ML20247H311
| ML20247H311 | |
| Person / Time | |
|---|---|
| Site: | Westinghouse |
| Issue date: | 09/01/1989 |
| From: | Mcalpine E, Troup G NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20247H307 | List: |
| References | |
| 70-1151-89-06, NUDOCS 8909190281 | |
| Download: ML20247H311 (22) | |
Text
,.' i "su c q. p a
. -$iD KEa+,,
UNITED STATES M~
' o
. NUCLEAR REGULATORY COMMISSION w
c
>[
p3
. REGION il J
g-
' 101 MARIETTA STREET.N.W.
' ATLANTA, GEORGIA 30323 '
%..... /
.- c i
v Report No.i' 70-1151/89-06
.Licens Westinghouse Electric Corporation Commercial Nuclear Fuel, Division Columbia, SC 29250
- Docket No.:
70-1151 License No.: SNM-1107
' Facility Name: Westinghouse Electric Corporation Inspection Conducted: July 31 - August 4, 1989 b
9 Ts4 l
er:
G. L. Troup, FueV Facility Project Inspector
~
Date Signed:
Team' Members: :J.'L. Kreh, Radiation Specialist W. S..Pennington, Health Physicist
~ Accompanying Personnel:
t W. E. Cline, Chief, Nuclear Materials c
. Safety.and Safeguards Branch,LRegion II Approved by:
M I
9
~
E. J.,McAlpilYe, Chief T
Date Signed
~ Radiation Safety Projects Section
' Nuclear. Materials Safety and Safeguards Branch Division of Radiation Safety and Safeguards
SUMMARY
Scope:
- This. special, announced Operational Safety Asses; ment was conducted in the areas of management controls, contingency planning, chemical process safety, and maintenance and surveillance testing to assess' the' licensee's ability to identify, prevent or mitigate the consequences of an accident.
Results:
The team determined that the-licer ue has implemented programs to identify possible accidents or process factors which could lead to an accident, maintain important-equipment and. instruments so they operate as required, train personnel, and maintain an emergency response capability.
Three' strengths were id3ntified in the program:
1.
- A strong management commitment to maintaining a safe work place.
8909190281 spopoi
{DR: ADOCK 07001151 i
'FDC
2 2.
A working inter-relationship between groups ct all levels which strengthens the timely identification and resolution of problems.
3.
A commitment to providing quality training to all personnel.
Two areas were identified which should be included in the license renewal application which will submitted in May 1990 (which are addressed in the report details as " renewal items").
1.
The Site Emergency Plan should address the assessment and mitigation of accidents involving hazardous radioactive chemicals, and the release of radioactive materials caused by fire, explosion or accidents involving other hazardous materials. This is in addition to revising the plan to address the new requirements for emergency preparedness for fuel-cycle facilities, which becomes effective April 7, 1990 (paragraph 4e)-.
2.
The system descriptions and accident analyses in the license renewal should be expanded, particularly for the ADV process, and the evaluations should incorporate both radiological and non-radiological factors (paragraph 7f).
No violations or deviations were identified.
l l
1 f
1
1
~ '
1 r
m REPORT DETAILS
- 1; Persons Contacted-Licensee Employees
- *J. B' Allen, Jr. Manager,, Technical ' Services
- R. J. Allen, Manager, Process Engineering D. R. Close, Supervisor, Maintenance
- L. W. Davis Supervisor, Regulatory Operations T. L. Davis, Manager, Employee Relations and Training R. Dereani, Supervisor, pellet Manufacturing W. M.-Ergle, Team Manager, map Operations
- R. E. Fischer, Senior Regulatory Engineer B..E. Garrett, Facilities Engineer
- W. ' L.. Goodwin, Manager, Regulatory Affairs M. L. Greenwald, Facilities Engineer-
-*J. W. Heathi 'Jr., tien&ger, Regulatory Operations R. W. Henry, Process Engineer.
C. C. Hightower, Document Control Administrator J. B.~ Hooper, Safety Engineer J. Hubich, Manager, Chemical Manufacturing E. E. Keelen, Manager, Manufacturing
- G. D. LaBruyere, Manager, MAP Operations B. D. Lewis, Supervisor, Conversion and Scrap Reprocessing
- E. P. Loch, Plant Manager
- G. T. Lowder, Manager, Maintenance
- R. D. ' Montgomery, Senior' Regulatory Engineer
~
- E. K. Reitler, Jr. Manager, Regulatory Engineering M. ' L. - Ruhl, Supervi sor,' Maintenance -
M. R. Sprinnata. Supervisur, IFBA Project E. J. Steck, M.-ger, Conversion and Scrap Reprocessing N. Stevenson, Superv'.sor, Conversion and Scrap Reprocessing R. D.. Young, Supervisor, Maintenance
- Attended Exit Interview Acronyms and Initialisms used throughout this report are listed in the L
last paragraph.
2.
Assessment Scope a '.
Outside' Agencies The South Carolina Department of Labor, Division of Occupational.
Safety and Health was invited to participate in the assessment, but declined because of other priorities.
Additionally, they had conducted an inspection in February 1988 which did not identify any problems. The licensee's safety and health program was evaluated as "Above Average "
~>
'4 2
The state inspection' report was reviewed during the planning of the assessment! Based on the extent of the inspection, and the lack of findings, it was, decided that industrial safety, chemical safety (not related to radioactive materials) and industrial hygiene had been adequately addressed and need not be covered by the assessment.
The Environmental Protection Agency was also contacted regarding participation in the assessment, but did not respond, b.
Assessment Methodology The assessment involved identification of accident potential s, determination of the adequacy of controls to prevent accidents, review of licensee's maintenance and surveillance programs which assure that controls would be operative to prevent an accident, and assessment of the licensee's ability to mitigate the effects and consequences should an accident occur. Programmatic assessments were performed of management controls, emergency contingency plans, process safety, and maintenance and surveillance testing (instruments and controls).
The assessment consisted of interviews / discussions with cognizant personnel, tours of portions of the facility, and review of appropriate procedures and records, c.
Other Inspections Routine inspections conducted by the Region II staff during FY89 have addressed areas which could have been included in the assessment.
Because no significant problems were identified in these inspections, and the programs were found to be acceptable, these functional areas were not included.
Rather, the results of the inspections were considered in the overall assessment. The areas previously inspected were:
(1) nuclear criticality safety [ Reports 70-1151/88-17 and 89-03]
(2) ALARA and radiation protection [ Report 70-1151/89-01]
(3) fire protection and fire safety [ Report 70-1151/89-02]
)
(4) effluent control and environmental ronitoring
[ Report 70-1151/89-04]
3.
Management Organization and Controls (88005) a.
Organization structure The Plant Manager is responsible for the safe operation of the Columbia Plant.
Line managers are assigned responsibility for the safe operation and control of activities in their functional areas.
Shift supervisors and team managers are first-level managers and supervise operating personnel in the ammonium diuranate (ADU) and Manufacturing Automation Product (map) lines, respectively.
In the MAP line, the licensee has implemented a self-managing concept in place of' traditional direct management styles. Operating personnel l
3 are organized into semi-autonomous teams which increases each operator's responsibility.for scheduling, product quality, and safety in his or her functional area.
however, the line managers remain responsible for ensuring that operations are safe and that operating personnel are adequately trained and qualified to perform their assigned tasks.
b.
Management Communication (1) The Columbia Plant is an operating component of the Westinghouse Commercial Nuclear Fuel Division (CNFD) which is headquartered in Pittsburgh, Pennsylvania.
The inspector reviewed the CNFD policy which provides safety objectives to be implemented at the Columbia Plant.
The objectives direct management to maintain (a) exposures as low as reasonably achievable (ALARA); (b) facilities in accordance with safety standards and practices to ensure that exposures are ALARA; (c) plant operations in compliance with Federal, State, and local regulations; and (d) pertinent safety records.
The inspector interviewed several managers and supervisors to discuss the organizational structure, delineation of responsibilities, and management involvement in day-to-day operations and safety issues.
(2) The Plant Manager meets weekly with upper-level managers to discuss corporate directives, operations, safety items identified by the Regulatory Compliance Committee, status of previously identified items, and the completion of corrective actions.
Upper-level managers meet with mid-level and first-level managers at unspecified frequencies or on an as needed basis to discuss various topics including items significant to safe operations in their areas of responsibility.
i First-level managers and senior operating personnel meet with j
their counterparts during each shift change to discuss operating conditions and safety concerns identified during the off going shift.
Operations personnel and the supporting safety staff work jointly to resolve safety issues and licensee identified deficiencies.
(3) In addition, the inspector reviewed the Strategic Implementation Plan which outlines the allocation of resources and capital I
appropriations for operational and safety initiatives projected i
for the next fiscal year. The plan is updated annually by a team of operations and safety managers.
The Columbia Plant I
management has also established an implementation team consisting of managers and engineers in anticipation of a revision to 10 CFR Part 20.
l 2_
+ : y 4-h (
g
- c.
' Procedures'and Pi,edural Control.
(1). The ' inspector reviewed selected administrative,. operating, maintenance, and safety ' procedures utilized at the Columbia Plant.
Procedure CA-002, " Columbia Plant Policy and Procedure System," establishes the policy and procedural. system. for the departmental administrative manuals and operating procedures.
The procedure outlines the responsibilities of departmental managers to establish administrative and operating procedures, requirements for the review and approval of procedures, and controlled distribution of new and revised' procedures.
')
1 Administrative procedures define departmental and managerial responsibilities and interfaces between the different departments. Operating procedures provide step-by-step outlines of-production activities and required safety items, activities, and-precautions.
Maintenance procedures consist of technical information on plant equipment, manufacturers' manuals, safety lock-out steps, and general safety requirements. The Regulatory Affairs Procedures Manual contains the procedures for the administration of the radiation,. nuclear criticality,.and industrial safety programs.
Operating procedures for specific activities performed by safety personnel are provided. in the Regulatory. Operations Operating ' Procedures Manual. ' New and revised operating and maintenance procedures
^e normally originated by. engineering staff assigned-to a am *tment. The
' new or revised procedure is reviewed and approve 6.>y. line and safety managers responsible for its preparation, in.plementation,
. quality control, and safety requirements.
The engineer j
originating the. procedure is responsible for coordinating his efforts -with the first-level managers and safety engineers.
Operating procedures are reviewed for adequacy at least every two years.
The inspector interviewed the Document Control Administrator who is responsible for ensuring that operating procedures have the proper format, approvals, and distribution, Sign-off sheets are used to acknowledge that distributed procedures have been received and reviewed by operators.
In MAP operations, procedures are computerized. Electronic signatures indicate the receipt and review of operating procedures.
(2) The safety component at the Columbia Plant is the Regulatory Affairs Department which consists of the Regulatory Engineering and Regulatory' Operations sections.
The Regulatory Affairs Procedures Manual contains the administrative and general procedures for the department. The procedures are prepared by J
Regulatory Engineering and are approved by the Managers of Regulatory Affairs and Regulatory Engineering, and the Plant Manager. The Regulatory Operations Operating Procedures Manual consists of th.e operating procedures utilized by the Regulatory Operations section. The procedures are reviewed and approved by
.)
1
=_
_ _a
p 5
the originator and Managers within the Regulatory Affairs Department. All procedures of the safety function are reviewed annually for adequacy.
Each section of the department is responsible for distributing and tracking new and revised procedures to ensure review by the safety engineers and technicians prior to implementation.
(3) The industrial safety component of the Regulatory Engineering section provides guidance to plant menagement and supervisors on industrial hygiene, industrial safety and fire protection.
Policies and procedures addressing these areas are provided in 1
the facility Safety Manual. The Safe Working Practices Handbook is given to new employees and provides comprehensive instruction on industrial safety in the workplace.
d.
Audits and Inspections (1) The inspector interviewed the Manager, Regulatory Engineering, to discuss internal and external audits and inspections.
Procedure RA-102, " Plant Inspection Program for Regulatory Compliance," provides requirements for the routine Regulatory Affairs inspection.
The inspection is conducted weekly to review manufacturing areas within the facility.
The inspection team includes the cognizant line and first-level managers for each area and Regulatory Affairs personnel with specialties in safeguards, nuclear criticality safety, radiation safety, and industrial safety.
A monthly report to plant management summarizes the inspection
- findings, trends, recommended corrective actions, individuals assigned responsibility for taking corrective actions, scheduled completion dates, and status of previously identified items.
(2) Safety programs are audited by the Regulatory Engineering staff.
The Manager, Regulatory Engineering, stated that each engineer's
]
yearly perforrrance objectives includes a schedule for auditing i
specific safety programs.
The licensee representative produced an engineer's performance records containing a current audit schedule.
Once a program has been audited, the engineer's findings and recommendations are placed in the Commitment Tracking System (CTS) along with the assigned implementor for the recommended corrective action, scheduled completion date, and assigned follow-up auditor. A monthly CTS Summary Report is I
provided to the assigned individuals, Regulatory Engineering Manager, and the responsible line manager, if necessary.
(3) Upper-level line managers, including the Plant Manager, conduct informal walk-through inspections on a rotating basis.
These inspections are conducted on all shifts.
In addition, the licensee has established the Safety Observer Progcam which
ti d
6 l
l provides selected operating personnel with special industrial j
{
safety training.
These operators are located throughout the plant to identify safety problems 'and poor safety practices i
while performing. their manufacturing duties.
)
1 (4) The corporate Environmental Affairs Department conducts an audit j
every 3 years at the Columbia Plant in the areas of industrial hygiene, fire protection, and chemical safety.
A separate corporate team conducts audits and inspections in the area of radiation safety. Columbia Plant management is also required to condua a comprehensive annual self-evaluation of facility activities based on a corporate check-list.
(5) The Columbia Plant is also audited and inspected by their insurer and officials from the State of South Carolina.
The findings of the insurer and State along with items identified by NRC are incorporated into the CTS to track the status of correction actions and follow-up reviews.
e.
Safety Committees (1) In the license, the licensee has committed to maintain the Regulatory Compliance Committee (RCC).
The RCC establishes plant policies in the areas of radiation protection, nuclear criticality. safety, environmental protection, emergency preparedness, nuclear materials accountability and safeguards, industrial hygiene and safety, fire protection, chemical process f
safety, regulatory compliance, review and evaluation of safety l
hazards (10 CFR Part 21), and risk management. RCC members are I
appointed by the Plant Manager and ~ consists of upper-level line managers and Regulatery Affairs managers. The committee meets at least quarterly to review items which effect the above areas.
Meeting minutes document the RCC's conclusions and recommendations which are reported directly to the Plant Manager.
The RCC's identified items and recommendations are incorporated into the CTS for tracking and follow-up.
The inspector reviewed ALARA Reports which are submitted every 6 I
months to the Plant Manager and provide the results of analyses
)
of personnel exposures and effluent release data to determine any trends. The reports also describe actions taken to maintain exposures and effluents concentrations ALARA.
j I
(2) Two subcommittees of the RCC are the Airborne Reduction Team j
(ART) and the Risk Management Committee (RMC).
ART meets at least monthly to review airborne radioactivity controls and personnal exposure reductions.
The team members consists of mid-level and first-level managers, selected Regulatory Engineering, ventilation, process, and facility engineers.
The team is chaired by a line manager.
Airborne
a
\\-
^
7 concentration obsectives are selected annually for o. manufacturing areas, with subteams assigned responsibility for solving problems with administrative and engineered controls. The ART meeting minutes are distributed to the RCC and selected line managers. The minutes provide.the current status of reduction efforts.
RMC meets on an unspecified basis to provide a mechanism for the
. continuing evaluation and assessment of risks associated with plant operations, and prior to implementation of plant modifica-tions.
Consideration is given to (a) risks posed to plant personnel, the public, and environment; (b) the potential for adverse public impact; and (c) the risk of business or financial loss to the company. When an unacceptable risk is identified,
.line managers are assigned responsibility for taking corrective actions to eliminate or reduce the risk in accordance with a predetermined completion schedule and for performing follow-up reviews.
RMC meeting minutes are reported to the RCC and include the status of corrective actions.
The RMC is appointed by the Plant Manager and co-chaired by the Manager, Regulatory Affairs, and the Assistant to the Plant Manager.
Mercbership consists of selected managers from Regulatory Affairs and the manufacturing departments.
f.
The Columbia Plant organizational structure appears adequate to conduct safe operations at the site.
The organization structure includes clearly delineated responsibilities and duties for various positions and provides for an. effective separation of safety and regulatory ccmoliance functions from production oriented functions.
Interviews with management personnel indicate a good attitude toward, and involvement in, operational safety.
Several audit and inspection mechanisms are utilized to provide continuing evaluations of licensed activities for upper-level management. In addition, the licensee has developed an extensive set of operating and safety procedures and administrative controls to assure that the procedures are properly maintained and implemented.
No violations, deviations, or renewal items were identified.
4.
Radiological Contingency Planning (88050) l a.
This area was reviewed to determine the adequacy of the licensee's Site Emergency plan (SEP) and associated emergency procedures, particularly with respect to the fcilowing two general categories of l
accidents:
(1) a release of radioactive hazardous chemicals; and (2) a release of radioactive material resulting from fire, explosion, or other accident with non-radioactive material.
NRC guidance for addressing these types of accidents is presented in the form of a L
l
4 8
t.
s
" Branch Technical Position on Chemical Safety for Fuel Cycle Facilities," published in the Federal Register on March 21, 1989.
b.
The inspector to'ured the various processing and manufacturing areas of the plant where radioactive material was handled, including the IFBA facility. No unusual plant conditions were observed which neight contribute to a significant accident of a type not previously postulated in the SEP.
c.
The inspector conducted an extensive review of the SEP and its implementing procedures. Both the plan and the procedures addressed I
the following types of accidents:
release of toxic fumes or vapors fire criticality release of radioactive material explosion 1
uranium hexafluoride release Cursorily discussed in Section 3.2.4 of the SEP, and not addressed in the emergency procedures, were such natural phenomena as eart.hquakes, high-winds (especially tornadoes), and floods. The possible impacts of such events were not mentioned in the SEP discussion.
Simply
~ dismissing earthquakes and floods at the plant as improbable is not consistent with prudent planning for emergencies.
These types of disasters could produce combinations of hazardous plant conditions not likely to arise under any other circumstances, and should be analyzed in the SEP and addressed in the implementing procedures.
d.
The possibility of hazardous chemicals in an offsite location posing a risk to the licensee's operations was reviewed.
No industrial facilities or railroad lines were present within four miles of the j
- plant, according to area maps and statements by licensee j
l representatives.
Risks to plant operations from accidents involving the transportation of hazardous chemicals on Highway 48 (Bluff Road) were considered negligible, since that road was about 0.5 mile from the plant at its closest point.
e.
The licensee had not yet begun the process of revising the SEP to address the requirements of the new rule (effective April 7,1990) on emergency preparedness for fuel-cycle facilities, although the rule had been reviewed and principal changes noted.
The inspector discussed with cognizant licensee representatives various aspects of the new rule, including format changes (none will be required) and the timing of the submittal of the revised SEP. The revision of the i
f.e-____._-_______-__-_____
Y
, os. -
.r:V;,
(
,I.-
e 4
a O
4 I
I
'. ]
I
]
f.
v
(
'\\_
l+ \\.
I,
't.,
M*
F
' t
,h, l
i 3
i l
e.
9 l
SEP to incorporate the items discussed herein is classified as a Renewal Item.
No violations or deviations were identified.
5.
Training (88010) a.
Procedure CA-005, " Columbia Plant Training Policy," ' establishes the policy and procedures for training and qualification of operations, support, management, and professional personnel.
New ecployees and contract personnel receive an orientation on radiation and nuclear criticality safety, health risk essociated with radiation exposure, and emergency alarms and response actions.
Operating personnel also receive safety training in-the areas of industrial safety, chemical handling safety, Material Safety Data Sheets, and personal protective equipment.
Personnel who will be
, forking with radioactive material receive additional safety and respiratory protection training and are tested. These individuals are retrained and retested every two years.
The Regulatory Engineering section maintains test results.
i b.
Following the initial orientation and safety training, operating personnel receive on-the-job training (0JT) in their assigned job function with an experienced operator or qualified trainer.
This process familiarizes the trainee with the wcrk and equipment prior to formal procedure training and testing. Upon successful completion of testing, the trainee returns to DJT. The trainee works under direct supervision until approved to work independently by the first-level manager. First-level managers are also responsible for ensuring that operators are qualified on new and revised procedures prior to implementation.
Records of training and qualifications are maintained within the individual's department.
Retraining is required every two years.
In addition, the licensee provides an incentive for additional training by compensating operators for increased job qualifications, j
c.
Following the initial orientation, maintenance personnel receive special radiation protection training, in addition to spectfic I
functional training which is provided in-house or by vendors. The first-level manager determines an individual's qualification level based on his or her training and experience.
d.
Procedure RA-105, " Regulatory Affairs Indoctrination and Training,"
defines the indoctrination and training program for Regulatory Affairs personnel. These individuals are trained in the Regulatory Affairs and Regulatory Operations Procedures Manuals, the license, NMM Critical Procedures Manual, and applicable Federal regulations and plant polic,es depending upon an individual's assigned task. New technicians in the Regulatory Opera +1ons section are placed with experienced technicians for familiarization with the section's i
i j
x%
) ;,.
y.
~
'10-
?
-' responsibilities. Upon completion o' the training, the technician is tested in"the area for which he or she is assigned. To verify that new or L revised Regulatory 0perations procedures have been received.
and f reviewed by technicians,. sign-cff sheets are provided.
The completed sheets are maintained witMn the sectior..
Q
- 3*
In addition to the Regulatory Affairs training, nuclear criticality safety 'engineersicomplete additional training in nuclear criticality safety prior to - performing the. job function.
The. training is documented with a formal checklist which requ'res departmental f
management approval upon completion, e.
The training-programs at the Columbia Plant appear adequate to assure v
upper-level management that the operating and safety functions are staffed with trained and qualified individuals. Mechanisms are in place for' documenting training, determining effectiveness, and ensuring that training is received prior to implementing procedures.
Administrative controis provide requirements for retraining operating personnel. Communication between all levels of management, including
~ the first-level managers, senior operating personnel, and MAP teams allows both management and operating personnel to. be adequately informed about safety concerns and findings 'of audits and inspections.
No violations, deviations or renewal items were identified.
6.
Emergency Respense Training (88010) a.
The licensee maintained an Emergency Brigade, (EB) composed of
-approximately 75 volunteers who were.. trained to respond to 4mergencies involving fire,L hazardous mate rial s',
and personnel injuries.
An ' inspector discussed EB. training. with the Regulatory Engineer who had' primary responsibility in this area.
u b.
The' licensee was in the process of revising the.EB training program.
The recently issued NRC Branch Technical Position on fire protection for fuel-cycle facilities was being factored into this revision. The licensee was.also working on methods of fully addressing applicable National - Fire Protection Association (NFPA) codes and standards,-
.particularly NFPA 600 (formerly NFPA 27). " Recommendations for Organization. Training, and Equipment of Private Fire Brigades". All of the " typical subjects" for training listed in NFPA 600 were expected to be covered during a two year cycle.
c.
According to the referenced licensee representative, 24 Conversion Area operators and 18 MAP operators formed the " backbone" of the EB because of their familiarity with the manufacturing areas 'and the hazards of uncontained radioactive materials.
Section 3.2.2 of the SEP stated that the Emergency Brigade was " thoroughly indoctrinated" in the Lechniques to be used in fighting fires involving radioactive matera11. Review of procedure CSEP-0003, Revf sion 6, " Fire C9ntrol",
(
,7
' /,
V' 4"I' F.. ~.,e~.
' ~
?
'. j l, j
...':. 's -.
,~
La Y
3
/
'{
4 3
't
, +t t...
4 O
s i
e
'O
/
giel f., y-i-i
,. q p,.,
s
(
I.
I1
'4.*
U1-k L
f r ?' l i
8.
' hi i
ll-I l
6 t
s'
%W i
l' l
('
1.
I..
1 i
'ih..;-.
. i k
t
.~
- ^ ' - - " ' - - ---
{
e' s
11 and-records pertaining to EB training and drills indicated that this SEP commitment was being adequately addressed.
Tne. aforementioned revision of the training program should improve EB awareness and capabilities with regard to " mixed" accidents (i.e., those involving release of radioactive material as a result of, or in conjunction with, fire explosion, hazardous chemical accident, or natural disaster).
No violations, deviations or renewal items were identified.
7.
Accident Analysis (88020) a.
The licensee c. ' rates two separate fuel fabrication processes: the ammonium diurr4 ate (ADU) process and the Integrated Dry Route (IDR) process, which is also referred to as the MAP (Manufacturing Automation Project) line. The description of the MAP line in Section 1.9.5.2 of.the license application contains a detailed discussion of instrumentation and interlocks, as well as discussions of radiological safety and nuclear criticality safety for various phases of the operation.
The description of the ADV process in Section 1.9.1 of the license application is more general in the discussion of instrumentation and interlocks, and does not discuss the control or mitigation of process upsets. Therefore, the accident analysis was directed to the ADV process.
b.
In conducting the accident analysis, three components.were selected for review.
Each component was then reviewed for the adequacy of controls in the following areas:
(1) Overheating (2) Overpressurization (3) Electrical failure leading to loss of control (4) Sensors or controls failures leading to loss of control (5)
Identification and control of off-normal conditions Other accident conditions are identified with each discussion. The analyses are discussed in the following paragraphs.
c.
Steam Vaporizer (1) Operation:
UF6 is received a 2-1/2 ton quantities in steel cylinders (Type 30A or 30B) in solid form. A cylinder is placed in a steam vaporizer and connected to the UF6 header. After the connections are leak tested for integrity, the vaporizer is closed and steam is supplied to heat the cylinder and contents.
Once the cylinder has been heated to operating temperature, liquifying the UF6, the discharge valves are opened and UF6 is released to the header as a gas. After the cylinder has been bled down of its contents, it is valved off and cooled down prior to the removal from the vaporizer.
(2) Overweight cylinder:
If a cylinder was filled with more UF6 than specified, when the cylinder is heated to the normal
-,.f'-,,
--,-,-,r,,------,-
c-,------n---.
3 5
I
.k s
0 9
4-2 4
e 8.
t i
f pm
-d 5
it a n..
pu g
P 17 h
operating temperature,- an' over pressurization accident could occur, resulting inLcylinder rupture.
- Control : Cylinders' are weighed upon arrival at the plant and-again when transferred into the vaporization area. Should either of the weights be above a preset limit, the cylinder : i s quarantined until an evaluation can be performed and special-process requirements established.
(3) Small UF6 leak in the vaporizer:
Each cylinder comes with a N,
cylinder valve installed, which is connected to the process header 'by.a temporary pipe
(" pigtail") with mechanical F
connections. ' A gas leak could develop at any of the mechanical connections, even ~ though a leak test is performed before the cylinder is heated.
Control:
Each vaporizer is connected to the steam condensate drain header, which is provided with a conductivity monitor.
UF6 gas released into the vaporizer would ' react with the steam /
condensate to form soluble compounds.
A high conductivity reading would be indicative of a leak into ti,e vaporizer.
A high conductivity alarm causes the steam header supply valve.to close,- shutting off steam to all of the vaporizers on a line.
The cylinder and piping in the vaporizer can then be cooled using CO. which ' is introduced through - a connection on the vaporizer.
The CO would cool the UF6, causing it to solidify 2
and stop the leak.
(4), High steam pressure: Heating of the vaporizers is accomplished i
with steam.
The steam from the boiler is reduced through a pressure reducing station at each vaporizer to 11-14 psig.
If steam at a higher pressure is supplied, it could result in overheating the cylinder.
Control: The vaporizer steam pressure is continuously measured.
A high pressure alarm activates if the pressure goes above 16 psig and an interlock causes the vaporizer steam supply valve to close if the pressure reaches a 18 psig.
In addition, each vaporizer is provided with a pressure relief valve which will lift if the interlock does not cut off the steam and pressure continues to increase.
(5) Low steam pressure:
A decrease in steam pressure (and temperature) would be a process upset rather than an accident condition. The heat capacity of the UF6, cylinder and vaporizer would permit the operation to continue for a period of time without action being required.
Control:
The vaporizer steam pressure monitor has a low pressure alarm at 11 psig. While no automatic functions are activated by this alarm, if the condition exits for an extended
+2 y-
' b.
L
7 m.__
i 4<
6' 4
4 c y; 4
',.y',
t 4
6
.E '
r 1
l"'
1
- i l
- i i
l t
t 1
i
~
l l
1 I
l l'
t I
l' l
l I '.
l u
1.
1' I
h 1
i i
>g 1
i I'
..'_W',
Yh i-
'1,',
t C
1-__._1____,__.
t 12 f:
operating temperature,. an over pressurization accident could occur, resulting in cylinder rupture.
i
" Control:
Cylinders are weighed upon arrival at the plant and again when transferred into the vaporization area. Should either of the weights be above a preset limit, the cylinder is quarantined until an evaluation can be performed and special process requirements established.
(3) Small UF6 leak in the vaporizer:
Each cylinder comes with a cylinder valve installed, which is connected to the process header by a temporary pipe
(" pigtail") with mechanical connections. A gas leak could develop at any of the mechanical connections, even though a leak test is performed before the cylinder is heated.
Control:
Each vaporizer is connected to the steam condensate drain header,.which is provided with a conductivity monitor.
UF6 gas released into the vaporizer would react with the steam /
condensate to form soluble compounds.
A high conductivity reading would be indicative of a leak into the vaporizer.
A high conductivity alarm causes the steam header supply valve to close, shutting off steam to all of the vaporizers on a line.
The cylinder and piping in the vaporizer can then be cooled using CO which is introduced through a connection on the 2
vaporizer. The CO would cool the UF6, causing it to solidify 2
and stop the leak.
i (4) High steam pressure: Heating of the vaporizers is accomplished with steam.
The steam from the boiler is reduced through a pressure reducing station at each vaporizer to 11-14 psig.
If steam at a higher pressure is supplied, it could result in overheating the cylinder.
Control: The vaporizer steam pressure is continuously measured.
A high pressure alarm activates if the pressure goes above 16 psig and an interlock causes the vaporizer steam supply valve to close if the pressure reaches a 18 psig.
In addition, each vaporizer is provided with a pressure relief valve which will lift if the interlock does not cut off the steam and pressure continues to increase.
(5) Low steam pressure:
A decrease in steam pressure (and temperature) would be a process upset rather than an accident condition. The heat capacity of the UF6, cylinder and vaporizer would permit the operation to continue for a period of time without action being required.
Control:
The vaporizer steam pressure monitor has a low pressure alarm at 11 psig. While no automatic functions are activated by this alarm, if the condition exits for an extended i
w-
- l? ?
13
^
[
period, other pressure and temperature sensors in the process header will activate on low. readings and initiate system
' i sol ati on.-
g (6) Plugged UF6 line: UF6-is a reactive gas which could react with
^=
moisture in the line or~ other contaminants and form a solid
. residue. '.This residue could block off gas flow in the header 7
and cause an increase in pressure upstream.of the plug due to continued heating.
Control:
The UF6 header is provided with a pressure sensor.
'With the plugging of the line and loss of flow, a low pressure
- alarm would activate. Additional alarms would activate on the hydrolysis column if the UF6 flow were interrupted.
Additionally, pressure gauges at different parts of the system
.would provide visual indications to the operator so the area of the plug could be identified.
(7) - High condensate level in vaporizer:
Steam is introduced into
~ the vaporizer chest for. heating purposes.
The condensate (liquid) drains out the bottom through a steam trap into a drain header.
If the drain lines becomes clogged, condensate would back up-into the vaporizer.
Control:
Each vaporizer is provided with a liquid level probe, which activates an alarm, and on some process lines, trips the steam supply valve.
A liquid back-up in the vaporizer would also increase the pressure and could activate a high vaporizer pressure alarm.
(8) Electrical failure:
A loss of electrical power to the plant would cause of loss of power to the instrument transmitters and other controllers.
The accident scenario would be loss of control of the system.
. Control: On loss of electrical power, the steam supply valves (header and vaporizers) and the UF6 header valve automatically close. This would stop heating of the cylinder and stop the gas flow. Once power is restored, these valves must be reset by the operator so the system is brought back in a controlled manner.
(9)
Instrument failure: A number of instruments are needed to run the system. The failure of a senser, transmitter or indicator could produce a false reading on the control panel and provide erroneous information to the operator.
Control:
The process control computer is programmed with a parameter value and a preset deviation for the parameter.
A failure in an instrument string would either cause a low reading
. alarm for that parameter, or give a deviation alarm resulting from the loss of signal.
The operator would then have to 1
i I
l
-(
l+'.
. 14 L
investigate the cause of alarm. Most of the instruments are not amenable to the'use of failure-indicating lights, but the output alarm or. loss of indication would serve the same function.
This control is applicable to other components which were reviewed as well.
.(10) Additional ~ Controls:
To improve the operation and control process, the'11censee identified four modifications for the UF6 heating. system.
One modifications which is incomplete is the installation of cylinder pressure monitors. As the cylinder is heated with the block valves closed, the header pressure sensors do not indicate high pressure in a cylinder. The modification would permit monitoring of the pressure and initiation of corrective actions while the block valves remain closed. This modification is being tracked under IFI 88-11 and will be reviewed during future inspections.
d.
Hydrolysis Column (1) Operation: UF6 gas from the vaporizers is fed into the spray section of the column where it reacts with a water spray to form urany1' fluoride and hydrofluoric acid by the reaction:
UF6 + 2H 0
- UO f2 2 + 4HF 2
A portion of the solution is recirculated through the packed spray section in the top of the column and the remainder is pumped to the precipitation column.
Deionized water is continuously supplied to the spray section to maintain a constant volume in the liquid section of the column.
(2) Low water level /high water. level: The column operates with a nominal water level which remains constant through a feed-bleed operation.
Either a low or high level would indicate an upset in the system.
Control: The column is provided with a level indicator. A low i-level alarm causes a trip of the drain pump and shuts the UF6 supply valve. A high level alarm shuts both the UF6 supply valve and the water supply valve, preventing flooding of the UF6 line to the column.
(3) Loss of Make-up Water:
Make-up water provides part the water L
spray for the reaction and maintains the level in the column.
l Control: On low flow or loss of flow, the flow transmitter in the make-up line trips the UF6 supply valve closed.
If the i
level continues to decrease, the low water alarm trips the drain pump off.
l
)
l:
t
~
=
15 (4) High Column Temperature: The reaction of UF6 with water to form 3P uranyl fluoride is highly exothermic. The feed-bleed operation with make-up water provides for heat removal from the column.
A high temperature could produce boiling in the column and would be indicative of of process upset.
1 Control: A temperature sensor is installed at the bottom of the column and provides temperature indication. A high temperature alarm causes the UF6 supply and make-up water valves to shut. A low temperature alarm is also provided but it has no interlocks and serves as a process monitor (e.g.,
low temperature is indicative that the reaction is slowing down due to diminished UF6 flow).
(5) High Uranium Concentration: The column serves as the mixer to convert the UF6 gas to a soluble form. The feed-bleed operation maintains the concentration within specific ranges.
An imbalance in the process flows could increase the concentration and ultimately result in the precipitation of uranyl fluoride in the column.
Control: The drain pump discharge line includes a recirculation loop which discharges back into the spray chamber. On the loop is an analyzer for the uranium concentration.
A high concentration reading by the analyzer causes a
high concentration alarm. Make-up water additions would then reduce the concentrations.
The temperature monitor also provides indication of an imbalance in the column, since the reaction will be adding heat as the concentration rises.
(6) Electrical failure:
A loss of electrical power to the plant would cause a loss of power to the instrument transmitters and other controllers.
The accident scenario would be loss of control of the system.
Control:
Lo;s of electrical power stops the drain pumps. The UF6 and make-up water supply valves close on loss of power, and the column vent valves also close, isolating the column. Once power is restored, these valves must be reset by the operator so the system is brought back in a controlled manner.
(7) Siphoning the column into the UF6 line:
UF6 reacts very strongly with water in an exothermic reaction.
If the water were to be drawn into the UF6 lines or a cylinder, the result would be very severe, possibly rupturing the system.
Control:
The UF6 connections on the column are in a section above the high water level, discharging the gas into a void
'L l
16 space.
High water level will trip the UF6 valve before water gets to the connection.
The column is vented to the scrubbers systems and operates at atmospheric pressure, which would prevent creating a siphon effect. A pressure controller also trips the UF6 valve if the column pressure reaches 15 in w.g., which not sufficient to push water up into the UF6 line.
e.
Calciner (1) Operation: The calciner operates at 1300-1500 F, and is heated by burning of natural gas. The combustion gases then heat the central tube to reaction temperatures.
Hydrogen is introduced to provide a reducing atmosphere; steam is also supplied to the calciner.
The calciner feed material is ammonium diuranate [(NH ), U 0,)].
t 2
Heating this material in a reducing atmosphere first produces U 0,, and then U0 as a powder.
3 2
(2) Air in the Calciner:
Air in the calciner at operating temperatures could result in forming an explosive mixture and cause detonation as hydrogen is introdu:ed.
Control: During the start-up of the calciner, a nitrogen purge is maintained.
This will sweep and dilute any oxygen present in the system. The purge is maintained during heat-up so when hydrogen and steam are introduced, it is not possible to form an explosive mixture.
The systems are interlocked so that if hydrogen flow is lost, nitrogen gas is automatically introduced.
(3) Loss of Combustion Air:
Combustion air is supplied to each of the burners to burn the natural gas.
Reduction or loss of combustion air could case physical damage to the unit and the discharge of a flammable mixture into the vent system.
Control:
Combustion air serves as control air for the natural gas system valves.
A reduction in combustion air causes a reduction in the gas flow; loss of air shuts off the gas supply.
(4) High pressure in calciner: High pressure in the calciner could indicate a process upset or plugging in the vent system.
High pressure could result in damage to the seals and the release of radioactive and combustible materials to the surrounding areas of the plant.
l Control: High pressure in the calciner trips the steam supply valve and the hydrogen supply valve, stopping the feed of these gases. High calciner pressure also shuts off combustion air and 1
~.
17 natural gas to the burners.
The interlock also opens the.
nitrogen supply valve to put a purge on the system.
f.
Based on the review of the components and the associated controls, the inspector concluded that the licensee _ has the capability to identify and mitigate upsets or malfunctions in the system. However, the system description and safety demonstration should be expanded to describe the safety controls and hazards (chemical, radiological, industrial) analyses for the components in the ADU and MAP systems.
This is a Renewal Item and should be addressed in the upcoming licensee renewal application.
g.
The licensee has established a multi group task force (Regulatory Engineering, Process Engineering, Facilities Engineering and Maintenance) to review the ADU Conversion Process Interlock System, and develop improvements to the interlocks and controls.
Actions being proposed include adding additional sensors, changing operating conditions, and revising alarm set points on the process control computer.
These recommendations and actions will be reviewed during subsequent routine inspections.
No violations or deviation were identified.
8.
Maintenance and Surveillance Testing (88025) a.
The Accident Analysis (paragraph 7) identified instruments and controls which have safety functions in preventing or mitigating accidents. To assure that these instruments and controls can perform the required function, they must be properly maintained and calibrated.
The licensee has established the Facility and Maintenance Information System (FMIS) to control instrument maintenance and calibration.
b.
FMIS is a computer data base which provides a printout of instruments, calibration frequency, due date and procedure.
The printout also identifies any instruments which are past-due for calibra? ion.
The list is printed out on a periodic basis and goes to main'inance personnel to accomplish the work. Once completed, the techn!ciin is responsible for entering any pertinent information on the instrument data cards and updating the data base.
Calibrations include trip or interlock functions, as appropriate.
c.
If an instrument malfunctions or fails, operations personnel initiate a work order to " check or replace". After completing any work (or replacement) on the instrument, it is calibrated and tested before returning it to service.
The data base is then updated.
d.
An inspector selected several instruments identified during the Accident Analysis and determined that they are listed on the FMIS printout.
For remote indicating instruments, the inspector determined that each element of the string (sensor, transmitter,
1i j
n.
18 indicator).was included on the list, as are local-reading instruments, such as pressure gauges.
l The descriptions' of the ADU and MAP ' operations in Section 1 of the e.
license application state in numerous. instances that when. an automatic. control stops a process, then " nitrogen purge flows" are,
' introduced..The nitrogen system has an important safety function for safe operation of the plant. - An' i.nspector reviewed the nitrogen
~
supply system to determined if. it was maintained to the' level 4
necessary to meet its safety function.
(1) Nitrogen:
Nitrogen gas is. supplied to the plant from two liquid nitrogen tanks.
The liquid 'is converted to a gas in-atmospheric
\\ aporizers', and fed into supply. headers ' at 115-125 psig.
Pressure reducing -stations throughout the. plant reduce - the pressure down to. local usage needs. The' header has
.both high and-low pressure alarms which annunciate in the ADU Control Room.
(2) Supply:
The level in each tank is read and recorded on each shift, and the results telephoned to the supplier once a : day.
Based on - the current supply and data of_ past-usage, the supplier schedules shipments.
Special shipments are also scheduled when planned evolutions will increase the demand.
(3) Availability:
Both MAP and ADU operations have interlocks on the systems which require : that nitrogen pressure be available before the systems can be started.
(4) Maintenance:
Pressure transmitters and gauges are included in the plant FMIS system.
Regulators are not routinely checked unless the pressure sensors indicate that the regulators are not functioning properly. A failed regulator can temporarily be by passed with manual valves.
The tanks and vaporizers are inspected annually by the supplier.
Safety devices and regulators in this part of the system are replaced on a five year cycle by the supplier.
(5) Electrical Failure: The nitrogen system operates independently of any rotating machinery.
Control and supply valves are " fail open" so when other
_ =_- _ _ _ __ _ _____ _ _ _ ____ _ _ _ _ __- _ _ - ___ _ _ _ _ _ _ _ - _ _ _ __ _ ___ _ - _ _
,pr i
N.
,,y J
19 valves close on loss of solenoid -power or instrument air, nitrogen will be supplied to-purge equipment.
The nitrogen system can also be connected : to the ' instrument. air system to provide control functions in an L
emergency.
'No violations, deviations or renewal items were identified.
9.-
. Nuclear Criticality Safety (88015)
.During the inspection, licensee management representatives informed the l
team members that a senior engineer would be terminating his employment'to accept' a position with another company..This ~ engineer is presently responsible for performing nuclear criticality analyses and evaluations using the KEN 0 codes.
The inspector. emphasized the importance of maintaining a strong nuclear criticality safety program as part of.the k
overall' safety program and-that the program description in the license
-~
renewal should discuss how such a program _would be implemented. Licensee management representatives emphasized their _ commitment to maintaining e
strong program in this area, and stated that it would be addressed in the-
-license renewal.
No violations or deviations were identified.
10.
Review of Previous Operational Safety Assessment Findings (92701)
The ' following IFIs identified during the. Operational Safety Assessment conducted in January 1987 and subsequent routine inspections were reviewed
.during the assessment:
a.
(Closed) 87-01-18,- Inspection and Test Program for the New Central Fire Detection System.
Preoperational testing of the smoke and heat detectors has been completed.
The entire system is now operable, and is under a periodic test program. This item is closed.
b.
(Closed) 88-11-01, Modification / Repair of the UN Discharge Monitors.
i As _ part of the plant review by the Risk Assessment Committee, a modification was approved to install uranium and pH monitors in the process lines discharging to the unfavorable geometry uranyl nitrate tanks. The uranium monitors had previously been reviewed but the pH monitors required modifications in the installation. Modifications and relocation of the pH monitors have been completed.
The pH monitors on the discharge lines from the Solvent Extraction Area are operational; the monitors in the Scrap Recovery Area discharge lines are installed but have not been calibrated.
C _ _ _ _ _ _ ____ __ _ _ ___ __ __ _____ _ _ _ ___ _ _ ______________ _ ____ _________ _____ ___ __ j
s 4 -
20 This item is closed for record purposes. The calibrations will be reviewed by during subsequent routine inspections.
c.
(0 pen) 89-02-01:
Improvements in the Emergency Brigade Training Program.
As noted in paragraph 6. the EB training was undergoing a major revision; the ' revised program will be evaluated in detail during future inspections.
11.
Exit Interview The inspection and findings were summer,ted on August 4,1989, with those persons indicated in paragraph I above.
The inspectors discussed in detail the assessment findings and conclusions.
Proprietary information was provided to and reviewed by the inspectors but is not included in the report. Dissenting comments were not received from the licensee.
Licensee' management was informed that two IFIs discussed in paragraph 10 were closed during this inspection.
- 12. Acronyms and Initialisms Ammonium Diuranate [(NH4)2U207]
ADU ART Airborne Reduction Team CNFD Commercial Nuclear Fuel Division CO2 Carbon Dioxide CTS Commitment Tracking System EB Emergency Brigade
.FMIS Facility and Maintenance Information System FY Fiscal Year HF Hydrogen Fluoride IDR Integrated Dry Route IFBA.
Integral Fuel Burnable Absorber IFI Inspector Followup Item In. w.g.
Inches, Water Gauge MAP Manufacturing Automation Project NFPA National Fire Protection Association PSIG pounds per square inch (gauge) 1 P.CC Regulatory Compliance Committee l
RMC Risk Management Committee SEP Site Emergency Plan UF6 Uranium Hexafluoride UN Uranium Nitrate U308 Uranium Oxide UO2F2 Uranyl Fluoride U32 Uranium Dioxide j
. _ _.