ML20248E314

Informs That,Based on Review of Submittal & Response to RAI, as Described in Encls,Two Apparent Violations Were Identified & Are Being Considered for Escalated Enforcement Action

ML20248E314
Person / Time
Site:	Paducah Gaseous Diffusion Plant
Issue date:	05/28/1998
From:	Paperiello C NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS)
To:	Timbers W UNITED STATES ENRICHMENT CORP. (USEC)
References
70-7001-98-06, 70-7001-98-6, EA-98-239, NUDOCS 9806030271
Download: ML20248E314 (6)

Text

70 M61 i

?

'/m\\

o O ^[

_4 UNITED STA1ES l

j l

NUCLEAR REGULATORY COMMISSION l

Ei 4E WASHINGTON, D.C. 20555-0001 j/

May 28, 1998 l

l EA 98-239 i

Mr. William H. Timbers i

President and Chief Executive Officer U. S. Enrichment Corporation 2 Democracy Center 6903 Rockledge Drive Bethesda, Maryland 20817

SUBJECT:

APPARENT VIOLATION OF 10 CFR 76.85 CONCERNING THE SEISMIC ACCIDENT ANALYSIS IN THE PADUCAH CERTIFICATE AMENDMENT REQUEST, DATED AUGUST 18,1997, UPDATE OF THE APPLICATION SAFETY ANALYSIS REPORT, AND APPARENT VIOLATION OF 10 CFR 76.68 CONCERNING THE C-315 WITHDRAWAL ACCUMULATORS SIZE

Dear Mr. Timbers:

This letter concerns the Nuclear Regulatory Commission's (NRC) review of a certificate amendment request for the Pacucah Gaseous Diffusion Plant (Paducah) dated October 31, 1997, submitted by your staff (GDP 97-0188). The NRC review resulted in a request for additional information (RAI) dated February 5,1998, and a subsequent telephone conversation with your staff on February 18,1998. Basad upon the issues identified from that conversation, your staff provided a verbal notification report pursuant to Section 76.9(b) of Title 10 of the Code of Federal Regulations (CFR) to NRC Region Ill on February 19,1998, and a follow-up written report on February 20,1998. Then, on February 24,1998, in telephone discussions with NEC, your staff also provided information that current operations were outside the Certification SAR based upon issues identified in responding to the RAl. On February 25,1998, your staff submitted a request for enforcement discretion with a justification for continued operations (JCO). That was followed by the NRC holding a telephone conference call on February 26, 1998, with your staff and the Paducah staff to discuss the adequacy of the JCO. A meeting was arranged for March 3,1998, at NRC Headquarters to further discuss the adequacy of the JCO with your staff and the Paducah staff. On March 5,1998, and March 11,1998, your staff submitted more information to support the safety analysis in the JCO and provided the short term and long term corrective actions that later became the basis of a Confirmatory Order issued on April 22,1998.

Based on our review of USEC's submittal and response to the RAI, as described in and Enclosure 2 to this letter, two apparent violations were identified anc are being considered for escalated enforcement action in accordance with the " General Statement of Policy and Procedure for NRC Enforcement Actions"(Enforcement Policy), NUREG-1600. The first apparent violation involves a failure by USEC to comply with 10 CFR 76.85, " Assessment of accidents" and 10 CFR 76.9," Completeness and accuracy of information." Scotion 76.85 of 10 CFR requires, in part, that the Corporation shall perform an analysis of potential accidents and consequences to establish the basis for limiting conditions for operation of the plant with respect to the potential for releases of radioactive material. Section 76.9(a) of 10 CFR requires, in part, that information provided to the Commission by the Corporation be complete and

-(

Sb 9906030271 980528

"')R ADOCK 07007001 g

PDR

I O

W. Timbers, USEC 3

May 28, 1998 In accordance with 10 CFR 2.790 of the NRC's " Rules of Practice," a copy of this letter and its enc!osures will be placed in the NRC Public Document Room and in the Local Public Document Room for the GDP.

Sincerely, (Original signed by M. Knapp)

Carl J. Paperiello, Director Office of Nuclear Material Safety and Safeguards Docket 70-7001 Certificate GDP-1

Enclosures:

1. NRC Review of Paducah Amendment Requests

2. NRC Inspection Report No. 70-7001/98006(DNMS)

3. NRC Information Notice 96-28 cc: Steven Toelle, USEC Randall DeVault, DOE DISTRIBUTION: (TAC No: L32054)

Docket 70-7001 NRC File Center PUBLIC Rlli NMSS Dir. Off. r/f FCSS r/f K. O'Brien, Rlll P. Hiland, Rill M.Hom Y. Faraz D. Persinko C. Cox N. Mamish,OE J. Lieberman,OE P. Ting W. Schwink D. Hartland, Rlli SPB r/f JGreeves b0

• See previous concurrence OFC

• SPB

• SPB

'lMAB

'SPr)

• SPB F

08

!OGC NMSS NAME CCox ll DHoodley DBroeddus DMartin RPerson E

Eyck

,kiellhan old DATE 5/4 /98 5/4/98 5/8/98 5/8/90 5/11 198 4 h/98

/[/98

/9l198 fL2b OFFICIAL RECORD COPY A:\\SEISVIOX.CoX

's W. Timbers, USEC 3

in accordance with 10 CFR 2.790 of the NRC's " Rules of Practice," a copy of this letter and its enclosureshll be placed in the NRC Public Document Room and in the Local Public Document Room for the GDP, l

Sincerely, Cari J. Paperiello, Director Office of Nuclear Material Safety and Safeguards Docket 70-7001 Certificate CDP-1

Enclosures:

1. NRC Review of Paducah Ame ment Regaests

2. NRC Inspection Repori No. 70-7DQ1/98006(DNMS)

3. NRC Information Notice 96-28 cc: Steven Toelle, USEC Randall DeVault, DOE DISTRIBUTION. (TAC No: L32054)

Docket 70-7001 NRC File Center PUBLIC Rlli NMSS Dlr Off. r/f

}

FCSS r/f K. O'Brien, Rlli P. Hiland, Rill M.Hom Y. sFarag D.

Persinko C.Cox N. Mamish,OE J. Lieberman,OE P. Ting W. Schwink jplO D. Hartland, Rlli SPB r/f-JGreaves w,

orc sPs

__ sk b

iMAIL, } *

SPD, W

' FCSS OE OGc NMSS DBr&

R ETen Eyck JUebermen JC CPoperiello NAME CCoul DATE-Il b hk198 b

Nh98 h Ag /98

/ 19 8

/ /98 4 M/98

/ /98 OFFICIAL RECORD copy A:\\SEISVioX.CoX s'plff M1

i Nuclear Regulatory Commission Review of Paducah Certificate Amendment Request Dated October 31,1997, -- Update of the Application Safety Analysis Report NRC Review Scoca:

The NRC conducted a review of the United States Enrichment Corporation's (USEC's) amendment request submitted on October 31,1997. The, amendment request involved changes to Application Safety Analysis Report (SAR) Chapter 2, and new SAR Sections 4.1, 4.2.1 through 4.2.5,4.3.1, end 4.4, with certificate amendment requests to approve the updated SAR (SARUP) modifications, for the Paducah gaseous diffusion plant.

NRC Findings:

A certificate amendment request dated October 31,1997, submitted by the Corporation, requested an update to the Safety Analysis Report (SAR) to include a new Chapter 4, " Accident Analysis." An NRC request for additional information (RAl) dated February 5,1998, identified questions about the conservative nature of assumptions for the seismic accident scenario in Chapter 4. In response to the RAI, the Corporation reviewed Paducah's liquid UF withdrawal facilities' records and determined that the seismic accident analysis assumption of no liquid UF, in both facilities' accumulators underestimated the potential source term from the withdrawal facilities for the seismic accident scenario. In telephone discussions with the NRC on February 18,1998, the Corporation indicated that with no restrictions on accumulator levels, a minor seismic event (0.5 g peak ground acceleration) could have unacceptable off-site consequences. The NRC informed the Corporation that a notification pursuant to 10 CFR 76.9(b) was warranted. Thereafter, the Corporation provided verbal notification to NRC Region Ill on February 19,1998, and a follow-up written report on February 20,1998, identifying the potential nonconservative assumption in the SAR updated accident analysis and potential off-site consequences. Then, on February 24,1998, in telephone discussions with NRC, the Corporation also provided information that the withdrawal facilities' current operations were outside the Certification SAR because the Chapter 4 seismic accident analysis assumed no liquid UF, release from the Building C-315 withdrawal facility's process piping, condensers, and accumulators and in addition, the source term from Building C-310/310A was probably too low.

In order for that scenario to be accurate, therefore, operations in the Building C-315 withdrawal facility would have to preclude any liquid UF, release e ch would require no liquid UFs in the facility's process piping, condensers, and accumulator!

NRC Requirements:

Title 10 of the Code of Federal Regulations, Section 76.85 requires, in part, that the Corporation l

shall perform an analysis of potential accidents and consequences to establish the basis for limiting conditions for operation of the plant with respect to the potential for releases of radioactive material. In performing this assessment, the full range of operations should be considered, including operation at maximum capacity.

l Title 10 of the Code of Federal Regulations, Section 76.9(a) requires, in part, that information provided to the Commission by the Corporation be complete and accurate in all material respects.

ENCLOSURE 1

e

~

W. Timbers, USEC 2

' accurhte in all material respects. The October 31,1997, amendment request was not in accordance with 10 CFR 76.85 in that it failed to provide an adequate accident analysis for an extemal event (seismic) and it was not in accordance with 10 CFR 76.9 in that the submittal was inaccurate and incomplete resulting in a delay in the NRC identifying the safety significance associat d with the inadequate accident analysis. Enclosure 1 provides further description regarding this apparent violation.

The second apparent violation involves a failure by USEC to comply with 10 CFR 76.68, " Plant changes." Section 76.68 of 10 CFR requires, in part, that the Corporation shall evaluate any as-found condition that does not agree with the plant's programs, plans, policies, and operations, as described in the Safety Analysis Report, to ensure that the as-found conditions do not constitute an unreviewed safety question requiring Commission review and approval. On June 25,1997, the Corporation failed to identify that the as-found condition of increased size of the two accumulators in the Building C-315 withdrawal facility could increase the consequences of accidents previously analyzed in the Safety Analysis Report and thereby failed to identify an unreviewed safety question. Then, on February 24,1998, a telephone conversation occurred between your staff and the NRC where, based on issues from the RAI and the as-found condition of the accumulators, your staff acknowledged that current operations with any liquid uranium hexaflouride in Building C 315 were outside your accident analysis in the Certification SAR. provides further description regarding the apparent violation.

No Notice of Violation is presently being issued for these findings. In addition, please be advised that the number and characterization of apparent vioiations described in the enclosed report may change as a result of further NRC review.

A predecisional enforcement conference to discuss these apparent violations has been scheduled for 9:00 a.m. on June 16,1998, in Room T9A1, at Two White Flint North, 11545 Rockville Pike, Rockville, Maryland 20852-2738. The conference will be open to public observation in accordance with the Enforcement Policy. The decision to hold a predecisional enforcement conference does not mean that the NRC has determined that a violation has occurred or that enforcement action will be taken. This conference is being held to obtain information to enable NRC to make an enforcement decision, such as a common understanding of the facts, root causes, missed opportunities to identify the apparent violation sooner, corrective actions, significance of the issues, and the need for lasting and effective corrective action. In addition, this is an opportunity for you to point out any errors you believe we have made, and for you to provide your perspectives on: (1) the severity of the violations, (2) the application of the factors that the NRC considers when it determines the amount of a civil penalty that may be assessed in accordance with Section VI.B.2 of the Enforcement Policy, and (3) any other application of the Enforcement Policy to this case, including the exercise of discretion in accordance with Section Vll.

In presenting your corrective action, you should be aware that the promptness and comprehensiveness of your actions will be considered in assessing any civil pensity for the apparent violations. The guidance in the enclosed NRC Information Notice 96-28, " Suggested Guidance Relating to Development and implementation of Corrective Action," may be helpful.

You will be advised by separate correspondence of the results of our deliberations on this matter.

No written response regarding these apparent violations is required at this time.

1 t

l L __

1 2

~

NRC

Conclusion:

Based on its review, the NRC has determined that the Corporation apparently failed to meet Title 10 of the Code of Federal Regulations, Section 76.85 and Section 76.9, in that the Corporation did not perform an adequate analysis of potential accidents and consequences to establish the basis for limiting conditions for operation of the plant with respect to the potential for releases of radioactive material and did not provide to the Commission information that was complete and accurate in all material respects. Specifically, on October 31,1997, the Corporation submitted a certificate amendment request for a Safety Analysis Report (SAR) update that provided an accident analysis for Buildings C-310/310 A and C-315 withdrawal facilities that did not establish a basis for limiting conditions for operations nor provide assurance that plant operations would be conducted in a manner to prevent or mitigate consequences from a reasonably postulated seismic event. This accident analysis did not consider the full range of operations, including operations at the ms ximum capacity contemplated. Rather, the accident analysis considered that the seismic event would occur with the withdrawal facilities' accumulators empty (i.e., no liquid UFe present), which would be the minimum capacity contemplated. Had the accident analysis considered the maximum capacity of the accumulators, the consequences of the accident would have iaentified a need for a limiting condition for operation for liquid UF, levels in the accumulators or required a plant modification. In addition, the October 31,1997, submittal was not complete and accurate. The submittal was incomplete by not identifying the size of an error noted by USEC in the Building C-315 accumulators' inventory of UFe. The certificate amendment request also was not accurate when it stated the overall consequences for liquid UFe releases from the Building C-310 and Building C-315 was on the same order as reported in the approved SAR. These statements were material because had the NRC known the size of the error noted in the Building C-315 accumulators or had the Corporation accurately assessed the consequences of the seismic accident, the unreviewed safety question would have been identified at least four months sooner and resulted in the seismic risk being reduced earlier.

The failure to submit an adequate accident analysis and complete and accurate information is an apparent violation of Title 10 of the Code of Federal Regulations, Section 76.85 and Section 76.9.

l 1

i

l May 7,1998 l

EA 98-239 Mr. J. H. Mil!er Vice President - Production United States Enrichment Corporation Two Democracy Center 6903 Rockledge Drive Bethesda, MD 20817

SUBJECT:

NRC INSPECTION REPORT 70-7001/98006(DNMS), APPARENT VIOLATION, AND NOTICE OF VIOLATION

Dear Mr. Miller:

On April 20,1998, the NRC completed a routine resident inspection at your Paducah Gaseous Diffusion Plant. The enclosed report presents the results of the inspection. During the period covered by the inspection report, the conduct of activities at the Paducah Gaseous Diffusion Plant were generally adequate.

During this inspection an apparent violation was identified and is being considered for escalated enforcement action in accordance with the

• General Statement of Policy and Procedure for NRC Enforcement Actions"(Enforcement Policy), NUREG-1600. The apparent violation involves an as-found condition, a safety evaluation, and a change to the Safety Analysis Report which appeared to involve an unreviewed safety question. Accordingly, no Notice of Violation is presently being issued for the finding. Please be advised that characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.

A predecisional enforcement conference to discuss the apparent violation has been tentatively scheduled for the week of May 25,1998, in the NRC Headquarters Offices, in Rockville, 1

Maryland. Further details regarding the date and time for the conference will be provided by separate correspondence. The decision to hold a predefsional enforcement conference does I

not mean that the NRC has determined that a violation has occurred or that enforcement action will be taken. The conference is being held to obtain information to enable the NRC to make an l

l enforcement decision, such as a common understanding of the facts, root causes, missed opportunities to identify the apparent violation sooner, corrective actions, significance of the l

I issues and the need for lasting and effective corrective action. In addition, this is an opportunity i

for you to point out any errors in our inspection report and for you to provide any information concerning your perspectives on: 1) the severity of the violation; 2) the application of the factors that the NRC considers when it determines the amount of a civil penalty that may be l

assessed in accordance with Section VI.B.2 of the Enforcement Policy; and,3) any other application of the Enforcement Policy to this case, including the exercise of discretion in accordance with Section Vll.

g ""* g-l

~

J. Miller,

You will be advised by separate correspondence of the results of our deliberations on this matter. No response regarding the apparent violation is required at this time.

In addition to the above, the NRC has determined that a violation of NRC requirements occurred. The violation is cited in the enclosed Notice of Violation (Notice) and the circumstances surrounding it are described in detail in the enclosed report. The violation is of concern because it indicates a weakness in the implementation of your program for testing safety system designs or modifications to ensure all critica! aspects of the design function as expected.

The NRC also inspected the status of actions identified in Confirmatory Action Letter Rlli 003 for the restart of cylinder wash operations in Building C-400. The details of our inspection are discussed in Section E1.1 of the enclosed report.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with reguletory requirements.

in accordance with 10 CFR 2.790 of the NRC's " Rules of Practice" a copy of this letter, its enclosures, and your response will be placed in the NRC Public Document Room.

We will gladly discuss any questions you have concerning these observations.

Sincerely, Original Signed by Cynthia D. Pederson, Director Division of Nuclear Materials Safety Docket No. 70-7001

Enclosures:

1. Notice of Violation

2. Inspection Report 70-7001/98006(DNMS)

3. Enforcement Policy: Section V, "Predecisional Enforcement Conferences" cc w encis:

s. A. Polston, Paducah General Manager r

L L. Jackson, Paducah Regulatory Affairs Manager J. M. Brown, Portsmouth General Manager

s. A. Toelle, Manager. Nuclear Regulatory Assurance and Policy, usEC Paducah Resident inspector office Portsmouth Resident inspector office l

R. M. Devault Regulatory oversight Manager. doe i

J. C. Hodges. Paducah site Manager, doe I

I l

~

NOTICE OF VIOLATION

' United ' States Enrichment Corporation Docket No. 70-7001 i

Paducah Gaseous Diffusion Plant Certificate No. GDP-1 During an NRC inspection conducted from March 10 through April 20,1998, a violation of NRC

{

requirements was identified. In accordance with the " General Statement of Policy and j

Procedure for NRC Enforcement Actions," NUREG-1600, the violation is listed below:

I Title 10 o' the Code of Federal Regulations, Part 76.93, "Quality Assurance," requires, in part, that the Corporation shall establish and execute a Quality Assurance Program.

l Item 3 of Section 2.3.3.4 of the Quality Assurance Program, " Design Verification," required, in part, that procedures for design verification activities shall be established and that design verification shall be completed prior to relying upon the component, system, structure, or computer program to perform its function. Item 5 requires, in part, that verification by testing shall demonstrate adequacy of performance under conditions that simulate the most adverse design requirements.

Contrary to the above, from March 3,1997, through April 6,1998, the Corporation failed to verify by testing the adequacy of the Building C-720 criticality accident alarm system horn j

design under conditions that simulate the most adverse design requirements prior to relying j

1 upon the system to perform its function of alerting personnel to an inadvertent criticality.

Specifically, testing and quarterly surveillance tests conducted after the design was modified in March 1997 did not demonstrate that the 24-volt channel of the Building C-720 criticality accident alarin system would sound the building horns for the 120 seconds required by l

Technical Safety Requirement 2.6.4.1 upon loss of the 48-volt channel.

l I

This is a Severity Level IV violation (Supplement VI). (VIO 70-7001/98006-01)

Pursuant to the provisions of 10 CFR 76.70, United States Enrichment Corporation is hereby required to submit a written statement or explanation for the violations to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555 with a copy to the Regional Administrator, Region ill, and a copy to the NRC Resident inspector at Padsah, within 30 days of the date of the letter transmitting this Notice of Violation (Notice).

TF,is reply should be clearly marked as a " Reply to a Notice of Violation" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken to avoid further violations, ar'd (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence,if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for

{

Information may be issued as to why the Certificate should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

1 1

l If you contest this enforcement action, you should also provide a copy of your response to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001, 1

y$

[

. Notice of Violation 2-

' Because your response will be placed in the NRC Public Document Room (PDR), to the extent f possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in

. detail the bases for your claim of withholding (for example, explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information l

required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or l

financial information). If safeguards information is necessary to provide an acceptable

- response, please provide the lovel of protection described in 10 CFR 73.21.

Dated at Lisle, Illinois this 7th day of May 1998

..-a

..}

,n.

i,.

i U.S. NUCLEAR REGULATORY COMMISSION REGIONlli Docket No:

70-7001 Certificate No:

GDP-1 Report No:

70 7001/98006(DNMS) l l

Facility Operator:

United States Enrichment Corporation l

Facility Name:

Paducah Gaseous Diffusion Plant L7 cation:

5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 Dates:

March 10 throug! April 20,1998 Inspectors:

K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector Approved By:

Patrick L. Hiland, Chief Fuel Cycle Branch Division of Nuclear Materials Safety

)

EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC inspection Report 70-7001/98006(DNMS)

Elant ooerations The plant staff effectively investigated three minor uranium hexafluoride releases and developed lessons-learned summaries in an effort to preclude recurrence of the releases. However, the summaries were not communicated to the staff using a formal system, such as the long-term order process, until after the inspectors questioned the effectiveness of using informal e-mail messages as the means of communication.

(Section 01.1)

The inspectors noted the generally effective implementation of a new problem reporting process during the inspection period. The new process reduced the number of nonsafety-related problem reports requiring Plant Shift Superintendent review, allowing the Plant Shift Superintendent to focus on safety, operability, and deportability issues.

(Section 01.2)

Maintenance and Surveillance A violation of the Quality Assurance Program was identified in that, from March 1997 to April 6,1998, the design of the Building C-720 criticality accident alarm system audibility function was not verified following a design modification. As a result, one of two independent alarm channels would not have sounded the criticality accident a: arm system horns for 120 seconds, as designed. The design inadequacy was self-revealed during a quarterly surveillance after a loss of the second channel. (Section M1.1)

Engineering The inspectors concluded the plant staff had successfully completed all of the actions identified in Confirmatory Action Letter Rlli-97-003 for restart of the Building C-400 cylinder wash operation. (Section E1.1)

An apparent violation was identified regarding a safety evaluation which failed to identify an existing unreviewed safety question. The inspectors determined that the evaluation performed following the plant staff's identification of an as-found condition associated with the Building C-315 liquid uranium hexafluoride accumulators, was nonrigorous. As a result, a potential unreviewed safety question was not identified and plant operations were conducted for approximately 8 months in a manner that was inconsistent with Safety Analysis Report-specified accident release limitations. (Section E1.2)

The inspectors determined that an operability evaluation, developed in response to questions raised regarding the performance capabilities of rail stops for cranes used to handle cylinders containing liquid uranium hexafluoride, was nonrigorous and

. inconsistently utilized applicable codes and standards. Additional engineering work, to document the crane rail stops' performance capabilities versus the applicable l

2 o _._ _ __

7. _. __ _. _ _ _ _ _ _ _ _ _ _ _ - _ - _.

I l~

l performance standards, was being completed as of the end of the inspection period.

(Section E1.3)

The inspectors identified several as-found conditions associated with the Safety Analysis Report Upgrade process that appeared to conflict with the current Safety Analysis Report. Actions by the plant staff to assess the acceptability of continued operations with the as-found conditions will be tracked as an Unresolved item.

(Section E1.4)

Plant Sucoort The inspectors determined that the classified matter purge campaign, undertaken in response to Escalated Enforcement Action 97-431, appeared to be on schedule to meet the June 1998 commitment date. (Section S1.1) 3

i d

e Report Details

1. Operations -

01 Conduct of Operations 01.1 Seal and Block Valve Buffer Releases a.

Insoection Scoce (88100)

.The inspectors reviewed the circumstances surrounding three minor uranium hexafluoride (UF.) releases from process buffer systems.

b.

Observations and Findinas On March 18, the plant emergency squad responded to a minor release of UF, from a seal buffer system cabinet. Buffer systems were installed to provide a means of controlling and monitoring leaks to or from the components most likely to fail for the gaseous diffusion process. The release occurred while operations staff were conducting troubleshooting activities to identify which seat systems were leaking to the process stream. As a result of operator actions, taken to return buffer air to the seal buffer exhaust system, a pressure regulator relieved (as designed) to an area outside the buffer cabinet and a small amount of UF, was released. No intakes or exposures to personnel resulted from the event.

On March 24, the plant emergency squad responded to a minor release of UF, from a block valve buffer system. The following day, March 25, another minor release occurred from the block valve buffer system. No intakes or exposures to personnel resulted from the events. An initial investigation by plant staff indicated the releases occurred as a result of contaminated air in the system which originated from a leaking valve bellows.

The contaminated air was released from an o-ring or seal on the block valve buffer panel after operators adjusted the system air pressure. The investigation also determined the second release could have been prevented had the air supply to the contaminated buffer system been isolated after first release. The plant staff subsequently performed a walkdown of the process buildings in an effnrt to identify other contaminated block valve buffer systems.

Plant operations management issued two long-term orders (LTOs) to communicate the lassons learned from these events. The LTOs reemphasized current procedural requirements. in addition, LTO No.98-007 indicated that troubleshooting evolutions should be coordinated through the cascade coordinator. The need to isolate the air supply when contaminated block valve buffer systems were identified was addressed in LTO No.98-006 The LTOs were issued after the inspectors raised concerns about j

communicating the lessons learned for the seal buffer events to operations staff via the l

e-mail system. The inspectors noted that the e-mail system was not a formal method that ensured long-term retention of lessons learned and previous attempts to use the system as such had resulted in repeat issues.

c.

Conclusions f

I 4

1

The plant staff effectively investigated three minor uranium hexafluoride releases and developed lessons leamed summaries in an effort to preclude recurrence of the

' releases. However, the summaries were not communicated to the staff using a formal system, such as the long-term order process, until after the inspectors questioned the effectiveness of using informal e-mail messages as the means of communication.

i 01.2 Transition to Assessment and Tracking Reoorts a.

Insoection Scoce (88100)

The inspectors reviewed the transition from the use of problem reports, for identifying problems, to the use of assessment and tracking reports (ATRs). The review included a comparison of ATRs generated and screened against the criteria in Procedure CP2-BM-Cl1031, Revision 0," Corrective Action Process at PGDP [Paducah Gaseous Diffusion Plant]."

b.

Observations and Findings During the inspection period, the plant staff implemented a new problem reporting and resolution procedure. The new procedu,e was developed to reduce the number of problem reports processed by the Plant Shift Superintendent (PSS) in order to allow the PSS to focus on safety, operability, and deportability issues. In addition, the change was intended to increase the effectiveness of the corrective action program by improving the tracking and resolution of identified problems.

One of the major changes in the problem reporting process was ?he use of screening managers to initially determine if an ATR should be provided to the PSS, for immediate review, or to the Commitment Management Department, for resolution. The screening criteria included whether or not the problem involved an immediate personnel or equipment safety hazard, an operability concem, a deportability concern, or a criticality safety issue. Any ATRs that met one of the screening criteria were required to be dispositioned by the PSS. All other ATRs were provided to the Commitment Management Department.

in addition to the procedurally required screenings, the plant staff had representatives from the PSS office and Commitment Management performing a check of each ATR to ensure the ATR was properly screened during the initial implementation phase. The inspectors also performed a review of ATRs which were not forwarded to the PSS for immediate action. Over a three week period, the inspectors identified a small number, approximately a dozen, ATRs that appeared to meet the criteria for PSS review but were not provided to the PSS. Independently, the plant staff also identified, through the second review checks, the need for the twelve ATRs to receive PSS review. In general, the inspectors determined that implementation of the new process for identifying problems requiring immediate PSS review appeared adequate.

c.

Conclusions The inspectors noted a generally effective implementation of a new problem reporting process (using Assessment and Tracking Reports) during the inspection period. The new procedure reduced the number of nonsafety-related problem reports processed by 5

~

~

the Plant Shift Superintendent, allowing the Plant Shift Superintendent to focus on safety, operability, and deportability issues.

6

I 08-Miscellaneous Operations issues

~

• 08.1 ' Certificate Event Reoorts (90712)

The certificate made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concerns indicated at the time of the initial verbal notification. The inspectors will evaluate the associated written reports for each of the events following submittal.

Number Status I!1Le 33929 Open Steam Blowdown Testing Creates inaudible Condition for i

Building C-400 and C-409 Criticality Accident Alarm System l

34034 Open Building C-720 Criticality Accident Alarm System Not Able l

to Provide Required Alarms in Building C-300 Central Control Facility 08.2 Bulletin 91-01 Reoorts (97012)

The certificate made the following reports pursuant to Bulletin 91-01 during the inspection period. The inspectors reviewed any immediate nuclear criticality safety concerns associated with the report at the time of the initial verbal notification. Any significant issues emerging from these reviews are discussed in separate sections of the report.

Number Dale Iille 34078 4/14/98 Maintenance Activities for Exhaust Pump Pipes Without an Approved Nuclear Criticality Safety Approval 08.3 (Closed) CER 33892: loss of power to Building C-360 criticality accident alarm systems and process gas leak detection systems. The plant staff reported a loss of power to the Building C-360 safety systems after a crane shoe caught and pulled an electrical cable l

causing a short. Upon further review of the electrical drawings and testing of the electrical system, the plant staff concluded that power for the safety systems was automatically transferred to an alternate electrical bus; therefore, power was not lost.

As a result, the plant staff retracted the event report. The inspectors reviewed the event investigation and determined the certificate's evaluation was reasonable and had no further questions.

08.4 (Closed) CER 33957: process gas leak detector alarmed in Building C-337 Unit 3 cell bypass duct. The plant staff reported the actuation (alarm) of the detector due to a l

small release of UF. from a block valve buffer system. After further review, the certificate concluded that the actuation was not reportable because the associated cascade equipment was not in a Technical Safety Requirement-specified Mode requiring the process gas leak detection system to be operable, that is, the cascade equipment was operating at sub-atmospheric pressures. The safety system was only required to be operable for operations above atmospheric pressure per Technical Safety 7

e t=

Requirement 2.4.4.1. The certificate subsequently retracted the event report. The

, inspectors reviewed the cascade conditions, present at the time of the detector actuation, and the deportability requirements specified in Section 6.9 of the Safety Analysis Report," Event Investigation and Reporting." Based upon the reviews, the inspectors determined the certificate's evaluation was reasonable and had no further questions.

08.5 (Closed) VIO 70-7001/97002-03: failure to determine and correct the cause of a high drain alarm prior to returning the autoclave to service, in response to the violation, the plant staff issued a long-term order which required the responsible system engineer to investigate safety system actuations in order to determine the validity of the initiating alarm signal and to ensure the appropriate corrective actions were taken. The long-term order was subsequently proceduralized in Procedure OPS-19, Revision 0, " Alarm Response Guidelines and Status Control." The inspectors reviewed selected safety system actuations and did not identify any systems which were returned to service without a review by the system engineer or a determination of cause with corrective action, as needed. The inspectors concluded that the corrective actions for the violation appeared adequate and had no further questions.

II. Maintenance and Surveillance M1 Conduct of Maintenance and Surveillance M1.1 Buildino C-720 Criticality Accident Alarm Svstem Reoairs a.

insoection Scoce (88102)

The inspectors reviewed the work package and followup repairs for the quarterly surveillance of the Building C-720 criticality accident alarm system (CAAS) horns and lights.

b.

Observations and Findinos On April 6, the plant staff removed the Building C-720 CAAS Cluster "AL" from service in order to perform a routine quarterly surveillance of the associated electronic horns and alarm lights in accordance with Technical Safety Requirement (TSR) 2.6.4.1.b-1. The I

test assessed the continued operability of the Building C-300 high radiation alarm light and bell and the Building C-720 horns and lights. The Building C-300 high radiation alarm light and bell served to notify the PSS of an alarm condition in Building C-720 and of the need to initiate a notification of personnel, in facilities within the CAAS audibility zone, to evacuate the area in accordance with a Justification for Continued Operations (JCO) included as a part of Compliance Plan Issue 50. The JCO provided the actions necessary to alert personnel, in facilities near Building C-720 that were not equipped with CAAS horns, of an inadvertent criticality.

While performing the surveillance, plant instrument mechanics noted that the high radiation alarm light in Building C-300 did not illuminate, as expected, when the CAAS cluster was put into an alarm state. Upon learning of the failed surveillance, the PSS I-made a 24-hour event notification to the NRC because the inoperable alarm light would not have allowed the PSS to notify affected personnel as required by the JCO f

8 l

1

,=

(Certificate Event Report 34034). The mechanics also noted that the Building C-720 horns ceased sounding after approximately 10 seconds, whereas TSR 2.6.4.1 required i

' the horns to sound for at least 120 seconds. The 120 second sounding of the horns was necessary to allow sufficient notification to personnel to evacuate the area.

During troubleshooting efforts, the plant staff discovered that two wires in the alarm circuit were reversed. The plant staff also discovered that one of the amphenol connectors for the Building C-300 48-volt circuit was missing a retaining clip, a subtle nonconformance which had not been previously discovered. The missing retaining clip allowed some wires to become loose so that the circuit path was broken. The loose wires were the root cause for the failure of the Building C-300 high radiation alarm light to illuminate upon an alarm condition. Repairs to the circuit were successfulin restonng the Building C-300 alarm function.

The plant staff continued the investigation in an effort to explain why the building horns had actuated for only 10 seconds. The investigation revealed that following loss of the 48-volt alarm channel from Building C-300, caused by the loose connector, the CAAS horn system relied upon a second, independent 24-volt alarm channel in Building C-720 to provide the signal to the control board for the building horns. During March 1997, the plant staff modified the horn circuit to decrease the actuation time for the building horns to below the 0.5 seconds upper limit specified in American National Standard (ANS) 8.3.

(The basis statement for TSR 2.6.4.1 referenced ANS 8.3 as the standard to which the Building C-720 CAAS conformed.) The design modification involved installing jumpers bet'Neen two control board inputs: the " Alert Command" input and the " Push-To-Talk" input. The design included two independent channels (48-volt and 24-volt) which could initiate the CAAS horns via inputs to a control board in the horn control box. At the time of the design change, the plant engineering staff did not realize the " Push-to-Talk" input required a continuous signal whereas the " Alert Command" input required an l

instantaneous signal to generate the output signal necessary to close a relay and cause the building horns to sound. As a result, a time-delay relay located in the 24-volt channel, but not in the 48-volt channel, would open after 10 seconds of receiving the alarm signal and would cause the output signal from the hom control board via the

" Push-To-Talk" input to be de-energized. Thus, the modified design would not maintain the building horns' sounding for the required 120 seconds for the 24-volt channel.

In order to allow for an independent assessment of the operability of both channels during the quarterly surveillance, the CAAS circuitry included two spring-loaded switches which, when depressed individually, disabled one channel in order to test the other channel. Procedure CP4-GP-lM6178, Revision 1," Maintenance of the C-720 Criticality Accident Alarm System," effective March 3,1997, was the maintenance procedure used to verify the CAAS design modification and to perform the quarterly surveillance of the building horns and lights. Steps 8.2.1.C and 8.2.1.J required the mechanics to " push and hold" the switches disabling the other independent channel, but did not provide guidance on how long to hold the switch. The mechanics were to release the switch after the horns and lights were actuated. Because the procedure did not require the disabling switch to be held long enough to overcome the time-delay function of the relay in the 24-volt channel, the loss of a continuous 24-volt signal to the " Push-To-Talk" input of the horn control board was not identified. Instead, once the disabling switch was returned to the normal position, the control circuitry switched back to the Building C-300 48-volt channel and the horns continued to sound as expected. The design inadequacy 9

0 was not identified until the loose connection in the 48-volt channel caused an interruption in the second path so that a true test of the 24-volt channel occurred.

After identification of the problem, the engineering staff performed an engineering evaluation which concluded the March 1997 modification design inadequacy could be l

corrected by replacing the time-delay relay with a standard relay. Engineering Evaluation EV-C-812-98-030, Revision 0, " Replacement of Interval-On Time Delay 1

Relay In Alarm Horn Control Box for C-720 Criticality Accident Alarm System," dated April 7,1997, indicated that the replacement relay was expected to be at least as fast as the time-delay relay (and thus would not negatively affect the response time). The evaluation also indicated that previous surveillance, performed under the procedure (CP4-GP-lM6178), were inadequate in that they did not identify that one of the inputs to the horn control board required a continuous rather than instantaneous input. The l

procedure did not verify that the second channel would initiate and maintain CAAS horn I

annunciation as designed. The plant instrument mechanics subsequently replaced the time-delay relay with the standard relay and successfully performed the quarterly surveillance for the horns and lights.

The inspectors noted that post-maintenance testing of the relay replacement did not include a check of response time for the alarm circuit although installation of the new relay involved the lifting ana landing of leads. Instead, the engineering staff performed an evaluation of the relay replacement. The engineering staff's actions appeared to satisfy the Quality Assurance Program-specified requirements for design control.

Title 10 of the Code of Federal Regulations, Part 76.93," Quality Assurance," required, in part, that the certificate establish and execute a Quality Assurance Program (OAP).

Item 3 of Section 2.3.3.4 of the OAP," Design Verification," required, in part, that procedures for design verification activities shall be established and that design verification shall be completed prior to relying upon the component, system, structure, or computer program to perform its function. Item 5 required, in part, that verification by testing shall demonstrate the adequacy of performance under conditions that simulate the most adverse design requirements. The failure of Procedure CP4-GP-lM6178 to demonstrate that the 24-volt channel of the Building C-720 CAAS would sound the building horns for the required 120 seconds upon loss of the 48-volt channel (the most adverse design requirement)is a Violation of 10 CFR 76.93 (VIO 70-7001/98006-01).

c.

Conclusions A violation of the Quality Assurance Program was identified in that, from March 1997 to l

April 6,1998, the design of the Building C-720 criticality accident alarm system audibility function was not verified following a design modification. As a result, one of two independent alarm channels would not have sounded the criticality accident alarm system horns for 120 seconds, as designed. The design inadequacy was self-revealed during a quarterly surveillance after the loss of the second channel.

l Ill. Engineering l

E1 Conduct of Engineering E1.1 Building C-400 Cvlinder Wash Ooerations 10

/

s 4

ap a.

Insoection Scoce (88100)

The inspectors reviewed the nuclear criticality safety approvals, procedure, and plant change documents associated with the restart of the Building C-400 cylinder wash and hydrostatic testing operations pursuant to NRC Confirmatory Action Letter (CAL) No. Rlli-97-003, dated February 28,1997 (see inspector Follow-up Item 70-7001/97002-15). In particular, the inspectors reviewed the following:

(1)

Nuclear Criticality Safety Approval No. NCSA.400.002.01, *C-400 Cylinder Wash Operations at the Paducah Gaseous Diffusion Plant";

(2)

Nuclear Criticality Safety Approval No. NCSA.400.003.01, "C-400 Cylinder Hydrostatic Testing Operations at the Paducah Gaseous Diffusion Plant";

(3)

Letter from United States Enrichment Corporation," Restart of C-400 Wash Facility," dated March 13,1998; and (4)

Request for Application Change No. 97C275,"Flowdown of NCSA Requirements for C-400 Cylinder Wash," approved March 12,1998.

The inspectors also reviewed selected portions of the governing procedure, observed activities in progress, and had discussions with responsible operators and a first-line mE;1ager in Building C-400.

b.

Qb10DatiRps and Findings The governing nuclear criticality safety approvals (NCSAs) identified a pre-selected group of cylinders which could be washed and hydrostatically tested under the NCSAs.

The group included only cylinders for which a complete set of material control and accounting (MC&A) records was available from the time of the last hydrostatic test until the present. This approach ensured the plant staff had an accurate knowledge of the l

assays of uranium hexafluoride introduced into the cylir.ders throughout the period of service. Thus, the assays of cylinders for washing were strictly limited to 2.0 weight percent or below. In addition to assay control, the governing NCSAs required mass control to ensure a greater than safe mass was not moderated during the washing operation in the unsafe volume of the 10-ton or 14-ton cylinders. The NCSAs n.cluded a number of independent verifications to ensure that only a cylinder from the approved list, meeting the mass control was selected for washing and hydrostatic testing.

j The inspectors performed a selected review of the governing procedure and observation of cylinder wash and hydrostatic testing operations and did not identify any failures to l

meet the dotcle contingency principle for fissile operations. Independent verifications of the assay, mass, and cylinder designator for cylinders to be washed were accomplished i

as required by tne NCSAs. The inspectors determined the operators were

)

knowledgeable of the NCSAs and procedural requirements and were able to readily i

I identify the criticality safety controls relied upon for safe operations.

Based on the review, the inspectors considered that the plant staff had accomplished the actions identified in the CAL for restart of the cylinder wash operation, including the hydrostatic testing of the cylinders after washing. These actions included a review of the administrative controls for the operation, revision of the NCSAs, revision of the procedure, providing appropriate training to operators, and notification of the NRC prior

{

to restart.

11

j l

c.

Conclusions

'The inspectors concluded that plant staff had accomplished the actions identified in Confirmatory Action Letter Rlll-97-003 for restart of the Building C-400 cylinder wash operation. No additional concerns were identified as a result of the review.

l E1.2 Tails Withdrawal Buildina Accumulator As-Found Caoacities Difference a.

Insoection Scoce (68100)

The inspectors reviewed the resolution of an as-found difference betweer: the capacities of the installed Building C-315 liquid uranium hexahoride accumulators and the accumulator capacities assumed in the Safety Analysis Report.

b.

Observations and Findings On April 13,1997, the Assistant Plant Shift Superintendent (APSS) filed a problem report to document a potentially anomalous condition involving the Building C-315 Tails Withdrawal Accumulators. The APSS noted during a tour of the building that the accumulators appeared to have a larger volume then described in the Safety Analysis Report.

On April 25,1997, the engineering staff completed an evaluation of the potentially anomalous condition and determined the two accumulators were each approximately twice as large as described in ths Safety Analysis Report. The increased accumulator capacities were estimated to be a'.* '.o contain 21 tons of liquid uranium hexafluoride versus the Safety Analysis Report stated capacity of 10 tons. The engineering evaluation also included a note which indicated the original bill of materials for installation of the accumulators required the accumulator steel supports to be designed to support a weight of 22.5 tons.

On May 5,1997, the plant staff initiated efforts to revise the Safety Analysis Report description of the accumulator capacities from 10 tons to approximately 21 tons. A safely evaluation of the proposed change to the Safety Analysis Report, performed in accordance with the requirements of 10 CFR 76.68, indicated it at the change did not present an undue risk to public health and safety and did not ins olve an unreviewed safety question. On June 25,1997, the Plant Operations Review Committee reviewed and approved the Safety Analysis Report change which increased the stated accumulated capacities from 10 to 21 tons.

During the inspection period, the inspectors reviewed the Safety Analysis Report change associated with the accumulator capacities. The inspectors noted the safety evaluation 12

appeared incomplete. Specifically, the evaluation did not assess how the change could impact the consequences of all Safety Analysis Report accident scenarios associated

' with Building C-315. Instead, the evaluation focused on a single accident scenario described in Section 4.3.4.2.1. The inspectors determined Safety Analysis Report Sections 4.3.3.1.2 ( Building C-310 Accumulators),4.6 (Natural Phenomena), and 4.9 (Accident Scenario Summaries) also included assessments and discussion of accident scenarios related to the Building C-315 accumulators.

The inspectors reviewed the assessments and conclusions of Safety Analysis Report Sections 4.3.3.1.2,4.6, and 4.9. Section 4.3.3.1.2 discussed a fatigue failure of the accumulator drain line. The assessment concluded that the accident consequences would be limited to 1000 pounds based on operator recognition of the event and actions to evacuate the accumulators within five minutes after a failure of the drain line. The assessment further acknowledged that smaller leaks may take longer to recognize; however, in all cases, the total materie.; released would not exceed 1000 pounds.

inspectors noted that accumulator capacity would have a direct impact on the opew ability to evacuate the system within five minutes. Therefore, an increase in the accumulator capacity may increase the consequences of the accident. The inspector also noted that the assessment appeared to assume only a limited amount of material was present in the accumulators; however, information provided in Section 4.3.2.4.1 indicated the act,umulators could be completely filled during cylinder changes. The inspectors determined the safety evaluation did not identify or assess the significance of the difference, though the safety evaluation referenced both sections.

Section 4.6 discussed the impacts of a seismic event on the plant. The potential for Building C-315 to be impacted by a seismic event appeared to have been recognized as a part of the assessment; however, the accident tables did not include a contribution to the overall release estimates from the Building C-315 accumulators. In order to assess the basis for the absence of a contribution by the accumulators to the overall seismic release estimates, the inspectors reviewed the source document for the referenced analysis. The source document indicated that the Building C-315 accumulators would withstand a 0.33g level earthquake. However, the inspectors concluded the analysis did not consider the true size of the accumulators or the potential for liquid uranium hexafluoride to be present in the accumulators. The presence of liquid uranium hexafluoride in the vertically mounted accumulators could change the seismic response of the accumulators. The inspectors concluded that consideration of this information, as a part of the safety evaluation, may have resulted in the accumulator capacity change being identified as an unreviewed safety question.

The inspectors also reviewed Section 4.9 of the Safety Analysis Report. The Section summarized, in table form, the residual risk represented by the expected consequences from the analyzed accident scenarios. The inspectors noted that the table included two scenarios that explicitly mentioned the accumulators. The table also included the generic seismic scenario. The maximum possible source term for the three scenarios was listed as 64,000 pounds of uranium hexafluoride. The inspectors determined the maximum source term was approximately 18,000 pounds less than Building C-315 accumulators' revised combined capacity.

During followup reviews of the issue, the plant staff determined the Building C-315 accumulators' structural supports were not adequate to ensure that the accumulators 13

~

would withstand a design basis earthquake. Failure of the accumulators, during a seismic event, could result in releases slightly greater than twice the level currently assumed in the accident analysis if the accumulators were full of liquid uranium hexafluoride.

As a result of the inadequate safety evaluation and an inadequate review of the safety evaluation by the Plant Operations Review Committee, the inspectors determined the plant operated from June 25,1997, until March 6,1998, without controls which would have controlled the amount of liquid uranium hexafluoride, in the Building C-315 accumulators, to within the Safety Analysis Report accident assumptions. The inspectors reviewed withdrawal data for the time period and determined that the accumulators contained liquid uranium hexafluoride approximately two percent of the time. The maximum amount of material present in the accumulators during the period was approximately 13,000 pounds.

On March 6,1998, operations management issued a long-term order which limited the amount of material ir. br'th the Building C-310A and Building C-315 accumulators, pending permanent modifications to the accumulators. The revised maximum filllimit, pending completion of the seismic modifications, was 10,000 pounds for the Building C-315 accumulators.

Title 10 of the Code of Federal Regulations, Part 76.68 (b) requires,in part, that as-found conditions that do not agree with the plant's programs, plans, policies, and operations shall be evaluated in accordance with 10 CFR 76.68 (a). Part 76.68 (a) allows, in part, the Corporation to make changes to the plant, as described in the Safety Analysis Report, without prior Commission approvas, if the changes do not constitute an unreviewed safety question. Part 76.4 defines an unreviewed safety question, in part, as a change for which the probability of occurrences or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased. The plant staff's failure to fully evaluate the impact of the as-found condition, increased Building C-315 accumulator capacities, for all Safety Analysis Report evaluated accidents and the Plant Operations Review Committee's approval of the Safety Analysis Report change and continued operations, for an as-found condition that increased the consequences of the Safety Analysis Report evaluated accidents, without prior Commission approval, is an Apparen?

Violation (eel 70-7001/98006-02).

c.

Conclusions The inspectors determined that a safety evaluation, performed following the plant staff's identification of an as-found condition associated with the Building C-316 liquid ura:?im hexafluoride accumulators, was nonrigorous. As a result, a potential unreviewed safety question was not identified and plant operations were conducted for approximately 8 months in a manner that was not consistent with the accident analysis limitations specified in the Safety Analysis Report.

E1.3 Liauid Uranium Hexafluoride Handling Cranes I

a.

Insoection Scooe (88100) 14

~

The inspectors reviewed an operability evaluation associated with the cranes used to move cylinders containing liquid uranium hexafluoride.

b.

Observations and Findings On March 27, the plant staff filed an ATR to document concerns with the current operability of the cranes used to move cylinders containing liquid uranium hexafluoride.

The ATR writeup s'.ated that the TSR-referenced crane rail stops were relied upon as design features for safety; however, the rail stops' performance requirements and operability status had not been defined. The ATR author noted that an LTO was currently in effect to ensure immediate safety; however, the acceptability of using an LTO as a substitute for a TSR-mandated control had not been addressed.

l On April 1, engineering staff completed an operability evaluation (OE) of the issues raised in the ATR. The inspectors reviewed the OE and concluded that the document was non-rigorous and did not address the ATR issues. Specifically, the OE did not provide detailed objective evidence to support the operability determination and did not respond to an ATR question regarding the acceptability of using an LTO as a compensatory measure for degraded or inoperable TSR-related equipment. In addition, the inspectors determined the OE arguments were internally inconsistent and in some cases were inconsistent with other regulatory requirements. For example, the OE used parts of several different codes and standards to support the operability assessment without consideration of the entire code or standard. In addition, the reference code or standard, to which the cranes were operated and maintained, was not defined. The OE also documented that the crane rails stops were not utilized for safety in direct conflict with the statements and information included in the TSRs and the Safety Analysis Report. Instead, the OE arguments relied upon operator actions to fulfill the TSRs and Safety Analysis Report specified safety function.

Late in the inspection period, the inspectors discussed the OE with operations and engineering management. The inspectors were informed that a reasonable basis for continued operability of the cranes existed based upon recent engineering review of the rails stops. In addition, the incident-specific safety implications of the issues were decreased by operation rr.anagement's continued use of the LTO which precluded crane operations in the immediate vicinity of the rail stops. Engineering management aho stated their plans to initiate further efforts to document objective evidence of the crane rail stops' performance capability versus applicable codes and standards. The additional engineering work was expected to be completed by the end of April,1998.

The inspectors will track completion of the engineering efforts as an inspection Follow-up item (IFl 70-7001/98006-03).

The inspectors noted that the issue of which codes and standards the certificate followed to ensure continued operability of the cranes and other safety-related equipment was previously raised during pre-certification activities and as a part of a Notice of Enforcement Discretion issued in February 1997. In addition, a Compliance Plan item was developed to ensure the issue was resolved. However, the information provided as a result of the Compliance Plan item was not sufficient to address the current concern. The certificate's efforts, in response to the Compliance P!an item, were currently being reviewed by the NRC (see Section E8.1).

15

c.

Conclusions The inspectors determined that an operability evaluation, developed in response to questions raised regarding the performance capabilities of rail stops for cranes used to handle cylinders containing liquid uranium hexafluoride, was nonrigorous and inconsistently applied applicable codes and standards. The inspectors will track the completion of additional engineering efforts being performed to document the rail stops' performance capabilities versus the applicable performance standards.

E1.4 Safety Analysis Reoort Uograde Process a.

Insoection Scoce (88100)

The inspectors reviewed the plant staff's dispositioning of issues developed as a part the of the Safety Analysis Report Upgrade process, b.

Observations and Findings The inmtors reviewed the plant staff' dispositioning of issues associated with the Building C-360 autoclaves, the Building C-310 and C-315 withdrawal pumps, the Building C-333A and C-337A autoclave containment valves, and the Building C-310 and C-315 witbrawal accumulators. Each of the issues was either developed as a result of the Safety Analysis Report Upgrade process or was handled as a part of the Upgrade process after being identified by the plant staff. The inspectors focused the review on engineering evaluations developed for each of the issues and the corrective or compensatory measures taken to permit continued operations. The inspectors' review of the Building C-310 and C-315 accumulators is included in Section E1.2.

Building C-360 Autoclaves The inspectors reviewed Engineering Evaluation EV-C-813-98-021, Revision 0, dated February 4,1998, related to the Building C-360 autoclave containment control logic.

The evaluation results indicated that the as-found system design could create a potential for new system failures not previously documented or assessed in the current Safety Analysis Report. Specifically, the evaluation results indicated that the control logic included a keyed reset switch that could, if incorrectly operated, allow an unmitigated release from the autoclaves following an accident. The evaluation also documented new failure modes, created as a result of non-proceduralized routine operations using the keyed reset switch, that would render other safety systems inoperable without alarms or other warnings to the operators. The evaluation included a recommendation that the system logic should be revised to remove the new failure modes.

Juring review of the issue, the inspectors determined that the finding had been previously documented in a problem report. On the problem report form, the PSS documented a need to revise the procedures associated with the safety systems i

affected by the keyed reset switch prior to returning the autoclaves to service. The inspectors reviewed the closed problem report and determined that the PSS's

. comments were not acted upon and that the autoclaves were returned to service without changes being made to the affected procedures.

L 16 L

O O

The inspectors discussed the findings developed as a results of reviews of the engineering evaluation and the previous problem report with plant management. During

' the discussions, the inspectors questioned whether presence of the keyed reset switch in the safety-related circuits represented an unreviewed safety question, in that, a new and different failure mechanism was identified for the involved safety systems. In addition, the inspectors noted that the lack of formal procedures for operation of the keyed reset switch may further increase the potential for incorrect alignment of the safety system actuation circuits. Based upon an independent re-evaluation of the issue, operations management chose to shut down the Building C-360 autoclaves and to revise the operations procedures associated with the affected safety systems. In a problem report filed to document the issue, the inspectors noted that the PSS placed a hold on the affected operating procedures to ensure that the facility was not restarted without resolution of the involved issues. The inspectors concluded that the PSS's handling of this second problem report related to the keyed reset switch provided more positive controls to ensure PSS-required actions were completed prior to returning the autoclaves to service.

As of the end of the inspection period, the plant staff were reviewing the initial handling of the issue to determine: 1)if a safety evaluation of the as-found condition was required; 2)if the as-found condition was dispositioned in accordance with the Compliance Plan, and; 3)if the as-found condition constituted an unreviewed safety question.

Buildina C-310 and 315 Withdrawal Pumos The inspectors reviewed Engineering Evaluation EV-C-812-98-017. Revision 0, dated February 23,1998, related to the product and tails withdrawal pump high discharge pressure safety systems. The engineering evaluation was performed in order to assess the system's design and operation versus the Safety Analysis Report-specified requirements. Results of the engineering evaluation were communicated to the NRC in a letter dated March 9,1998.

The inspectors noted the engineering evaluation did not assess the adequacy of current operations and did not add significantly to the information available prior to the evaluation. In addition, the inspectors concluded a nuclear safety impact assessment of the system asign, included as a part of the engineering evaluation, did not include sufficient information to support the conclusions reached relative to Building C-310 and did not consider all the Technical Safety Requirement Modes during development of the conclusions for Building C-315. Specifically, the Building C-310 evaluation did not I

con? Mr the impact of only a partialloss of plant air systems and the Building C-315 evat

. on did not consider that constant manning of the control room was not required.

Th: 1spectors discussed the engineering evaluation with operations and engineering management. The inspectors questioned the ability of the current systems to perform the expected safety functions and whether compensatory measures were appropriate pending resolution of severalissues, including the planned system modifications. The inspectors also questioned whether the as-found condition should have been evaluated to determine if an unreviewed safety question existed. Operations and engineering management indicated a belief that an adequate assurance of operability existed; however, further assessment of the impact of support system failures associated with 17

the safety system was planned. In addition, engineering management was reviewing the need for a specific evaluation of the as-found condition and the acceptability of

' continued operations with and without compensatory measures. Engineering management also indicated that a generic unreviewed safety question determination was performed for issues identified as a part of the Safety Analysis Report Upgrade process.

As of the end of the inspection period, the inspectors had not completed a review of the system design and operation information to assess the full impact of support system failures. Engineering management also had not completed their review of the need for a issue-specific unreviewed safety question evaluation.

Buildina C-333A and C-337A Autoclave Containment Valves During a followup inspection of findings developed by the NRC at the Portsmouth Gaseous Diffusion Plant, the inspectors identified that certain containment isolation valves, associated with the feed autoclaves, had an air assist provided to improve the valve closing times. Each autoclave had four valves that relied on the plant air system, a nonsafety-related system, to provide an air assist to improve the closing times. The four valves were located on three separate autoclave penetrations, with two of the four valves located on the condensate drain line. The condensate drain line was open to the atmosphere during normal operations; therefore, timely isolation of the line following an accident appeared dependent upon a nonsafety-related system.

The inspectors reviewed the TSRs and the Safety Analyus Report and determined that the TSRs required the autoclave containment valves to close within 10 seconds in order to support continued operability and to limit accident consequences to within values documented in the Safety Analysis Report. The inspectors also noted that the Safety

)

Analysis Report information indicated that the failure of the plant air system would not cause any safety concerns.

The inspectors discussed the findings with operations and engineering management.

During the discussions, engineering management confirmed the inspectors' findings and indicated that a previous valve test, conducted without the air assist, documented that the valve closing time increased from 10 to approximately 45 seconds. The inspectors were also informed that the Safety Analysis Upgrade process had identified this issue as a potential concern; however, no actions had been taken to resolve the issue. Instead, the Corporation proposed to the NRC, in a letter that transmitted Upgrade process results, to perform an engineering evaluation of the situation by October 31,1998.

Necessary corrective measures would be identified and a schedule for implementation would be proposed following completion of the engineering evaluation.

Based upon the information provided, the inspectors questioned: 1) whether the feed autoclaves were operable; 2) whether reliance on the plant air system for the operability of safety-related systems was acceptable, and; 3) whether the as-found condition l

should have been evaluated to determine if an unreviewed safety question existed. As of the end of the inspection period, operations management indicated their belief that a reasonable expectation of operability existed; however, engineering management was assessing the findings to determine if the current accident analysis relied upon 18

nonsafety-related systems to ensure operability and if the current situation should be evaluated to determine if an unreviewed safety question existed.

4 Summary The inspectors determined that several as-found conditions, identified as a part of the Safety Analysis Report Upgrade process, could impact current operations. However, the inspectors were unable to determine if the as-found conditions had been evaluated against the current Safety Analysis Report. As of the end of the inspection period, the plant str 'f were evaluating each of the as-found conditions, in addition to the other Safety e atysis Report Upgrade process findings, to determine if continued operations were consistent with the current Safety Analysis Report. The inspectors will track 1

completion of these evaluations as an Unresolved item (URI 70-7001/98006-04).

c.

Conclusions The inspectors identified several as-found conditions associated with the Safety Analysis Report Upgrade process appeared to conflict with the current Safety Analysis Report. Actions by the plant staff to assess the acceptability of continued operations with the as-found conditions will be tracked as an Unresolved item.

E8 Mitsellanggus Engineering issues E8.1 LOcen) URI 70-7001/97007-08: identification of codes and standards used for operation and modification of the Paducah Gaseous Diffusion Plant. During the inspection period, engineering management indicated that actions taken to identify the codes and standards that should be applicable to the gaseous diffusion plants would be completed during April 1998. Engineering management also planned to identify differences between the identified codes and standards and actual plant practices by the end of August 1998. During discussions with engineering and plant management, the inspectors noted that the resolution of several recent operability and engineering issues was complicated by an apparent incomplete definition or understanding of the applicable codes and standards. An example of such a situation is documented in Section E1.3.

The inspectors will review the listing of codes and standardc that should be applied to the plant following development. The Unresolved item will remain open pending the plant staff's completion of the two outstanding action items and the inspectors' review of the action item products.

E8.2 (Closed) URI 70-7001/97011-08: modification of the criticality accident alarm system operating temperature limits. Three issues were identified as a part of the Unresolved l

Item: 1) adequacy of the modification testing methods; 2) appropriateness of the critical l

parameters evaluated for the modification, and; 3) appropriateness of making changes l

to operating parameters without performing safety evaluations required for plant design changes.

Following identification of the Unrt solved item and prior to implementation of the l

modified operating temperature limits, the plant staff performed a setpoint calculation assessment for criticality accident alarm system. Results of the setpoint calculation l

assessment indicated that additional uncertainty would be created in the setpoints as a 19 l

l

byproduct of the expanded operating temperature limits. Because the increased uncertainty could result in an increased probability of false actuations, the plant staff

' chose not to implement the modification to the operating temperature limits. As a consequence, the inspectors had no further basis for concerns and the Unresolved item is considered closed.

IV. Plant Su.pppIt S1 Conduct of Security S1.1 Vodate on Corrective Actions for Classified Matter Escalated Enforcement Action 97-431 a.

Insoection Scoce (88100)

The inspectors reviewed the corrective actions taken to date by the plant staff in response to the escalated enforcement action for a significant failure to control classified matter onsite (VIO 70-7001/97007-09).

b.

Observations and Findinas in August 1997, the plant staff began a site-wide campaign to purge any materials containing classified information (properly or improperly marked) from areas of the plant which were not designated for the storage of such information. The campaign included 1

a walkdown of all the buildings and trailers in the leased areas of the plant both inside and outside of the Controlled Access Area fence. After a walkdown of each building was complete, plant security staff were conducting verification sweeps as an independent means to ensure no classified information was left uncontrolled in the building. The walkdowns and security verifications were being performed in accordance with a detailed schedule and were due to be completed by June 30,1998.

As of the end of the inspection period, plant staff had completed walkdowns for about 75% of the buildings onsite. Over 80,000 documents and drawings had been reviewed to determine whether or not the documents were properly classified. Numerous other documents were brought into a classified storage vault to await review. The inspectors concluded that the classified matter purge campaign was on schedule for meeting the June 30,1998, commitment date in the response letter dated January 7,1998.

c.

Conclusions The inspectors determined that the classified matter purge campaign, undertaken in response to Escalated Enforcement Action 97-431, appeared to be on schedule to meet the June 1998 commitment date.

S8 Miscellaneous Security issues S8.1 Certificate Security Reoorts (90712)

The certificate made the following security-related one-hour reports pursuant to 20 j

l t

4 e

10 CFR 95 during the inspection period. The inspectors reviewed any immediate security concerns associated with the report at the time of the initial verbal notification.

Dal2 Ill!A 1/24/98 Pedestrian Gate 27A Discovered Unsecured S8.2 (Closed) VIO 70-7001/97014-13: fai'me to develop and implement administrative procedures to limit the hours of work for plant security guards in accordance with TSR 3.2.2.b. The plant security staff had not implemented the site procedure for limiting overtime for security officers performing safety and safeguards-related activities. After identification by the NRC, management directed the security staff to implement the requirements of the site procedure and to utilize the Overtime Canvassing System to ensure compliance with the hours of work requirements. In addition, the security management reduced the number of officers required for patrols during criticality accident alarm outages and supplemented the security staff in order to decrease the need for large amounts of overtime by the guards. The inspectors conducted a review of security officers' hours for the month of March 1998 and did not identify any violations I

of the TSR. The inspectors concluded that the corrective actions for the violation had been appropriate.

l T8 Miscellaneous Transportation Issues T8.1 LClosed) VIO 70-7001/97002-32: failure to tin cylinGer valves and plugs with the proper solder and to mark the correct tare weight on cylinders offered for shipment. The certificate requested and received an amendment to the NRC Certificate of Compliance (CoC) for use of the solder generated onsite. In addition, an exemption from Department of Transportation requirements was obtained. Plant maintenance procedures were revised to test the solder mixture for compliance with the limits in the CoC. The plant staff also began welding supplemental nameplates onto cylinders l

during the five-year decertification process and stamping the re-established tare weight l

on the nameplate. The inspectors observed six cylinders which had recently been washed and decertified, and noted that the supplemental nameplates were attached.

The certificate also revised the governing procedure to include a note that only the official tare weight in the material control and accounting reords was to be used in establishing the actual amount of UF,in a cylinder. The information included in the accounting records was considered the most reliable and accurate number pending the addition of supplemental plates to all cylinders. The inspectors concluded that the corrective actions for the violation appeared appropriate.

V. Management Meetinos X1 Exit Meeting Summary The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on April 20. The plant staff acknowledged the findings l

. presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

i 21 l'

PARTIAL LIST OF PERSONS CONTACTED

• Licensee i

• J. A. Labarraque, Safety, Safeguards and Quality Manager J. H. Miller, Vice President - Production Lockheed Martin Utility Services (LMUS)

• L. L. Jackson, Nuclear Regulatory Affairs Manager S. R. Penrod, Operations Manager

• S. A. Polston, General Manager H. Pulley, Enrichment Plant Manager United States Decartment of Enerav (DOE)

G. A. Bazzell, Site Safety Representative NRG

• J. M. Jacobson, Resident inspector

'K. G. O'Bnen, Senior Resident inspector

• Denotes those present at the April 20,1998, exit meeting.

Other members of the plant staff were also contacted during the inspection period.

)

INSPECTION PROCEDURES USED IP 88100: Plant Operations IP 88102: Surveillance Observations IP 90712: In-office Review of Events IP 92702: Follow-up of Events 1

l l

1 22

)

l

ITEMS OPENED, CLOSED, AND DISCUSSED Ooenbd 70-7001/98006-01 VIO Inadequate Verification of Building C-720 Criticality Accident Alarm System Design Modification 33929 CER Steam Blowdown Testing Creates inaudible Condition for Building C-400 and C-409 Criticality Accident Alarm System 34034 CER Building C-720 Criticality Accident Alarm System Not Able to Previde Required Alarms in Building C-300 Central Control Facility 70-7001/98006-02 eel As-Found Condition, Safety Evaluation, and Safety Analysis Report Change That Appeared to involve an Unreviewed Safety Question 70-7001/98006-03 IFl Adequacy of Rail Stops on Crane Authorized to Handle Cylinders Containing Liquid Uranium Hexafluoride 70-7001/98006-04 URI Evaluation of As-Found Conditions identified as a Part of the Safety Analysis Report Upgrade Process Closed 70-7001/97002-03 VIO Failure to Determine and Correct the Cause of an Autoc! ave High Drain Alarm j

33892 CER Loss of Power to Building C-360 Criticality Accident Alarm Systems and Process Gas Leak Detection Systems l

33957 CER Process Gas Leak Detector Alarmed in Building C-337 Unit 3 Cell Bypass Duct 70-7001/97014-13 VIO Failure to Develop and implement Administrative Procedures to Limit the Hours of Work for Plant Security Guards 70-7001/97002-32 VIO Failure to Tin Cylinder Valves and Plugs with the Proper Solder and to Mark the Correct Tare Weight on Cylinders 70-7001/97011-08 URI Modification of the Criticality Accident Alarm System Operating Temperature Limits Discussed 70-7001/97007-08 URI Identification of Codes and Standards Used for Operation and Modification of the Paducah Gaseous Diffusion Plant 1

1 70-7001/97007-09 VIO Failure to Properly Mark and Control Classified Matter at Paducah Gaseous Diffusion Plant l

23 IE_

e

.. +

i

.E 70-7001/97002-15 IFl Confirmatory Action Letter Rlll-97-003 for inadequate

~

implementation of Nuclear Criticality Safety Requirements LIST OF ACRONYMS USED 1

APSS Assistant Plant Shift Superintendent ATR Assessment and Tracking Reports CofC Certificate of Compliance l

CAAS Criticality Accident Alarm System CAL Confirmatory Action Letter CER Certificate Event Report CFR Code of Federal Regulations eel

- Escalated Enforcement Item LTO Long-Term Order MC&A Material Control and Accounting NCSA Nuclear Criticality Safety Approval NCSE Nuclear Criticality Safety Evaluation

'NRC

. Nuclear Regulatory Commission OE Operability Evaluation PSS Plant Shift Supervisor QAP Ouality Assurance Program TSR Technical Safety Requirement UF6 Uranium Hexafluoride USEC United States Enrichment Corporation VIO Violation 24

,a

" ?; w. hew h*

. UNITED STATES

i NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS WASHINGTON. D.C.

20555 May 1. 1996 NRC INFORMATION NOTICE 96-28: SUGGESTED GUIDANCE RELATING TO DEVELOPMENT AND IMPLEMENTATION OF CORRECTIVE ACTION Addressees 411 mat'eNa'landfuelcyclelicensees.

Puroose The U.S. Nuclear PogoWory Cnmpiqinn INRC) is issuing this information notice to providt: edienees wil.h guiderice relating to development and implementation of corrective actions that should be considered after identification of violation (s) of NRC requirements.

It is expected that recipients will review this information for applicability to their facilities and consider actions, as a]propriate, to avoid similar problems.

However.

suggestions contained in t1is information notice are not new NRC requirements; therefore no specific action nor written response is required.

Backaround On June 30, 1995. NRC revised its Enforcement Policy (NUREG-1600)' 60 FR 34381. to clarify the enforcement program's focus by. in part, emphasizing the importance of identifying problems before events occur and of tacing prompt, Consistent with comprehensive corrective action when problems are ident!ified.

the revised Enforcement Policy. NRC encourages and expects identification and prompt, comprehensive correction of violations.

In many cases. licensees who identify and promptly correct non-recurring Severity Level IV violations, without NRC involvement, will not be subject to I

formal enforcement action.

Such violations will be characterized as "non-cited" violations as provided in Section VII.B.1 of the Enforcement Policy.

l Minor violations are not subject to formal enforcement action.

Nevertheless, the root cause(s) of minor violations must be identified and appropriate corrective action must be taken to prevent recurrence.

l If violations of more than a minor concern are identified by the NRC during an

)

inspection, licensees will be subject to a Notice of Violation and may need to l

provide a. written response, as required by 10 CFR 2.201. addressing the causes of the violations and corrective actions taken to prevent recurrence.

In some cases. such violations are documented on Form 591 (for materials licensees) m-mm, mm t

/WW.7V A Ja I

(, ( ( ~

1 Copies of NUREG-1600 can be obtained by calling the contacts listed at i

the end.of the Information Notice..

l se

IN 96-28 May 1. 1996 e.

Page 2 of 6

• which constitutes a notice of violation that requires corrective action but does not require a written response.

If a significant violation is involved, a predecisional enforcement conference may be held to discuss those actions.

The quality of a licensee's root cause analysis and plans for corrective actions may affect the NRC's decision regarding both the need to hold a l

predecisional enforcement conference with the licensee and the level of sanction proposed or imposed.

Discussion Comprehensive corrective action is required for all violations.

In most cases, NRC does not propose im)osition of a civil penalty where the licensee promptly identifies and compre1ensively corrects violations.

However a Severity Level III violation will almost always result in a c1v11 penalty if a licensee does not take prompt and comprehensive corrective actions to address the v'olation.

It is important for licensees, upon identification of a violation, to take the necessary corrective action to address the noncompliant condition and to 3revent recurrence of the violation and the occurrence of similar violations.

3rompt com)rehensive action to improve safety is not only in the public interest. Jut is also in the interest of licensees and their employees.

In addition. it will lessen the likelihood of receiving a civil penalty.

Compre-hensive corrective action cannot be developed without a full understanding of the root causes of the violation.

Therefore, to assist licensees, the NRC staff has prepared the following guidance, that may be used for developing and im)lementing corrective action.

Corrective action should be appropriately compre1ensive to not only prevent recurrence of the violation at issue, but also to prevent occurrence of similar violations. The guidance should help in focusing corrective actions broadly to the general area of concern rather than narrowly to the specific violations. The actions that need to be taken are dependent on the facts and circumstances of the particular case.

The corrective action process should involve the following three steps:

1.

Conduct a comolete and thorouah review of the circumstances that led to the violation.

Typically, such reviews include:

Interviews with individuals who are either directly or indirectly involved in the violation, including management personnel and those responsible for training or 3rocedure development / guidance.

Particular attention 3hould )e paid to lines of communication between supervisors and workers.

I l

o*

IN 96-28 May 1. 1996 Page 3 of 6 0

Tours and observations of the area where the violation occurred, particularly when those reviewing the incident do not have day-to-day contact with the o)eration under review.

During the tour, individuals should loot for items that may have contributed to the violation as well as those items that may result in future violations.

Reenactments (without use of radiation sources. if they were involved in the original incident) may be warranted to better understand what actually occurred.

Review of programs, procedures. audits, and records that relate directly or indirectly to the violation.

The program should be reviewed to ensure that its overall objectives and requirements are clearly stated and implemented.

Procedures should be reviewed to determine whether they are com]lete. logical, understandabic, and meet their objectives (i.e., 11ey should ensure compliance with the current requirewnts). Records should be reviewed to determine whether thero is sufficient documentation of necessary tasks to provide an auditable record and to determine whether similar violations have occurred previously.

Particular attention should be paid to training and qualification records of individuals involved f

with the violation.

2.

Identify the root cause of the violation.

Corrective action is not comprehensive unless it addresses the root cause(s) of the violation.

It is essential therefore, that the root cause(s) of a violation be identified so that appropriate action can be taken to prevent further noncompliance in this area, as well as other potentially affected areas.

Violations typically have direct and indirect cause(s). As each cause is identified, ask what other factors could have contributed to the cause.

When it is nc longer possible to identify other contributing factors, the root causes probably have been identified.

For example, the direct cause of a violation may be a failure to follow procedures: the indirect causes may be inadequate training, lack of attention to detail, and inadequate time to carry out an activity.

These factors may have been caused by a lack of staff resources that, in turn, are indicative of lack of inanagement support.

i Each of these factors must be addressed before corrective action is considered to be comprehensive.

l

A:

j x *i A*i

'IN 96-28 May 1. 1996 t f'.

Page 4.of 6 3

o 3'/

Take oromot and ' comprehensive corrective action that will address the immediate concerns and orevent recurrence of the violation.

It is import' ant toltake'immediate corrective action to address the specific findings of the violation.

For. example, if the violation was issued because radioactive material was found in an unrestricted area.

'immediate~ corrective action must be taken to place the material under

' licensee control in' authorized locations. After the immediate safety concerns have been addressed timely action must be taken to prevent

-future' recurrence'of the' violation. Corrective action'is sufficiently comprehensive when corrective action is broad enough to reasonably-prevent recurrence of the specific violation as well as prevent similar violations.

~In evaluating the root causes of a violation and developing effective corrective action, consider the following:

1.

Has management been informed of the violation (s)?

2.

Have the programmatic implications of the cited violation (s) and the potential presence of similar weaknesses in other program areas been considered in formulating corrective actions so that both areas are adequately addressed?

3.

Have precursor events been considered and factored into the corrective actions?

4.

In the event-of loss of radioactive material, should security of radioactive material be enhanced?

5.

Has your staff been adequately trained on the applicable requirements?

6.

Should personnel be re-tested to determine whether re-training should be emphasized for a given area? Is tt.3 ting adequate to ensure understanding of requirements and procedures?

7.

Has your staff been notified of the violation and of the applicable corrective action?

8.

Are audits sufficiently detailed and frecuently performed? Should the frequency of periodic audits be increasec?

n

.C*-

4 IN-96-28 T,

May 1. 1996 Page 5 of 6

.o

9..

Is there a need for retaining an independent technical consultant to audit the area of concern or revise your procedures?

10.

Are the procedures consistent with current NRC requirements, should they be clarified, or should new procedures be developed?

11.

Is a system in place for keeping abreast of new or modified NRC requirements?

12.

Does your staff appreciate the need to consider safety in approaching.

daily assignments?

13.

Are resources adequate to perform and maintain control over..the.

licensed activities? Has the radiation safety officer been provided sufficient time and resources to perform his or her oversight duties?

14.

Have work hours affected the eniployees' ability to safely. perform the job?

15.

Should organizational changes be made-(e.g.. changing the reporting relationship of the radiation safety officer to provide increased independence)?

16.

Are management and the radiation safety officer adequately-involved in -

oversight and implementation of the licensed activities? Do supervisors adequately observe new employees and difficult, unique, or new operations?

17.

Has management established a work environment that encourages employees to raise safety and compliance concerns?

18.

Has management placed a premium on production over compliance and safety? Does management demonstrate a commitment to compliance and safety?

19.

Has management conrnunicated its expectations for safety and compliance?

20.

.Is there a published discipline policy for safety violations, and are employees aware of it? Is it being followed?

U

..c-

[r 3 O IN 96-28 May 1. 1996 o ',.

Page 6 of 6 This information notice requires no specific action nor written response.

If you have any questions about the information in this notice, please contact one of the technical contacts listed below.

Elizabeth 0. Ten Eyck. Director Donald A. Cool. Director

. Division of Fuel Cycle Safety Division of Industrial a'nd Safeguards and Medical Safety Office of_ Nuclear Material Safety Office of Nuclear Material Safety

.and Safeguards and Safeguards Technical contacts: Nader L. Mamish. OE Daniel J. Holus, RI (301) 415-2740 (610) 337-5312 Internet:nlm@nrc. gov Internet:djh@nrc. gov Bruno Uryc. Jr., RII Bruce L. Burgess. RIII (404) 331-5505 (708) 829-9666 Internet:bxu@nrc. gov Internet:blb@nrc. gov Gary F. Sanborn RIV (817) 860-8222 Internet:gfs@nrc. gov Attachments:

1.

List of Recently Issued NMSS Information Notices 2.

List of Recently Issued NRC Information Notices