ML20236Y115

Insp Rept 70-7001/98-11 on 980609-0720.Violations Noted. Major Areas Inspected:Operations,Maintenance,Engineering & Plant Support

ML20236Y115
Person / Time
Site:	07007001
Issue date:	08/05/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20236Y095	List: ML20236Y093 ML20236Y110 ML20236Y115
References
70-7001-98-11, NUDOCS 9808110178
Download: ML20236Y115 (19)

Text

U.S. NUCLEAR REGULATORY COMMISSION REGIONlli Docket No: 70-7001 Certificate No: GDP-1

- Report No: 70-7001/98011(DNMS)

Facility Operator. United States Enrichment Corporation Facility Name: Paducah Gaseous Diffusion Plant Location: 5600 Hobbs Road P.O. Box 1410 Paducah,KY 42001 Dates: June 9 through July 20,1998 Inspectors: K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector Approved By: Timothy D. Reidinger, Acting Chief Fuel Cycle Branch Division of Nuclear Materials Safety 9908110178 990905 PDR i

C ADOCK 07007001 pg a

1 EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC Inspection Report 70-7001/98011(DNMS)

Plant Operations Plant staff were well-prepared for a decrease in the plant power level to 400 megawatts, the lowest power level in recent history, and performed the evolution without any problems. (Section 01.1)

. The lack of a common understanding and rigorous communications between operations staff and laboratory personnel, as well as poorly defined record-keeping practices, resulted in two product withdrawal assay measurements not being performed within the i eight hour time interval required by Technical Safety Requirement 2.4.4.3. (Section 01.2)

. The inspectors identified several examples of weak control and oversight of ongoing activities by operations staff. Individually, none of the examples resulted in immediate safety issues. However, the inspectors determinea that the number of related issues were indicative of a weakness in the operations staff's coordination and control of l ongoing activities. (Section O1.3)

. The inspectors determined that an initial plan, developed in January 1998 to remediate a planned expeditious handling deposit, did not centained definite acceptance criteria or a i schedule for closure of the issue. As a result, plant operations with a planned expeditious handling deposit could continue indefinitely. To address the identified weakness in the initial plan, the plant staff deve'oped a revised plan with action _ steps and interim milestones to remediate or remove the deposit by a target date of October 1998.

(Section 01.4)

I Maintenance and Surveillance 4 l

. Numerous weaknesses were noted in a work package used to perform electrical installation work for a Building C-710 criticality accident alarm system modification. The l weaknesses included an incorrect quality class designation, control of modifications to

the drawings in the package, and inconsistent use of the lifted and landed leads protocol.

(Section M1.1)

. Plant staff took timely action in response to a problem with autoclave pressure l - relief system monitoring instrumentation identified at Portsmouth. The action included a conservative decision to apply calibration tolerances and accuracies for the pressure indicators involved to reduce the operational check to below the limit of 5 pounds per square inch gauge. (Section M1.2)

Enaineerina

. The inspectors identified a violation of the Quality Assurance Program, Design Controls that significantly contributed to problems encountered during installation of a Building C-710 criticality accident alarm system modification. The design control problems included inadequate identification of design assumptions, incorrect quality j classification of the installation work packages, and an incomplete description and review i ofinstallation procedures as a part of the design drawings. Installation problems 2

l )

encountered as a result of the design controlissues included an unplanned momentary challenge to the continued operability of inservice safety systems, weak operational and maintenance overview of modification activities, and repeated changes to the installation drawings. (Section E1.1)

Plant Support

. The inspectors concluded that, as of June 30, the certificate had completed all the corrective actions identified for a violation involving lack of proper marking and control of classified information (Enforcement Action 97-431). The inspectors had no further concems and considered the violation closed. (Section S1.1) i 3

(

t

' ~

Report Details

1. Operations 01 Conduct of Operations 3

.j 01.1 Cascade Power Level Decreast

a. Inspection Scope (88100)

The inspectors reviewed a decrease in the plant power load during the inspection period j from approximately 900 megawatts (MW) to 400 MW, the lowest power level in recent l l plant history.

I

b. Observations and Findinas The inspectors observed the plant staff perform decreases in the plant power level by I taking cells offline, evacuating and purging the uranium hexafluoride (UF.) from the cells,

i. and withdrawing the UF, from the cascade. The plant staff performed the process in a l well-executed manner. The power decreases were planned in detail and appropriately considered potential concems with changing nuclear criticality safety parameters, i solidification of UF, and plugging equipment, and maintenance issues associated with

. maintaining celis ready for retum-to-service. Operations staff reviewed applicable procedures ahead of the time for the scheduled cell shutdowns to ensure that all issues were addressed. Operations staff appeared knowledgeable of all requirements for cell shutdowns. As a result, the inspectors did not identify any problems during ined decreases to the 450 MW and 400 MW levels.

c. Conclusions Plant staff were well-prepared for a decrease in plant power level to 400 MW, the lowest power level in recent plant history, and performed the evolution without any problems.

l 01.2 Ep $ buildine.c-310 Product Withdrawal Assav Sample Analysis

a. ' Inspection Scope (88100)

I The inspectors reviewed the circumstances surrounding a UF, withdrawal assay sample l that was not analyzed and reported to the operations staff within the required eight hour l l- period due to issues with the testing of a newly installed criticality accident alarm system j (CAAS) in Building C-710 (Plant Laboratory).  !

b. Observations and Findinos ]

! Surveillance Requirement 2.4.4.3-1 of Technical Safety Requirement (TSR) 2.4.4.3, l " Cascade Equipment Assay Limitations," requires that the product stream assay be .

' measured twice per shift. TSR 1.3 defined "twice per shift" as an interval not to exceed i

eight hours. Normally, the plant staff relied upon continuous assay sampling machines in Building C-310 to measure the product assay to ensure the assay was maintained below the limit of 2.75 weight percent. However, when the two assay machines were out-of-service, plant procedures indicated that spot samples shall be taken and analyzed to meet the TSR surveillance requirement.

l l

1 On June 29, the plant operations staff discovered that two spot samples, taken because the Building C-310 assay machines were out-of service, were not analyzed and reported to the Building C-300 control room within the eight hour interval. Specifically, the interval between when the samples were taken and when the results were reported to Building C-300 was 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The intervalincluded portions of both the day and night shifts.

A complicating factor in performing a timely analysis of the fissile samples was that %

Building C-710 CAAS system had been declared inoperable in order to perform post-modification testing of a new CAAS system installed in the laboratory to meet the plan of action in Compliance Plan issue 8. As a result, the fissile samples could not be handled in the laboratory while the CAAS was inoperable. Operations management was aware of the competing needs to perform th9 analyses and continue the CAAS testing and had communicated an awareness of the competing needs to on-shift staff during the tumover meeting.

The review of the issue identified numerous shortcomings in the rigor of coordination and oversight of assay measurements between Buildings C-300 (Central Control Facility),

C-310 (Product Withdrawal), and C-710 (Plant Laboratory). The shortcomings included: i

1) the lack of a common understanding by Building C-300 operators and Building C-310 operators on how to schedule and track the required assay samples; 2) the lack of 4 common understanding by Building C-300 operators and Building C-710 personnel cr the required time interval for analyzing the assay samples and reporting the results to I

l operations staff; and,3) the lack of precise record-keeping criteria for recording when the assay measurement had been performed (sample times and analysis times were variously logged as the time for completing the TSR surveillance). In addition, the laboratory personnel did not always report the results to Building C-300 operators in ]

general, the inspectors rioted that management oversight of portions of the process existed; however, coordinated and comprehensive management controls were not

, de6ned.

The safety significance of the missed surveillance was limited, in this case, due to the current withdrawal assay of 1.1 weight percent and the time needed for a significant assay change (days to increase assay to 2.75 weight percent). In addition, the results of the samples did not indicate any significant change in the product assay. However, had the maximum assay been in the range of 2.75 weight percent, the delays in processing the samples could have been a pioblem. Plant staff subsequently issued more rigorous guidance on performing the entire measurement process within six hours, unless unusual circumstances were involved, and how to properly document completion of the j surveillance requirement. The failure to measure the withdrawal assay within eight hours

on June 2g is a Violation of Minor Significance not subject to formal enforcement action, consistent with Section IV of the NRC Enforcement Policy (NUREG-1600, Revision 1).- (NCV 70-7001/9801101)  ;

l

c. Conclusions j The lack of a common understanding and rigorous communications between operations l staff and laboratory personnel, as well as poorly defined recordkeeping practices, led to two product withdrawal assay measurements not being performed within the TSR ]

cpecified eight hour time interval.

5

01.3 Manaaement Oversiaht and Control of Operations

a. Inspection Scope (88100) l

( While following up on ongoing events and activities during the inspection period, the i inspecbrs reviewed aspects of management oversight and control of operations at the

( plant.

b. Observations and Findinas A. Locaina of Fire Protection Tank Level Overflow TSR 2.4.4.9, " Fire Protection System - High Pressure Fire Water Storage Tank,"

[ requires that the storage tank be maintained at least 90 percent full. The TSR l Limiting Condition for Operation (LCO) Action Statements requires that if the water levsl in the tank falls below 90 percent full, plant staff were to take actions to l restore the level to at least 90 percent within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. During the inspection period, the plant staff raised questions regarding the accuracy of the

instrumentation for monitoring tank level indications. As a result, the operations

! staff entered the Action Statements and met the water-level requirement by overflowing the tank every two hours. Overflow efforts were monitored by the cascade coordinator staffin Building C-300 and conducted by the utilitics operators l out in the plant.

During a review of the compensatory actions, the inspectors identified that logging of the overflow activities and managemer,t oversight of TSR compliance were inconsistent. Some overflow activities were logged in the Plant Shift I Superintendent's (PSS) log book, while others were tracked on a " yellow sticky l note" by one of the cascade coordinator's staff. ~ Following a change in the method for recording the completion of the overflow activities from the PSS log to the

" yellow sticky note," the onshift PSS staff were unaware that the data was not recorded in the PSS log for the previous shift. In addition, the cascade coordinator was unaware that the data was not recorded by the PSS during the previous shift.

Although none of the required overflow activities were missed, a consistent policy on how and where to track and monitor t% completion of TSR related compensatory actions was not evident %wd upon discussions with several operations managers.

B. Retum to Service of the Plant Air System for Puraina Activities On July 1, a high moisture alarm was received for Building C-335 air dryers due to the failure of a temperature controller earlier in the day. In accordance with the applicable nuclear criticality safety approval (NCSA) for controlling moderator in the plant air system, the PSS discontinued use of plant air for purging activities associated with equipment containing material enriched to greater than

1.0 weight percent. Subsequently, the PSS requested an engineering evaluation

of the impact of the high moisture condition and definition of the appropriate corrective actions required prior to resumed us6 of the system for potentially fissile purging activities.

An initial engineering assessment of the event determined that a failure in the air dryer recycle system had allowed a moisture laden air dryer to be placed into service, adding moisture to the plant air system. In addition, the moisture sensing 6

l

1 system associated with the air dryer was thermally overranged. Engineering Evaluation EV-C-822-98-020, Revision 0, dated July 1,1998, determined that the excess moisture, added to the plant air system as a result of the wet dryer being placed in service, would be removed from the system after approximately seven hours of normal operations using other available dryers. This information was communicated to the PSS and the system was retumed to service later that same day.

During a followup review of the system status and the PSS logs, the inspectors questioned if the moisture sensing gauge had been replaced prior to the system being retumed-to-service. The PSS performed a review of the system status which indicated that the moisture sensing gauge had not been replaced. However, the plant dry air system had not been used for purging equipment containing .

uranium enriched to greater than 1.0 weight percent since the system was ]

retumed-to-service. Therefore, no violation of the NCSA requirements had i occurred.~ Based upon outstanding questions regarding the acceptability of continued use of the plant dry air system with a thermally overranged moisture

)

sensing analyzer, the PSS declared the system inoperable pending replacement of i l the analyzer. )

The inspectors performed a further review of the engineering staff's handling of the initial assessment of the high moisture condition and their communications with operations staff. The inspectors determined that engineering staff had requested and received preliminary information from the vendor which indicated that a thermally overranged analyzer should respond conservatively. However, no formal documentation on the analyzer's performance was available. Therefore, engineering staff considered the analyzer to be degraded (inoperable) and I informally notified the plant operations of a need to replace the analyzer prior to retuming the system to service. The informal engineering staff communications were passed from one operations shift to another but were not documented in the

. shift tumover sheets. As a result, the later operations shift assumed the partial engineering evaluation for the event, which addressed only the system moisture content, allowed the system to be retumed-to-service.

l .The inspectors noted that neither operations nor engineering management had l sufficiently defined the steps necessary to ensure a proper and complete response l

to a plant dry air system high moisture system alarm.

C. Safety System Actuation of an Autoclave Water Inventory Control System j On July 6, during the routine heating of a feed cylinder in Building C-337A, )

Autoclave 1 East, the water inventory control system (WICS) actuated upon an I actual high water condition. The high water condition resulted from the programmable logic controller (PLC) being placed in the manual mode concurrent with the cylinder reaching the UF, triple point temperature.

In following up the event, the plant staff identified that the autoclave system engineer had inadvertently placed the PLC into the manual mode during an unrelated interrogation of the PLC. Operations staff authorized the system engineer to interrogate the system during the cylinder heatup. The system failed to the safe configuration; however, operations authorization of the system engineer's activities, work that could have been done with the system offline, was considered a weakness in the control of ongoing activities in that the actuation was an 7

unnecessary challenge to a safety system. Although system engineers had previously performed such interrogations of the PLCs without causing a safety system actuation, the potential for such an event did not appear to be a consideration for the authorization of the work.

D. Buildina C-710 Criticality Accident Alarm System Modification Work Authorization 1

During the last week of June, the plant staff performed final modification work for the newly installed CAAS system in the Building C-710 laboratory. During the +

work, an electrician landed a lead as part of the modification which caused a momentary CAAS alarm. The electrician astutely retightened the associated screws and ensured the continued operability of the system when the alarm cleared.

{

Following the event, the inspectors reviewed the modification work package and '

discussed the evolution with the Cascade Coordinator that had authorized the work. The inspectors determined that the modification work package did not specify entry into applicable TSR LCO Action Statements or clearly state the work controls used to ensure that systems, currently inservice and relied upon for safety, were maintained operable. During discussions with the Cascade Coordinator, the inspector was informed that the Cascade Coordinator relied upon the work package information to identify if the proposed work would affect inservice systems ,

and if any TSR LCO Action Statements were applicable. The Cascade Coordinator also indicated that he could not independently determine if the modification work package would affect inservice systems without a detailed and timely review of the modification work package. In addition, the Cascade Coordinator indicated the he did not believe that he had sufficient training and information to make such a determination based upon the limited information in the work package.

The inspectors co,cluded that although the inadvertent actuation of the CAAS alarms was quickly corrected, the potential for a more significant problem was evident by the operations staff's incomplete understanding of the scope of the work and the possible impact on safety systems prior to authorizing the work to begin.

(For additional discussion of this issue, see Section E1.1.)

c. Conclusions During the inspection period, several examples of weak control and oversight of ongoing activities by operations staff were identified. Individually, none of the items resulted in immediate safety issues. However, the inspectors concluded that the number of related j Issues were indicative of a weakness in the operations staff's coordination and control of I ongoing activities.

01.4 Planned Expeditious Handlina Deposit in Buildina C-335 l

a. InsDection ScoDe (88100) -

The inspectors reviewed the status of remediation activities for a planned expeditious handling (PEH) deposit, that is, a deposit of material enriched to greater than 1.0 weight percent which exceeded safe mass, in the Number 1 Purge and Evacuation Pump Gas Coo!er in Building C-335.

l 8

l t i

b. Observations and Findinas The plant staff discovered the PEH deposit in the Number 1 Purge and Evacuation Pump ,

in January 1998. Following the discovery, the plant staff correctly entered TSR 2.4.4.4, j LCO Action Statement A1 by ensuring that the deposit was maintained in a fluorinating environment and by developing a remediation plan for the deposit. The remediation plan ,

was completed in February 1998 and accepted by operations staff. Subsequent to )'

February 1998, the operations staff had treated the deposit in accordance with the plan.

However, as of July 20, the plant staff had rot been successful in remediating the deposit or obtaining a non-destructive assay scan that demonstrated that a PEH deposit was no longer present in the cooler. As a result, the plant staff continued to operate under the i LCO Action Statement.

The inspectors independently reviewed the remediation plant and noted that the plan I contained broad methodologies for handling the PEH deposit. However, the plan lacked detailed acceptance criteria and scheduling information necessary to ensure that the potentially safety-significant issue was resolved in a planned and focused manner. The plan appeared to allow the operations staff to continue operating under the LCO Action Statement with the deposit in place for an indefinite period.

In response to questions by the inspectors, plant management developed additional guidance to bring final resolution to the issue. The revised plan, dated July 16,1998, included more detailed action steps with target dates for remediating or removing the PEH deposit by the end of October 1998. The inspectors concluded that the amended plan appeared to preclude continued long-term operations with a PEH deposit.

c. Conclusions The inspectors determined that an initial plan, developed in January 1998 to remediate a planned expeditious handling deposit, did not contained definite acceptance criteria or a schedule for closure of the issue. As a result, plant operatior's with a planned expeditious handling depos;t could continue indefinitely. To address the identified weakness in the initial plan, the plant staff developed a revised plan with action steps and interim milestones to remediate or remove the deposit by a target date of October 1998.

08 Miscellaneous Operations issues 08.1 Certificate Event Reports (90712) i The certificate made the following operations related event reports during the inspection i period. The inspectors reviewed any immediate safety concems indicated at the time of l the initial verbal notification and also reviewed any subsequent retractions made. The .

Inspectors will evaluate the associated written reports for each of the events following l l submittal. ,

Number Status Title 34354 Closed Courtesy Notification of Hydraulic Oil Leak from Building C-333A Autoclave 4S Exceeding l Reportable Quantity (Not Reportable) 34446 Open Loss of Building C-300 Criticality Accident Alarm System Power because of 48-Volt DC Breaker Trip l

9

i l 34469 Open Process Gas Leak Detector Fired in Building C-310A i 34483 Open Safety System Actuation of the Building C-337A

!- Autoclave 1 East Water Inventory Control System 34492 Open Safety System Actuation of Building C-315 i

Normetex Pump High Discharge Pressure System 34496 Open Process Gas Leak Detector Fired in Building C-315 l 34498 Open Building C-310 Normetex Pump Release Detection System Failure 34507 Open Lightning Strike Caused Loss of Criticality Accident Alarm System Waming Lights for Building C-720 08.2 (Closed) Certificate Event Report 32048 (CER 70-7001/97002-10): Legacy G-17 valves I with unknown amounts of potentially fissile material not spaced in accordance with NCSA GEN-27. After a subsequent violation for this issue, the plant staff performed an extensive plant-wide walkdown to identify and properly space legacy equipment. After the walkdown and corrective actions for Violation 70-7001/97002-13 were completed, no further spacing problems for legacy equipment have been identified. The inspectors concluded the certificate's corrective actions were reasonable and considered the event report closed.

08.3 (Closed) Certificate Event Report 32128 (CER 70-7001/97002-11) and Certificate Event Report 32212 (CER 70-7001/97003-05): Actuations of the Building C-360 Autoclave Number 1 WICS due to an inadequate design of the drain system which included inadequate system venting and design control. The certifit.atee completed a number of correctivo actions, including drain inspections and foreign material removal, replacing check valves, revising maintenance and alarm response procedures, revising the operating procedure to preclude simultaneous startup of autoclaves connected to the ,

same drain and revising preventive maintenance requirements for the WICS condensate l probes. The inspectors concluded the certificate's corrective actions were reasonable

and considered the event report closed.

08.4 (Closed) Certificate Event Report 31897 (CER 70-7001/97002-06): Actuation of the Building C-333A Autoclave 1 North WICS due to a coiroded thermocouple extension wire as a result of a missing conduit cover. The certificate completed inspections of all feed facility thermocouple assemblies and replaced any missing covers, conducted crew briefings with instrument riechanics and operators on the event, and revised the conduct of maintenance procedure for assuring adequate configuration control. The inspectors concluded the certificate's corrective actions were reasonable and considered the event report closed.

08.5 (Closed) Violation 70-7001/97002-19: Failure to report a disconnected TSR required

- sprinkler pipe in Building C-331. The certificate developed an engineering basis for determining the deportability and operability of the high pressure fire water systems based on the lack of fire walls in the process buildings, incorporated the basis into system 10

training, and conducted crew briefings with the PSS and Cascade Coordinators. The inspectors noted there were subsequently no additional issues with improper reporting fire water system failures. The inspectors concluded the certificate'c corrective actions were reasonable and considered the violation closed.

08.6 (Closed) Violation 70 7001/97002-13: Failure to mark or rope off legacy equipment containing potentially fissile materials. The certificate revised the goveming NCSA and the implementing procedure to better specify the posting and spacing requirements for the equipment. In addition the plant staff conducted a plant-wide walkdown to identify and control legacy equipment. Training review groups for the various fissile material handling functions onsite updated the criticality safety training task analyses to ensure appropriate training to applicable NCSAs. The inspectors concluded the certificate's corrective actions were reasonable and considered the violation closed.

i'

11. Maintenance and Surveillance M1. Conduct of Maintenance and Surveillance  ;

M1.1 Buildina C-710 Criticality Accident Alarm System Modification Work

a. Inspection Scope (88102)

The inspectors reviewed selected aspects of the modification work performed to bring the Building C-710 CAAS system into compliance with current Safety Analysis Report and TSR requirements in accordance with Compliance Plan issue 8. The review included evaluations of the installed system and drawings, post-modification test results, and the following work packages:

1. Maintenance Work Package R 9801218-14, approved for start on June 18,1998

2. Maintenance Work Package R 9801212-16, approved for start on June 28,1998

b. Observations and Findinas The inspectors noted that the two work packages, one for the electrical installation work and one for the functional testing of certain instruments included in the system,

< demonstrated significantly different levels of quality. The work package associated with the electrical installation of new CAAS components for monitoring alarms in the Building C-300 Central Control Facility included numerous weaknesses. The weaknesses involved: 1) identification of the work as being "non-safety" for activities involving and interfacing with "Q" safety systems; 2) control of the modification drawings;

3) documentation and implementation of changes to the package in that the latest drawing revisions were not included in the package; and,4) inconsistent use of the plant's landed and lifted leads protocol. The inspectors did not identify any problems with the work package for post-modification testing.

Upon identification of the weaknesses in the work package for the electrical work, the pl ant staff initiated a thorough management review of the work package to determine the root causes for the weaknesses and to ensure timely corrective actions.

11

c. Conclusions Numerous weaknesses were noted in a work package used to perform electrical l Installation work for a Building C-710 CAAS modification. The weaknesses included an l incorrect quality class designation, control of modifications to the drawings in the package, and inconsistent use of the lifted and landed leads protocol. i f

M1.2 Followuo To A Portsmouth Surveillance Acceptance Criteria Issue j

a. Inspection Scope (85102)

The inspectors reuewed the plant staff's followup to an issue identified in a Portsmouth Gaseous Diffusion Plant problem report, dated June 8, dealir>g with pressure indicators in the autoclave pressure reliefline. In addition to discussions with plant staff, the review included: 4

1. Portsmouth Problem Report PR-PTS-98-03184, dated June 8,1998

2. Long-Term Order No. 98-11, Revision 0, "C-360 Rupture Disk Pressure," dated June 9,1998

3. Long-Term Order No. 98-12, Revision 0, "C-333A/C-337A Rupture Disk Pressure,"

dated June 9,1998 3

b. Observations and Findinas The Portsmouth engineering staff identified issues with the calibration and range of pressure gauges for the autoclave pressure relief line, in particular, Surveillance Requirement 2.1.3.6.1 of the TSR required a check of the pressure indicator installed in the cavity between the rupture disk and relief valve to ensure the pressure was no greater than 2.0 pounds per square inch gauge (psig) once steam was admitted to the autoclave.

The issues identified at Portsmouth included questions about the adequacy of the current calibration program for the pressure indicators as well as the adequacy of the ranges and tolerances for making a meaningful measurement of 2.0 psig.

Paducah staff followed up on the Portsmouth problem report and evaluated the adequacy of the calibration, accuracy, and tolerances of the instrumentation in the autoclaves at Paducah. A similar TSR required pressure of 5 psig or less was included in the Paducah operating procedure as an operational check of the pressure relief system operability. In reviewing current practices, Paducah engineering staff identified that the pressure indicators were calibrated appropriately, but the procedurally required ch6,ck did not l

include considerations of the calibration tolerances and accuracy of the instrument.

1 Although the 5 psig check was not a limiting control setting or safety limit, the operations staff conservatively decided to apply the methodology for establishing setpoints to the operational check. As a result, on June 9, two long term orders (LTO) were issued that l

required operators to ensure the pressure indicators for Building C-360 autoclaves were l less than 4 psig and the pressure indicators for Buildings C-333A and C-337A were less L than 3.0 psig prior to initiating a cylinder heat cycle. Discussions with feed facility ,

l operators during building tours indicated that the operators were aware of the l requirements in the LTOs.  !

1 12

I

) .

c. Conclusions Plant staff took timely action in response to a problem with autoclave pressure relief system monitoring instrumentation identified at Portsmouth. The action included a conservative decision to apply calibration tolerances and accuracies for the pressure indicators involved to reduce the operational check to below the limit of 5 pounds per j square in gauge.

Ill. Enaineerina I l

l E1. Conduct of Engineering f

E1.1 Buildina C-710 Criticality Accident Alarm System Modification l

a. Inspection Scope (88100)

The inspectors reviewed the engineering modification package, developed to upgrade the l

Building C-710 CAAS and related materials, t

l

b. Observations and Findinas During the inspection period, the certificate experienced several operational problems

related to the installation of the Building C-710 CAAS modification. As a result of the l'

t recurring problems, the inspectors reviewed the information and materials developed as a part of the modification process. The materials reviewed included the design modification package, the design input and output checklists, the design installation and verification specification, the design drawings, and related engineering evaluations and notices.

l l The inspectors noted that the design modification paperwork indicated that the l modification was a safety-related, "O," activity. However, the problems recently i experienced were with work activities designated as nonsafety-related. The inspectors i discussed with engineering management the nonsafety-related designation for the inrlividual work activities and were informed that the work should have been designated and processed as a safety-related activity. The inspectors also determined that f designation of the work activities as safety-related would have been consistent with

[ current quality and work control processes. In addition, designation of the modification activities as safety-related would have increased the level of review and oversight of the procedures and instructions used to direct the work efforts. The inspectors determined that the nonsafety-related designation was made without consideration of the impact the l work could have other safety-related systems.

The inspectors reviewed the design input and output checklists and concluded that the checklists did not identify critical functional interfaces associated with installation of the modification. Specially, Section 11 of the input checklist did not identify TSR limitations or special operational modes required for installation of the modification instead, the input checklist only noted a requirement that Building C-710 remain operational during the installation process.' As a result of the failure to specify specific functional interfaces for the modification, the negative impact the installation process could have on the inservice criticality accident alarm systems, monitored in Building C-300, was not identified until the systems were momentarily affected by an electrician lifting a lead during the installation process.

l i

13 l

1

_ . _ - - . _ _ _ _ - - - _ . - - _ _ - _ _ _ _ . _ _ _ ._-- N

Subsequent to the electrician's actions which momentarily affected the inservice safety systems, engineering management reevaluated the installation process and identified other upcoming actions which could also affect the inservice systems. The re-evaluation was documented in an engineering evaluation and provided to operations staff a few days after the initial operational issue. However, the inspectors noted that the installation process was not halted, pending completion of the evaluation. Instead, engineering staff recommended that the modification work package should be revised to request operations management to enter the appropriate TSR Action Statements for the remainder of the work. The inspectors also noted that the engineering evaluation did not include information as to which systems would be affected by the remaining work or at what point in the process the TSR Action Statements should be entered.

The inspectors reviewed the design installation and verification specification for the modification. Engineering staff developed the specification to document the expected sequence of events for installation of the modification, to identify the specific procedures or drawings to be used for the installation activities and to identify any precautions or limitations necessary during the installation efforts. The work control organization used the specification to develop field work packages for the modification. The inspectors noted that the specification did not define operational mode limitations for the work and did not include a precaution statement which indicated the impact the modification could have on other operating systems, in addition, the specification did not identify the specific version of the modification drawings to be used for the work.

Finally, the inspectors reviewed the design drawings which specified the work necessary for installation of the modification. The inspectors determined that the drawings did not include sufficient information be which to identify where the existing system ended and the where the modification bef, The drawings included only a minimal amount of information relative to the potenwl impact of the work on operating systems. During discussions of the drawings with engineering management and staff, the inspectors concluded that the drawings, though approved by engineering management, had not been provided to or approved by the Plant Operations Review Committee (PORC).

Although PORC approval of the drawings, as the procedural method for installation of the modification, was required, the inspectors determined that it would have been unlikely for the PORC to identify the installation process weaknesses observed due to the limited type and quality of information included on the drawings.

l Title 10 of the Code of Federal Regulations, Part 76.93, " Quality Assurance," requires, in part, that the Corporation shall establish, implement, and maintain a Quality Assurance Program. Section 2.3, of the Quality Assurance Program, " Design Control," required, in part, that design requirements shall be correctly translated into design output and procedural documents of adequate quality to support facility installation and operation.

The failure to identify and adequately translate design requirements associated with installation of the Buisding C-710 criticality accident alarm system, including quality classification, operational mode limitations, and work procedures, into the design output documents and drawings, is a Violation of the Quality Assurance Program (VIO 70-7001/98011 02).

l c. Conclusions The inspectors identified a violation of the Quality Assurance Program design control requirements that significantly contributed to problems encountered during installation of a Building C-710 CAAS modification. The design control problems included inadequate identification of design assumptions, incorrect quality classification of the installation work 14

a packages, and an incomplete description and review of installation procedures as a part of the design drawings. Installation problems scountered as a result of the design control issues included an unplanned momentary challenge to the continued operability of inservice safety systems, weak operational and maintenance overview of modification activities, and repeated changes to the installation drawings.

IV. Plant Suonort S1 Conduct of Security and Safeguards Activities S1.1 Control of Classified Information

a. Inspection Scope (88100)

The inspectors reviewed plant staffs completion of corrective actions for a violation

- involving a failure to properly mark and control classified information (Enforcement Action 97-431).

b. Observations and Findinos in response to Violation 70-7001/97007-09 involving a lack of control of classified materials, the plant staff initiated a thorough sweep of all buildings and structures in the area under control by the United States Enrichment Corporation. The process identified and controlled suspect materials until the materials were either determined not to be classified or were properly marked and controlled as classified information. The potential l

generic impacts of each finding were assessed across the plant and prompt corrective measures were implemented to gain control of any similar information out in the plant.

In addition to the actua! sweep for classified materials, new training was provided to all staff to ensure that the definition of classified information and its application to Paducah was well understood. The effectiveness o'the training was evident when non-security i

staff subsequently identified information requiring control and documentation.

Plant management concluded that all materials that had not been proper 1y controlled in various buildings at Paducah were properly identified and controlled as of June 30. As a result of the new training for all staff, dedicated and individual staff building sweeps, and dedicated reviews of potentially classified information, the inspectors concluded that the certificate had completed the corrective actions identified in response to Violation 70-l 7001/97007-09. This violation is considered closed.

c. -Conclusions The inspectors concluded that the certificate had completed all the corrective actions identified for a violation involving lack of proper marking and control of classified information (Enforcement Action 97-431) and had no further concems.

S8- Miscellaneous Security issues S8.1 Certificate Security Reports (90712)

The certificate made the following security-related one hour reports pursuant to 10 CFR 95 during the inspection period. The inspectors reviewed any immediate security concems associated with the report at the time of the initial verbal notification.

15

Date Title 6/8/98 Uncleared Foreign Nationals improperly Admitted to Controlled Access Area V. Manaaement Meetina X. Exit Meeting Summary The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on July 20. The plant staff acknowledged the findings presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

l l

16

PARTIAL LIST OF PERSONS CONTACTED Lockheed Martin Utility Services (LMUS)

M. A. Buckner, Operations Manager

• L. L. Jackson, Nuclear Regulatory Affairs Manager

• S. R. Penrod, Enrichment Plant Manager

• H. Pulley, General Manager United States Departmerit of Enerov (DOE)

G. A. Bazzell, Site Safety Representative 1

United States Enrichment Corocration

)

! *J. A. Labarraque, Safety, Safeguards and Quality Manager

• J. H. Miller, Vice Pusident - Production U.S. Nuclear Reaulatory Commission (NRC)

• J. M. Jacobson, Resident inspector

• K. G. O'Brien, Senior Resident inspector

• Denotes those present at the July 20,1998, exit meeting.

Other members of the plant staff were also contacted during the inspection period.

INSPECTION PROCEDURES USED IP 88100: Plant Operations IP 88102: Surveillance Observations IP 90712: In-office Review of Events 1

l l

t 17 i

f ITEMS OPENED, CLOSED, AND DISCUSSED Opened 34446 CER Loss of Building C-300 CAAS power due to 48-Volt DC breaker trip 34483 CER Actuation of Building C-337A WICS 34498 CER Building C-310 Normetex release detection system failure 70-7001/98011-01 NCV Minor violation for failure to perform a timely assay analysis as required by the Technical Safety Requirements 70-7001/98011-02 VIO Failure to property implement the Quality Assurance Program design control requirements 34469 CER Process gas leak detector fired in Building C-310A 34492 CER Building C-315 high discharge pressure system actuation 34496 CER Process gas leak detector fired in Building C-315 34507 CER Lightning strike caused loss of Building C-720 CAAS Closed 70-7001/98011-01 NCV Minor violation for failure to perform a timely assay analysis as required by the Technical Safety Requirements 34354 CER Courtesy notification of hydraulic oil leak 70-7001/97002-10 CER Legacy G-17 valves not properly spaced 70-7001/97002-11 CER Actuation of Building C-360 autoclave WICS 70-7001/97003-05 CER Actuation of Building C-360 autoclave WICS 70-7001/97002-06 CER Actuation of Building C-333A autoclave WICS 70-7001/97002-19 VIO Failure to report disconnected sprinkler pipe in Building C-331 70-7001/97002-13 VIO Failure to mark or rope off legacy equipment 70-7001/97007-09 VIO Failure to properly mark or control classified information Discussed None L

18

t .

LIST OF ACRONYMS USED CAAS Criticality Accident Alarm System CER Certificate Event Report CFR Code of Federal Regulations DNMS. Division of Nuclear Materials Safety DOE Department of Energy

.LCO Limiting Condition for Operation LTO Long Term Order MW Megawatts NCSA Nuclear Criticality Safety Approval NCV Non-Cited Violation NMSS Nuclear Material Safety and Safeguards NOV Notice of Violation NRC Nuclear Regulatory Commission PDR Public Document Room PEH Planned Expeditious Handling PLC Programmable Logic Controller PORC Plant Operations Review Committee PSIG Pounds Per Square Inch Gauge PSS Plant Shift Supervisor TSR Technical Safety Requirement UF, Uranium Hexafluoride USEC United States Enrichment Corporation VIO Violation WICS Water inventory Control System l

1 19

_ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _