ML20217N199
| ML20217N199 | |
| Person / Time | |
|---|---|
| Site: | Paducah Gaseous Diffusion Plant |
| Issue date: | 08/19/1997 |
| From: | Polston S UNITED STATES ENRICHMENT CORP. (USEC) |
| To: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| References | |
| CAL-RIII-97-03, CAL-RIII-97-3, GDP-97-1026, NUDOCS 9708260060 | |
| Download: ML20217N199 (14) | |
Text
c Unitnf Statn e
I.new hment l'orpactum 9
y radiuh Ltc Office P O IW 1410 Padinh. K Y 42tyll Tel 402 441.WO Ias.402 44l 5801 August 19,1997 U.S. Nuclear Regulatory Commission SERIAL: GDP 971026 Attn: Administrator, Region til 801 Warrenville Road Lisle, Illinois 60532-4351 Paducah Gaseous Diffusion Plant (PGDP), Docket No. 70 7001, Restart of C-400 Spray Hooth Operations With regard to your Confirmatory Action Letter (CAL) No, Rill 97-003, dated February 28, 1997, the purpose of this letter is to notify you that: 1) USEC has completed the actions required in the CAL for C-400 spray booth operations; and,2) The target date for restarting spray booth operations is on or aller August 21,1997. Enclosure I summarizes the actions completed for the C-400 spray booth operations which implement the CAL-required actions. The CAL-required actions for the C-400 cylinder wash operations have not yet been completed; we will provide a separate response at a later date.
Additionally, our letter of June 16,1997 " Response to inspection Report 70 7001/97 201 Notices of Violation," committed to include a discussion of the results of an independent assessment of the PGDP nuclear criticality safety program, along with the corrective actions taken, or being taken, to prevent recurrence of the events that led to the shutdown of the C-400 cylinder wash and spray booth operations. This is included in our response to Action 4 of the CAL and in Enclosure 2.
feW i 9708260060 970010 PDR ADOCK 0700 0 1
' g o g, 01141111!41011Ell i
2-o
)
_U.S. N aclear Regulatory Commission.
August 19,1997 GDP 971026, Page 2.
- If you have any questions regarding this submittal, please contact Bill Sykes at (502) 441-6796.
There are no new regulatory commitments in this submittal.
Sincerely, J
Steve Polston General Manager
_ Paducah Gaseous Diffusion Plant 4 '
- SP:RL2:mel cc:-
-U.S.WRODocument Control Desk
- NRC Resident Inspectors, PGDP NRC Special Projects Branch (B. Pierson) y
+
n 4
4 k
g r
vw-r.yav y
e w
=
-,%-w.--
.--~~-y
..m----.
i Enclosure I to l
GDP 97-1026 ENCLOSUREI CONFIRMATORY ACTION LETTER REQUIREMENTS AND RESPONSES This enclosure summarizes the results of the completed Confirmatory Action Letter (CAL) requirements as they apply to C-400 spray booth operations.
CAL Required Action 1 Complete a revicw ofall PGDP NCSAs which rely upon administrative controls and identify any other scenarios which could have only one contingency, or which rely upon controls which can be readily bypassed without management 's knowledge.
Response
All Nuclear Criticality Safety Approvals (NCSAs) were reviewed and all controls which relied on independent verification of any type were identi..ed.' Controls which relied on independent verification were categorized based on their direct importance to double contingency. The categories are defined below:
Priority 1: These controls used independent verification ofinformation contained on some fomi of documentation. These verifications were typically the sole source of double contingency for a particular scenario. These controls are most similar to the cylinder wash controls that were violated.
Priority 2: These controls typically relied on independent verification for both legs of double contingency.
Priority 3: These controls typically included verification of some operator action. An example of such a control would be one operator verifying that another operator closed a valve or depressed a switch. None of these verifications were the sole control for maintaining double coatingency, instead, these controls typically were used to strengthen arguments of a failure being unlikely.
'The results of the surveillance are documented in SUR-97-3122, w hich is available on-site for NRC review.
El-1
Enclosure I to GDP 971026 Surveillance walkdowns were performed for each of the Priority 1 and 2 controls. This review identined administrative control de6ciencies associated with eight NCSAs. These denciencies were documented in site problem reports, requiring corrective actions, procedure revisions and/or revision of the applicable NCSA/ Evaluations (NCSA/Es). The NCSA/E for the spray booth was one of these.
These actions were also reviewed by an NRC Inspection Team and documented in Paducah inspection Report 70-7001/97 201, dated May 16,1997.
CAL Required Action 2 Evaluate the root cause ofthe events, as well as the causesfor any additional controlproblems identafled during your review, and revise the associated NCSAs, as needed, to prevent recurrence and tofidly ensure the double contingencyprinciple is met. This action shall be completedprior to reinitiating operations under the associated NCSAs.
Response
USEC has completed a root cause analysis of the events that led to the suspension of the spray booth and cylinder wash operations. The results of this root cause analysis are summarized in. The NCSA for spray booth operations has been revised.
CAL Required Action 3 Revise procedures and conduct training necessary to implement the new nuclear criticality safety (NCS) controls prior to reinitiating cylinder washing or spray booth operation.
Response
The following procedures have been revised to implement the new nuclear criticality safety controls: CP4-CU-CH2109, C-400 Spray Booth Nonroutine Operation; and CP4-CU-CH2108, Operation ofthe C-400 Spray Booth Crew Brienngs of Operations personnel will be completed prior to restart of spray booth operations.
E l-2
Enclosure i to GDP 971026 CAL Required Action 4 Perform an outside review ofthe NCSprogramfocused on assessment ofthe independence and effectiveness ofcontrols and their implementation prior to March 17,1997.
Response -
This action was completed on March 17,1997, and documented in a report titled " Programmatic Review of the Nuclear Criticality Safety Program at PGDP " Additionally, concurrent with this outside review, the PGDP General Manager convened a team to evaluate the PGDP NCS prognun. The outside consultant also panicipated in this review. The results of the PGDP.
initiated review are documented in KY/A 578," General Manager's Independent Assessment Nuclear Criticality Safety." USEC has discussed this assessment with NRC during the inspection covered by NRC Inspection Report 70-7001/97-201 and at a meeting with NRC Region III on May 2,1997 A discussion of the results of these assessments, along with a summary of the corrective actions taken or being taken to prevent recurrence of the events that led to the shutdown of the C-400 cylinder wash and spray booth operanons, is provided in.
CAL Required Action 5 Prior to the restart ofthe cylinder wash and spray booth operations you will notify the PGDP Senior Residentinspector.
Response
The NRC Senior Resident Inspector has been notified of USEC's plans to resume spray booth operations.
El-3
. to GDP 97-1026 ENCLOSURE 2 GENERAL MANAGER'S INDEPENDENT ASSESSMENT FINDINGS AND CORRECTIVE ACTIONS Section I below summarizes those findings of the PGDP General Manager's independent assessment of the plant's nuclear criticality safety (NCS) program, including the USEC-initiated outside review thereof, which were determined to be significant conditions adverse to quality.
Both of the assessments are available on site for NRC review.
Section 11 presents the corrective actions taken and to be taken to address the findings of the subject independent assessments.
Table 1 provides a correlation of the applicable independent assessment findings, root causes and corrective actions.
I.
SUMMARY
OF FINDINGS A. Inadequate Flowdown Process for Plant Requirements including, But Not Limited to, NCS The lack of a comprehensive flowdown process (and practice) was a root cause of the double contingency breakdown in NCS requirements in C-400, if a thorough flowdown process were comprehensively defined, proceduralized, and closely followed, the C 400 organization would not have failed to perform actions required to meet the intent of the NCSA.
B ' Management Guidance Must be Available in NCS Regarding When to Use Probabilistic Approaches on Accident Analysis The use of probabilistic approaches for evaluation of NCS hazards allows the targeted application of resources and controls to those accident scenarios which are most likely to result in conditions favorable for criticality. Use of probabilistic analysis also allows certain accident scenarios to be dismissed based on a determination ofincredibility. The management assessment determined that guidance should be made available for NCS regarding when to use probabilistic approaches so that resources can be better applied when requirements are implemented in the field. Use ofprobabilistic analyses can also help to support a determination of overall risk of the operation, which should be communicated to the Plant Operations Review Committee (PORC) during review and approval of NCS documentation.
E2-1
i to GDP 97-1026 The methodology employed at PGDP for perfomiing NCS evaluations contains some generic guidance for the application of probabilistic analysis; however, the final determination of whether to use probabilistic approaches in an evaluation is left up to the analyst, A standard which establishes management expectations regarding when to use probabilistic approaches for NCS evaluations has not been developed.
C. Lack of Adequate Precursor Identification and Use in NCS -
The management assessment detennined that there was not an adequate program in place for identification and use of precursors to provide the ability for tracking and trending the degradation of NCS programs and practices. The NCS incident trending procedure, CP4 EG NSI113 outlined the requirements for tracking and trending of NCS related incidents; however, this procedure did not specifically identify and utilize precursors as part ofits trending guidance.
D. NCS Staff Gave Insufficient Consideration to the Possibility of Errors in the Cylinder Fill Records Errors in the Nuclear Materials Control and Accountability (NMC&A) database were discussed and the probability of such errors were minimized in the NCSE. The possibility of missing records in the NMC&A records was not addressed so that the issue of common mode failures with the NMC&A database was not adequately resolved. The common mode failures associated with the C-400 event illustrated the weakness and, hence, the increased risk of relying on administrative controls, especially when the two controls are identical.
E. NCS Program Weaknesses Exist in Using Engineered Controls to Comply With Double Contingency Principle (DCP) -
During review of the NCS program, the lack of emphasis in the NCS procedures on the selection of engineered controls was noted. The use of engineered controls for all parametric limits was neither detailed nor emphasized in guidance to NCS engineers. No guidance to NCS senior engineers doing peer review was provided. In addition, the use of diverse controls to avoid common mode failures should be emphasized over use of two identical controls.
Procedure CP4 EG-NSI101, which controls the establishment of NCSEs, did not place emphasis on the hierarchy of controls (engineered over administrative), nor did it place emphasis on different or diverse controls for all NCS control parameters. PORC Nuclear Safety Subcommittee (NSS; and PORC reviews have not focused on the hierarchy of
_ _ controls or on diversity of controls. Several Operations staff who were interviewed were E2-2
. to GDP 97-1026 willing to accept any controls identified by NCS. Additional management awareness and attention to the increased risk of nuclear criticality due to the use of administrative controls, especially use ofidentical controls, was not addressed.
F. Program Weaknesses Exist in Specifying the I,ydependent Verification Procedures to Follow to Comply With DCP Some NCSEs required Operations to take various independent verification steps, but the NCSAs did not identify either the specific verification procedure or the specific verification requirements which should be implemented and documented. The requirement was very general in nature, i.e., no criteria addressing adequacy or reference to such criteria. Some Operations staff did not seem to be familiar with the verification procedures.
G. Inadequate Verification by Operations to Comply With the DCP Criteria,i.e., Relied on
" Cylinder Wash Letter" From NMC&A Instead of Two Independent Checks of Fill Records NCSE/NCSA 3973-04, C-400 cylinder washing, used independent verification as the control to satisfy the DCP. A second common mode failure based on misunderstood communications occurred. The intent of the NCSA was to require that the cylinder wash personnel obtain data from NMC&A to verify the enrichment in the cylinder since the hydro test. Operations assumed that NMC&A had provided the appropriate information and, hence, neither cylinder wash person understood the requirement to verify the enrichment since the last hydro test.
II. Inadequate Procedure Formats for Controls to Satisfy the DCP NCSA requirements for operator actions were not always placed in the " Action Steps." The flowdown of requirements to procedures was assured by the preedure development process.
However, examples of the requirements for operator action being placed in the
" Applicability" section rather than in the " Action Steps" section were noted. This did not enhance verbatim conformance. Even if there is a need to place requirements in the
" Applicability" section, they should be repeated in the " Action Steps."
1.
Program Weakness in Using the NCSE to Implement Controls for DCP,i.e., Some Operations Staff Do Not Understand Fully "Why" Controls are Used Often the Operations staff did not provide an adequate prccess description in the NCS A. The Operations staff did not review the process description in the NCSE, which served as the basis for the hazard analysis. Hence, the Operations staff was not well informed of the basis l
E2-3 l-l l
L
4
. to GDP 971026 for disposition of hazardous items (potential process upsets leading to criticality). With the exception of the Chemical Operations managers, little interest in the disposition was evident in discussions with the Operations staff.
J. Program Weakness in Timely Surveillance to Implement Controls for DCP The NCS staff did not perform timely surveillances of new or revised operations. The
> procedure for " Nuclear Criticality Field Oversight Program," CP4-EG-NSI107, did not address prompt post implementation surveillance of such operations. There was no i
requirement or mechani m to ensure timely surveillance of the implementation of new or revised NCSAs.
K. Program Weakness in PGDP Response to Fallere of DCP Controls,i.e., NCS Staff Does Not Obtain Enough Direct Observation of Work Practices The PODP response to unusual events did not provide high assurance by direct observation of activities covered by NCSAs employing only a single administrative control to satisfy tlie DCP.
E2-4
1
. to GDP 971026,
- 11. CORRECTIVE ACTIONS A. Corrective Actions Taken
- 1. Realigned NCS resources to provide a field support and oversight staff which allows more direct observation of field activities.
- 2. Developed a self-study guide on procedure validation.
- 3. Identified the implementing procedures related to the "most violated" NCSAs to back fit the flowdown requirements developed under Corrective Action B.1 for this set of procedures.
- 4. Identified precursors and appropriate performance indicators for use in enhancing NCS performance.
- 5. Issued a procedure (CP2 EG-NS1038) to outline expectations for NSS review of NCSE/NCSAs to consider the preferred use of engineered and diverse controls for fissile material operating limits.
6, Reviewed NCSE/As for "most violated" NCGA performance indicators and " complexity of controls" to identify those NCSE/As which could utilize attemative controls to reduce reliance on adininistrative controls.
- 7. Conducted a briefing for PORC members to outline expectations for review of NCSE/As to consider the preferred use of engineered and diverse controls for fissile material operating limits.
- 8. a. Determined the number of NCSAs and approximate number of flowdown procedures in which independent verifications are relied on to demonstrate double contingency,
- b. Reviewed NCSAs to identify those requirements for which independent verifications are relied on to demonstrate double contingency.
- 9. Revised the general plant procedure for independent verifications (P-GP-99) to ensure the appropriate level of detail to ensure independent verifications is included.
- 10. Functional Managers administered the self-study guide for procedure validation with individuals in their organization who are authorized to perform validations.
E2 5
I
\\
l.
\\
l to GDP 971026
- 11. Provided a standard and appropriate flowdown to program procedures for selected use of risk-based screening for NCS accident scenarios.
- 12. Revised NCS procedure CP4-EG-NSI 101 to incorporate the following changes:
a.
Establish guidelines to require more explicit requirements for accomplishing independent verification of requirements as required for each specific NCSA.
- b. Establish a more formal process for Operations review and concurrence on NCSE process descriptions and hazard identification / analyses.
- c. Modify the field verification check!ist, form CP-20933, used during the implementation of NCS approvals to include a review of organizations affected by the limits to ensure responsibilities are clearly designated. This review should be jointly performed by NCS and affected organizations.
- d. Ensure specific guidance for implementing administrative controls is included in the NCS A when applying these controls for double contingency.
- e. Specify requirements for more explicit discussion of controls credited for ensuring double contingency and for the generation of a control matrix which identifies controls and safety systems required for the prevention of each accident scenario, f.
Provide guidance to analyst and establish the expectations of the level of rigor necessary when developing computer code input files and model descriptions in the evaluation,
- g. Require a preparation for and a discussion of risk by each NCSA presentation to
- PORC,
- h. Using ANS/ ANSI standards as guidelines, establish a standard for the preferred use of engineered and diverse controls for fissile material operating limits,
- i. Develop and implement a phased approach for performing field verification which requires initiation of field verification prior to PORC/NSS review and which involves Systems Engineer and Configuration Management. The final phase will consist of an operational " DRY. RUN" observed by NCS, Operations, the Systems Engineer and Configuration Manag: ment.
E2-6
r w to GDP 97-1026 j, Revise technical review checklist to provide more specific criteria for technical review of KENO model development during the course of the evaluation.
. k. Establish a targeted walking spaces schedule for NCS Field Support personnel which provides guidance for surveying operations with newly implemented NCSAs.
- 13. Performed a crew briefing for NCS personnel on modifications to CP4-EG-NSI 101.
- 14. Revised NCS program procedure CP2-EG-NS1031 to establish a more fonnal process for all operating organizations' review and concurrence on NCSE process descriptions and hazard identification / analyses.
- 15. Developed and implemented a program for generating " Facts Sheet" type information describing lessons leamed, incident review summary, and other potential information for dissemination through plant Required Reading and Crew Briefmgs.
w l
l E2 7
9
.a 1
) to :
1
{
s
- GDP 971026 -
B.' Corrective Actions To Be Taken -
4
- 1. Approve a policy for requirements flo_wdown that provides direction for an understanding of a requirement intent at the end user level and demonstration of change feasibility.
- 2. ' Modify the procedures identified in the Corrective Action A.3, as necessary, to -
i incorporate NCS approval requirements in accordance with the enhanced flowdown
- process developed under Corrective Action B.1 and implement ass'ociated training.
- 3. Revise current procedures for each specific operation wkre independent verifications are relied on to demonstrate double contingency to clearly specify the criteria which must be.
- met'to ensure the intent of the NCSA controls are maintained.
- 4. Review NCSEs GEN 10,3973 02, and 3974-05, to determine if any additional; discrepancies / deficiencies exist between the KENO model descriptions presented in the evaluations and the actual KENO input files. Based on this review update the evaluations
- to correct any discrepancies / deficiencies that exist.
a
-E2,.
y,,
y mw.-
-r i
+.
- Enclosure 2 to GDP 971026 ishle i Root Cause Category, Root Cause Code, and Corrective Action Plan for NCS Dnuble Contingency SCAQ Issues Independent Applicable Assenment Findine (1)
Root Cause (2)
Corrective Actions (3)
A.
SPAC LTA and No SPAC A3,Bl.B2 11.
SPAC LTA and No SPAC All, Al2 g C.
SPAC LTA and No SPAC A4 D.
SPAC LTA and Not Strict Enough A5, All, Al2 d.
Al2-h E.
SPAC LTA and Not Strict Enough A5,A6,A7, Al2 g, Al2 h F.
SPAC LTA and Noi Strict Enough AS a, A8 b, A9, Al2 a, Al2 d, A15,B3 0.
SPAC Needs improvement and Not Strict Enough A2, A10, Al2 b, Al2i,B4 H.
SPAC LTA and Not Strict Enough A3,81,B2 1.
SPAC LTA and Not Strict Enough A5, Al2-b, A14 J.
SPAC L1 A and No SPAC Al2 k K.
SPAC LTA and Not Strict Enough Al (1) Reference Enclosure 2,Section I.
(2) SPAC: Standards, Policies, and Administrative Controls LTA: Less Than Adequate (3) Reference Enclosure 2, Section 11. The schedule for these actions is contained in PGDP PR AD-971615, which is available on site for NRC review.
E2-9