ML20248H738

Insp Rept 70-7002/98-206 on 980427-0501.Violations Noted. Major Areas Inspected:Highest Risk Activities in High Enriched U Feed Area,Extended Range Product Area & U Recovery Activities in X-705 Building

ML20248H738
Person / Time
Site:	Portsmouth Gaseous Diffusion Plant
Issue date:	06/02/1998
From:	NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS)
To:
Shared Package
ML20248H711	List: ML20248H708 ML20248H729 ML20248H738
References
70-7002-98-206, NUDOCS 9806080231
Download: ML20248H738 (16)

Text

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _

6 e

I U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS Docket No: 70-7002 Certificate No: GDP-2 Report No: 70-7002/98-206 Certificate Holder: United States Enrichment Corporation Location: Portsmouth Gaseous Diffusion Plant Piketon, OH Dates: April 27 - May 1,1998 Inspectors: Christopher Tripp, inspection Tearn Leader, NRC Headquarters Sandra Larson, NRC Contractor l

Approved By: Philip Ting, Chief, Operations Branch, Division of Fuel Cycle Safety and Safeguards, NMSS Enclosure 1 9906000231 990602 1 PDR ADOCK 07007002L C PDR ,

c

• e EXECUTIVE

SUMMARY

UNITED STATES ENRICHMENT CORPORATION PORTSMOUTH GASEOUS DIFFUSION PLANT NRC INSPECTION REPORT 70-7002/98-206 Areas insoected The Nuclear Regulatory Commission (NRC) conducted a routine, announced nuclear crit lcality safety inspection of the Portsmouth Gaseous Diffusion Plant (PORTS) on April 27 - May 1, 1998. The inspection was conducted by NRC Headquarters' staff and a contractor, using Inspection Procedure (IP) 88015. The inspection focused on the highest risk activities in the high enriched uranium (HEU) feed area, extended range product (ERP) area, and the uranium recovery activities in the X-705 building. Program areas covered by the inspection included nuclear regulatory event reporting, corrective actions, and reliability of controls.

Results The inspection resulted in three Level IV violations (VIOs) and two inspector followup items (IFis). One IFl from a previous inspection was closed in this report. No immediate safety issues were identified.

e Due to ongoing modifications to the Corrective Action Program, the inspectors could not review the effectiveness of corrective actions under the revised program. Review of the program's effectiveness and the trend in the number of NCS incidents will be treated as IFl 70-7002/98-206-01.

• Several systems, structures, and components (SSCs) required to establish double contingency during cascade operations in the X-326 Building were not identified as Nuclear Criticality Safety (NCS) requirements in Part B of NCSA-0326_024.04 and NCSA-0326_013.A0 and were not classified as augmented quality (AQ)-NCS items.

The failure to identify and control those features relied on for safety is a program weakness, and is VIO 70 7002/98-206-02.

• Nuclear Criticality Safety Approval (NCSA)-0326,_015.A02, "ERP Withdrawal Station,"

states that double contingency cannot be deinonstrated because of possible in-leakage of wet air into the compressors. Failure to initiate a Technical Safety Requirement (TSR) for this singly contingent operation was identified as VIO 70-7002/98-206-03.

• The plant staff could not provide a demonstration of the reliability and availability of those SSCs relied on for criticality safety in cascade operations, and in particular, to control the enrichment during HEU refeed. This will be treated as IFl 70 7002/

98-206-04.

l Enclosure 2 j i

l .-

4 a

• e l

• There was no 4-hour report made ir: connection with the discovery that double contingency had not been established in the Low Assay Withdrawal (LAW) and Tails Withdrawal station (Violation 70-7002/97-206-06. Failure to report a loss of double contingency is VIO 70-7002/98-206-05.

• Several cases were observed in which corrective actions were too narrowly focused to resolve broad or systemic criticality safety issues, which is a programmatic weakness.

These cases include the response to Violation 97-206-06 and recurring spacing violations.

e The functional testing and configuration control of Quality (Q) and AQ-NCS items in the solution recovery calciner process was thorough and robust, and all safety SSCs were found to be correctly characterized in the Boundary Definition Manual (BDM).

e IFl 70-7002/97-206-08 concerning the quality status of the withdrawal station gamma and mass spectrometers was closed. The inspectors agreed that the spectrometers were not required for double contingency given the compensatory measures in l TSR 2.5.3.5.

Conclusion I

The inspectors did not note evidence of any immediate safety hazards or broad programmatic breakdowns. The criticality safety program and plant operations have instituted a number of changes that should improve performance in the areas of corrective actions and NCS violations, though the inspectors could not discern a definitive trend. However, there were a number of programmatic weaknesses, as evidenced by the number of recurring problems and NCS violations. The more significant weaknesses were the tendency to focus narrowly on the immediate corrective actions without considering generic, plant-wide implications, failure to establish and maintain effective controls for all plant processes, and failure to identify those plant features relied on for criticality safety. Major contributing causes appeared to be the complex nature of interlocking NCSAs and procedures, the size and complexity of plant operations, and the lack of consistent management direction resulting from frequent tumover in the NCS Manager position.

2 1

6 1

.c REPORT DETAILS 1.0 Corrective Action Program

a. Scope The inspectors reviewed the corrective action program to determine the scope and safety significance of the corrective action backlog for nuclear criticality-related problems, to determine whether the corrective actions are prompt and effective in preventing recurrence, and whether previously identified weaknesses in the corrective action program have been addressed as part of the corrective in. tion upgrade.

b. Observations and Findings The inspectors reviewed the " Corrective Actions Program Report," POEF-LMUS-110, Part 7 (for February 1998) and the

• Performance Indicators for March 1998," UEO-1071, Part 4, in order to determine recent trends in the corrective action backlog and program. At the end of February, 16% (89 of 541) of the 7.ignificant conditions adverse to quality (SCAQ) action items were past due, down from 18% at the end of January. The report cited an " increased effort by '

management to reduce past due SCAQ items" as the reason for the improvement. The number of past due initial responses to SCAO problem reports was also down from 11 in January to 4 in February, and was attributed to the same reason. The inspectors note that the expected standard deviation on a population of 541 items is ~4.3%. These trends are not considered statistically significant and do not represent conclusive evidence that increased management attention has, been effective.

The inspectors determined that the longest overdue action item was initially due on June 1, l 1997, and had not yet been completed. The average time required to complete all action items on SCAQ Problem Reports (prs) was 15 months. The March performance indicators showed I that approximately 5% of allissues remained past due, and 15% of actions were past due.

There was no distinction between SCAQ and non-SCAQ items in this amount. Violations of NCS controls were also tracked in each report. Level 3 NCS incidents, defined as "the loss of controls such that only one double contingency control remains in place," peaked at 31 in February, with 25 incidents in March. Many of these incidents were spacing violations found during in-depth self-assessments as part of a heightened awareness of NCS controls, and presumably did not indicate a negative trend in plant safety Various corrective actions have been implemented to remedy these NCS violations, such as simplification of requirements and painting of guidelines where spaning control is required. However, it is too early to definitively measure the effectiveness of these actions or state with certainty that there is a positive trend in performance.

The inspectors noted that items in the Business Prioritization System (BPS) were classified as regulatory issues, SCAQ items, conditions adverse to quality (CAQ) items, non-quality items, and items of minor importance. Those having a SCAO or regulatory designation received higher priority than CAQ, non-quality, or minor items. Beyond this designation, there was no finer gradation prioritizing corrective actions according to risk or safety-significance.

3  ;

l

1 o I

.. i

'o l

The. inspectors randomly sampled NCS-related problem reports to assess the effectiveness of corrective a'ctions. Several cases where corrective actions were narrowly focused anc/or did not prevent recurrence of the problem were identified. One example is the PR for Violation 70-7002/97-206-11 concerning the lack of NCS-related information in emergency packets. The PR indicated that the emergency packet in question had recently passed an internal audit, a% hough neither the root cause evaluation nor the corrective actions addressed the J effectiveness of the internal audit, or the reason that the audit failed to identify this finding. A l second example is the repeat violation concerning technical safety requirements (TSRs) for l

singly contingent operations discussed in Section 2.2.

The certificant's corrective action program is undergoing major changes as part of Task 14 for the NCS Corrective Action Plan (CAP). In the CAP, plant management identified that the Conective Action Program had failed to prevent recurrence of NCS violations and needed to be reviewed. The root cause of the program's failure was determined to be lack of personnel accountability for CAPS and inadequate conveyance of management expectations in completing action items, which were often considered low priorities. A new Corrective Action Review Board (CARB) charter has been issued, and the General Manager has been appointed the CARB Chairman. The CARB will perform trending analysis of problem reports in the future, and five procedures pertaining to problem reporting and corrective actions are to be revised. In addition, the certificant indicated that a small number of staff in each department will be intensely trained as investigators / evaluators to conduct root cause evaluations. This will replace the ~300 people currently trained to perform TAPROOT analyses. The CARB is also expected to include more performance measures in the endpoint assessment of their CAPS, and a new goal of six months has been established for closing SCAQ prs. While these modifications should improve the overall performance of the Corrective Action Program, their effectiveness cannot be verified at this time, because the program has not been finalized and there has not been sufficient time to develop a long-term trend. This item will be tracked as IFl 70-7002/98-206-01.

The inspectors reviewed interim corrective actions to reduce the number of NCS violations by inspecting the X-333 and X-705 buildings and discussing changes to plant operations with the operations staff. As with long-term corrective actions, an assessment of the effectiveness of the changes is premature. For contaminated process equipment, some of the spacing requirements have been removed for parts with no visible contamination and internal hidden volumes of less than one gallon. Some parts that had been segregated with a two-foot spacing rule could now be consolidated in batches of six parts in a single drum. These less conservative requirements, combined with an effort to remove excess material from the buildings, reduced the plant-wide storage space and should reduce the risk of spacing violations. Additional guidelines increasing the spacing between components has increased the margin and made spacing violations, due to measurement error or bumping of equipment, less likely. The availability of tape measures and rulers has also made inadvertent spacing violations less probable. Painted lines spaced at a greater distance than required by the NCSA {

i have been added to underscore spacing rules in the X-705 building and similar plans are underway in X-333. Additional attention has been paid by operations to features of their system that could contribute to inadvertent non-compliances. Depressions in floors that could hold greater than a safe slab depth of fissile solution have been patched; the middle row on polybottle carts is no longer used because spacing requirements could be violated if two bottles leaned towards one another. I f

i 4

I 1

'o l

As part of the long-term corrective actions, NCSAs and NCSEs are now revised by a team including both NCS and operations staff. Plant staff indicated that this approach has helped to better communicate the importance of NCS controls to hourly operations staff and has resulted in a greater sense of ownership in the process.

The inspectors noted that the criticality safety function had been split into three separate groups, as part of the NCS Corrective Action Plan. The functions of analysis and documentation, controlimplementation, and NCSA/NCSE upgrades have been separated into three departments under the Director of Nuclear Safety. The plant staff indicated that this was an advantage in that the program upgrade could proceed without impacting routine criticality safety duties. Inspectors noted that there could be a potential weakness if the groups responsible for criticality analysis and documentation, NCS and field implementation (Field Support), did not communicate ef'ectively; the plant indicated, however, that the three groups take part in a daily morning meeting to discuss common issues.

c. Conclusions Additional tracking will be needed to show whether the slight improvement in the SCAQ item backlog and number of NCS violations represents a realimprovement or a statistical fluctuation.

The age atd size of the corrective action backlog and number of criticality-related incidents remains a concern.

Changes in operations and in management structure have been observed that should produce positive trends in the number and likelihood of NCS violations, and which should produce more communication between criticality safety and operations staff. The long-term effectiveness of the programmatic changes will be monitored in future inspections. The inspectors observed cases in which there was a simplification in the criticality safety requirements, and determined that in those cases, there remains an acceptable margin of safety. Inspectors noted that the simplification of requirements and removal of unnecessary criticality controls should enhance safe operation of the plant.

2.0 Reliability of Controls

a. Sgspg l

l The inspectors examined the implementation of the dominant controls relied on to satisfy double contingency in the highest-risk operations, to determine whether barriers against nuclear criticality were available and reliable when challenged. The inspectors reviewed maintenance and configuration control of equipment relied on for criticality safety, surveillance, and functional !

testing of active engineered controls (AECs), and correspondence between the documented '

l safety basis and the as-found condition of plant operations. The potential for common mode

( failure between controls, as a result of loss of essential plant utilities, was also evaluated.

b. Qhservations and Findinas The inspectors examined several NCSAs to determine the reliability and availability of the nuclear criticality controls relied on for doub'e contingency. These NCSAs covered the plant L

l 5

1

's

• o ope, rations at highest risk for an accidental criticality, including operation of the X-326 cascade, ERP withdrawalin X-326, and uranium solution recovery operations in X-705. Plant staff identified solution recovery and handling of planned expeditious handling (PEH) deposits as the highest risk of criticality at the site. The NCSAs chosen for review were:

• NCSA-0326_015.A02, " Extended Range Product (ERP) Withdrawal Station"

• NCSA-0326_024.A04, " Feeding of 5-inch,8-inch and 12-inch Cylinders in the X-326 Product Withdrawal Area"

• NCSA-0326_013.A05, " Cascade Operations in the X-326 Building"

• NCSA-0705_024.0C5, "Calciners, Solution Recovery" 2.1 Canade Operations NCSA-0326_024.A04 covers the feeding of HEU cylinders into the cascade as part of the HEU downblending project. Although the actual refeed is conducted in a de-leased area, the concern is that a process upset could cause the leased portion of the cascade to exceed its authorization basis of 10wt% 23sU enrichment. The inspectors examined this NCSA and noted that deposits in the cascade equipment did not meet double contingency, in accordance with SAR Section 5.2.2.3. This SAR section identifies those portions of the plant not meeting double contingency, and requires the establishment of TSRs in those areas. However, the NCSA took credit for meeting double contingency when a deposit of less than a safe mass was involved.

The inspectors examined Part B of NCSA-0326_024.A04 to determine what SSCs were relied on to ensure nuclear criticality safety. The inspectors also examined the " Double Contingency Analysis" contained in Part B of NCSE-0326_024.E04 to determine what SSCs were relied on for criticality safety. The inspectors then discussed the specific implementation of those SSCs with NCS and operations staff.

The HEU materialis refed into the odd cells of unit 25-7, which are designed for 100wt%

2'5U. However, a valving arrangement is possible which could feed materialinto other operation cells in the X-326 building, specifically cells in unit 27-1 and 27-2, which are only demonstrated to be subcritical up to an enrichment of 35wt% 23sU. The inspectors determined that the dominant controls consisted of maintaining the UF./ freon front below the feed point and maintaining enrichment below 20wt%. These were the two controls identified as required to meet double contingency for Contingency B.4.1 in NCSE-0326_024 ("HEU material is refed to cells not in unit 25-7-odd or HEU materialis not blended down to an acceptable enrichment for 27-1 or 27-2"), in addition to these controls against exceeding the authorized enrichment, the NCSE took credit for valves tagged and locked to prevent diversion of material from the 25-7-odd cells. The controls on location of the front and on cascade enrichment are implemented by shutting off the refeed if instrumentation indicates that either of these process conditions are lost. The valves are manually actuated. The inspectors asked plant staff to identify what equipment was relied on by operators to inform them when the front position moved beyond the refeed point or enrichment control was lost. Plant staff indicated that there 6

1

'9 wer,e several redundant systems for monitoring the lights front, including cell motor loadings and line recorders. Cell enrichment was a function of the process and was sampled at the withdrawal stations.

The Configuration Management Program Manual (CMPM) defines AQ-NCS items as "SSCs identified in NCSAs/NCSEs required to meet the double contingency principle." Plant staff confirmed that there were SSCs relied on to implement the administrative control of shutting off the refeed if the front is lost. The functioning of an administrative control requires that the operator be aware of changes in the state of the system, because the administrative controls require informed operator decisions. The inspectors determined that the state of the system cannot be determined without relying on certain key instrumentation. However, they could not identify any specific piece of front monitoring equipment that was classified as AQ-NCS. The inspectors also noted that the required equipment was not identified as AQ-NCS in the Boundary Definition Manual (BDM).

NCSA-0326_013.A05 concerns cascade operations, including normal operations and cell treatment in the event of deposits. Although the cascade operations are singly contingent, relying on moderation control alone, the inspectors noted that certain SSCs were relied on to maintain this single barrier. Part C of NCSA-0326_013 identified several contingencies and NCSE-0326_013.E04 demonstrated that at least one barrier against criticality existed for each contingency. In addition, double contingency protection was also demonstrated for each contingency except where a deposit of more than a safe mass or PEH deoosit existed. The inspectors noted that expansion joints, seals, and gas coolers were required to ensure that the moderation barrier remained available and reliable. Also, a dry air /N2 buffer was provided in shutdown cells to maintain moderation control. Plant staff indicated that the dry air /N2 buffer consisted of multiple trains of air dryers and relied on dewpoint monitors and line recorders to confirm that the buffer did not contain moisture. The inspectors determined that there were five separate trains of air dryers, consisting of a main plant air system and an auxiliary in each of the process buildings. In the event that main plant air or one of the auxiliary units is lost, plant air can be provided from one of the other process buildings. The inspectors also confirmed that the five sets of pump motors are on separate diesel generators. Thus, there are redundant electrical and plant air systems to ensure against complete loss of the dry air /N2 buffer. This was considered an incredible event. Though the inspectors agreed that there appeared to be adequate redundancy in the plant air system, they noted that the NCSA did not address either the redundancy of these controls or the potential for common mode failure due to loss of essential utilities.

The inspectors determined that the SSCs relied on to maintain the moderation barrier and to demonstrate double contingency in the NCSA were not identified as engineered features in l

Part B of the NCSA, and were also not categorized as AQ-NCS items in the BDM. The failure to identify all nuclear criticality safety requirements in Part B of NCSA-0326_024.A04 and NCSA-0326_013.A05 and the failure to identify SSCs relied on for double contingency as AQ-NCS items is Violation (VIO) 70-7002/98-206-02.

l Plant staff indicated that the reason these SSCs had not been designated as AQ-NCS was that there were no specific and dedicated systems relied on to implement the corresponding administrative control. In the case of the position of the UF,/ Freon front, there were numerous 7

l

[

w systems that could be used by operations to determine that the front had moved below the refeed point. However, when the inspectors asked the staff to identify what hardware was relied on for criticality safety, the plant could not identify any pieces of equipment used to monitor the front. This inability to point out what equipment performs the required safety function indicates an incomplete implementation of the criticality controls and a nebulous conception of plant activities. There appears to be a reluctance to commit to a specific safety basis.

2.2 ERP Withdrawal NCSA-0326_015.A02 covers the ERP withdrawal station in the X-326 building. The inspectors reviewed the controls required to establish double contingency on the product withdrawal operation at this station. NCSE-0326_015.E02 for the ERP station noted that double contingency could not be demonstrated due to the possibility of wet air in leakage into the ERP station UF. compressors. The inspectors noted that there was no TSR implementing controls against the scenario of leaking wet air into the ERP withdrawal station compressors.

TSR 3.11.5 states that the double contingency principle (described in the SAR) shall be used as the basis for the design and operation of processes using fissionable materials. In those instances in which double contingency is not met, TSRs shall be established. They are required to elevate the awareness of NCS controls on operations that do not meet the double contingency principle. Those processes and operations identified as singly contingent require controls and limits to maintain their single barrier protection, and these controls should be at least as reliable and robust as those on doubly contingent operations. Inspectors had raised the same issue with respect to the Tails and LAW Stations within the previous year, citing this non-compliance as Violation 70-7002/97-206-06. The corrective actions in response to this violation included revising the NCSEs for the Tails and LAW stations to demonstrate double contingency, but did not include a review of the NCSE for the ERP withdrawal station. The corrective actions were too narrowly focused, did not address the root cause of the violation, and were ineffective in preventing recurrence. This failure to establish double contingency on a process not covered by a TSR is VIO 70-7002/98-206-03.

As a result of this violation, the certificant committed to revising the ERP NCSE to demonstrate double contingency and a 4-hour event notification was filed. Based on the fact that process conditions existed to prevent a critical excursion, the safety significance is low. The fact that process features already existed that could been credited as criticality controls does not, however, mean that this is merely a documentation problem. Quality criticality controls must be identified and recognized in order to maintain them and ensure that they remain available and reliable during plant operations, and operators must be aware of their significance. Because the single barrier is the only protection against nuclear criticality, the requirement to maintain TSRs for singly contingent operations is very important to ensuring it remains available and reliable. This violation also indicates a programmatic weakness in the corrective action program, in that it is a nearly identical repeat of a previous violation and should have been addressed when the evaluations for the Tails and LAW stations were revised.

The ERP withdrawal station has engineered valves and UF smoke detectors to stop the flow of enriched UF. to product cylinders in the event of off-normal conditions, including a UF leak, loss of plant air, and loss of electrical power. All valves relied on for double contingency are 8

I solenoid valves classified as Q systems. The valves are held open by plant air and close upon loss of the' plant air supply. These solenoid valves are also held open by electrical current and fait closed upon loss of power. The valves are designed to be automatically actuated upon activation of the smoke detectors above the withdrawal positions. Functional testing is performed quarterly for those smoke detectors which are not self-testing The inspectors reviewed the last two quarterly surveillance of the smoke detectors and the last annual surveillance of the system shutdown capability. For the two out of three withdrawal positions currently operating, all tested systems performed as designed. Functional testing appeared adequate and in accordance with current plant procedures, and valving is designed to fail safe on loss of essential utilities.

2.3 Solution Recoverv NCSA-705,_024.C05 concerns the calcining of low-enriched uranyl nitrate into U3 0, in rotary kilns in the solution recovery area, for the purpose of storing the material in a stable form. The inspectors examined Part B of the NCSA and Part B of NCSE-705_024.001 to determine what SSCs were relied on to ensure criticality safety. The inspectors determined that there were a number of administrative and active engineered controls to preclude criticality, including dual calciner high-temperature thermocouple anG three level probes in the receiving can and calciner exit chute. These AECs are interlocked back to the calciner feed valve to prevent overheating and rupturing of the calciner and overfilling of the calciner, respectively. There was also a rotation detector to trigger the interlock in the event that the freely-rotating end of the calciner tube stopped rotating. In addition to closing the feed valve, the interlock stops the feed pump. The inspectors observed that the controls would be adequate to ensure double contingency protection, provided that they were maintained functional The inspectors reviewed the BDM for the X-705 Complex and determined that all required SSCs including the thermocouple, level probes, the rotation detector, feed pump, and isolation valves were identified as Q items (with the exception of the rotation interlock, which was AQ) on system drawing X-705-19CA-Z. The calciner tube itself was not considered O or AQ-NCS, even though the tube integrity is relied on for double contingency and is part of a periodic monitoring program. The inspectors then examined the functional testing records for the previous year and operating and testing procedures that incorporate the functional testing requirements. The inspectors reviewed the following testing procedures:

• XP4-CU-lM6100, "X-705 Test and Calibration of Calciners High Temperature Shutdown,"

Rev. 3, Ch. A.

• XP4-CU-lM6101, "X-705 Test and Ca!ibration of Calciners Throat Level Probe Safety System," Rev. 3, Ch. A.

• XP4-CU-lM6102, "X-705 Test and Calibration of Calciners Can Level Probe Safety System," Rev. 3, Ch. B.

• XP4-QA-Ql6901, " Inspection of X-705 Calciner Tubes," Rev.1.

• XP4-CU-CH1200, " Operation of the Electric Calciner," Rev. 4, Ch. C.

9

___--__--m___--___._...mm__._ _.m..__

o

• XP4-CU-CH1205, " Leak Test of Calciner Feed Pump Safety Valves," Rev. O.

The inspectors also reviewed quarterly testing records for the tube ultrasonic inspections, testing of the calciner high-high temperature probes, testing of can and throat level probes, and testing of the feed pump isolation valve. (Testing records were only available for two quarters due to extended shutdowns of the calciner.) The inspectors found that the tests appeared robust and adequately tested all relevant components of safety features under conditions similar to those expected during normal and off-normal operations. Acceptance criteria were specified in the above-mentioned procedures and were adequate. In all cases, the AECs relied on for nuclear criticality safety met the relevant acceptance criteria. In addition to quarterly surveillance, the operators perform visual checks of the calc.aer housing, tube rotation, and valving alignment prior to initiating feed (procedure XP4-CU-CH1200).

The inspectors also examined Part B, " Contingency Analysis," of the NCSE to determine whether the evaluation adequately considered the potential for common mode failure due to loss of electrical power. Procedure XP4-EG-NS1101, "NCSEA," Rev. 2, does not explicitly address evaluation of common mode failure. Both the SAR and this procedure do require that "at least two unlikely, independent, and concurrent changes in process conditions" occur "before a criticality accident is possible." The inspectors noted that the evaluation did not explicitly consider possible failure of multiple controls dJe to loss of electrical power. However, discussions with operations and criticality safety staff revealed that the feed isolation valve fails closed on loss of electrical power or actuator air pressure, and that the feed pump stops feed on loss of electrical power. Loss of power also causes the can and throat level probes to register high level and stop the feed, since the interlock is triggered upon measurement of decreased capacitance between the probe and the grounded can or chute. This can be the result of either loss of signal to the probe or the intrusion of uranium oxide. The inspectors determined that there was adequate double contingency protection to prevent a critical excursion upon loss of power. However, the inspectors considered this fortuitous because it was not the result of explicitly analyzing for common mode failure and proviwng for it in the design. This was the result of designing individual system components to fail safe on loss of power and air, rather than a conscious decision to design the system as a whole to fail safe.

Pre-startup trip tests were conducted on all system interlocks by moving equipment set points, and were required as part of procedure XP4-CU-CH1200. The inspectors determined that these tests provided adequate assurance that system interlocks would fail safe on loss of electrical power.

The inspectors noted that in the solution recovery area, there was a clear flowdown of controls through the NCSA and NCSE into the BDM and Configuration Management program, and into maintenance, surveillance, and testing. Identification and maintenance of SSCs relied on for criticality safety was robust and thorough.

c. Conclusions The failure to identify and maintain SSCs relied on for criticality safety in the cascade is a program weakness. Where the documented safety basis was founded on double contingency, those SSCs required to support administrative controls were not identified in Part B of the 10

=

v NCSA or categorized as AQ-NCS in the BDM. Additionally, the inspectors asked for a demonstration of the reliability and functionality of the instrumentation, and the plant was unable to provide it during the inspection.. The inability of the plant to demonstrate the reliability and functionality of controls on the cascade is not, however, considered an immediate safety hazard, because the cascade itself has been designed at this end for 100wt% 2"U. Functional testing of this equipment will be tracked as IFl 70-7002/98-206-04.

Other areas of the plant, such as solution recovery, demonstrated a more robust identification and configuration control of safety features. There were no discrepancies noted between the plant safety basis and the as-built condition, and no avenues of common mode failure identified in any of the operations considered.

The failure to identify deficiencies in NCSE-0326 015.E02 during corrective actions in response to Violation 70-7002/97-206-06 represents a significant weakness in the certificant's corrective action program.

3.0 NCS Event Reporting

a. Scope The inspectors examined several incidents involving loss of nuclear criticality controls in order to determine whether they were identified and characterized in accordance with the deportability criteria. The inspectors also examined recent event reports to determine whether information provided to NRC was accurate, thorough, and met the requirements of 10 CFR 76.120.

b. Observations and Findinas The inspectors examined several NCS-related problem reports issued since the previous NRC inspection, many of which were reported as 24-hour or 4-hour reportable events. The inspectors reviewed a sampling of these incidents to determine whether they had been correctly classified as to their deportability, since there were too many to review in total. The certificant classifies a loss of criticality controls as Level 4 if a controlis lost but double contingency remains, Level 3 events involve loss of double contingency. There were 31 Level 3 incidents in February 1998, and 25 Level 3 incidents in March. The inspectors noted that a large percentage of the events concerned dry active waste (DAW) storage, and, in particular, the loss i of moderation controls on DAW drums. These issues represent a recurring problem and a concern that the corrective actions are too limited in scope to address root causes to prevent similar occurrences. The corrective actions that have typically been taken consist of putting the immediate operation into compliance and retraining operators, without addressing generic issues. These violations, however, are of minor safety significance, since DAW typically consists of waste materials with very low levels of fissile contamination. The inspectors also noted the occurrence of a large percentage of spacing violations, particularly in process building storage arrays and storage of removed contaminated equipment. 'hese incidents are more significant, although they also involve relatively low inherent risk. Plant staff indicated that there would be a new revision of PLANT-018.A01, " Dry Active Waste (Contaminated Burnables)in Waste Generation Areas and in Interim Storage" that would address the observed problems.

I1 l

o The, inspectors reviewed a sample of Level 3 criticality incidents to determine whether they met the reporting criteria and contained the required level ofinformation. The selected 24-hour reports and both 4-hour reports were shown to meet the reporting criteria in Table 6.9-1'of the SAR. SAR Section 6.9.3 requires that all reportable events contain the information specified in 10 CFR 76.120(d)(1). This includes, among other information, the description of events, date, and time of the event, the location, the isotopes, quantities, and chemical and physical form of materials involved, and any immediate corrective actions taken. The certificant uses NRC Form 361C, " Gaseous Diffusion Plant Event Notification Worksheet," to make its notifications to l NRC. The inspectors reviewed the information on these forms and concluded that they j I

contained the necessary level of detail and contained accurate information to the extent known at the time of the incidents.

The inspectors then examined several Level 4 incidents that were not classified as reportable to determine if they had been correctly characterized. Of the eight incidents reviewed in this class, four were found upon review of the applicable NCSA to involve degradation of controls that did not result in an NCSA Part B limit being exceeded or a control being lost. Upon reviewing the NCSA, the inspectors agreed that there was no compromise of double contingency as a result. Some of these incidents appeared due to confusion as to what NCSA covered a given operation or what the requirements were.

Upon discovery of the defectiveness of NCSE-0326_015.E02 concerning double contingency of the ERP withdrawal station, and issuance of a 4-hour reportable event, the inspectors inquired as to whether an event notification was made following the previous event at the Tails and LAW stations. Plant staff indicated that no event notification was made at the time, because the event was dispositioned as a TSR violation instead of a loss of double contingency. TSR violations are not necessarily reportable events. At the time of the event, the LAW station was withdrawing enriched product, and thus, there vwas more than a safe mass of material involved.

This failure to make the necessary event notification is VIO 70-7002/98 206-05,

c. Conclusions The large number of reportable events remains a concern, and raises a question as to whether the certificant is capable of maintaining the safety basis of the plant. Most of these events had little safety significance of themselves, but collectively they represent an apparent weakness in maintaining criticality controls and taking effective corrective actions in response to recurrent problems, as a significant number of these events involved similar or identical violations of NCS requirements. The inspectors did not note any events that had been incorrectly classified as either reportable or non-reportable events, with the exception of the Tails and LAW Station failure to establish double contingency (see Section 2.2).

4.0 Followun of Previous Inspection items The inspectors reviewed the status of IFl 70-7002/97-206-07, noting that the corrective

, maintenance backlog of Q items remains, according to the internal document, " Performance indicators for March 1998," UEO-1071, Part 4, an area of significant weakness with a downward trend. The inspectors, observed 69 items overdue an average of 145 days at the end of March. The preventive maintenance backlog has decreased from 54% overdue in October 12 1

., ; E" 199,7, to 7% overdue in March 1998. Because further improvement is needed in both these creas, IFl 70-7002/97-206-07 remains open.

The inspectors reviewed the status of IFl 70-7002/97-206-08 concerning the Q-classification of the mass and gamma spectrometers at the withdrawal stations. Plant staff indicated that these spectrometers should not be classified as AQ-NCS, based on additional administrative controls, such as sampling, which are relied on in the event the spectrometers are out of service.

TSR 2.5.3.5 dictates the actions to be taken if the spectrometers are out of service, and thus loss of the spectrometers does not represent loss of double contingency. Upon review, the inspectors agreed that the spectrometers are not required for double contingency. This item is closed.

The inspectors also reviewed the Configuration Control Plan (CCP) for the PORTS IBM RS/6000 computer system (POEF-LMUS-14). As required by the CCP and the SAR, the quarterly bit-by-bit comparison of the production version of the SCALE executable code and 27-group cross section library to an archived version was performed adequately for the last three quarters.

5.0 Exit Meetina An exit meeting was held between NRC Headquarters and Resident inspector staff and plant I I

management on May 1,1998. Management briefings were also held daily throughout the inspection. No classified or proprietary information was discussed.

l I

13

,;.f *

• M, I

• ITEMS OPENED. CLOSED. OR DISCUSSED ltems Ooened 70-7002/98-206-01 IFl Effectiveness of changes to corrective action program.

70-7002/98-206-02 VIO Failure to identify SSCs relied on for double contingency.

70-7002/98-206-03 VIO Failure to establish double contingency without TSR.

70-7002/98-206-04 IFl Availability and reliability of SSCs relied on for criticality safety in the cascade.

70-7002/98-206-05 VIO Failure to make 4-hour event notification.

Items Closed

i. 70-7002/97-206-08 IFl Q-classification of withdrawal station spectrometers.

l

! ~ ltems Discussed 70-7002/97-206-07 IFl Corrective and preventive maintenance backlog.

PARTIAL LIST OF PERSONS CONTACTED USEC Mike Hone Nuclear Criticality Safety Dan Wilczynski Nuclear Safety Jim Anzelmo Configuration Management Pat Musser Maintenance Ron Smith Production Support Roger McDermott Operations Organization Manager Ralph Lipfert Procedures and Training Charles Gamm Engineering Mark Hasty ' Engineering J.B. Morgan Enrichment Plant Manager Toni Brooks Operations Sid Martin Nuclear Regulatory Affairs Jim Miller Vice President, Production Dave Waters Nuclear Regulatory Affairs L Russ Wells Nuclear Regulatory Affairs and Policy Steve Toelle Manager, Nuclear Regulatory Affairs and Policy l Lee Fink Safety, Safeguards and Quality NflG Courtney Blanchard Fuel Facilities inspector, Rlli QQE' John Orrison Regulatory Oversight Agreement i

14

- _ _ _ _ _ _ _ _ _ _ l

,s w.

l ACRONYMS USED AEC Active Engineered Control AO Augmented Quality AQ-NCS Augmented Quality - Nuclear Criticality Safety BDM Boundary Definition Manual BPS Business Prioritization System CAP Corrective Action Plan CAO Conditions Adverse to Quality CARB Corrective Action Review Board CCP Configuration Control Plan CMPM Configuration Management Program Manual DAW Dry Active Waste ERP Extended Range Product HEU High-Enriched Uranium IFl inspector Followup item LAW Low Assay Withdrawal NCS Nuclear Criticality Safety NCSA Nuclear Criticality Safety Approval NCSE Nuclear Criticahty Safety Evaluation PDR Public Document Room PEH Planned Expeditious Handling PORT Portsmouth Gaseous Diffusion Plant PR Problem Report O Quality SAR Safety Analysis Report SCAQ Significant Conditions Adverse to Quality SSC Systems, Structures, and Components TSR Technical Safety Requirement 15 i

_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _