tested to generate the high l radiation signal during the quarterly functional test. The system engineer identified that l

the quarterly surveillance procedure (CP4-GP-lM6209) had been revised in February l 1998 and the requirements to test all the module combinations had been deleted and i replaced with a requirement to only test one combination. As a result, the CAAS l clusters tested with the procedure since that time had not been appropriately tested to l ensure the clusters remained operable.

l Upon discovery of the ist.ue, the plant staff identified 10 clusters which had been tested l with the procedure and whose surveillances were inadequate. (A number of clusters j had been tested recently with the annual CAAS surveillance procedure which did

contain the requirements to test all module combinations.) For those 10 clusters, the plant staff entered TSR 1.6.3.3 for missed surveillances and performed appropriate tests with a newly revised procedure within the required 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. All of the clusters l were tested successfully.

l The inspectors reviewed the 10 CFR 76.68 plant change request (PCR) conducted by plant staff during February 1998 to support changing the cAAS quarterly a Jrveillance procedure. The inspectors noted that the PCR containoa generic statemen's about the changes to the procedure, but did not specifically identity that the testing requirements for the CAAS cluster logic were being revised. The maintenance front-line manager who initiated the change and developed the PCR believed that the previous system engineer had committed to developing an analysis and revising the TSR basis statements to specify that operability could be assured by testing only one combination.

However, the system engineer subsequently left the facility without following up on these discussions. Because of the lack of specifics in the PCR, a proper review of the proposed changes against the requirements in the approved TSR basis statements was not performed.

1 L in addition to the immediate corrective actions to revise the quarterly surveillance procedure and re-test the affected CAAS clusters, the plant staff developed more generic corrective actions for the issue. These included enhancing the procedural guidance for performing system engineer tumover and developing a lessons learned package for PCR evaluators and reviewers. As a result of the prompt followup by plant staff, this non-repetitive, certificatee-identified and corrected violation is being treated as a Non Cited Violation (NCV 70-7001/99001-03), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

9 L

c. Conclusions A Non-Cited Violation resulted when the plant staff identified that the procedure used to perform quarterly surveillances of the criticality accident alarm system's audibility function did not include testing all combinations of cluster modules es specified in the pertinent TSR basis statements. The requirements had been removed from the procedure in February 1998 and were not identified during plant change reviews because of a lack of detail in the change package.

Ill. Enaineerina E1 Conduct of Engineering E1.1 Bulletin 91-01 Reoortability Evaluations

a. Inspection Scope (88100)

As part of the followup inspection for the missed NDAs discussed in Section M1.1, the inspectors reviewed the following incident reports written by the plant nuclear criticality safety (NCS) staff:

e incident Report NCS-INC-99-001, Rev. O aad Rev.1; and e incident Report NCS-INC-99-004, Rev. O.

b. Observations and Findinot The incident reports were developed to review the circumstances for each event, discuss the impact on double contingency controls, ider:tify any immediato corrective actions necessary, and make a recommendation to the Plant Shift Sul vtendent on whether or not the associated event was repor.able under Bulletin 91-L me inspectors noted that incident Report NCS-INC-99-001 concluded tha. Jouble contingency was maintained for the fissile operation. The NCS staff's conclueion was based on the results from the second NDA (obtained some 5 days rafter the equipment removal) which indicated that the process condition (less than safe mass) for the activity was not violated. As such, the NCS staff did not believe the incident was reportable.

The inspectors questioned the basis for the incident report's conclusion and noted that

. double contingency for the activity appeared to rely upon one parameter (mass) with two  !

controls (separate NDAs) as opposed to more typical situations in which two separate parameters were controlled. During the NCS staff's review of the inspectors' questions, a second event occurred in which a verification NDA was not obtained prior to a cascade penetration. At this point, the NCS staff identified that both events appeared to  !

meet the Bulletin 91-0124-hour threshold for loss of one control relied upon for double contingency, even though the process condition or controlled parameter (mass) never l exceeded its limit. The NCS staff concluded that the failures to obtain the verification NDAs within the timeframes specified in the NCSAs meant that two independent contingencies (incorrect independent determinations of the controlled process parameter) had not been maintained throughout the entire process. Both events were subsequently reported to the NRC on January 25 and 26 (Event Reports 35316 and i 35317). l 10

[ ,

l 1

i l l  ;

Corrective actions for the initial incorrect reportability evaluation included: an NCS staff l briefing by the NCS manager concerning events involving one parameter with two l independent controls; and the initiation of a procedure revision to include more specific j guidance for reporting loss of double contingency when one control is lost for similar one-parameter operations. As a result of the prompt followup by plant staff, this non-l repetitive, certificatee-identified and corrected violation is being treated as a Non-Cited i Violation (NCV 70-7001/99001-04), consistent with Section Vll.B.1 of the NRC  !

Enforcement Policy. l

c. Conclusions A Non-Cited Violation resulted when the plant staff failed to report the loss of one control for a fissile material operation in Building C-310 involving the removal of a pump subassembly within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The plant staff subsequently revised the reporting guidance for nuclear criticality safety engineers and a subsequent similar event was l properly reported within the 24-hour timeframe specified in Bulletin 91-01.  ;

1 E1.2 Buildina C-337 Autoclave Modifications ~ l

\

a. Insoection Scope (88101) l The inspectors reviewed the modification activities associated with returning Building C-337A Autoclaves 3 East and 3 West to service after approximately 4 years of j not operating. The inspectors reviewed selected work packages associated with the i modifications and required post-modification and Technical Surveillance Requirement i (TSR) surveillance tests. I

b. Observations and Findinas  !

Compliance Plan issue 3 identified that the pressure monitoring instrumentation serving the autoc! ave safety systems and defense-in-depth systems would be replaced. For those autoclaves which were considered inoperable as of the end date of October 31, 1997, the plant staff decided to m'aintain the autoclaves inoperable until the instrumentation modifications were completed.

l The inspectors' review and selected walkdown of the modifications indicated that the pressure monitoring instrumentation for Autoclaves 3 East and 3 West had been upgraded as described in the Compliance Plan. The irastrumentation installed had better accuracy and resolution than that previously available in the autoclaves. In addition, the plant staff completed appropriate post-modification tests and TSR-required sunreillances of the autoclave pressure boundary and safety instrumentation. Based upon the review, the plant staff's decision to declare the autoclaves operable appeared reasonable.

c. Conclusions The plant staff performed appropriate pressure monitoring instrumentation modifications and tests to support retuming Building C-337A Autoclaves 3 East and 3 West to service l after a number of years of inoperability, i

11 l

E IV. Plant Suncort T1 Transportation T1.1 Receiot of Cylinder with Hioh Extemal Radiation Readinas

a. Insoection Scooe (88100)

The inspectcr:: reviewed the plant staff's hcndling of a cylinder received at the plant with high extemal radiation readings and the application of corrective actions for previous

. similar events.

b. Observations and Findinas On February 11, the plant staff received an empty product cylinder from the Portsmouth Gaseous Diffusion plant. Upon receipt of the cylinder, the plant staff performed an incoming inspection and identified extemal radiation levels that exceeded limits permitted by plant procedures and the applicable regulations. As a result of the inspection, the plant staff controlleu access to the cylinder, notified both the Portsmouth plant staff and made a one-hour report to the NRC. The inspectors reviewed P e plant staff's inspection data and noted that the highest radiation level measured was 347 millirem per hour on contact with the cylinder and 6 millirem per hour at one meter from the cylinder.

As a result of the event,. the inspectors evaluated the plant staff's corrective actions to previous similar events. The inspectors noted that in September and December 1998, the plant staff had received cylinders with high extemal radiation levels from a shipper  ;

other than the Portsmouth plant. Based upon an evaluation of the specifics surrounding i the September and December 1998 events, the plant staff determined that root causes  !

for the event were the shippers's failure to hold the cylinder for a minimum of 70 days l after bel,g emptied and inadequate radiation surveys of the cylinders. As corrective  ;

action, the plant staff reached an agreement with the shipper on the proper holding time i for an emptied cylinder and identified the most appropriate equipment and survey points for evaluating the extemal radiation levels prior to shipping the cylinders.

A!! hough the plant staff implemented the above corrective actions with the shipper involved in the September and December 1998 events, the inspectors noted that the corrective actions were not fully documented in the corrective action data base. In addition, the plant staff did not evaluate applicability of the corrective actions to other organizations that ship empty cylinders to the plant. Based upon a preliminary review of the circumstances associated with the current event, the inspectors determined that a generic application of the lessons leamed from the September and December 1998 events may have precluded the current event.

The inspectors discussed the findings with the plant staff responsible for the inspection of cylinders. The plant staff acknowledged the inspectors findings and identified a need to review the procedures used by other shippers to ensure an adequate overall program for control of cylinders. As of the end of the inspection period, the plant staff was ,

reviewing those generic actions that should be taken to preclude a recurrence of the February 1999 event. An assessment of regulatory issues associated with the incorrect 12 L

1 1

shipment of the cylinder from the Portsmouth Plant was being performed by the Portsmouth NRC resident inspectors.

c. Conclusions The inspectors identified that the plant staff did not fully record or generically apply lessons learned, as a result of events in September and December 1998, to all the shippers of empty cylinders to the Paducah Plant. As a result, a cylinder was received j at the Paducah Plant with extemal radiation levels in excess of the allowed procedural '

and regulatory limits.

'S1 Conduct of Security and Safeguards Activities S1.1 Control of Classified Information

a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding the plant staff's handling of some classified information,

b. Observations and Findinas During the inspection period, the plant staff identified an instance when classified information was not controlled in accordance with the Classified Information Security Plan. Specifically, the plant staff identified that information included on a video tape, maintained in the plant security vault following sweeps of the site for uncontrolled information, was incorrectly determined not to include classified information. The video tape was subsequently transferred to a location outside the plant controlled access area for a period of a few days and was sent to the Portsmouth Gaseous Diffusion Plant.

The plant staff had previously performed sweeps of the site for uncontrolled classified information as a corrective action to a prior NRC finding. The inspectors noted that the video tape was originally developed and assessed to be unclassified in the 1986 time period.

A few days after the video tape was removed from the security vault, the plant staff i identified that the video tape may contain classified information and a re-evaluation of the video tape was initiated. The re-evaluation determined that a few seconds portion of the hours-long video tape included classified information. As a result, the video tape was returned to the security vault and the video tape mailed to the Portsmouth Plant  !

was retrieved. Information provided to the inspectors indicated that the video tape package sent to the Portsmouth Plant had not been opened since being mailed from the Paducah Plant. Following a confirmation oy the plant staff that the viWo tape included i

. classified information, the Plant Shift Superintendent made a one-hour report to the NRC in accordance with applicable regulations.

Immediately after the plant staff identdied that the video tape included classified

. information, the plant management implemented short-term corrective measures to preclude a recurrence of the event pending a formal root cause evaluation. The short-term corrective measures included: 1) recovery and proper control of the classified video tapes; 2) restricting the classification review responsibilities of the involved personnel and requiring subsequent retraining; 3) implementation of a temporary system

]

13 a

of independent reviews of similar types of material (e.g. video tapes) that may contain classified information; 4) a re-evaluation of some materials reviewed by the involved individuals during the past year; and 5) the initiation of revisions to the procedure used to direct the review process to increase the guidance and level of controls spec:'iad for the process.

The inspectors reviewed the video tape, discussed the event with plant management and security staff, and reviewed the short-term corrective measures. The inspectors determined that the plant staff's assessment that the video tape included classified information was consistent with guidance contained in an NRC and Department of Energy classification guide for the subject information. The inspectors also determined that the information, though stored outside the plant controlled access area for a few days following removal from the security vault, was not maintained in a manner that made the information readily available to personnel without a proper security clearance and was not directly provided to personnel without a proper security clearance.

During discussions of the event with plant management, the inspectors were informed no additional examples of incorrectly classified materials were identified as a part of the re-evaluation process. The inspectors also noted that a plant management-directed human performance enhancement system analysis of the event determined that one root cause for the event was a human error caused by inadequate time being allocated to perform a repetitive task without provisions for sufficient breaks. Plant management expected the short-term corrective measure that required independent reviews of similar

! materials conducted over a longer time period to resolve the root cause. In addition, the security manager indicated that changes to the controlling procedure were in progress to ensure a more clearly defined review process and to minimize the potential for similar repeat occurrences.

The inspectors determined that the short-term and planned corrective actions appeareA

' appropriate to preclude a recurrence of the event. The inspectors also determined that the loss of control of the classified information did not create a significant potentialihat the material was or could have been compromised. Specifically, the inspectors determined that: 1) the classified nature of the information was not readily evident; i 2) the information was masked within a significantly larger body of unclassified l information; and 3) the information, though taken and maintained outside the controlled access area for a short period of time (days), was not provided to or readily accessible to individuals without a proper security clearance. Therefore, the loss of control of the classified information contained on the video tape outside the controlled access area was not significant. As a result of the prompt followup by plant staff, this non-repetitive, certificatee-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/9900105), consistent with Section Vll.B.1 of the NRC Enforcement Policy,

c. Conclusions )

' The inspectors determined that a Non-Cited Violation occurred as a result of a human performance error, facilitated by a lack of an independent review process, that permitted <

the incogect hand!ing of classified information. The loss of control was not considered I to be significant in that the potential that the information was or could have been compromised was very smallc Implemented or planned corrective actions, to preclude a recurrence of the loss c' control, appeared appropriate.

14 l.

r l

• l S8 Miscellaneous Security issues ,

I S8.1 Certificatee Escurity Reports (90712)

l. The certificatee made the following security-related one hour reports pursuant to 10 CFR 95 during the inspection period. The inspectors reviewed any immediate .

security concerns associated with the report at the time of the initial verbal notification.

DMs! Ill!st 2/1/99 Classified Matter in Video Tape was not Properly Protected. ,

i V. Manaaement Meetinos i I

X1 Exit Meeting Summary l The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on February 23,1999. The plant staff acknowledged the findings presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

l l I

l l

i 15 i

l

l l

PARTIAL LIST OF PERSONS CONTACThG l l

Lockheed Martin Utility Services '

i

• M. A. Buckner, Operations Manager

• L. L. Jackson, Nuclear Regulatory Affairs Manager

• S. R. Penrod, Enrichment Plant Manager  ;

• H. Pulley, General Manager United States Department of Enerav G. A. Bazzell, Site Safety Representative United States Enrichment Corooration "J. A. Labarraque, Safety, Safeguards and Quality Manager

• J. L. Adkins, Vice President - Production U.S. Nuclear Reaulatory Commission

• J. M. Jacobson, Resident inspector i

• K. G. O'Brien, Senior Resident inspector i

• Denotes those present at the February 23,1999, exit meeting.

Other members of the plant staff were also contacted during the inspection period.

INSPECTION PROCEDURES USED IP 88100: Plant Operations IP 88101: Configuration Control IP 88102: Surveillance Observations IP 88103: Maintenance Observations '

IP 90712: In-office Review of Events i

1 I

l 16

I ITEMS OPENED, CLOSED, AND DISCUSSED j opened  !

70-7001/99001-01 IFl Plant management resolution of issues associated with l emergencies involving facility evacuations  !

35387 CER Safety system actuation of Building C-360 Autoclave Number 4 Water inveniary Control System Closed  ;

i 70-7001/99001-02 NCV Failure to obtain verification non-destructive assays 70-7001/99001-03 NCV Failure to properly conduct quarterly surveillance for CAAS audibility function due to inappropriate procedure change 70-7001/99001-04 NCV Failure to report loss of criticality control for missed non-destructive assay within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per Bulletin 91-01 70-7001/99001-05 NCV Failure to properly controlled classified information CER Cylinder shipped from Portsmouth with radiation level exceeding Department of Transportation limit 35316 CER Loss of a single control when a second non-destructive assay measurement was not obtained prior to the penetration of cascade piping.

35317 CER Loss of a single control when a second non-destructive assay measurement was not obtained for potentially fissile equipment removal activities.

35377 CER Cylinder shipped from offsite contractor with removable contamination exceeding Department of Transportation limit Discusud None 17

7 1 l

LIST OF ACRONYMS USED CAAS Criticality Accident Alarm System , ;

CER Certificatee Event Report l CFR Code of Federal Regulations j DNMS Division of Nuclear Materials Safety '

DOE Department of Energy IFl Inspector Followup item NCS Nuclear Criticality Safety NCSA Nuclear Criticality Safety Approval

{

NCV Non-Cited Violation NDA Non-Destructive Assay NMSS Nuclear Material Safety and Safeguards NRC Nuclear Regulatory Commission PCR Plant Change Request PDR Public Document Room PSS Plant Shift Supervisor TSR Technical Safety Requirement UH Uncomplicated Handling USEC United States Enrichment Corporation l

l i

18 1