ML20216G932

Insp Rept 70-7002/97-07 on 970729-0801.No Violations Noted. Major Areas Inspected:Review of Loss of Steam Supply That Occurred on 970725

ML20216G932
Person / Time
Site:	Portsmouth Gaseous Diffusion Plant
Issue date:	09/09/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20216G896	List: ML20216G890 ML20216G932
References
70-7002-97-07, 70-7002-97-7, NUDOCS 9709160093
Download: ML20216G932 (22)

Text

. . . - _ - . _ . . . . .- ~ . . - .-. - . . -

.. , 4 i i

-j U.S. NUCLEAR REGULATORY COMMISSION '  ;

REGION lli ,

I Docket No: 70 7002 Certificate No: GDP-2 ,

inspection Report No:  ;

'/0 7002/97007(DNMS) -

Fa'cility Operator: - United States Enrichment Corporation  :

Facility Name: Portsmouth Gaseous Diff'Jsion Plant i

ccation: 3930 V 6. Route 23 South P.O. Box 628 Piketon,OH 45661 Dates: . July 29 through August 1,1997 Inspectors: C R. Cox, Senior Resident inspector (Team Leader)

C A, Blanchard, Fuel Cycle inspector D S. Butler, Senior Electrical Engineer J. G Guzman, Senior Mechanical Engineer P. M. Lewis, Engineering Psychologist --

A. Persinko, Mechanical Specialist T. D. Reidinger, Senior Fuel Cycle Inspector Approved By: P L. Hiland, Chief, Fuel Cycle Branch Division of Nuclear Materials Safety 9709160093 97090?

PDR -ADOCK' 07007002 C-. PDR a

l EXECUTIVE

SUMMARY

Portsmouth Gaseous Diffusion Plant inspection Report 70 7002/97007(DNMS)

This inspection involved a review of the loss of steam supply that occurred on July 25,1997.

The followhy findings were identified:

• The event started when the operating deaerator (DA) motor driven pump tripped and then was complicated by the pump's check valve failure to close. The tripped DA motor driven pump was not identified for approximately five hours. The event ended with operating boilers (No. 2 and No. 3) being shut down and damaged from lack of water.

• The event resulted in no radiological or chemical safety concems or reduction in the margin of criticality safety. Cascade operators took appropriate action to ensure solid uranium hexafluoride (UF ) did not form in critical production equipment or piping.

• Significant overheating damage occurred to the No. 3 boiler as a result of the off normal condition experienced durir.g the moming of July 25,1997. Damage to the No. 2 boiler was limited, and ' hat boiler was repaired and placed in service by the end of the inspection.

• Outside of " normal' steam valve Maks, no other damage was noted on other steam plant components, on other utility systems, or on cascade equipment as a result of the loss of steam supply.

• Numerous equipmert failures in the cteam plant were identified during the inspection, e Stoam ple 'l operators failed to diagnose plant conditions resulting in a loss of boiler water level.

• The two root causes tht.t were identified involved the lack of a preventive maintenance program for steam plant equipment and deficiency in operator knowledge of integrated plant operations due to training and procedure weaknesses.

o One inspection follow up item was identified to determine if the training requirements for steam plant operators had been defined and met.

• One inspection follow up item was identified to determine how controlled procedures were issued for use before the effective date.

• Contributing factors that led to the loss of steam supply were the meterial condition of the steam systems (exhibited in the number of steam system leaks), the itek of clear operational guidance for monitoring the water level of operating boilent the increased steam demand site-wide which has required operation near the system design capabilities, the crew's reluctance to call for help, and lack of clear guidance for when to shut down the steam plant 2

1 I

o One generic implication of the event is that poor maintenance practices on nonsafety .

related equipment continues to cl%w plant operations. From the narrow focus of  ;

corrective actions in the past and this event, plant management has accepted the  ;

operational transients caused by inadequate maintenance support of nonsafety related  ;

• equipment.

a i

l

+

7 I 5

r 4  ;

i i-

-3 m- -- yei.wg,. = - >er +M y yygiyy v'e*s-?- -m mtmWp my *+ +"M-m---ww y me q +gv7-. #,wggy---,-ee4.mve--.--g m- g-em--- 9 a 9 ey- er 9gy 2 y- y eiMyg. 9g.,.Wiyq 5 ep sew. g sg s ger m gy--3 ray-spW^sbT***'?-1

REPORT DETAILS

1. Purpose of the Speciallnspection Tea.rti The NRC has established a policy to provide for the timoly, thorough, and systemat!:

Inspection of significant operational events at fuel cycle facilities. This includes the use of a special inspection team (SIT) to determine the cause, conditions, and circumstances about an event, and to communicate the team's findings, safety concerns, and recommendations to NRC management.

Following initial notification and review of the July 25 event resulting with a complete loss of steam supply to the plant, the NRC formed a SIT to examine the ekcumstances surrounding the event. The SIT Charter (Enclosure 2) directed the ovaluation of; (1) the certificate holder's response to the event; (2) effects of any radiolog! cal and chemical consequences; (3) effects that damaged equipment will have on the a bility of the certificate holder to safely operate the steam plant; (4) tool causes or contributors that led to the steam plant boiler damage;(5) the root cause analysis and proposed correction action; and (0) the generic implications of the event for other plant equipment and systems.

2. RyugsLQtEqfjpil20 The Portsmouth Gaseous Diffusion Plant's steam plant (X 600) produr.es 125 gage pressure (psig) saturated steam used to heat buildings, vaporize uranium hexafluoride (UF.), obtain UF, samples, maintain process temperatures, clean equipment, and provide heat for other miscellaneous process operations. Three bent tube coal fired boilers are used with necessary, auxiliary equipment to achieve the desired quantity of steam. Tho Ohio Department of Industrial Compliance, Division of Boller inspection, certified each bent tube coal fired boiler for continuous operation at 125,000 lbs/hr at a saturation steam temperature of 353*F.

The boilers are supplied with feed water by avo sources, (1) make up water (approximately 65%) and (2) condensate retum (approximately 35%). Make-up water is normally treated using a soft water system (hydrogen, sodium zeolite, and degasifier tanks) before being pumped to a deaerator (DA) tank. A control valve regulates the required amount of make-up water. This control valve automatically adjusts the water flow rate to maintain the correct water %velin the DA tank. Gravity supplier water to four boiler feed (DF) pumps from the DA tank. The BF pumps pump water through economizers (located in the rear of each boller) to the boiler drums. The boilers supply steam around the site using east and west steam header piping loops,

3. Event Summary and Seguance of Events A detailed chronology of the events before, during, and after is presented in Enclosure 3.

The X-000 steam plant was operating normally with No. 2 and No. 3 boilers in service (No.1 boiler was not in service) on July 25, until approximately 1:30 a.m. when the No.1 DA pump tripped. With the No.1 DA pump off, the DA tank water level dropped very rapidly until the DA tank was almost empty. This caused No. 3 BF pump, which takes i

4 L -

9 suction from the DA tank, dischargs pressure to Ductuate resulting in low water level condition in the operating boilers. 'T he steam plant operators (SPO) responded to low level boiler water alarms and the low water level in the DA tank by placing No.1 and No. 2 BF pumps on line and opening water softener by pass valve No. 413. Opening water softener by pass valve No. 413 restored the water supply to DF pumps by allowing sanisry water to by pass the DA pumps and supply water directly to the DA tank make-up water control valve. With ample water pressure to the BF pumps restored, flow to the boilers was reestablished at 2:10 a.m. However, the large quantity of cold water addition to the boilers caused steam production to decrease. The SPOs responded to the decrease production of steam by placing the boiler combustion controls in manual and then increasing the fuel source.

Water levels in the boilers fluctuated between off scale high and off scale low from 2:20 a.m. to about 4:05 a.m. The water levels in the boilers stabilized at approximately 4:05 a.m. The water levelin the DA fluctuated between off scale high and off scale low from 2:27 a.m. to 3:20 a.m. before stabilizing at 3:21 a.m. The water levelin the DA tank remained within normal range until 4:35 a.m.

The SPOs, still unaware that DA pump No.1 had tripped, placed No. 2 DA pump on line at 4:32 r..m. trying to supply more water to the DA tank. The SPOs had observed that the No.1 DA pump shaft was rotating but were unaware that the shaft was rotating in the opposite direction and did not observe the control room computer screen pump mimic display, motor control center operating light, or local control center operating light that indicated that the No.1 DA pump was off, in addition, the SPOs did not know that the No.1 DA pump discharge check valve had stuck open allowing most of the No. 2 DA pump discharge water to recirculate back through the No.1 DA pump. Since some water flow from No. 2 DA pump was still going to the DA tank, the DA tank water level increased leading the SPOs to believe that they had adequate make up water flow to the DA tank At 4:35 a.m., the SPOs closed the water softener by pass valve No. 413 to restore normal make up water supply valve alignment. Once water softener by-pass valve No. 413 was closed, the SPOs observed a loss of make up water to the DA tank water.

The water in the DA tank decreased to an off scale low level. Steam plant operators then re opened water softener by pass valve No. 413 to restore water to the DA tank.

The DA tank water level, from 4:40 to 5:25 a.m., fluctuated between off scale high and low. The SPOs responded differently during the sc ;ond DA tank low water level event.

The SPOs manually switched to the old DA tank water level control system (Fisher system). -The SPOs believed that the new Bailey controller system had malfunctioned which caused the fluctuating water levelin the DA tank. The old control system was unabic to control the DA tank water level. The water levels in both operating boilers remained within normal operating range during this fluctuating DA tank watei level transient. However, the influx of cold water into the DA tank apparently caused a water hammer effect that resulted in a blown inlet gasket on No.1 BF pump at 4:40 a.m.

At approximately 5:26 a.m. the DA tank went empty and the BF pumps became steam bound and started cavitating. The DA tank and the degasifier tank (part of the make up water soft water system) then began to overflow. The SPOs valved off the sodium water 5

softeners to stop water flow to the degasifier tank. The boiler water level sensors went >

off scale low and the boiler low water level alarms sounded.

The boilers remained in a low water condition from approximately 5:37 to 6:34 a.m.

Dunng this time the SPOs focused on maintaining steam pressure and flow while attempting to restore water flow to the boilers. The SPos attempted to vent the BF pumps to reestablish water flow to the boilers. The SPos contacted the night shift front line manager (FLM) at 5:45 a.m. to request additional help. ,

The day shift FLM arrived at the steam plant at 6:15 a.m. and found that low water level boiler alarms were sounding. In addition, the day shift FLM noted that control room boiler water level electronic indicators were off scale low. The SPos told the day shift FLM that boilers had not been shut down because water remained in all boiler sight glasses.

The FLM saw that the motor control center power supply light indicated that the No.1 DA pump's power was off. The FLM restarted the No.1 DA pump. The FLM instructed the SPOs to open condensate by pass valve No. 808 (this action routed condensate water -

directly to the BF pump suction), and place the feed water regulators to manual. The SPOs reestablished water flow to the boilers at 6:30 a.m.

The day shift FLM heard a loud noise from the No. 3 boiler at 6:35 a.m. and directed that both boilers be immediately shutdown.

i At 6:12 p.m. the No.1 boiler was placed in service and provided sufficient steam for operation of the cascade. The No.1 boiler capacity required that steam conservation measures be initiated for potable water heating for personnel showers and the cafeteria

' steam was secured. The certificate holder's immediate recovery plan included the installation of an oil fired portable package boiler capable of providing 65,000 lbs/hr of steam at 125 psig. This oil fired portable package boiler was delivered the evening of the event and was scheduled to be in service by September 1,1997. In addition, No. 2 boiler was repaired and placed in service on August 1, at 4:12 a.m.

4. Safety Consecuenets

a. lDIPElign1ggpe (IP 881QQ)

The inspectors evaluated the extent of the radiological (criticality safety) and i chemical consequences of tne event by discussions with plant personnel, review of logs, and review of safety analyses,

b. Observations and Findinas The loss of steam supply caused the cascade operators to start steam conservation measures. The first problem appeared at the low assay withdrawal station where the withdrawal manifold started to experience a line blockage due to

freeze out * (solidification or freezing point) of liquid UF,. Freeze out occurred approximately three 1.ours after the steam loss. The cascade operators secured withdrawal at the station and vented the accumulator and withdrawal piping to the evacuation header according to procedures. The cascade operator valved the r

talls station off approximately five hours after the steam loss and the station was properly vented to the evacuation header. The cascade operators returned the 6

.. - - - - _ ~ - _ - . . _ _

tails station to service about twelve hours after the steam loss and the low assay withdrawal station was back in service eighteen hours after the loss.

The loss of steam to the cascade feed and fluorine generation facilities resulted in a shutdown of these areas. Activities affected by the steam loss in cascade and fluorine generation facilities include the heating of both feed and transfer of UF, cylinders. The inspectors did not identify any criticality or chemical safety issues caused by the loss of steam to these facilities.

Steam loss to the rest of the process buildings led to the withdrawal stations freezing out and being removed from service. Long term loss of steam, several days, would have caused more complications for the cascade operators ultimately resulting in individual cells being placed on recirculation and eventual degradation of the barrier tubes. Contingency plans using portable package boilers would have steam available within several days precluding long-term steam loss.

The primary chemical safety concem for a loss of steam would be the freeze out of UF,in process piping and the potential for a hydraulic rupture of the piping when reheated by steam. Such an event occurred at Paducah in 1994 when a cascade operator reheated a section of piping filled with solid UF.. A release of 10 pounds of UF. resulted. The relative large diameter of cascade piping makes such a solid plug forming unlikely. However, withdrawal station piping has had freeze outs resulting in solid plugged pipes. Review of the cascade logs and interviews with cascade personnel indicated that the cascade operator evacuated the pipes arid removed the p ugs by sublimation. The cascade operators stated that piping ' clarity" was checked by bleeding nitrogen through the pipe and noting the appropriate pressure increase at the end of the piping indicating the nitrogen had flowed through the previously plugged pipe. The inspectors determined that the process used to take the withdrawal stations off line was routine.

Criticality safety concems were raised when solid UF. deposits began forming. In general, criticality is a safety concern if the size and geometry of UF, deposits make nuclear criticality likely. The withdrawal piping that had a freeze out was 3 inches in diameter but was evaluated as geometrically safe. The cascade operators vented and emptied unsafe geometry accumulators and condensers in the withdrawal stations according to procedures. The cascade operators monitored the pressures and temperatures of intermediate and bottom surge drums to determine if UF. freeze out conditions existed. During the loss of steam supply, the temperatures in the UF, surge drums were never low enough to cause a concern. Long term steam loss could cause UF freeze out in the unsafe geometry drums. Therefore, procedures required temperature and pressure monitoring of drums during cold ambient weather conditions. Criticality is always a concern for any assay above 1 percent. Process piping inside the cascade did not have any freeze out during the event. However, long term steam loss would result in deposits in piping routing UF, between cells and buildings.

A nuclear criticality safety (NCS) calculation (NCS CAL 96 010) dated October 16, 1996, indicated that at a 10 per cent assay a deposit over twenty tons would be required to raise K, above .95 (a technical safety requirement (TSR) safety limit).

7

< - y - , , __ - --, -_ ,, -

_ . - = - . .. -- _ __ - .

4 That calculation assumed spherical geometry and wet air in leakage. Such conditions would be very unlikely as a result of this event.

c. Conclusion The short term steam loss did not result in any chemical safety concerns or reduce the margins on criticality safety However, the event unnecessarily challenged the cascade operators such that chemical and criticality safety was maintained due to cascade operators' actions in venting the withdrawal stations and verifying piping clarity before reheating.

5. Extent of Dampae

a. Insoection Segp_tt To determine the extent of damage resulting from the loss of steam supply, the inspectors walked down the steam plant systems and visually inspected cornponents and interviewed staff from engineering, operations, maintenance and site boiler inspectors as well as the site event investigation staff,

b. Qbigfyations and Findinal Damage to the plant, a red W oli hss of steam supply event, was limited to the No. 2 and No. 3 boilers. h q@ ment failures such as the No.1 DA pump discharge check valve and a bicwn gasket on the No. 2 BF pump were contributors to the event, no damage was noted on other steam plant equipment as a result of the event. A review of other plant utility systems did not identify damage. Review of the cascade equipment and interviews with cascade operations staff revealed that, outside of additional steam leaks noted in isolation valves and other piping components, no damage was noted on the cascade. The major impact was on plant productivity resulting from emergency steam curtailment due to the loss of steam supply.

An oil-fired portable package boiler was delivered to the site on the evening of the loss of steam supply and was scheduled to be in service on September 1,1997.

During tne day of the event, the No.1 boiler was brought back on line (at reduced capacity due to precipitator problems) and was able to provide sufficient steam for cascade operation with steam conservation to non essential services.

Damage to the No. 2 boiler was confined to minor tube-to-drum leaks in both the upper steam drum and in the lower mud drum. Based on the information available during the week of the inspection, the inspectors concluded that the damage to the No. 2 and No. 3 boilers was likely due to overheating of the tubes caused by the fluctuating feed water level when the boiler tubes were intermittently empty as well as from thermal stresses induced with the reintroduction of large quantities of feed water with the opening of the condensate by-pass valve (No. 808) to route condensate pump discharge directly into the BF pump. The certificate holder completed the required repairs by re rolling and/or seal welding the affected tubes, approximately 20 in the upper drum and 100 in the lower drum. The work required to get the No. 2 boiler on line was completed 8

while the SlT was onsite and the boiler was producing steam by Thursday July 31, 1997.

The No. 3 boiler had more extensive overheating and thermal stress damage that '

would require extensive repairs. As of the date of the inspection exit, the repair plan was still under assessment. Based on initial visualinspections by the site '

code insp 9ctor, which only covered a small area of the No. 3 boiler, the following conditions were noted:

e A generating tube had burst in the middle of the tube run. The burst tube had upward movement and hit the soot blower below the water circulating tubes. The soot blower pipe was bent due to the force.

e Several tubes in the immediate area showed signs of severe distortion and overheating, e Numerous tube to-drum leaks wors identified.

• Water circulating tubes were sagging.

Proceduralized actions taken by the certificate holder such as prioritization of available steam appeared appropriate and minimized NCS concems. After the event, the certificate holder initiated compensatory actions to preclude further problems with the only operating boiler (No.1 boiler) to protect the remaining steam generation capability. These included generation of orders to maintain two DA pumps in operation at all times, replacement of the check valve that failed open, troubleshooting to determine the cause of the initial DA pump trip, and generation of orders to shut off the fuel and forced draft fan on an operating boiler if the water levelin that boiler drops below the sight glass.

c. QgaglgJons i Significant overheating damage occurred to the No. 3 boiler; damage to the No. 2 boiler was limited to tube to drum leaks in the upper and lower drums. Outside of steam valve leaks, no other damage was noted on other steam plant components, on other utility systems, or on cascade equipment as a result of the loss of steam supply.

6. Adeaunqy_qlHg.gponse 0.1 Equ.ipment Rtangntg

a. Inspecilon,Rqgag The inspectors reviewed the performance of plant equipment during the transients leading to the loss of steam event. The inspectors reviewed Bailey trend reports, equipment maintenance and calibration record, and interviewed plant personnel.

9

i

b. Qhfervations and Findin01 The initiating event of the No.1 DA pump tripping apparently was due to a motor overload condition. That was determined by the pump controller Indications which the day shift FLM found upon arriving at the steam plant at 6:15 a.m. during the event. During the specialinspection, a work order was initiated to test the pump to determine the cause of the overload trip. Test indicated that the overload trip function was working properly but at the time no direct cause for the trip was determined. Interviews with GPOs indicated that a common practice had been to restart a pump if the motor had tripped and if restarted, no record of a problem was documented.

The DA tank level dropped very rapidly upon the DA pump trip. It reached the set point for the low level alarm in only four minutes. The rapid level drop was due to a heavy reliance of makeup water for the DA tank. Normal operations would have a mix of 05% condensate retum and 35% makeup water supplying the DA tank.

Due to the poor material condition of the condensate return from the various buildings and the many steam leaks , the steam plant was relying on 65% makeup and 35% condensate return; therefore, the tank level was very sensitive to a loss of makeup water.

A second equipment failure occurred when the DA tank level alarm failed to actuate. After the event, the alarm was functionally tested by lowering the tank water level and the alarm failed to actuate. The instrument and control technicians identified that the Mercold float switch was hung up in the float chamber. Interviews with maintenance personnel and review of calibration records indicated that steam plant equipment was not included in a regular preventive maintenance and calibration program.

After restoring the DA tank water level by bypassing the DA pumps, the SPOs attempted to stabilize the water level fluctuations by starting a second DA pump and shutting the bypass valve (No. 413). The second pump was started without knowing that the No.1 DA pump had tripped. At that point, a thkd equipment failure caused the second loss of DA tank water level. The check valve on the No.1 DA pump discharge line failed to seat fully. As a result, much of No. 2 DA pump's output recirculated through the check valve and did not reach the DA tank.

Maintenance personnel and many of the SPOs were aware of the DA pump's check valve problems. Interviews with the SPOs, maintenance personnel, and the FLMs indicated that maintenance activities were being initiated by review of operating and maintenance logs rather than by problem reports and the more formal maintenance planning process used on the cascade.

The ongoing upgrade to the steam plant was reviewed to determine if it contributed to the loss of steam. The original process pneumatic control system was upgraded to a Bailey LAN 90 electronic monitoring, control, and data acquisition system with various parts of the system being installed in phases.

Review of the Bailey system trend reports were used to determine the sequence of events and indicated that the Bailey system operated as designed. The inspectors did note that the SPOs were apprehensive about operating the Bailey system and interpreting the screen process data. They Indicated that they had 10 i

I received some training but were unsure how the Bailey system would respond to different operational transients, in addition, most control room monitor icons had '

l 1

not been booked up yet, such as the icons for several running pumps. This fudher complicate event recovery since the SPOs were not always sure which icons were hooked up and accurately represented actual equipment status. 1 I

c. Conclusion i 1

y inadequate material condition led to multiple equipment failures that initiated the ,

loss of steam supply event and complicated the SPOs response to those j

conditions. While a new controller system responded to the event as designed, SPO response using the system was complicated by a lack of confidence in the new system, 6.2 Steam Plant Operefors J

i

s. Inspection Scope--

The inspectors reviewed the response activities that occurred in the steam plant and interviewed SPOs and involved staff.  ;

b. Observations and Findinal 1 The SPOs consisted of the normal compliment of an auxiliary boiler operator, a boiler operator, and a stationary engineer. The boiler operator and stationery engineer positions required state licensed boiler certifications. The crew was on their first night of a 7:00 p.m. to 7:00 a.m. shift, The inspectors review of the event noted that the SPOs failed to diagnose plant conditions. The first key failure was the crew's inability to diagnose the loss of makeup water. They never realized No.1 DA pump tripped nor that its check valve was leaking when the No. 2 DA pump was started. A second problem not identified was the lowering DA tank level. Finally, the boiler water level was never directly verified before feed water was re-established at 6:30 a.m.

The inspectors interviewed SPOs, and as noted in Section 6.1, some of the SPOs did not have confidence in the new Bailey system. Not all the icons on the control room displays were active, and the SPos did not feel comfortable trusting the information. This lack of comfort was displayed by the SPOs during the event when they switched to the older control system. Training on the new system had not been completed and the training received was categorized by the SPOs as

• useless." Rather, the SPOs self taught the required skills in order to address system interactions, The inspectors reviewed the training program for the SPOs. Plant wide training requirements were documented in XP 2 TR TR1030 ' Conduct of Training,"

Revision 0. Program documents indicated that utility operator training (including SPO training) did not fall under the systems approach to training (SAT) required for operating safety-related equipment. The SPO training requirements were to be documented in a ' job and needs analysis' contained in a division training 11

guide. The only documentation available at the time of the inspection was a document entitled ' Utility Operations Department 832. Steam Plant Operations,"

dated April 8,1986. The training requirements in that document required training on single and integrated steam plant system transients and emergency and abnormal operating procedures. The training staff indicated that although the 1988 training plan was never deleted from the list of

• active" plans, they felt it had been superseded by later training requirements. Training records also were not readily retrievable during the inspection. The inspectors could not determine if the SPO training requirements had been defined or met due to the lack of records and uncertainty conceming what was the guiding documtnt defining those requirements. The issue of whether training requirements for SPOs had been met will be tracked as an inspection Followup item (IH 70 7002/97007 01).

The inspectors determined that steam plan operating procedures only addressed how to operate individual equipment or component operation. There were no alarm response procedures for responding to annunciator alarms in the control room in addition, there were no abnormal response procedures for the steam plant. The steam plant lesson plans and evaluation checklists did not address the malfunctions that the SPOs experienced during the event.

c. Conclusions The inspectors concluded that the SPO response to the event demonstrated deficiencies h system knowledge that resulted in the SPos responding to the symptoms of the equipment failures. Diagnosis of the symptoms would have identified the equipment failures and allowed the SPOs to restore normal plant operations. Deficiencies were noted in the effectiveness of SPO training and the quality of operating procedures. An inspection follow up item was identified because the inspectors could not determine if the minimum training requirements had been defined or met.

6.3 Qastade Qperators

a. Lrgrection Scope The inspectors interviewed cascade controllers, reviewed the controllers' log and turnover sheets, and viewed the control rcom panel and alarms that relate to steam supply from the steam plant.

b. Observations and Findinas At 6:40 a.m. on July 25, the cascade controller on duty was told by the cascade shift superintendent that there was a steam failure at the steam plant resulting in a totalloss of steam generating capacity. The cascade shift superintendent had been informed of the loss of steam via a phone call from the steam plant. At this point, the cascado controller began to implement Cascade Procedure XP4 CO-CA3944, " Operations During a Steam Failure, Rev. 0." The cascade operator notified the feed plant and the process buildings (326,330,333,342,343) of the situation and instructed the process buildings to begin following the appropriate procedures for a steam failure. The cascade coordinator also called utilities and 12

.__ ._ = - .- . ,

Instructed them to valve out non-critical buildings. Buildings X 700, 705, 720, and also the autoclaves in Buildings 342 and 343, and the low assay withdrawal area in Building X 333 were valved out. A section of piping in the 10 y arsay withdrawal area froze up during the event. When steam supply was restored, the cascade operator stated that he assured clarity of the lines before valving the lines back into service to prevent the possibility of a hydraulic pipe. The inspector observed that procedure XP4 CO-CA3944 had an effective date of July 30,1997, at which time it replaced procedure CE 6.1. The cascade operator implemented procedure XP4 CO-CA3944 on July 25,1997, five days before its effective date. '

The training on the new procedure had been completed by required reading and the cascade operatorivas familiar with the procedure.

c, Conclusions The inspectors concluded that the cascade operator's actions in response to the loss of steam supply were completed according to procedure and were acceptable. However, the inspectors were concemed that the procedure was available for use before its effectiva date. The issuance of controlled procedures before their effective date will be tracked as an Inspection Followup item (IFl 70 7002/97007 02).

7. Root Cause Investloation inspection Scope Overview The inspectors reviewed the condition of the steam plant equipment and how the SPOs responded to equipment failures to identify if these factors where root causes for the loss of steam event.

7.1 Root Causes

a. Inspection Scope Independent review of the plant and operator responses identified two root causes for the loss of steam event.

b. Observejions and Findinal The poor material condition of the steam plant (identified in Section 6.1) was a result of a poor preventive maintenance program. A rigorous preventive maintenance program did not exist at the facility, Until recently, the program had not been expanded to include the steam plant, and other utility services except for electrical switchgear as a result of a loss of power event to the X-326 building in 1996. In addition, a reliable equipment history of the failed pump motor was not available to assist in determining the cause of the motor trip. Furthermore, the DA tank low level alarm failed, and the status of the leaky check valve was not well understood nor was it repaired prior to the event.

The failure of the operators to diagnose the cause for the loss of makeup water (the pump trip and later the leaky check valve) resulted in a failure to re-establish 13

control of the boiler water level. That failure to diagnose was due to weak operator knowledge of integrated plant operations. Training and procedure deficiencies identified in Section 6.2 were the root cause for weak operator knowledge,

c. Conclusions The two root causes for the loss of steam event were a lack of a preventive maintenance program for the steam plant and weak operator knowledge of integrated plant operations due to training and procedure deficiencies. The poor material condition of the steam plant and the poor operator knowledge in.11cated a lack of management attention to the steam plant.

7.2 Contributina Factors

a. [rippection Scoqq The inspectors root cause analysis identified several contributing factors to the loss of steam event,

b. Qbservation and Findinal Poor material condition was a contributing factor to the event. The heavy reliance on makeup water discussed in Section 0.2 caused the DA tank level to fluctuate quickly contributing to the problem of the operators responding to events and not diagnosing the symptoms. The DA tank lowlevel alarm failure caused similar problems.

Limited steam plant control room staffing and the division of control room responsibilities were contributing factors. The control room division of responsibilities had the auxiliary SPO on the ground floor monitoring coal feed and the BF pumps, one licensed SPO roving responding to off normal confitions, and one licensed SPO in the control room controlling the boiler level. With all the equipment fwilures, both licensed SPOs were too busy to diagnose the situation.

The roving SPO was running up and down three flights of stairs visually monitoring the water levelin each boiler and by-passing failed equipment. No licensed SPO was available to step back and diagnose the conditions, in addition, the staff was reluctant to call for assistance partially due to the time constraint.

Another contributing factor was a lack of clear management guidance on when to shut down the steam plant. The plant relied on the licensed SPOs' training and skill to determine if the boiler should be shut down or if feed water could be safely restored.

c. ponclusions Poor material condition contributed to the event due to the heavy reliance on makeup water causing the rapid DA tank transients. The rapid transients gave little time to the available crew to perform an integrated assessment. In addition, 14

a lack of clear guidance on when to shut down the boiler placed a heavy reliance on SPO knowledge of plant conditions when they were busy responding to the failed equipment.

7.3 Q_gf1! Mate Holder Root Cause Investination

a. inspection Sepag The inspectors reviewed the certificate holder's event investigation and root cause determ%ation and correctiva action recommendations,

b. Qbservations and Findinas Due to the large economic losses as the result of damaged plant equipment and lost production incurred by the loss of steam event, the certificate holder initiated a full scale event investigation normally reserved for a significant safety related event. The event investigation team conducted their investigation independent of the SIT. The results of the investigation were in general agreement with the SIT.

The event investigation team identified the

• lack of an effective preventive maintenance or testing program' as the root cause, and a contributing cause was "no procedures or training that adequately addressed integrated plant operations or response to abnormal situations." Other contributing causes included a lack of communications between the crew on shift FLM (reluctance to call for help) and degraded material conditions in the steam plant.

The corrective action recommendations for the investigation team addressed the root cause and contributing causes. Establishing a preventive maintenance program for the steam plant and developing a more effective steatu plant training program were the primary corrective actions.

c. Conclusions The certificate holder initiated an event investigation team due to the large economic costs of the event. The team's conclusions were in general agreement with the SIT. The SIT included the tralning and procedure issues as a root cause rather than a contributing cause. The recommended corrective actions appeared adequate to address the issues at the steam plant.

10. Generic impli_g_a_lio_rn

a. Inspection Scong The inspectors reviewed potential generic implications of the event,

b. Observations and Findinas A key reason for conducting the specialinspection of the loss of steam supply was to determine whether generic implications resulted from the event. The steam plant (and steam supply system)is a nonsafety system similar to a balance-of plant system in a nuclear reactor. The NRC often reviews balance of-15

4 plant systems for deleterious effects that failures of these systems may have on safety systems, including unnecessary challenges that such failures present to safety systems.

Failures of nonsafety related systems increase the potential for human error because of unnecessary challenges to safety systems. Human error during such challenges could potentially result in the plant being placed in an unanalyzed condition and could present unnecessary risks to the workers and the public. This event pressated an unnecessary challenge to safety systems and SPOs, and introduced an increased potential for human error during the transient and recovery operations. Although the occurrence of a nuclear criticality was unlikely due to a loss of steam, the potential for a nuclear criticality was increased during the transient.

Besides the generic implication that failures of nonsafety systems have upon safety systems and hurnan performance, other generic implications may arise if the same root cause and factors of this event also exist in safety systems. In this case, poor maintenance and poor SPO training were identified as root causes.

Past inspection end observation reports for Portsmouth and Paducah have noted many material condition problems. Material conditions resulted in numerous operational problems. Pedsmouth had experienced power losses to the X 326 building, X 344 building, and the steam plant due to transformer failures, switchgear failures, and feed line grounds. The power failure in the X 326 building resulted in a minor UF, release through the building purge vents. The power losses were due to equipment age and a lack of preventive maintenance. Recent NCS and chemical safety inspections did not identify similar material condition concerns with safety equipment. Maintenance and modification processes for safety related equipment have been developed with a higher degree of rigor in accordance with the graded approach to quality defined in 10CFR76.

Deficiencies in the SPOs knowledge have also been identified in previous reports.

Portsmouth Report 97004 did identify tails operator knowledge deficiencies regarding the high pressure vent system. However, other recent inspections in NCS and chemical safety did not identify cascade operator knowledge weaknesses regarding safety-related equipment. System approach to training (SAT) for those personnel operating and maintaining safety related equipment has been developed and the NCS and chemical safety inspections determined thPt the SAT training for those programs was adequate. Training for nonsafety system operators wc.s not as rigorously defined as that for SAT based training on safety systems. However, minimum training requirements for the SPOs were required by procedures to be defined and met. An inspection follow up item (IFI) was previously identified in the report to check those requirements, c, Conclusio01 Poor material condition in auxiliary systems continue to provide unnecessary f

- challenges to the gaseous diffusion facilities. Poor maintenance practices and I tow priorities in the nonsafety related systems contributed to the materiel condition l problems. Past nu.. safety related equipment failures such as the electrical I switchgear failure and loss of power to the X 326 building resulted in corrective j l

, < 1 16 l

I

a 1 actions that placed the switchgear in a preventive maintenance program. The proposed corrective actions to the steam plant event have the same narrow focus  ;

of just fixing the steam plant maintenance problem. However, recent inspections have determined that the safety-related systems were maintained with more rigor.

Similarty, operator training for nonsafety related systems was not as rigorous as ,

the required SAT training required for personnel operating and maintaining safety.

related equipment. Future NRC inspections will continue to assess the adequacy of maintenance and training as implemented on safety and nonsafety systems.

11. Exit Meetina Summary The inspectors presented the inspection results to the plant staff management at the conclusion of the inspection on August 1,1997. The plant staff acknowledged the findings presented.

The inspectors asked the plant staff whether any materials examined during the inspection should be 0.onsidered proprietary. No proprietary information was identified.

f i

i 7

17

- - . _ . - .. .-,_ - _ . _ _ _ . _ _ , _ _ . _ . . . . , _ _ - - - - ~ - _ - - _ - - , . _ .

r PARTIAL LIST OF PERSONS CONTACTED Lockheed Martin Utility Services (LMUS)

• D. l. Allen, General Manager

'J. B. Morgan, Enrichment Plant Manager

• M. Hasty, Engineering Manager

• R. W. Gaston, Nuclear Regulatory Affairs Manager

'C. W. Sheward, Maintenance Manager

• R. D. McDermott, Operations Manager

• D. Armstrong, Utilities Group Manager E. Wagner, Nudest safety Manager

• D Rockhold, Nuclear Regulatory Assurance Compliance

• S. Schholl, Nuclear Regulatory Assurance Compliance G. Shular, Project Manager

'T. Kramer, Utilities shift Facility Coordinator

• L Cutlip, Cascade Control Section Manager V. Lonardo, System Engineer D. Quillen, Cascade Coordinator B. Wilkenson Cascade Controller D. Poetker, Mechanical Maintenance D. Lewis, Electrical Maintenance Uniltd.Sjates Enrichment Corporation J. H. Miller, USEC Vice President, Production

• L. Fink, Safety, Safeguards & Quality Manager United States Deoartment of Enerov (DOE)

'J. C. Orrison, Site Safety Representative Nuclear Reaulatory Commission (NRC)

• P. L. Hiland, Chief, Fuel Cycle Branch

• C, R. Cox, Senior Resident inspector (Team Leader)

• C. A. Blanchard, Fuel Cycle Inspector

• D. S. Butler, Senior Electrical Engineer

• J. G. Guzman, Senior Mechanical Engineer

• P. M. Lewis, Engineering Psychologist

• A, Persinko, Mechanical Specialist

• T. D. Reldinger, Senior Fuel Cycle inspector

• Denotes those present at the exit meeting on August 1,1997.

18

i

. UST OF ACRONYMS USED BF Boiler Feed DA -Demerator FLM Front Line Manager NCS Nuclear Criticality safety HM88 Nuclear Material Safety and Safeguards PSIG Gage Pressure SPO- Steam Plant operator SIT Specialinspection Team UF, Uranium Hexafluoride 19

I I

l ERCLOSURE 2 DoecialIr,spection Team Charter Portsmouth G.P.

The tearn should examine the circumstances surrounding the loss of steam supply to the plant and evaluate the safety significance of the event focusing on the following areas:

1. Develop and validate the sequence of events associated with the July 25,1997, loss of steam supply event. This sequence should begin with the plant condition prior to the event, and extend through the time at which full, stable steam supply was restored to the plant and the operator had complete prompt follow up actions.

t

2. Determine the extent of any radiological and chemical safety consequences of the event.

This should include an assessment of the nature and safety implications of any buildup of solid UF,in plant piping and equipment, any loss of NCS margin or double contint sney protection, and the potential for releases of loss containment of UF .

3. Determine the extent of damage to the plant steam supply system and any equiptsent or plant systems needed for safe operation of the plant in NRC regulated activities.

4. Evaluate the root cause of the loss of steam supply. This should include review and evaluation of plant equipment, maintenance, procedures, training, personnel, and management control. The review should encompass factors related to hardware, administrative controls, and human factors.

5. Evaluate the adequacy of the certificate holder's response and root cause determination to the event. This should include the initialidentification and assessment of the event, and all follow up activities, including event classification and reporting.

6. Assess the generic implications of the event and its precursors with respect to other plant equipment and systems necessary for safe operation.

ENCL.OSURE 3 Sigence of Events 7/25/97 Prior to Event No. 2 and No. 3 boilers were operating at normel pressure t.15 psig) at 50,000 and 49,000 lbs/hr respectively to meet steam site requirements. These boilers were functioning with coal and water in semiautomatic and the combustion air in manual feed. No.1 deaerator (DA) pump and No. 3 boiler feed (BF) pump were operating. The only off evolution in progress was the restoration of the X 333 process building steam supply that was on going from July 24, at 10.45 p.m.

7/25/97 0139 0143 DA tank water level drops to off scale low.

Make up water control valve 608 in open position.

0144 DA tank's low water alarm failed to sound.

0144 0227 DA tank water level remains off scale low.

0155 0220 No. 2 and No. 3 boilers water levels drop to off scale low.

0200-0230 (1) The steam plant operators (SPOs) notes low BF pump suction pressure and fluctuating BF pump discharge pressure and notifies enDi neer.

(2) Low water level alarms sound for No. 2 and No. 3 boilers.

(3) The SPOs starts No. 2 and No. 4 BF pumps.

(4) The SPos manually opens water softener by pass valve 413 attempting to diverting make up water directly to the make up control water valve 608 (falled open No.1 DA pump check valve allows water to recirculate back through No.1 DA pump to DA 'ank), by passing water treatment tanks (sodium zoelite and hydtc. gen tanks) and degasifier tank and DA pumps.

(5) The SPOs observe that the water levels in both boilers increasing and steam output reduced.

(0) The SPOs switch boilers to manual combustion controls.

(7) The SPOs manually increase boilers com'Justion.

0220-0225 No. 2 and No,3 boiler water levelincreases to off scale high.

0226-0303 No. 3 boiler water level off scale high.

0304 0307 No. 3 boiler water level decreases to within range.

0227 0320 DA tank water level fluctuated between off scale high and low.

0308-0536 No. 3 boiler water level remains within range.

0321-0435 DA tank water level within range.

0220-0315 No. 2 boiler water level drops off scale low.

5 0316-0334 No. 2 boiler water levelincreases to off scale high.

0335 0348 No. 2 boiler water level off scale high.

0346 0405 No. 2 boiler water level decreases to within range.  ;

i 0406-0536 No. 2 boiler water level remains within range. l 0430 X 333 process building restoration complete.

0431 The SPos observes No.1 DA pump shaft luming.

0432 No. 2 DA pump placed on line.

0435 The SPos manually closes water softener by pass valve 413 to restore normal i

make up water supply alignment, 0436-0440 DA tank water level drops.

0440 The SPOs open by pass valve 413.  ;

- SPOs switch to the old control system to regulate make up control valve 608.

No.1 BF pump inlet gasket fails.

The degasifier tank overflows.

The SPOs close inlet valves to sodium zoelite tanks on water trestment system.

0441 0525 DA tank water level fluctuated between off scale high and low.

0525 DA tank empty.- 1 0530-0636 No. 2, No. 3, and No. 4 BF pumps steam bound and cavitating.

0531 0636 DA tank water level off scale high.

The SPos observe DA tank overflowing.

0537 0634 No. 2 and No. 3 boiler water levels off scale low.

Feed water regulating 5 alves in full open position. ,

0545 The SPOs contact night shift FLM to request additional help.

0615 Day shift FLM arrives at steam plant.

0630_ No.1 DA pump identified as electrically tripped. No.1 DA pump breaker reset and No.1 pump placed on-line.

0635 No. 3 boiler blowes a tube and SPOs unlatch stokers on both boilers (coal feed temiinated) e s

--r-... . . , , ,.