ML20216B923

Insp Rept 70-7001/98-06 on 980310-0420.Violation Noted.Major Areas Inspected:Operations,Maint & Surveillance,Engineering & Plant Support

ML20216B923
Person / Time
Site:	07007001
Issue date:	05/07/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20216B914	List: ML20216B923
References
70-7001-98-06, 70-7001-98-6, NUDOCS 9805190005
Download: ML20216B923 (22)

Text

-

U.S. NUCLEAR REGULATORY COMMISSION REGION lil Docket No: 70-7001 Certificate No; GDP-1 Report No: 70-7001/98006(DNMS)

Facility Operator: United States Enrichment Corporation Facility Name: Paducah Gaseous Diffusion Plant Location: 5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 Dates: March 10 through April 20,1998 inspectors: K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector Approved By: Patrick L. Hiland, Chief Fuel Cycle Branch Division of Nuclear Materials Safety 9805190005 990507 PDR ADOCK 07007001 C PDR

EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC Inspection Report 70-7001/98006(DNMS)

Plant Operations

. The plant staff effectively investigated three minor uranium hexafluoride releases and developed lessons-learned summaries in an effort to preclude recurrence of the releases.

However, the summaries were not communicated to the staff using a formal system, such as the long-term order process, until after the inspectors questioned the effectiveness of using informal e-mail messages as the means of communication. (Section 01.1)

. The inspectors noted the generally effective implementation of a new problem reporting process during the inspection period. The new process reduced the number of nonsafety-related problem reports requiring Plant Shift Superintendent review, allowing the Plant Shift Superintendent to focus on safety, operability, and reportability issues.

(Section 01.2)

Maintenance and Surveillance

. A violation of the Quality Assurance Program was identified in that, from March 1997 to April 6,1998, the design of the Building C-720 criticality accident alarm system audibility J function was not verified following a design modification. As a result, one of two independent alarm channels would not have sounded the criticality accident alarm system horns for 120 seconds, as designed. The design inadequacy was self-revealed during a quarterly surveillance after a loss of the second channel. (Section M1.1)

Enaineerina

. The inspectors concluded the plant staff had successfully completed all of the actions identified in Confirmatory Action Letter Rlll-97-003 for restar1 of the Building C-400 cylinder wash operation. (Section E1.1)

. An apparent violation was identified regarding a safety evaluation which failed to identify an existing unreviewed safety question. The inspectors determined that the evaluation performed following the plant staff's identification of an as-found condition associated with the Building C-315 liquid uranium hexafluoride accumulators, was nonrigorous. As a result, a potential unreviewed safety question was not identified and plant operations were conducted for approximately 8 months in a manner that was inconsistent with Safety Analysis Report-specified accident release limitations. (Section E1.2)

. The inspectors determined that an operability evaluation, developed in response to questions raised regarding the performance capabilities of rail stops for cranes used to handle cylinders containing liquid uranium hexafluoride, was nonrigorous and inconsistently utilized applicable codes and standards. Additional engineering work, to document the crane rail stops' performance capabilities versus the applicable performance standards, was being completed as of the end of the inspection period.

(Section E1.3)

. The inspectors identified several as-found conditions associated with the Safety Analysis Report Upgrade process that appeared to conflict with the current Safety Analysis Report.

2

Actions by the plant staff to assess the acceptability of continued operations with the as-found conditions will be tracked as an Unresolved item. (Section E1.4)

Plant Support

. The inspectors determined that the classified matter purge campaign, undertaken in response to Escalated Enforcement Action 97-431, appeared to be on schedule to meet the June 1998 commitment date. (Section S1.1) i l

1 1

1 3

l l

l Report Details l

1. Operations 01 Conduct of Operations O1.1 Seal and Block Valve Buffer Releases

a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding three minor uranium hexafluoride (UFe) releases from process buffer systems.

s b. Observations and Findinas On March 18, the plant emergency squad responded to a minortalease of UFe from a seal buffer system cabinet. Buffer systems were installed to provide a means of controlling and monitoring leaks to or from the components most likely to fail for the gaseous diffusion process. The release occurred while operations staff were conducting troubleshooting activities to identify which seal systems were leaking to the process stream. As a result of operator actions, taken to returri buffer air to the seal buffer exhaust system, a pressure regulator relieved (as design 9d) to an area outside the buffer cabinet and a small amount of UFe was released. No intakes or exposures to personnel resulted from the event.

On March 24, the plant emergency squad responded to a minor release of UFe from a  ;

j block valve buffer system. The following day, March 25, another minor release occurred from the block valve buffer system. No intakes or exposures to personnel resulted from the events. An initialinvestigation by plant staff indicated the releases occurred as a result of contaminated air in the system which originated from a leaking valve bellows.

The contaminated air was released from an o-ring or seal on the block valve buffer panel after operators adjusted the system eir pressure. The investigation also determined the second release could have beeri preunted had the air supply to the contaminated buffer system been isolated after first release. The plant staff subsequently performed a walkdown of the process buildings in an effort to identify other contaminated block valve buffer systems.

Plant operations management issued two long-term orders (LTOs) to communicate the lessons learned from these events. The LTOs reemphasized current procedural requirements. In addition, LTO No.98-007 indicated that troubleshooting evolutions should be coordinated through the cascade coordinator. The need to isolate the air supply when contaminated block valve buffer systems were M ntified was addressed in LTO No.98-006. The LTOs were issued after the inspectors .aised concerns about communicating the lessons learned for the seal buffer events to operations staff via the ,

e-mail system. The inspectors noted that the e mail system was not a formal method that j ensured long-term retention of lessons learned and previous attempts to use the system as such had resulted in re; peat issues.

c. Conclusions The plant staff effecti ely investigated three minor uranium hexafluoride releases and l developed lessons leamed summaries in an effort to preclude recurrence of the releases.

However, the summaries were not communicated to the staff using a formal system, such  !

l 4  !

I

~

1 j

as the long-term order process, until after the inspectors questioned the effectiveness of using informal e-mail messages as the means of communication.

01.2 Transition to Assessment and Trackina Reports

a. Inspection Scope (88100)

The inspectors reviewed the transition from the use of problem reports, for identifying problems, to the use of assessment and tracking reports (ATRs). The review included a comparison of ATRs generated and screened against the criteria in Procedure CP2-BM-Cl1031, Revision 0, " Corrective Action Process at PGDP [Paducah Gaseous Diffusion l Plant)."

t) Observations and Findinas During the inspection period, the plant staff implemented a new problem reporting and resolution procedure. The new procedure was developed to reduce the number of problem reports processed by the Plant Shift Superintendent (PSS) in order to allow the PSS to focus on safety.. operability, and reportability issues. In addition, the change was intended to increase the effectiveness of the corrective action program by improving the tracking and resolution of identified problems.

One of the major enanges in the problem reporting process was the use of screening managers to initially determine if an ATR should be provided to the PSS, for immediate review, or to the Commitment Management Capartment, for resolution. The screening criteria included whether or not the problem involved an immediate personnel or I' equipment safety hazard, an operability concern, a reportability concern, or a criticality safety issue. Any ATRs that met one of the screening criteria were required to be dispositioned by the PSS. All other ATRs were provided to the Commitment Management Department.

In addition to the procedurally required screenings, the plant staff had representatives from the PSS office and Commitment Management performing a check of each ATR to ensure the ATR was properly screened during the initialimplementation phase. The inspectors also performed a review of ATRs which were not forwarded to the PSS for immediate action. Over a three week period, the inspectors identified a small number, approximately a dozen, ATRs that appeared to meet the criteria for PSS review but were not provided to the PSS. Independently, the plant staff also identified, through the second review checks, the need for the twelve ATRs to receive PSS review, in general, the inspectors determined that implementation of the new process for identifying problems requiring immediate PSS review appeared adequate.

c. Conclusions The inspectors noted a generally effective implementation of a new problem reporting process (using Assessment and Tracking Reports) during the inspection period. The new procedure reduced the number of nonsafety-related problem reports processed by the Plant Shift Superintendent, allowing the Plant Shift Superintendent to focus on safety, operability, and reportability issues.

l l

5

I

• 08 Miscellaneous Operations issues 08.1 Certificatee Event Reports (90712) 1 The certificatee made the following operations-related event reports during the inspection ,

penod. The inspectors reviewed any immediate safety concerns indicated at the time of  !

the initial verbal notification. The inspectors will evaluate the associated written reports for each of the events following submittal.

_ Number Status Title i

33929 Open Steam Blowdown Testin; Creates inaudible Condition for l Building C-400 and C 409 Criticality Accident Alarm System 34034 Open Building C-720 Cr:ticality Accident Alarm System Not Able )

to Provide Raquired Alarms in Building C-300 Central Control Facility 08.2 Bulletin 91-01 Reports (97012_) I The certificatee made the following reports pursuant to Bulletin 91-01 during the inspection period. The inspectors reviewed any immediate nuclear criticality safety concerns associated with the report at the time of the initial verbal notification. Any significant issues emerging from these reviews are discussed in separate sections of the report.

Number Date Title l 34078 4/14/98 Maintenance Activities for Exhaust Pump Pipes Without an Approved Nuclear Criticality Safety Approval 08.3 (Closed) CER 33892: loss of power to Building C-360 criticality accident alarm systems and process gas leak detection systems. The plant staff reported a loss of power to the Building C-360 safety systems after a crane shoe caught and pulled an electrical cable causing a short. Upon further review of the electrical drawings and testing of the electrical system, the plant staff concluded that power for the safety systems was automatica'!y transferred to an alternate electrical bus; therefore, power was nct lost. As a result, the plant staff retracted the event report. The inspectors reviewed the event investigation and determined the certificatee's evaluation was reasonable and had no further questions.

08.4 (Closed) CER_33957: process gas leak detector alarmed in Building C-337 Unit 3 cell l bypass duct. The plant staff reported the actuation (alarrn) of the detector due to a small I release of UF, from a block valve buffer system. After further review, the certificatee i concluded that the actuation was not reportable because the associated cascade  :

l equipment was not in a Technical Safety Requirement-specified Mode requiring the I

process gas leak detection system to be operable, that is, the cascade equipment was operating at sub-atmospheric pressures. The safety system was only required to be j operable for operations above atmospheric pressure per Technical Safety Requirement 2.4.4.1. The certificatee subsequently retracted the event report. The inspectors reviewed the cascade conditions, present at the time of the detector actuation, and the reportability requirements specified in Section 6.9 of the Safety Analysis Report, 6

l l

\

l " Event investigation and Reporting." Based upon the reviews, the inspectors determined the certificatee's evaluation was reasonable and had no further questions.  ;

O 08.5 (Closed) VIO 70-7001/97002-03: failure to determine and correct the cause of a high i drain alarm prior to returning the autoclave to service. In response to the violation, the plant staff issued a long-term order which required the responsible system engineer to  ;

investigate safety system actuations in order to determine the validity of the initiating  !

alarm signal and to ensure the appropriate corrective actions were taken. The long-term )

order was subsequently proceduralized in Procedure OPS-19, Revision 0, " Alarm i Response Guidelines and Status Control." The inspectors reviewed selected safety )

system actuations and did not identify any systems which were returned to service I without a review by the system engineer or a determination of cause with corrective j action, as needed. The inspectors concluded that the corrective actions for the violation appeared adequate and had no further questions.

II. Maintenance and Surveillance M1 Conduct of Maintenance and Surveillance M1.1 Buildina C-720 Criticality Accident Alarm System Repairs

a. Inspection Scope (88102)

The inspectors reviewed the work package and followup repairs for the quarterly surveillance of the Building C-720 criticality accident aiaiai Fjstem (CAAS) horns and lights,

b. Observations and Findinas On April 6, the plant staff removed the Building C-720 CAAS Cluster "AL" from service in order to perform a routine quarterly surveillance of the associated electronic horns and alarm lights in accordance with Technical Safety Requirement (TSR) 2.6.4.1.b-1. The test assessed the continued operability of the Building C-300 high radiation alarm light and bell and the Building C-720 horns and lights. The Building C-300 high radiation alarm light and bell served to notify the PSS of an alarm condition in Building C-720 and of the need to initiate a notification of personnel, in facilities within the CAAS audibility zone, to j evacuate the area in accordance with a Justification for Continued Operations (JCO) ,

included as a part of Compliance Plan losue 50. The JCO provided the actions l necessary to alert personnel, in facilities near Building C-720 that were not equipped with l CAAS horns, of an inadvertent criticality.

While performing the surveillance, plant instrument mechanics noted that the high radiation alarm light in Building C-300 did not illuminate, as expected, when the CAAS cluster was put into an alarm state. Upon learning of the failed surveillance, the PSS i made a 24-hour event notification to the NRC because the inoperable alarm light would l not have allowed the PSS to notify affected personnel as required by the JCO ,

(Certificatee Event Report 34034). The mechanics also noted that the Building C-720 horns ceased sounding after approximately 10 seconds, whereas TSR 2.6.4.1 require i the horns to sound for at least 120 seconds. The 120 second sounding of the horns " .5 necessary to allow sufficient notification to personnel to evacuate the area.

l During troubleshooting efforts, the plant staff discovered that two wires in the alare drcuit were reversed. The plant staff also discovered that one of the amphenol connec' ors for l

. 7 l

l

! the Building C-300 48-volt circuit was missing a retaining clip, a subtle nonconformance

, which had not been previously discovered. The missing retaining clip allowed some wires l to become loose so that the circuit path was broken. The loose wires were the ioot l cause for the failure of the Building C-300 high radiation alarm light to illuminate upon an alarm condition. Repairs to the circuit were successful in restoring the Building C-300 alarm function.  ;

The plant staff continued the investigation in an effort to explain why the building horns l had actuated for only 10 seconds. The investigation revealed that following loss of the l 48-volt alarm channel from Building C-300, caused by the loose connector, the CAAS horn system relied upon a second, independent 24-volt alarm channel in Building C-720 to provide the signal to the control board for the building horns. During March 1997, the plant staff modified the horn circuit to decrease the actuation time for the building horns  ;

to below the 0.5 seconds upper limit specified in American National Standard (ANS) 8.3.

(The basis statement for TSR 2.6.4.1 referenced ANS 8.3 as the standard to which the Building C-720 CAAS conformed.) The design modification involved installing jumpers between two control board inputs: the " Alert Command" input and the " Push-To-Talk" input. The design included two independent channels (48-volt and 24-volt) which ccaid initiate the CAAS horns via inputs to a control board in the hom control box. At the time of the design change, the plant engineering staff did not realize the " Push-to-Talk"innut required a continuous signal whereas the " Alert Command" input required an >

instantaneous signal to generate the output signal necessary to close a relay and cause the building horns to sound. As a result, a time-delay relay located in the 24-volt channel, but not in the 48-volt channel, would open after 10 seconds of receiving the alarm signal and would cause the output signal from the horn control board via the " Push-To-Talk" l input to be de-energized. Thus, the modified design would not maintain the building i I

homs' sounding for the required 120 seconds for the 24-volt channel.

In order to allow for an independent assessment of the operability of both channels during the quarterly surveillance, the CAAS circuitry included two spring-loaded switches which, when depressed individually, disabled one channel in order to test the other channel.

Procedure CP4-GP-lM6178, Revision 1, " Maintenance of the C-720 Criticality Accident Alarm System," effective March 3,1997, was the maintenance procedure used to verify the CAAS design modification and to perform the quarterly surveillances of the building horns and lights. Steps 8.2.1.C and 8.2.1.J required the mechanics to " push and hold" the switches disabling the other independent channel, but did not provide guidance on how long to hold the switch. The mechanics were to release the switch after the homs and lights were actuated. Because the procedure did not require the disabling switch to be held long enough to overcome the time-delay function of the relay in the 24-volt channel, the loss of a continuous 24-volt signal to the " Push-To-Talk" input of the horn control board was not identified. Instead, once the disabling switch was returned to the normal position, the control circuitry switched back to the Building C-300 48-volt channel l and the horns continued to sound as expected. The design inadequacy was not identified ,

until the loose connection in the 48-volt chanr'el caused an interruption in the second path so that a true test of the 24-volt channel occurred.

l Afteridentification of the problem, the engineering staff performed an engineering evaluation which concluded the March 1997 modification design inadequacy could be corrected by replacing the time-delay relay with a standard relay. Engineering Evaluation i

EV-C-812-98-030, Revision 0, " Replacement of Interval-On Time Delay Relay In Alarm Horn Control Box for C-720 Criticality Accident Alarm System," dated April 7,1997, indicated that the replacement relay was expected to be at least as fast as the time-delay relay (and thus would not negatively affect the response time). The evaluation also I

indicated that previous surveillances, performed under the procedure (CP4-GP-lM6178),

were inadequate in that they did not identify that one of the inputs to the hom control board required a continuous rather than instantaneous input. The procedure did not verify that the second channel would initiate and maintain CAAS horn annunciation as designed. The plant instrument mechanics subsequently replaced the time-delay relay with the standard relay and successfully performed the quarterly surveillance for the horns and lights.

The inspectors noted that post-maintenance testing of the relay replacement did not include a check of response time for the alarm circuit although installation of the new relay involved the lifting and landing of leads. Instead, the engineering staff performed an evaluation of the relay replacement. The engineering staff's actions appeared to satisfy the Quality Assurance Program-specified requirements for design control.

Title 10 of the Code of Federal Regulations, Part 76.93, " Quality Assurance," required, in part, that the certificatee establish and execute a Quality Assurance Program (QAP).

Item 3 of Section 2.3.3.4 of the QAP, " Design Verification," required, in part, that procedures for design verification activities shall be established and that design verification sha!! be completed prior to relying upon the component, system, structure, or computer program to perform its function. Item 5 required, in part, that verification by testing shall demonstrate the adequacy of performance under conditions that simulate the most adverse design requirements. The failure of Procedure CP4-GP-lM6178 to demonstrate that the 24-volt channel of the Building C-720 CAAS would sound the building horns for the required 120 seconds upon loss of the 48-volt channel (the most adverse design requirement) is a Violation of 10 CFR 76.93 (VIO 70-7001/98006-01). ,

c. Conclusions A violation of the Quality Assurance Program was identified in that, from March 1997 to April 6,1998, the design of the Building C-720 criticality accident alarm system audibility function was not verified following a design modification. As a result, one of two independent alarm channels would not have sounded the criticality accident alarm system horns for 120 seconds, as designed. The design inadequacy was self-revealed during a quarterly surveillance after the loss of the second channel.

111. Enaineerina E1 Conduct of Engineering E1.1 Buildina C-400 Cylinder Wash Operations

a. inspection Scope f88100)

The inspectors reviewed the nuclear criticality safety approvals, procedure, and plant change documents associated with the restart of the Building C-400 cylinder wash and hydrostatic testing operations pursuant to NRC Confirmatory Action Letter (CAL) No. Rlll-97-003, dated February 28,1997 (see Inspector Follow-up item 70-7001/97002-15). In particular, the inspectors reviewed the following:

(1)  % clear Criticality Safety Approval No. NCSA.400.002.01, "C-400 Cylinder Wash Operations at the Paducah Gaseous Diffusion Plant",

(2) Nuclear Criticality Safety Approval No. NCSA.400.003.01, "C-400 Cylinder Hydrostatic Testing Operations at the Paducah Gaseous Diffusion Plant";

9

(3) Letter from United States Enrichment Corporation, " Restart of C-400 Wash Facility," dated March 13,1998; and (4) Request for Application Change No. 97C275,"Flowdown of NCSA Requirements for C-400 Cylinder Wash," approved March 12,1998.

The inspectors also reviewed selected portions of the governing procedure, observed activities in progress, and had discussions with responsible operators and a first-line manager in Building C-400. l

b. Observations and Findinas The governing nuclear criticality safety approvals (NCSAs) identified a pre-selected group i of cylinders which could be washed and hydrostatically tested under the NCSAs. The group included only cylinders for which a complete set of material control and accounting  ;

(MC&A) records was available from the time of the last hydrostatic test until the present.

This approach ensured the plant staff had an accurate knowledge of the assays of uranium hexafluoride introduced into the cylinders throughout the period of service.

Thus, the assays of cylinders for washing were strictly limited to 2.0 weight percent or below. In addition to assay control, the governing NCSAs required mass control to ensure a greater than safe mass was not moderated during the washing operation in the unsafe volume of the 10-ton or 14-ton cylinders. The NCSAs included a number of l independent verifications to ensure that only a cylinder from the approved list, meeting the mass control was selected for washing and hydrostatic testing.

The inspectors performed a selected review of the governing procedure and observation l

of cylinder wash and hydrostatic testing operations and did not identify any failures to meet the double contingency principle for fissile operations. Independent verifications of the assay, mass, and cylinder designator for cylinders to be washed were accomplished i as required by the NCSAs. The inspectors determined the operators were knowledgeable of the NCSAs and procedural requirements and were able to readily ,

identify the criticality safety controls relied upon for safe operations. I l

Based on the review, the inspectors considered that the plant staff had accomplished the l actions identified in the CAL for restart of the cylinder wash operation, including the hydrostatic testing of the cylinders after washing. These actions included a review of the administrative controls for the operation, revision of the NCSAs, revision of the procedure, providing appropriate training to operators, and notification of the NRC prior to restart.

c. Conclusions The inspectors concluded that plant staff had accomplished the actions identified in ,

Confirmatory Action Letter Rlll-97-003 for restart of the Building C-400 cylinder wash  !'

operation. No additional concerns were identified as a result of the review.

1 10 f

i E1.2 Tails Withdrawal Buildina Accumulator As-Found Capacities Difference

a. Inspection Scope (88100)

The inspectors reviewed the resolution of an as-found difference between the capacities of the installed Building C-315 liquid uranium hexafluoride accumulators and the Pccumulator capacities assumed in the Safety Analysis Report.

b. Observations and Findinas On April 13,1997, the Assistant Plant Shift Superintendent (APSS) filed a problem report I to document a potentially anomalous condition involving the Building C-315 Tails Withdrawal Accumulators. The APSS noted during a tour of the building that the l accumulators appeared to have a larger volume then described in the Safety Analysis Report.

On April 25,1997, the engineering staff completed an evaluation of the potentially anomalous condition and determined the two accumulators were each approximately twice as large as described in the Safety Analysis Report. The increased accumulator capacities were estimated to be able to contain 21 tons of liquid uranium hexafluoride versus the Safety Analysis Report stated capacity of 10 tons. The engineering evaluation also included a note which indicated the original bill of materials for installation of the accumulators required the accumulator steel supports to be designed to support a weight of 22.5 tons.

l On May 5,1997, the plant staff initiated efforts to revise the Safety Analysis Report description of the accumulator capacities from 10 tons to approximately 21 tons. A safety evaluation of the proposed change to the Safety Analysis Report, performed in

! accordance with the requirements of 10 CFR 76.68, indicated that the change did not  ;

present an undue risk to public health and safety and did not involve an unreviewed I safety question. On June 25,1997, the Plant Operations Review Committee reviewed and approved the Safety Analysis Report change which increased the stated accumulator capacities from 10 to 21 tons. l During the inspection period, the inspectors reviewed the Safety Analysis Report change l asscciated with the accumulator capacities. The inspectors noted the safety evaluation l

appeared incomplete. Specifically, the evaluation did not assess how the change could impact the consequences of all Safety Analysis Report accident scenarios associated with Building C-315. Instead, the evaluation focused on a single accident scenario

! described in Section 4.3.4.2.1. The inspectors determined Safety Analysis Report

Sections 4.3.3.1.2 ( Building C-310 Accumulators),4.6 (Natural Phenomena), and ,

l 4.9 (Accident Scenario Summaries) also included assessments and discussion of accident scenarios related to the Building C-315 accumulators.

l The inspectors reviewed the assessments and conclusions of Safety Analysis Report I Sections 4 3.3.1.2,4.6, and 4.9. Section 4.3.3.1.2 discussed a fatigue failure of the accumulator drain line. The assessment concluded that the accident consequences l would be limited to 1000 pounds based on operator recognition of the event and actions l to evacuate the accumulators within five minutes after a failure of the drain line. The assessment further acknowledged that smaller leaks may take longer to recognize; however, in all cases, the total material released would not exceed 1000 pounds. The inspectors noted that accumulator capacity would have a direct impact on the operator's ability to evacuate the system within five minutes. Therefore, an increase in the 11 l

[

1 l

accumulator capacity may increase the consequences of the accident. The inspector also noted that the assessment appeared to assume only a limited amount of material was present in the accumulators; however, information provided in Section 4.3.2.4.1 indicated the accumulators could be completely filled during cylinder changes. The inspectors determined the safety evaluation did not identify or assess the significance of the difference, though the safety evaluation referenced both sections.

Section 4.6 discussed the impacts of a seismic event on the plant. The potential for Building C-315 to be impacted by a seismic event appeared to have been recognized as a part of the assessment; however, the accident tables did not include a contribution to the overall release estimates from the Building C-315 accumulators. In order to assess the basis for the absence of a contribution by the accumulators to the overall seismic release estimates, the inspectors reviewed the source document for the referenced analysis. The source document indicated that the Building C-315 accumulators would withstand a 0.33g level earthquake. However, the inspectors concluded the analysis did not consider the true size of the accumulators or the potential for liquid uranium hexafluoride to be present in the accumulators. The presence of liquid uranium hexafluoride in the vertically mounted accumulators could change the seismic response of the accumulators. The inspectors concluded that consideration of this information, as a part of the safety evaluation, may have resulted in the accumulator capacity change being identified as an unreviewed safety question.

The inspectors also reviewed Section 4.9 of the Safety Analysis Report. The Section '

summarized, in table form, the residual risk represented by the expected consequences from the analyzed accident scenarios. The inspectors noted that the table included two scenarios that explicitly mentioned the accumulators. The table also included the generic seismic scenario. The maximum possible source term for the three scenarios was listed as 64,000 pounds of uranium hexafluoride. The inspectors determined the maximum source term was approximately 18,000 pounds less than Building C-315 accumulators' revised combined capacity.

Dur:ng followup reviews of the issue, the plant staff determined the Building C-315 accumulators' structural supports were not adequate to ensure that the accumulators would withstand a design basis earthquake. Failure of the accumulators, during a seismic event, could result in releases slightly greater than twice the level currently assumed in the accident Enalysis if the accumulators were full of liquid uranium hexafluoride.

As a result of the inadequate safety evaluation and an inadequate review of the safety evaluation by the Plant Operations Review Committee, the inspectors determined the plant operated from June 25,1907, until March 6,1998, without controls which would b zve controlled the amount of liquid uranium hexafluoride, in the Building C-315 at:amulators, to within the Safety Analysis Report accident assumptions. The inspectors reviewed withdrawal data for the time period and determined that the accumulators contained liouid uranium hexafluoride approximately two percent of the time. The maximum amount of material present in the accumulators during the period was approximately 13,000 pounds.

l On March 6,1998, operations management issued a long-term order which limited the i amount of materialin both the Building C-310A and Building C-315 accumulators,

! pending permanent modifications to the accumulators. The revised maximum filllimit, pending completion of the seismic modifications, was 10,000 pounds for the Building C-315 accu:1ulators.

12 J

l Title 10 of the Code of Federal Regulations, Part 76.68 (b) requires, in part, that as-found I conditions that do not agree with the plant's programs, plans, policies, and operations shall be evaluated in accordance with 10 CFR 76.68 (a). Part 76.68 (a) allows, in part, the Corporation to make changes to the plant, as described in the Safety Analysis Report, without prior Commission approval, if the changes do not constitute an unreviewed safety question. Part 76.4 defines an unreviewed safety question, in part, as a change for which ,

the probability of occurrences or the consequences of an accident or malfunction of l equipment important to safety previously evaluated in the safety analysis report may be increased. The plant staff's failure to fully evaluate the impact of the as-found condition, increased Building C-315 accumulator capacities, for all Safety Analysis Report evaluated accidents and the Plant Operations Review Committee's approval of the Safety Analysis Report change and continued operations, for an as-found condition that increased the consequences of the  % Analysis Report evaluated accidents, without prior Commission appre i Apparent Violation (eel 70-700i/98006-02).

c. Conclusions The inspectors determined that a safety evaluation, performed following the plant staff's identification of an as-found condition associated with the Building C-315 liquid uranium hexafluoride accumulators, was nonrigorous. As a result, a potential unreviewed safety question was not identified and plant operations were conducted for approximately 8 months in a manner that was not consistent with the accident analysis limitations specified in the Safety Analysis Report.

E1.3 Liauid Uranium Hexafluoride Handlina Cranes

a. Inspection Scope (8810.0_)

The inspectors reviewed an operability ' sation assour.ed with the cranes used to move cylinders containing liquid uranium hexafluoride.

b. Observations and Findinas On March 27, the plant staff filed an ATR to document concerns with the current operability of the cranes used to move cylinders containing liquid uranium hexafluoride.

The ATR writeup stated that the TSR-referenced crane rail stops were relied upon as design features for safety; however, the rail stops' performance requirements and operability status had not been defined. The ATR author noted that an LTO was currently in effect to ensure immediate safety; however, the acceptability of using an LTO as a substitute for a TSR-mandated control had not been addressed.

On April 1, engineering staff completed an operability evaluation (OE) of the issues raised in the ATR. The inspectors reviewed the OE and concluded that the document was non-rigorous and did not address the ATR issues. Specifically, the OE did not provide detailed objective evidence to support the operability determination and did not respond to an ATR question regarding the acceptability of using an LTO as a compensatory measure for degraded or inoperable TSR-related equipment. In addition, the inspectors determined the OE arguments were internally inconsistent and in some cases were inconsistent with other regulatory requirements. For example, the OE used parts of several different codes and standards to support the operability assessment without consideration of the entire code or standard. In addition, the reference code or standard, to which the cranes were operated and maintained, was not defined. The OE also documented that the crane rails stops were not utilized for safety in direct conflict with the 13

I

. i l

statements and information included in the TSRs and the Safety Analysis Report.

Instead, the OE arguments relied upon operator actions to fulfill the TSRs and Safety Analysis Report specified safety function.

Late in the inspection period, the inspectors discussed the OE with operations and engineering management. The inspectors were informed that a reasonable basis for continued operability of the cranes existed based upon recent engineering review of the rails stops. In addition, the incident-specific safety implications of the issues were decreased by operation management's continued use of the LTO which precluded crane operations in the immediate vicinity of the rail stops. Engineering management also stated their plans to initiate further efforts to document objective evidence of the crane rail stops' performancs capability versus applicable codes and standards. The additional engineering work was expected to be completed by the end of April,1998. The inspectors will track completion of the engineering efforts as an Inspection Follow-up Item (IFl 70-7001/98006-03).

The inspectors noted that the issue of which codes and standards the certificatee followed to ensure continued operability of the cranes and other safety-related equipment was previously raised during pre-certification activities and as a part of a Notice of Enforcement Discretion issued in February 1997. In addition, a Compliance Plan Item was developed to ensuie the issue was resolved. However, the information provided as a result of the Compliance Plan Item was not sufficient to address the current concern.

The certificatee's efforts, in response to the Compliance Plan item, were currently being reviewed by the NRC (see Section E8.1).

c. Conclusions The inspectors determined that an operability evaluation, developed in response to questions raised regarding the performance capabilities of rail stops for cranes used to handle cylinders containing liquid uranium hexafluoride, was nonrigorous and inconsistently applied applicable codes and standards. The inspectors will track the completion of additional engineering efforts being performed to document the rail stops' i performance capabilities versus the applicable performance standards. l E1.4 Safety Analysis Report Uparade Process

a. Inspection Scope (88100)

The inspectors reviewed the plant staff's dispositioning of issues developed as a part the of the Safety Analysis Report Upgrade process.

b. Observations and Findinas The inspectors reviewed the plant staff' dispositioning of issues associated with the Building C-360 autoclaves, the Building C-310 and C-315 withdrawal pumps, the Building C-333A and C-337A autoclave containment valves, and the Building C-310 and C-315 withdrawal accumulators. Each of the issues was either developed as a result of the Safety Analysis Report Upgrade process or was handled as a part of the Upgrade process after being identified by the plant staff. The inspectors focused the review on engineering evaluations developed for each of the issues and the corrective or compensatory measures taken to permit continued operations. The inspectors' review of the Building C-310 and C-315 accumulators is included in Section E1.2.

14

r l

l l

l

! Buildina C-360 Autoclaves i

The inspectors reviewed Engineering Evaluation EV-C-813-98-021, Revision 0, dated February 4,1998, related to the Building C-360 autoclave containment controllogic. The evaluation results indicated that the as-found system design could create a potential for new system failures not previously documented or assessed in the current Safety Analysis Report. Specifically, the evaluation results indicated that the control logic included a keyed reset switch that could, if incorrectly operated, allow an unmitigated release from the autoclaves following an accident. The evaluation also documented new failure modes, created as a result of non-proceduralized routine operationc using the keyed reset switch, that would render other safety systems inoperable without alarms or other warnings to the operators. The evaluation included a recommendation that the system logic should be revised to remove the new failure modes.

l During review of the issue, the inspectors determined that the finding had been previously documented in a problem report. On the problem report form, the PSS documented a need to revise the procedures associated with the safety systems affected by the keyed reset switch prior to returning the autoclaves to service. The inspectors reviewed the

, closed problem report and determined that the PSS's comments were not acted upon j and that the autoclaves were returned to service without changes being made to the affected procedures.

l The inspectors discussed the findings developed as a results of reviews of the engineering evaluation and the previous problem report with plant management. During the discussions, the inspectors questioned whether presence of the keyed reset switch in the safety-related circuits represented an unreviewed safety question, in that, a new and l

different failure mechanism was identified for the involved safety systems. In addition, the inspectors noted that the lack of formal procedures for operation of the keyed reset switch may further increase the potential for incorrect alignment of the safety system actuation circuits. Based upon an independent re-evaluation of the issue, operations management chose to shut down the Building C-360 autoclaves and to revise the operations procedures associated with the affected safety systems. In a problem report filed to document the issue, the inspectors noted that the PSS placed a hold on the affected operating procedures to ensure that the facility was not restarted without resolution of the involved issues. The inspectors concluded that the PSS's handling of this second problem report related to the keyed reset switch provided more positive controls to ensure PSS-required actions were completed prior to returning the autoclaves l

to service.

l As of the end of the inspection period, the plant staff were reviewing the initial hanalog of the issue to determine: 1)if a safety evaluation of the as-found condition was required; 2)if the as-found condition was dispositioned in accordance with the Compliance Plan, and; 3)if the as-found condition constituted an unreviewed safety question.

Buildina C-310 and 315 Withdrawal Pumps The inspectors reviewed Engineering Evaluation EV-C-812-98-017, Revision 0, dated February 23,1998, related to the product and tails withdrawal pump high discharge pressure safety systems. The engineering evaluation was performed in order to assess the system's design and operation versus the Safety Analysis Report-specified requirements. Results of the engineering evaluation were communicated to the NRC in a letter dated March 9,1998.

15 l

1 f

i l

l The inspectors noted the engineering evaluation did not assess the adequacy of current l operations and did not add significantly to the information available prior to the evaluation.

i In addition, the inspectors concluded a nuclear safety impact assessment of the system design, included as a part of the engineering evaluation, did not include sufficient information to support the conclusions reached relative to Building C-310 and did not consider all the Technical Safety Requirement Modes during development of the conclusions for Building C-315. Specifically, the Building C-310 evaluation did not consider the impact of only a partialloss of plant air systems and the Building C-315 l evaluation did not consider that constant manning of the control room was not required.

l The inspectors discussed the engineering evaluation with operations and engineering management. The inspectors questioned the ability of the current systems to perform the expected safety functions and whether compensatory measures were appropriate pending resolution of severalissues, including the planned system modifications. The inspectors also questioned whether the as-found condition should have been evaluated to determine if an unreviewed safety question existed. Operations and engineering management indicated a belief that an adequate assurance of operability existed; however, further assessment of the impact of support system failures associated with the safety system was planned, in addition, engineering management was reviewing the need for a specific evaluation of the as-found condition and the acceptability of continued l operations with and without compensatory measures. Engineering management alst.,

indicated that a generic unreviewed safety question determination was performed for issues identified as a part of the Safety Analysis Report Upgrade process.

4 As of the end of the inspection period, the inspectors had not completed a review of the l system design and operation information to assess the full impact of support system failures. Engineering management also had not completed their review of the need for a

issue-specific unreviewed safety question evaluation.

Buildina C-333A and C-337A Autoclave Containment Valves  ;

l During a followup inspection of findings developed by the NRC at the Portsmouth Gaseous Diffusion Plant, the inspectors identified that certain containment isolation  ;

valves, associated with the feed autoclaves, had an air assist provided to improve the i valve closing times. Each autoclave had four valves that relied on the plant air system, a nonsafety-related system, to provide an air assist to improve the closing times. The four valves were located on three separate autoclave penetrations, with two of the four valves located on the condensate drain line. The condensate drain line was open to the atmosphere during normal operations; therefore, timely isolation of the line following an accident appeared dependent upon a nonsafety-related system.

The inspectors reviewed the TSRs and the Safety Analysis Report and determined that the TSRs required the autoclave containment valves to close within 10 seconds in order to support continued operabilitij and to limit accident consequences to within values documented in the Safety Analysis Report. The inspectors also noted that the Safety Analysis Report information indicated that the failure of the plant air system would not cause any safety concerns.

i The inspectors discussed the findings with operations and engineering management.

{ During the discussions, engineering management confirmed the inspectors' findings and indicated that a previous valve test, conducted without the air assist, documented that the valve closing time increased from 10 to approximately 45 seconds. The inspectors were also informed that the Safety Analysis Upgrade process had identified this issue as a 16 i

l

i l

potential concern; however, no actions had been taken to resolve the issue. Instead, the l Corporation proposed to the NRC, in a letter that transmitted Upgrade process results, to J perform an engineering evaluation of the situation by October 31,1998. Necessary corrective measures would be identified and a schedule for implementation would be proposed following completion of the engineering evaluation.

Based upon the information provided, the inspectors questioned: 1) whether the feed autoclaves were operable; 2) whether reliance on the plant air system for the operability of safety-related systems was acceptable, and; 3) whether the as-found condition should have been evaluated to determine if an unreviewed safety question existed. As of the end of the inspection period, operations management indicated their belief that a reasonable expectation of operability existed; however, engineering management was )

assessing the findings to determine if the current accident analysis relied upon nonsafety-related systems to ensure operability and if the current situation should be evaluated to i

determine if an unreviewed safety question existed.

Summary The inspectors determined that several as-found conditions, identified as a part of the Safety Analysis Report Upgrade process, could impact current operations. However, the j inspectors were unable to determine if the as-found conditions had been evaluated I against the current Safety Analysis Report. As of the end of the inspection period, the plant staff were evaluating each of the as-found conditions, in addition to the other Safety Analysis Report Upgrade process findings, to determine if continued operations were consistent with the current Safety Analysis Report. The inspectors will track completion of these evaluations as an Unresolved item (URI 70-7001/98006-04).

c. Conclusions The inspectors identified several as-found conditions associated with the Safety Analysis .

Report Upgrade process appeared to conflict with the current Safety Analysis Report.

Actions by the plant staff to assess the acceptability of continued operations with the as-found conditions will be tracked as an Unresolved item. .

1 l

l E8 Miscellaneous Enaineerina Issues E8.1 (Open) URI 70-7001/97007-08: identification of codes and standards used for operation and modification of the Paducah Gaseous Diffusion Plant. During the inspection period, l

engineering management indicated that actions taken to identify the codes and standards that should be applicable to the gaseous diffusion plants would be completed during April 1998. Engineering management also planned to identify differences between the l identified codes and standards and actual plant practices by the end of August 1998.

During discussions with engineering and plant management, the inspectors noted that the resolution of several recent operability and engineering issues was complicated by an l

apparent incomplete definition or understanding of the applicable codes and standards.

An example of such a situation is documented in Section E13.

l l The inspectors will review the listing of codes and standards that should be applied to the plant following development. The Unresolved item will remain open pending the plant staff's completion of the two outstanding action items and the inspectors' review of the action item products.

l 17

E8.2 (Closed) URI 70-7001/97011-08: modification of the criticality accident alarm system operating temperature limits. Three issues were identified as a part of the Unresolved i Item: 1) adequacy of the modification testing methods; 2) appropriateness of the critical parameters evaluated for the modification, and; 3) appropriateness of making changes to operating parameters without performing safety evaluations required for plant design changes.

l. Following identification of the Unresolved item and prior to implementation of the modified l operating temperature limits, the plant staff performed a setpoint calculation assessment .

l for criticality accident alarm system. Results of the setpoint calculation assessment i l indicated that additional uncertainty would be created in the setpoints as a byproduct of )

l the expanded operating temperature limits. Because the increased uncertainty could l l result in an increased probability of false actuations, the plant staff chose not to j l implement the modification to the operating temperature limits. As a consequence, the inspectors had no further basis for concerns and the Unresolved item is considered closed, l

IV. Plant Support '

i S1 Conduct of Security S1.1 Update on Corrective Actions for Classified Matter Escalated Enforcement Action 97-431

a. Inspection Scope (88100) j The inspectors reviewed the corrective actions taken to date by the plant staff in response to the escalated enforcement action for a significant failure to control classified matter onsite (VIO 70-7001/97007-09).

b. Observations and Findinas in August 1997, the plant staff began a site-wide campaign to purge any materials  !

containing classified information (properly or improperly marked) from areas of the plant which were not designated for the storage of such information. The campaign included a walkdown of all the buildings and trailers in the leased areas of the plant both inside and i outside of the Controlled Access Area fence. After a walkdown of each building was i complete, plant security staff were conducting verification sweeps as an independent means to ensure no classified information was left uncontrolled in the building. The walkdowns and security verifications were being performed in accordance with a detailed schedule and were due to be completed by June 30,1998.

As of the end of the inspection period, plant staff had completed walkdowns for about 75% of the buildings onsite. Over 80,000 documents and drawings had been reviewed to determine whether or not the documents were properly classified. Numerous other documents were brought into a classified storage vault to await review. The inspectors concluded that the classified matter purge campaign was on schedule for meeting the 3 June 30,1998, commitment date in the response letter dated January 7,1998.

I

c. Conclusions The inspectors determined that the classified matter purge campaign, undertaken in  !

response to Escalated Enforcement Action 97-431, appeared to be on schedule to meet the June 1998 commitment date.

18

S8 Miscellaneous Security issues S8.1 Certificatee Security Reports (90712)

The certificatee made the following security-related one-hour reports pursuant to 10 CFR 95 during the inspection period. The inspectors reviewed any immediate security concerns associated with the report at the time of the initial verbal notification.

Date Title 1/24/98 Pedestrian Gate 27A Discovered Unsecured S8.2 (Closed) VIO 70-7001/97014-13: failure to develop and implement administrative procedures to limit the hours of work for plant security guards in accordance with TSR 3.2.2.b. The plant security staff had not implemented the site procedure for limiting overtime for security officers performing safety and safeguards-related activities. After identification by the NRC, rnanagement directed the security staff to implement the requirements of the site procedure and to utilize the Overtime Canvassing System to ensure compliance with the hours of work requirements. In addition, the security management reduced the number of officers required for patrols during criticality accident alarm outages and supplemented the secunty staff in order to decrease the need for large amounts of overtime by the guards. The inspectors conducted a review of security officers' hours for the month of March 1998 and did not identify any violations of the TSR.

The inspectors concluded that the corrective actions for the violation had been appropriate.

T8 Miscsilaneous Transportation Issues T8.1 (Closed) VIO 70-7001/97002-32: failure to tin cylinder valves and plugs with the proper solder and to mark the correct tare weight on cylinders offered for shipment. The certificatee requested and received an arrandment to the NRC Certificate of Compliance (CoC) for use of the solder generated onsite. In addition, an exemption from Department of Transportation requirements was obtained. Plant maintenance procedures were l revised to test the solder mixture for compliance with the limits in the CoC. The plant staff also began welding supplemental nameplates onto cylinders during the five-year  ;

recertification process and stamping the re-established tare weight on the nameplate'. l The inspectors observed six cylinders which had recently been washed and recertified, and noted that the supplemental nameplates were attached. The certificatee also revised the governing procedure to include a note that only the official tare weight in the material control and accounting records was to be used in establishing the actual amount of UFe in a cylinder. The information included in the accounting records was considered the most reliable and accurate number pending the addition of supplemental plates to all cylinders. {

The inspectors concluded that the corrective actions for the violation appeared l appropriate.

V. Manaaement Meetinos X1 Exit Meeting Summary l

The inspectors presented the inspection results to members of the plant staff and management l at the conclusion of the inspection on April 20. The plant staff acknowledged the findings l i

presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

l 19 I l

PARTIAL LIST OF PERSONS CONTACTED t Licensee j

• J. A. Labarraque, Safety, Safeguards and Quality Manager J. H. Miller, Vice President - Production Lockheed Martin Utility Services (LMUS)

• L. L. Jackson, Nuclear Regulatory Affairs Manager S. R. Penrod, Operations Manager

• S. A. Polston, General Manager H. Pulley, Enrichment Plant Manager United States Department of Enerav (DOE) l l

G. A. Bazzell, Site Safety Representative NRC ,

i

• J. M. Jacobson, Resident inspector ,

• K. G. O'Brien, Senior Resident inspector

• Denotes those present at the April 20,1998, exit meeting.

Other members of the plant staff were also contacted during the inspection period.

I INSPECTION PROCEDURES USED l

1 IP 88100: Plant Operations j l

IP 88102: Surveillance Observations l IP 90712:. In-office Review of Events IP 92702: Follow-up of Events 20 4

J

I

. 1 ITEMS OPENED, CLOSED, AND DISCUSSED j l

Opened >

70-7001/98006-01 VIO Inadequate Verification of Building C-720 Criticality Accident Alarm System Design Modification  !

33929 CER Steam Blowdown Testing Creates inaudible Condition for Building C-400 and C-409 Criticality Accident Alarm System 34034 CER Building C-720 Criticality Accident Alarm System Not Able to Provide Required Alarms in Building C-300 Central Control Facility 70-7001/98006-02 eel As-Found Condition, Safety Evaluation, and Safety Analysis Report Change That Appeared to involve an Unreviewed Safety Question 70-7001/98006-03 IFl Adequacy of Rail Stops on Crane Authorized to Handle Cylinders Containing Liquid Uranium Hexafluoride 70-7001/98006-04 URI Evaluation of As-Found Conditions identified as a Part of the i Safety Analysis Report Upgrade Process -  !

Closed  ;

70-7001/97002-03 VIO Failure to Determine and Correct the Cause of an Autoclave High Drain Alarm 33892 CER Loss of Power to Building C-360 Criticality Accident Alarm Systems and Process Gas Leak Detection Systems 33957 CER Process Gas Leak Detector Alarmed in Building C-337 Unit 3 Cell Bypass Duct 70-7001/97014-13 VIO Failure to Develop and Implement Administrative Procedures to Limit the Hours of Work for Plant Security Guards 70-7001/97002-32 VIO Failure to Tin Cylinder Valves and Plugs e the Proper Solder and to Mark the Correct Tare Weight on Cylinders 70-7001/97011-08 URI Modification of the Criticality Accident Alarm System Operating Temperature Limits i i

Discussed 70-7001/97007-08 URI Identification of Codes and Standards Used for Operation and ,

Modification of the Paducah Gaseous Diffusion Plant l 70-7001/97007-09 VIO Failure to Propeily Mark and Control Classified Matter at Paducah l Gaseous Diffusion Plant 70-7001/97002-15 IFl Confirmatory Action Letter Rill-97-003 for Inadequate 1 Implementation of Nuclear Criticality Safety Requirements I

21 I

LIST OF ACRONYMS USED APSS- Assistant Plant Shift Superintendent ATR Assessment and Tracking Reports CofC Certificate of Compliance CAAS Criticality Accident Alarm System CAL Confirmatory Action Letter CER Certificatee Event Report CFR Code of Federal Regulations eel Escalated Enforcement item LTO Long-Term Order MC&A Material Control and Accounting NCSA Nuclear Criticality Safety Approval NCSE Nuclear Criticality Safety Evaluation NRC Nuclear Regulatory Commission OE Operability Evaluation PSS Plant Shift Supervisor QAP Quality Assurance Program TSR Technical Safety Requirement UF6 Uraniutn Hexafluoride USEC United States Enrichment Corporation VIO Violation 4

1 22

.