ML20236F824

Insp Rept 70-7001/98-09 on 980420-0608.Violations Noted. Major Areas Inspected:Plant Operations,Maintenance & Surveillance,Engineering & Plant Support

ML20236F824
Person / Time
Site:	07007001
Issue date:	06/30/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20236F810	List: ML20236F808 ML20236F822 ML20236F824
References
70-7001-98-09, 70-7001-98-9, NUDOCS 9807020361
Download: ML20236F824 (19)

Text

- _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ - - _ -

U.S. NUCLEAR REGULATORY COMMISSION

(

l REGION ll1 l

l

! Docket No: 70-7001 l Certificate No: GDP-1 l Report No: 70-7001/98009(DNMS) i Facility Operator: United States Enrichment Corporation Facility Name: Paducah Gaseous Diffusion Plant Location: 5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 Dates: April 20 through June 8,1998 Inspectors: K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector )

Approved By: Patrick L. Hiland, Chief Fuel Cycle Branch Division of Nuclear Materials Safety i

i i

l l

9907020361 990630 I i PDR ADOCK 07007001 j-

! C PDR s i

EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC Inspection Report 70-7001/98009(DNMS)

Plant Operations 3

. The plant staff demonstrated a questioning attitude in the identification of a criticality accident scenario for which a degraded plant air system could lead to the criticality accident alarm system homs not sounding for the required two minutes. As a result, the certificate made four certificate event reports when the plant air capacity dropped below the nominal values necessary to ensure that all air-driven homs sounded. The plant engineering staff planned to install air accumulators in the process buildings to assure the presence of a reliable air supply to support the criticality accident alarm system as part of the corrective actions for Compliance Plan issue 46. All corrective actions for Compliance Plan issue 46 were scheduled to be completed by December 15, 1998. (Section 01.1)

. The inspectors identified apparent weaknesses in the corrective actions implemented for previous outgassing incidents which contributed to: 1) the current minor outgassing incident; 2) the relocation of all building staff tc an area control room for an extended period of time; and,3) the failure by plant staff to perform some non-Technical Safety Requirement periodic fire watches for other plant areas. Management planned several additional corrective actions to minimize the potential for future outgassings and to ensure both an appropriate and comprehensive response to any future outgassings.

(Section 01.2)

. The inspectors identified a violation in that the plant staff failed to effectively implement immediate corrective actions for an anomalous condition involving nuclear criticality safety issues. As a result, the condition persisted for almost a month. In addition, the inspectors determined that plant policies and procedures did not appear to include specific methods to ensure that nuclear criticality safety staff guidance, provided in response to anomalous conditions, was properly implemented and documented.

(Section 01.3)

Maintenance and Surveillance

. The inspectors identified a violation of the Quality Assurance Program in that appropriate documented instructions were not provided to the plant staff involved in a switchyard sprinkler test to ensure continued operability of the criticality accident alarm system. As a result, the test caused some plant air compressors to trip offline and the plant criticality accident alarm system homs to become inoperable due to the degraded air supply.

(Section M1.1)

. The inspectors determined that field tests of the new air homs properly considered the impacts the tests could have on the inservice criticality accident alarm system, were conservatively conducted within the controls established for an inoperable criticality l accident alarm system, and were performed using property approved procedures or I instructions. (Section M1.2) 2

I Enoineerina .

. The inspectors determined that the plant staff did not assess the risk or perform safety l

evaluations of some as-found conditions, identified during the Safety Analysis Report upgrade process. As a result, timely compensatory or corrective actions were not taken to ensure that plant operations were maintained within the descriptions and analysis of

the Safety Analysis Report. Subsequent corrective actions were implemented which appeared to address the potential safety issues associated with the as-found conditions reviewed. (Section E1.1)

Plant Supposi

. The inspectors determined that the plant staff identified, investigated, and took timely - l corrective actions for an incident which involved the non-rigorous handling of classified )

information and initial delayed reporting of the incident. The certificate's investigation .

concluded, based upon objective evidence, that the classified information was not compromised as a result of the non-rigorous handling. (Section S1.1)

I

~I l

i 3

4 e

Report Details

1. Operations 01 Conduct of Operations 01.1 Criticality Accident Alarm System Audibility Function inoperability

a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding five certificate event reports (CERs) for inoperable criticality accident alarm system (CAAS) building alarm homs due  ;

to a loss of plant air capacity. The inspectors discussed the reports with the cognizant i system engineers and the Plant Shift Superintendent (PSS), and reviewed the following: j l

1. Operability Evaluation OE-C-822-98-005, Revision 0, " Criticality Accident Alarm System (CAAS) Plant Air Capacity," dated April 3,1998; l

2. Long-Term Order (LTO) C-600-98-001, Revision 2, "Available Air Capacity," dated  !

May 5,1998; .

3. Compliance Plan issue 46; and

4. Certificate Event Reports 34206,34212,34236,34277, and 34356. I

b. Observations and Findinos Audibility of the criticality accident alarm system, !n plant process buildings (except ,

outlying facilities such as Buildings C-720 and C-746-Q), was provided by air-powered homs. The homs included both local homs, associated with specific CAAS clusters'(29),

and general building homs (52), connected to multiple CAAS clusters.- The local CAAS ]

homs had a backup nitrogen supply to enable the local homs to sound upon loss of plant -

air. All CAAS homs were required to sound for two minutes to alert personnel to evacuate the area in which someone could potentially receive a dose of 12 rads from an inadvertent criticality.

1

. During a review of the actions necessary to close Compliance Plan issue 46, "CAAS Inaudibility," the plant engineering staff identified a scenario in which a large, prompt criticality, occurring in or near the center of the plant, would cause all of the CAAS clusters to alarm and would require all of the CAAS homs to sound. Although a number of the homs would be located beyond the 12-rad exposure boundary created by the criticality event, the engineering staff determined that the system was not designed to determine which homs were needed. Thus, sufficient air pressure and capacity was necessary to sound all of the homs for the required two minutes. In response to this

> finding, the plant engineering staff developed an operability evaluation which determined the minimum plant air system parameters required to ensure that sufficient air was available, under normal plant conditions,- to provide the motive force required for the homs.-

The operability evaluation concluded with a normal plant air system pressure (90 pounds per square inch) and with a normal plant air system capacity (11,250 standard cubic feet per minute (scfm)), enough excess capacity, beyond that required by normal plant operations, would be available to sound all of the CAAS homs for the required time. The L

4

operability evaluation also addressed degraded conditions, but did not provide an air pressure and volume below which the system would be clearly inoperable (except for the case of a totalloss of the plant air system). The system engineerindicated that a definite limit could not be established. Based upon the engineering evaluation, operations management, on May 10, issued LTO C-600-98-001 which required the total plant dry air capacity to equal or exceed 11,250 scfm to ensure continued operability of the CAAS audibility function.

Subsequently, on May 10, the plant experienced a partial loss of plant air, which lowered the nominal plant air system pressure to 41.5 pounds per square inch, when three air compressors in the Building C-335 air plant failed due to a blown fuse in an electrical substation. The failure occurred at approximately 11:35 a.m., and plant air system pressure was retumed to normal at approximately 12:25 p.m. On May 11, a second partial loss of plant air system capacity occurred when an online air compressor twice tripped offline. The compressorwas re-started after downtimes of approximately 5 minutes and 30 seconds, respectively. On May 14, a third partialloss of the plant air system capacity occurred when two compressors momentarily tripped offline on high cooling water temperature, due to increased demands on the associated cooling water systems caused by a fire sprinkler test being performed in a plant switchyard (see Section M1.1). Finally, on May 21, a fourth partial loss of the plant air system capacity occurred for approximately 6 minutes as a result of an electrical transient caused by a thunderstorm. On each occasion, the PSS declared the CAAS homs inoperable and began entry into the appropriate Limiting Condition of Operation (LCO) Action Steps of the CAAS Technical Safety Requirements.

The inspectors reviewed the Boundary Definition Manual sections and Compliance Plan issues associated with the CAAS audibility function to understand the reliability and impact of the plant air system capacity on the CAAS homs, a "Q" safety system. The inspectors noted that a section of the plant air system piping, up to the first isolation valve for the homs, was designated as a "Q" safety system. The rest of the plant air system, however, was considered a "non-safety" system, meaning its functions and components were not covered by the Quality Assurance Program. Compliance Plan issue 46 documented that the CAAS audibility function was degraded and allowed the plant staff to use the building evacuation horns (" howlers") and the plant public address system to supplement the current CAAS homs until full CAAS audibility was provided.

The plant modifications to achieve full CAAS audibility were scheduled to be completed by December 15,1998. In discussions with plant engineering staff, the inspectors were informed that the plant staff had identified the problem with relying upon the plant air system for CAAS audibility as part of the design process for adding additional homs to improve audibility. As a result, the engineering staff developed a plant modification to install air accumulators in each building to ensure an adequate capacity for the CAAS homs under degraded plant air system conditions. The inspectors considered this a reasonable approach to resolving the specific and overall issues associated with CAAS system audibility,

c. Conclusions The plant staff demonstrated a questioning attitude in the identification of a criticality accident scenario for which a degraded plant air system could lead to the criticality accident alarm system homs not sounding for the required two minutes. As a result, the 5

certificate made four certificate event reports when the plant air system capacity dropped below the nominal values necessary to ensure that all air-driven homs sounded.

The plant engineering staff planned to install air accumulators in each of the process buildings to assure a reliable air supply to support the criticality accident alarm system as l part of the corrective actions for Compliance Plan issue 46. All corrective actions for Compliance Plan Issue 46 were scheduled to be completed by December 15,1998.

01.2 Buildina C-333 Uranium Hexafluoride Minor Outaassino and Event Response

~ a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding and the plant staff's response to a minor outgassing from cascade-related systems in Building C-333.

b. Observations and Findinas On May ig, an operator, while conducting routine rounds of the building, observed smoke coming from the Building C-333 SC Buffer Panel. The cascade buffer panels route dry air to some cascade components to preclude the inleakage of wet air into cascade systems.

Procedures for operating the system documented that a past or current failure of the buffer systems could result in uranium hexafluoride (UF ) entering the buffer system and being released from the system to the immediate area as the result of a failed system component or pressure transient.

In response to the observation of smoke emanating from the buffer panel, the building staff initiated pre-defined actions to recall all personnel, located in the building, to the area control room (ACR) and to request an immediate investigation by the plant emergency squad. Over the next few hours, the plant emergency squad confirmed the release of small amounts of UFe from the buffer panel and took actions to isolate the buffer panel and stop the release. Following completion of the emergency response squad activities, personnel, re-located to the ACR, were allowed to resume normal building operations.

During a review of the plant staff's response to the minor outgassing, the inspectors  ;

noted several similarities between the outgassing and past incidents. Significant among the similarities were: 1) the release originated from a buffer panel pressure gauge, due,

. in part, to either a failed or degraded seal; 2) the release, though very small, resulted in a recall and confinement of building staff in the ACR for several hours while the plant emergency squad responded to and stopped the release; and,3) the plant staff's ]

response to the release resulted in other required periodic safety monitoring activities, fire watches, not being conducted for almost 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The inspectors reviewed the missed fire watches and determined that none of the fire watches were required by the Technical Safety Requirements, in contrast to the past incidents. However, the fire watches were being performed as a compensatory measure

. for nonsafety-related fire protection systems which were out-of-service.

The inspectors discussed with plant management the corrective actions taken to previous minor outgassing incidents and noted that some of the planned corrective actions had not been completed and others may not have been sufficiently comprehensive. For example, 6

a corrective action for a previous outgassings was to inspect and test all buffer panels to I determine if the systems were contaminated and thus could serve as a potential location for outgassings. The inspectors noted that the system involved in the current outgassing had not yet been evaluated to determine if contamination was present.' As another corrective action to previous outgassings, management provided improved guidance to the incident Commanders to ensure that competing safety needs, such as responding to

the outgassing incident and completing other periodic safety-related monitoring, were evaluated during the incident. However, the missed fire watches during the current event appekred to indicate that the guidance was primarily focused on ensuring only the timely

. completion of periodic safety-related monitoring associated with the facility involved in the outgassing. Manr gement indicated that additional reviews of the current and past outgassings would be perfom*,ed to ensure tha implemented corrective actions were appropriate.

l

c. Conclusions The inspectors identified apparent weaknesses in the corrective actions implemented for .

previous outgassing incidents which contributed to: 1) the current minor outgassing incident; 2) the relocation of all bWiding staff to an area control room for an extended period of time; and,3) a faiiure by plant staff to perform some non-Technical Safety

. Requirement periodic fire watches for other plant areas. Management planned several additional corrective actions to minimize the potential for future outgassings and to ensure both an appropriate and comprehensive response to any future outgassings.  ;

1 l

01.3 Implementation of Nuclear Criticc$y Controls for Pumo Parts Located in Buildina C-333

a. Inspection Scope (88100} '

The inspectors reviewed the implementation of corrective actions taken to control seal exhaust and wet air pump parts that were removed from plant systems without an approved nuclear criticality safety evaluation or proper operational controls.

b. Observations and Findinos On May 13, during routine tours of the Building C-333 cell floor, the inspectors observed two small plastic bags stored in an area par *.ially encircled by a rope barrier. The rope l

barrier did not include any signs or postings. Markings on the plastic bags indicated that  !

the bags contained piping elbows removed from the nearby wet air pumps. The markings also indicated that the materials should not be moved without nuclear criticality safety i j staff guidance.

. The inspectors discussed the observations with building and nuclear criticality safety staff. In response to the inspectors' observations, the building and nuclear criticality staff performed a preliminary review of the situation and determined that the materials were nct pmperly controlled. Specifically, the , ope barrier, which was relied upon to ensure proper spacing between the piping elbows and other fissile materials, did not ensure a two foot spacing on one side of the bags. In addition, the rope barrier did not include

. appropriate signs and postings describing the administrative controls being relied upon

- for nuclear criticality safety. Based upon an independent review of the inspectors' findings, the building and nuclear criticality safety staff implemented proper interim i

i 7

l L__ _ _ _ _ ___ -__ . - _ _

spacing controls and took action to ensure that the proper signs and postings were displayed.

( During a further review of the findings, the inspectors determined that the plant staff were i previously aware of the need to provide specing controls for the elbows. Specifically, on 1 April 14,1998, the plant staff identified that a nuclear criticanty safety evaluation (NCSE),

, for an ongoing maintenance evolution involving seal exhaust pumps in Building C-337, l did not analyze the removal and disassembly of the piping system elbows. As a result, f ~t he nuclear cridcality safety approval (NCSA) did not include required nuclear criticality safety controls to ensure the evolution was proper 1y conducted. As an immediate corrective action to the apparent differences between the NCSE/NCSA and the maintenance field practices, plant management conducted plant walkdowns to identify the existence of additional examples of seal exhaust or wet air pump piping systems that may have been inappropriately disassembled. During the walkdowns, the plant blaff identified the elbows that were the focus of the inspectors' questions. As a second immediate

- corrective action to the incident identi'ied on April 14,1998, the nuclear criticality safety staff directed that all elbows shall be roped off in order to maintain interim spacing control. The nuclear criticality staff's use of spacing, as an interim control, was communicated to the NRC as a corrective measure taken to restore safety as a part of the initial Bulletin 91-01 report made on April 14,1998. The Bulletin 91-01 report also indicated the corrective actions were implemented on April 15,1998. However, the l inspectors determined that neither the operations nor the nuclear criticality safety staff verified the proper completion of this task. In addition, tho inspectors noted that the plant policies and procedures did not appear to include predefined methods by which to ensure that the immediate corrective actions, directed by nuclear criticality safety staff in response to anomalous conditions, were properly implemented, verified, and documented.

< The regulations in.10 CFR 76.93, " Quality Assurance," require, in part, that the certificate shall establish, implement, and maintain a Quality Assurance Program.

Section 2.16, of the Quality Assurance Program requires, in part, that conditions adverse to quality shall be corrected as soon as practical. The failure to properly implement, as soon as practical, interim nuclear criticality safety spacing controls (corrective actions) for the Building C-333 cell floor wet air pump piping elbows, removed from a cascade support system without an approved nuclear criticality safety evaluation and approval, a condition adverse to quality, is a Violation of the Quality Assurance Program (VIO 70-7001/98009-01).

c. Conclusions The inspectors identified a violation of the Quality Assurance Program in that the plant staff failed to effectively implement immediate corrective actions for an anomalous condition involving nuclear criticality safety issues. As a result, the condition persisted uncorrected for almost a month. In addition, the inspectors determined that plant policies and procedures did not appear to include specific methods to ensure that nuclear l

' criticality safety staff guidance, provided in response to anomalous conditions, were l property implemented, verified, and documented.

8

( ____________- ___ _ -

I t

I 08 M!scellaneous Operations issues 08.1 Certificate Event Reports (90712) l The certificate made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concems indicated at the time of the initial verbal notification. The inspectors will evaluate the associated written reports for each of the events following submittal.

Number Status Title 34206 Open Partial Failure of the Plant Air System Results in the Criticality Accident Alarm System being inoperable l for Audibility l

' 34236 Open Partial Failure of the Plant Air System Results in the Criticality Accident Alarm System being inoperable for Audibility 34263 Open Building C-746Q Criticality Accident Alarm System inoperable due to a Power Failure

! 34277 Open Partial Failure of the Plant Air System Results in the Criticality Accident Alarm System being inoperable forAudibility 34292 Open Safety System Actuation of a Release Detection l Head in Building C-310 due to a Minor Release j i

34329 Open Failure of a Release Detection Head to Reset after Testing 34356 Open Partial Failure of the Plant Air System Results in the f Criticality Accident Alarm System being inoperable i for Audibility i l

l 34358 Open Criticality Accident Alarm System inoperable for Audibility due to Isolation of a Plant Air System Header 34360 Open Safety System Actuation of Building C-333A Autoclave 4 North Steam Pressure Control System l 08.2 Bulletin 91-01 Reports (97012) l l The certificate made the following reports pursuant to Bulletin 91-01 during the i inspection period. The inspectors reviewed any immediate nuclear criticality safety concems associated with the report at the time of the initial verbal notification. Any l

significant issues emerging from these reviews are discussed in separate sections of the 4 report.

9 u___________ . _ _ _ _ _ _ _ _ . . _ . _ _ _ _ _ _ _ _ _ _ ___ _ _ . - _ _ _ . _ _ _ _ _ _ . . _ _ _ _ _ . ._ . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

i-h Number Date Title 34158 4/30/98 Seals Containing Potentially Fissile Material Moved in Building C-337 Cage Without a Nuclear Criticality Safety Approval

11. Maintenance and Surveillance M1. Conduct of Maintenance and Surveillance M1.1 Inadeauste Instructions f,cr Switchyard Sprinkler System Test

. a. Inspection Scope (88102)

The inspectors reviewed the circumstances surrounding a functional test of the fire sprinkler system for Transformer No. 72 in Switchyard C-537 which led to two air compressors tripping offline and an inoperable CAAS audibility function. The inspectors had discussions with personnel involved in the test and reviewed the following:

1. Procedure CP4-GP-EM4104, Revision 2, " Operational Test and Repair of Fire Sprinkler Systems Heat Actuated Devices in 161 kV Switchyards and Auxiliary Substations," dated March 7,1995; and

2. Task Package R 9502090-31, " Operational Test and Repair of Fire Sprinkler System Transformer No. 72 and Bay 72," completed May 18,1998.

b. Observations and Findinas On May 14, the PSS reported a partialloss of the plant air system capacity when two air .

compressors in the Building C-335 air plant tripped offline (see CER 34236). The two air compressors were promptly brought back online and then one compressor subsequently tripped offline again. The loss of the air compressors reduced the plant air system .

capacity to below the_11,250 scfm required for continued operability of the criticality accident alarm system air-driven homs (CAAS audibility), a "Q" safety system covered by the Quality Assurance Program. The air compressor trips were caused when the cooling water supply for the air compressors experienced a transient due to a significant demand on the sanitary water system. The sudden increase in the sanitary water system demand was caused by a fire sprinkler system test which was conducted by electrical -

maintenance personnel in Switchyard C-537. The second air compressor trip occurred c when plant utilities operators adjusted the cooling water supply to the first air compressor in order to bring the air compressor back online.

' The inspectors noted that during the moming status meeting held prior to the test, plant management discussed the test and whether or not the test should be performed based upon the current plant conditions. Specifically, plant management noted the limited number of air compressors currently available and recognized that on previous occasions implementation of the test had caused trips of the Building C-335 air compressors. The inspectors noted that the ensuing discussion appeared to indicate that the operations staff had considered the issues and had concluded that there would be no problem with performing the test. Subsequent discussions between the inspectors and the operations 10

staff indicated that the managers had meant to convey that operators were prepared to promptly bring the compressors back online in the event of a trip. Consistent with approach to the implementation of the test, the managers had stationed operators to manipulate the air compressor cooling water valves to maintain appropriate flow during the test. However, the operators were unsuccessful due, in part, to a partially throttled valve in the cooling water supply line to one of the air compressors which wasn't fully understood by operators and the speed of the sanitary water transient. The inspectors i

reviewed the task package and associated procedures developed for the sprinkler system 1 l test and noted that the package did not include any written instructions or precautions to ensure a continued adequate plant air system capacity during the test. In addition, the task package documentation did not indicate whether or not the Limiting Condition for Operation Action Statements for CAAS inaudibility should be entered.

The regulations in 10 CFR 76.93, " Quality Assurance," require, in part, that the certificate shall establish, implement, and maintain a Quality Assurance Program.

!. Section 2.5, of the Quality Assurance Program required, in part, that activities affecting l quality are prescribed by documented instructions, procedures, or drawings appropriate to l the circumstances, and are accomplished in accordance with these documents. The failure to include documented instructions appropriate for ensuring an adequate plant air system capacity for the CAAS homs in the task package or procedure for the switchyard sprinkler system test, an activity affecting the quality of a CAAS safety function (audibility), is a Violation of 10 CFR 76.93 (VIO 70-7001/98009 42).

l c. Conclusions The inspectors identified a violation of the Quality Assurance Program in that appropriate documented instructions were not provided to the plant staff involved in a switchyard l sprinkler test. As a result, the test caused plant air compressors to trip offline and the plant CAAS homs to become inoperable due to the degraded air system.

1 M1.2 Criticality Accident Alarm System Hom Tests

a. Inspection Scope (88102) l The inspectors observed field testing of air homs proposed as a potential modification for the criticality accident alarm system (CAAS) to improve system audibility.

b. Observations and Findinas The inspectors observed field tests of air homs being considered for use as a part of the

.. plant CAAS. The tests were performed to assess the audibility of an air hom designed to .

l sound at a lower frequency than the dominate background noise in the cascade buildings.

ll The testing efforts were conducted as part of the scheduled Compliance Plan issue 46 L corrective actions.

The inspectors noted that the tests were conducted immediately following a previously scheduled periodic test of the Building C 333 CAAS. The system engineer indicated that scheduling the special test immediately following the periodic system test was done in order to minimize the time the CAAS system was inoperable and to ensure that the tests did not mask or otherwise interfere with the site personnel's response to the CAAS 11

alarms. During discussions with operations personnel, the inspectors were informed that all aspects of the periodic CAAS system tests were completed and that the appropriate paperwork was reviewed prior to initiation of the special test. Operations efforts to ensure completion of the periodic CAAS system tests, prior to the performing the special testing of the air hom, ensured that both the detection and the alarm portions of the CAAS system would be functional during the special tests.

c. Conclusions The inspectors determined that field tests of the air homs properly considered the impacts the tests could have on the inservice criticality accident alarm system, were conservatively conducted within controls established for an inoperable criticality accident alarm system, and were performed using properly approved procedures or instructions.

Ill. Enoineerina I

E1, Conduct of Engineering E1.1 Resolution of As-Found Conditions

a. Inspection Scope f88100)

The inspectors completed a review of the engineering staff's dispositioning of as-found conditions identified as a part of the Safety Analysis Report (SAR) upgrade process. The review was focused on three as-found conditions which were previously discussed in NRC Inspection Report 70-7001/98006, Section E1 A.

b. Observations and Findinas During the period, the inspectors reviewed evaluations made by the plant staff of as-found conditions involving safety systems discovered as a part of the SAR upgrade process and compensatory or corrective actions implemented based upon the evaluations. The inspectors focused the review on three specific as-found conditions

' involving the Building C-360 autoclaves, the Buildings C-310 and C-315 withdrawal pumps, and the Buildings C-333A and C-337A autoclaves.

For each of the three as-found conditions reviewed, the inspectors determined that engineering evaluations were performed, as discussed in NRC Inspection Report 70-7001/98006. In addition, the plant staff performed a general safety evaluation for the issues included in the SAR upgrade process. Each of the engineering evaluations concluded that additional measurements or specific corrective actions were necessary to address the as-found conditions. Results of the general safety evaluation indicated that implementation of the upgraded SAR would represent an unreviewed safety question. l The inspectors noted that this conclusion was not supported by specific information which indicated that the probability or consequences of accidents evaluated in the current SAR were increased or that the margin of safety defined in the Technical Safety Requirements  ;

was reduced. Instead, the safety evaluation conclusions stated that new and different  !

l methods were used and that new or different accident scenarios were considered as the l basis for the upgraded SAR.  !

12

l During discussions with engineering staff and management, the inspectors were informed that irdividual as-found safety evaluations, in accordance with 10 CFR 76.68(b), were not required because: -1) the as-found conditions were identified as a part of the SAR upgrade process; 2) the as-found conditions did not represent risks more severe then those described in the current SAR; and, 3) the safety evaluation performed for the SAR l- upgrade results determined the SAR upgrade results were an unreviewed safety question. The SAR upgrade results safety evaluation was provided to the NRC in October 1997,

. However, both operations and engineering management also indicated that immediate

- corrective or compensatory measures should be implemented for some of the as-found conditions reviewed by the inspectors. As a result, operations management implemented additional operator training and surveillance to compensate for the issues associated with the Buildings C-310 and C-315 withdrawal pumps and shut down the Building C-360 autoclaves pending development of procedural controls and training to ensure proper positioning and operation of the keyed reset switch in the safety system actuation circuits.

In addition, the engineering staff performed an evaluation which demonstrated that the autoclave air-assisted containment valves in Buildings C-333A and C-337A would operate properly with normal plant air system pressures or a total loss of the plant air system. An

! assessment of the valves' performance, assuming degraded plant air system pressures, was scheduled for completion within a few weeks after the end of the inspection period.

j. The inspectors reviewed the corrective or compensatory measures and concluded that the actions appeared to address the immediate safety aspects of each as-found condition.

l During a subsequent review of the as-found conditions and regulatory requirements, the

! inspectors noted that Compliance Plan issue 2 required the certificate to address as-found conditions, identified during the SAR upgrade process that represented risks more severe than those in the current SAR, in accordance with 10 CFR 76.68. In addition, .10 CFR 76.68(b) required the certificate to evaluate any as-found conditions

! . that do not agree with the plant's operations as described in the current SAR in

accordance with 10 CR 76.68(a). However, during discussions with the plant staff, the

l. inspectors were informed that a formal, documented risk assessment of the SAR upgrade as-found conditions against the current SAR was not conducted.

The inspectors performed a limited review of the probability and consequences, that is, the risks, associated with the three as-found conditions and determined that the risks appeared to be increased for each of the as-found conditions. For example, improper operation of the reset switch included in the Building C-360 autoclave safety system ,

actuation circuits, without specific training, procedures, or other controls, could be l expected and would increase in the SAR-assumed accident releases from a few pounds

! to greater than 25,000 pounds of uranium hexafluoride, in addition, a delayed closing of the Buildings C-333A and C-337A air-assisted autoclave containment valves would increase releases of uranium hexafluoride from the autoclaves during an accident. The  ;

inspectors also determined that the safety evaluation, performed as a part of the SAR  !

! upgrade process, did not evaluate the acceptability of continued plant operations based l upon the current SAR or pending NRC review and approval of the SAR upgrade results.

Condition 8 of the Certificate of Compliance requires, in part, that the certificate shall conduct operations in accordance with the Compliance Plan. Compliance Plan issue 2, 13 1

required, in part, that the certificate shall evaluate as-found conditions that represent

~r isks more severe than described in the Safety Analysis Report in accordance with 10 CFR 76.68. Title 10 of the Code of Federal Regulations, Part 76.68(b) requires, in part, that as-found conditions that do not agree with the plant's programs, plans, policies, ad operations as described in the Safety Analysis Report shall be evaluated in accordance with 10 CFR 76.68(a). The failure to evaluate as-found conditions identified during the Safety Analysis Report upgrade process to determine if the as-found conditions represented risks more severe than those addressed in the Safety Analysis Report and failure to perform safety evaluations, to determined if continued plant j operations with the as-found condition is in accordance with the Safety Analysis Report, is a Violation (70-7001/98009-03).

The inspectors' review of the above described as-found conditions completed an ,

evaluation initially documented in NRC Inspection Report 70-7001/98006 and closes j Unresolved item 70-7001/98006-04.

L

c. Conclusions The inspectors determined that the plant staff did not assess the risk or perform safety evaluations of some as-found conditions, identified during the Safety Analysis Report upgrade process. As a result l timely compensatory or corrective actions were not taken to ensure that plant operations were maintained within the operations descriptions and analysis of the Safety Analysis Report. Subsequent corrective actions were implemented which appeared to address the potential safety issues associated with the as-found conditions reviewed.

IV. Plant Support S1.- Conduct of Security and Safeguards Activities S1.1 Control of Classified Information l a. Inspection Scope (88100)

L l: The inspectors reviewed the circumstances surrounding a loss of control of classified information during routine operations.

I- b.-' Observations and Findinas On May 6, during the performance of routine plant mail delivery and pickup operations, a plant mail courier identified that a classified document mailing envelope was I inappropriately included in the normal plant mail system. Specifically, the envelope was placed in a box in the Building C-335 Area Control Room (ACR) designated for non-classified outgoing mail. Upon discovery that the classified document mailing envelope was included with the normal plant mail, the mail courier hand delivered the envelope to the designated addressee and filed an assessment and tracking report (ATR) documenting the incident. On May 12, plant management reviewed the ATR and initially determined that the incident was reportable, within one hour after discovery, to the NRC

. Region lli Administrator and the NRC Division of Security. A one hour report was made to the NRC at 10:40 a.m. on May 12.

14 i

- - - = _ _

1 h The inspectors discussed the incident with the mail courier and security management, and retraced the sequence of events leading up to the mail courier's finding of the classified document mailing envelope. Based upon these discussions, the inspectors

,. determined that the classified information was improperly stored in the Building C-335 L ACR for up to 24-hours prior to being discovered on May 6. Specifically, the information was prepared for transmittal on May 5; however, the information could not be hand delivered to the mail courier, as required by the security plan. Subsequently, the information was not maintained in the direct control of authorized personnel, was not maintained under continuous visual observation, and was not stored in a classified information repository. The inspectors also noted that following the mail courier's l

- identification and documentation of the problem in an ATR, an initial management review

! of the ATR incorrectly determined that the occurrence was not reportable. The second i error was not discovered until four days later, in part, due to routing of the ATR to the I plant commitment management group versus the plant shift superintendent. The inspectors noted that the routing of ATRs to the commitment management group was a new method for handling ATRs that was instituted with recent changes to the problem reporting system.

During a review of the finding with the plant's security management, the inspectors determined that a prompt investigation of the finding was performed. The investigation included discussions with the involved staff and a review of personnel traffic through the area during the time the envelope could have been unattended. The plant security management determined that the incident occurred, in part, due to non-rigorous handling of the envelope by some building staff. An initial review of personnel traffic through the l

area where the envelope was stored determined that no. uncleared persons accessed the building during the time the envelope was unattended. However, the inspectors noted l that the review did not evaluate all reasonably available information documenting personnel access to the building. As a result, a second review was conducted and concluded that one uncleared individual had accessed the building. However, personnel

' interviews also indicated that the uncleared individual was escorted at all times. Based upon the investigation results, plant management determined that the loss of control of  ;

i the classified material was not reportable and the initial report made on May 12 was l l- retracted.  !

L .

Following the incident, plant security management took several immediate corrective actions to preclude recurrence. The corrective actions included providing additional training for building personnel regarding the proper handling of classified information and a revision of the ATR process to require that all security-related issues be provided to the H

!. plant shift superintendent to ensure a prompt and detailed review for deportability.

i Title 10 of the Code of Federal Regulations (CFR), Part 95.27 requires, in part, that while

. in use, matter containing classified information must be under direct control of an authorized individual. The Paducah Gaseous Diffusion Plant Security Plan for the i

Protection of Classified Matter, Revision 2, dated January 19,1996, implementing 10 CFR 95.27, required, in part, that classified information must not be left in an unprotected mail tray, but shall be under visual observations or locked in a classified repository. The failure on May 5 and 6 to maintain direct control of classified information l in use in Building C-335, as demonstrated by its storage in an unprotected mail tray, is a 15

violation of Security Plan. However, this non-repetitive, certificate-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/98009-04),

consistent with Section Vil.B.1 of the NRC Enforcement Policy.

c. Conclusions 1 The inspectors determined that the plant staff identified, investigated, and took timely corrective actions for an incident which involved the non-rigorous handling of classified information and initial delayed reporting of incident. The certificate's investigation concluded, based upon objective evidence, that the classified information was not compromised as a result of the non-rigorous handling. I S8 Miscellaneous Security issues S8,1 Certificate Security ReDorts (90712)

The certificate made the following security-related one-hour reports pursuant to 10 CFR 95 during the inspection period. The inspectors reviewed any immediate security concems associated with the report at the time of the initial verbal notification.

Date Title i

4/21/98 Loss of Control of Classified Documents inside Controlled Access Area 5/12/98 Classified Document Left Unattended inside Controlled Access Area The last report was later retracted after an investigation demonstrated that no personnel  !

without proper clearance had access to the document and there was no potential j compromise. The inspectors reviewed the certificate's investigation and had no further  ;

questions. l V. Manaaement Meetina l X. Exit Meeting Summary The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on June 8. The plant staff acknowledged the findings presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

16 L____---___---__.___ _ __ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ - _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _

l PARTIAL LIST OF PERSONS CONTACTED Lockheed Martin Utility Services (LMUS)

• S. A. Poiston, General Manager

• H. Pulley, Enrichment Plant Manager

• S. R. Penrod, Operations Manager

• L L.' Jackson, Nuclear Regulatory Affairs Manager United States Department of Enerav (DOE) l G. A. Bazzell, Site Safety Representative i

United States Enrichment Corporation

• J. H. Miller, Vice President - Production

• J. A. Labarraque, Safety, Safeguards and Quality Manager

. U.S. Nuclear Reaulatory Commission (NRC)

• K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector

• Denotes those present at the June 8,1998, exit meeting.

l- Other members of the plant staff were also contacted during the inspection period.

INSPECTION PROCEDURES USED IP 88100 Plant Operations -

IP 88102 Surveillance Observations IP 90712 in-office Revi 6 yof Events i

17

ITEMS OPENED, CLOSED, AND DISCUSSED Opened L

i 70-7001/98009-01 VIO - Failure to implement Timely Corrective Actions for a Nuclear Criticality Safety Control Problem 34206 CER Partial Failure of Plant Air System Results in Criticality

' Accident Alarm System being inoperable for Audibility 34236 CER Partial Failure of Plant Air System Results in Criticality Accident Alarm System being inoperable for Audibility 34263 CER Building C-746Q Criticality Accident Alarm System inoperable due to Power Failure 34277 CER Partial Failure of Plant Air System Results in Criticality Accident Alarm System being inoperable for Audibility 34292 CER Safety System Actuation of Release Detection Head in 1 Building C-310 due to Minor Release 34329 CER Failure of Release Detection Head to Reset after Testing i l

34356 CER Partial Failure of Piart Air System Results in Criticality i Accident Alarm System being Inoperable for Audibility j 34358 CER Criticality Accident Alarm System inoperable for Audibility j due to isolation of Plant Air Header 34360 CER Safety System Actuation of Building C-333A Autoclave 4 North Steam Pressure Control System 70-7001/98009 VIO Inadequate Procedures for an Activity Affecting that Resulted in the Inoperability of the Criticality Accident Alarm System 70-7001/98009-03 VIO Failure to Perform Safety Evaluations of As-Found Conditions Associated with the Safety Analysis Report Upgrade Process

- Closed 70-7001/98006-04. URI Evaluation of As-Found Conditions identified as a Par 1 of the Safety Analysis Report Upgrade Process 70-7001/98009-04 NCV Failure to Properly Handle Classified Information Discussed None 18

l LIST OF ACRONYMS USED ACR Area Control Room l ATR Assessment and Tracking Report l CAAS Criticality Accident Alarm System Certificate Event Report CER CFR Code of Federal Regulations DNMS Division of Nuclear Materials Safety DOE Department of Energy LCO Limiting Condition for Operation LTO Long Term Order NCSA Nuclear Criticality Safety Approval l NCSE Nuclear Criticality Safety Evaluation l NCV Non-Cited Violation NMSS Nuclear Material Safety and Safeguards NOV Notice of Violation NRC Nuclear Regulatory Commission PDR Public Document Room PSS Plant Shift Supervisor SAR Safety Analysis Report SCFM Standard Cubic Feet Per Minute TSR Technical Safety Requirement

, UF, Uranium Hexafluoride

! USEC United States Enrichment Corporation VIO Violation l

l l

l l

i 19 t- - - - . - - --- -- - - - - - - - - - - - - - - - - - - ------------------________i