ML22122A092

Westinghouse Clarified Information ISA Program to Support License Renewal

ML22122A092
Person / Time
Issue date:	05/02/2022
From:	Jennifer Tobin Office of Nuclear Material Safety and Safeguards
To:
J TOBIN NRC/NMSS/DFM/FFLB 3014152328
References
Download: ML22122A092 (16)

Text

Two Clarification Questions to WEC on the License Renewal The following two questions are asked based on 10 CFR 70.62(c)(1)(v) and (vi), which states, in part, each licensee or applicant shall conduct and maintain an integrated safety analysis, that is of appropriate detail for the complexity of the process, that identifies (1) the methods used to determine the consequences and likelihoods [70.62(c)(1)(v)], and (2) each item relied on for safety identified pursuant to § 70.61(e) of this subpart, the characteristics of its preventive, mitigative, or other safety function, and the assumptions and conditions under which the item is relied upon to support compliance with the performance requirements of § 70.61

[70.62(c)(1)(vi)].

Question 1 is about the criticality event sequence with the highly likelihood identified in the ISA Summary 2022. The event sequence of interest has a likelihood index (FPIN) of -4 while all the likelihood indexes of the other criticality event sequences are -5 or less. The double contingency measures of the event sequence of interest are two administrative controls (AC). The likelihood assessment of one of the two ACs (VENT-AFS-119) is different from the other ACs with similar task characteristics. Question 1 seeks to clarify the factors contributing to the differences in the likelihood assessments.

Question 2 is a follow-up of RAI 19.4) dated 2016 (Ref.1) on interdependencies between tasks.

In a consolidated RAI response (Ref. 2), the response to the RAI state, Based on discussions with the NRC and the CAP generated, the remaining RAI questions 19.2 through 19.4 and 19.6 through 19.9 were resolved. NRC staff found the dependency pair mentioned in the RAI 19.4 (UN-148 and UN-149) is still modeled independent to each other. Question 2 is to seek clarification how the RAI 19.4 issue entered into the CAP has been addressed.

Question 1:

Discuss the factors contributing to the assessed likelihood of VENT-AFS-119 (FPIN: -2) is different from ADUROD-153 (FPIN: -1) and IFBA-140 (FPIN: -1) while the three ACs has the same task characteristics.

VENT-AFS-119: Failure of Administrative Control. The scrubber vessel reservoir shall be inspected and significant uranium accumulation (greater than a surface coating) removed on an annual basis.

ADUROD-153: Periodic hood cleanout not performed or performed improperly. Pellets and pellet chips shall be removed from the hoods in the ADU rod area periodically as an operations maintenance requirement. This cleaning shall be documented IFBA-140: Annually, the drybox shall be opened and cleaned. This cleaning is in addition to any required due to routine inspections.

Additional information: VENT-AFS-119, ADUROD-153, and IFBA-140 have the same task characteristics. All of them are the tasks need to be performed periodically, and a long time between two performances. VENT-AFS-119 and IFBA-140 are to be performed annually. The frequency of ADUROD-19 is not specified in the 2022 ISA Summary. The 2022 ISA Summary assigned a likelihood index of -1 for ADUROD-153, citing Since repeated failures to perform ADUROD-153 were identified in the past (Reference 8), a conservative value of 1.0 E-01 will be utilized. The ISA Summary does not provide the reason for the likelihood index of -1 of IFBA-140. Different from ADUROD-153 and IFBA-140, the VENT-AFS-119s likelihood index was

assessed as -2. Because the three ACs have the same tasks characteristics, the different likelihood assessments raise a question about what cause the difference.

Question 2:

Discuss the technical basis for the administrative controls (AC) in AC pairs listed at the end of this question are independent to each other.

Additional information: The ISA Summary lists many cutsets having two ACs that are about the same task performed by different individuals. The descriptions of the ACs suggest that many of them have an individual (the first AC) performing the task and the second individual (the second AC) verifying the performance of the first individual. The ISA Summary shows that the two ACs have the same likelihood index. That suggests the two ACs are independent to each other. This raises a question about the effects of task dependency on the reliability of the second individual. The task performed by an individual and verified by another person is more appropriately modeled as an enhanced AC IROFS, instead of two AC IROFS. Depending on the task practices and other considerations, it may be appropriate to model them as two ACs and independent to each other. For example, if the two individuals perform the same task in duplications first, then compare their results afterward. This type of operation is appropriate to model as two independent ACs. This question focuses on human reliability. The non-human related considerations are assumed as designed. For example, if multiple samples are used, it is assumed that all samples, if measured correctly, all samples will result in the same decision.

The measurement equipment is assumed function as designed. The list below shows examples of the AC pairs of the interest. The page numbers below are according to ISA Summary 2022.

p. 556/2987 (AC pair: UN-150 and UN-130) o UN-150: An operator shall verify that the sample results of the UN transferred to a bulk storage tank from the safe geometry dissolver UN hold tanks or SOLX does not exceed the 6 g 235U/l limit.

o UN-130: A second operator shall verify that the sample results of the UN transferred to a bulk storage tank from the safe geometry dissolver UN hold tanks or SOLX does not exceed the 6 g 235U/l limit.

P.557/2897 (UN-148 and UN-149) o UN-148: The process engineer shall confirm that both onsite and offsite UN sample indicate that the 235U concentration does not exceed 6 g/l and the enrichment does not exceed 5.0 wt% (including uncertainties) prior to transfer to a bulk storage tank.

o UN-149: The operator shall confirm that both onsite and offsite UN sample indicate that the 235U concentration does not exceed 6 g/l and the enrichment does not exceed 5.0 wt% (including uncertainties) prior to transfer to a bulk storage tank.

p. 1207/2897: multiple basic event pairs o ADUBB-105 & ADUBB-106: Fail properly record and enter MM1 Lab Results in computer system AND Fail properly record and enter MM2 Lab Results in computer system o ADUBB-107 & ADUBB-112: 1st Sampling Process Execution fails AND 2nd Sampling Process Execution fails o ADUBB-110 & ADUBB-111: Failure Chem Lab Procedure for 1st Sample AND Failure Chem Lab Procedure for 2nd Sample

P. 1442/2897 (PEL&BAEGRIND-138 & PEL&BAEGRIND-139) o PEL&BAEGRIND-138: Prior to initial use, each centrifuge bowl shall be inspected by an Area Process Engineer to verify that it meets the requirements of PELGRIND-120/BAEGRIND-120. Such verification shall be recorded on a control form.

o PEL&BAEGRIND-139: Prior to initial use, each centrifuge bowl shall be inspected by an operator to verify that it meets the requirements of PELGRIND-120/BAEGRIND-120. Such verification shall be recorded on a control form.

P. 1592/2897 (ADUROD-148 & ADUROD-149) o ADUROD-148: Removal of pellet chips from the loader shall be checked by someone other than the person performing the cleanout. This check shall be documented on a controlled form.

o ADUROD-149: Removal of pellet chips from the loader shall be overchecked by a Team Manager or Product Assurance Inspector. This action shall be documented on a controlled form and performed by someone other than the person responsible for the cleanout or check.

P. 1610/2897 (ADUROD-138 & ADUROD-139) o ADUROD-138: Prior to installation, the zirc fines collection bag shall be inspected for holes in the fabric and thinning and replaced if any found. This inspection shall be recorded on a control form.

o ADUROD-139: Prior to installation, the zirc fines collection bag shall be independently inspected for holes in the fabric or thinning and replaced if any found. This independent inspection shall be recorded on a control form.

P. 1610/2897 (ADUROD-140 & ADUROD-141) o ADUROD-140: The zirc fines collection bag shall be tightly clamped to the suction pipe and the suction pipe shall be snapped in place. These actions shall be recorded on a control form.

o ADUROD-141: Proper connection of the zirc fines collection bag to the suction pipe and the suction pipe to the vacuum shall be independently verified. This independent verification must be recorded on a control form.

P. 1663/2897 (ADUSCRP-140 & ADUSCRP-114) Should be ADUSCRA-114 not ADUSCRP-114 o ADUSCRP-140: Filter press plates shall be verified by process engineering to be of proper design and dimension prior to use (initial installation after procurement).

o ADUSCRP-114: Filter press plates shall be verified by a 2nd independent process engineer or a team manager to be of proper design and dimension prior to use (initial installation after procurement).

P. 1663/2897 (ADUSCRP-115 & ADUSCRP-116) Should be ADUSCRA-115 and 116 not ADUSCRP-115 and 116 o ADUSCRP-115: Annually, the filter press shall be verified by an Area Process Engineer or Team Manager to be the correct scrap cage SS type plates and contain no more than ten double-sided plate and two single-sided plates (for a total of twelve plates).

o ADUSCRP-116: Annually, the filter press shall be verified by a 2nd independent Area Process Engineer or Team Manager to be the correct scrap cage SS type plates and contain no more than ten double-sided plate and two single-sided plates (for a total of twelve plates).

P. 1665/2897 (ADUSCRP-141 & ADUSCRP-119) Should be ADUSCRA-119 not ADUSCRP-119

o ADUSCRP-141: SNM material removed from the filter press plates during cleanout shall be removed from the filter press hood prior to returning the filter press to service.

o ADUSCRP-119: SNM material removed from the filter press plates during cleanout shall be independently verified to have been removed from the filter press hood prior to returning the filter press to service. (Note: should the basic event be ADUSCRA-119 or ADUSCRP-119. The descriptions of the two basic events are identical.).

P. 1774/2897 (IFBA-134 & IFBA-135) o IFBA-134: Prior to each loading of a drying oven, the jail of the drying oven shall be inspected for accumulation of material. The inspection shall be recorded on a control form. If an accumulation greater than an inch high exists, the material shall be removed.

o IFBA-135: Prior to each loading of a drying oven, the jail of the drying oven shall be independently inspected for accumulation of material. The independent inspection shall be recorded on a control form. If an accumulation greater than an inch high exists, the material shall be removed.

P. 1775/2897 (IFBA-138 & IFBA-139) o IFBA-138: For each enrichment cleanout, the floor of the drybox shall be inspected for accumulation of pellets or pellet chips. The inspection shall be recorded on a control form. If an accumulation greater than an inch high exists, the drybox shall be opened and the material removed.

o IFBA-139: For each enrichment cleanout, the floor of the drybox shall be independently inspected for accumulation of pellets or pellet chips. This independent inspection shall be recorded on a control form. If an accumulation greater than an inch high exists, the drybox shall be opened and the material removed.

P. 1777/2897 (IFBA-144 & IFBA-145) o IFBA-144: Upon opening of any section(s) of the drybox, pellets and pellet chips shall be removed from the affected section(s).

o IFBA-145: A Team Manager shall verify that the cleanout of pellets and pellet chips from any open drybox section(s) is complete.

P. 1777/2897 (IFBA-140 & IFBA-141) o IFBA-140: Annually, the drybox shall be opened and cleaned. This cleaning is in addition to any required due to routine inspections.

o IFBA-141: Following the annual cleaning, an area engineer shall inspect the drybox to verify that pellets and pellet chips have been removed.

References

1. US Nuclear Regulatory Commission Request for additional information: renewal of special nuclear materials license SNM-107 (Cost Activity Code: L33317), June 23, 2016. ADAMS Assessing No.: ML16141A734.

2. Westinghouse Electric Company LLC Westinghouse consolidated responses to request for additional information with revised SNM-107 License Renewal Application (Cost Activity Code:

L33317) Enclosure 2, March 28, 2018, ADAMS Assessing No.: ML18087A400.

Westinghouse Response to Question 1:

The difference in the failure values utilized in the ISA for VENT-AFS-119, ADUROD-153, and IFBA-140 is explained below. A value of 1E-2 is utilized in the ISA for the probability for Failure of Administrative Control in normal circumstances (Reference SNM-1107 Table 4.6 and CN-SB-17-004). If the administrative control is an initiating event a value of 1E-1/yr is utilized for the occurrence rate (SNM-1107 Table 4.5). In addition, failure data is periodically reviewed and as required, updates to the ISA and ISA Summary documents are performed to correct underestimated performance (SNM1107 Section 3.7). As shown below 1E-2 is an appropriate failure probability for VENT-AFS-119. The failure probability of ADUROD-153 was reduced from 1E-2 to 1E-1 based on the failure history of this control when it was first implemented in 2012. The failure probability of ADUROD-153 has no relationship to the failure probability of VENT-AFS-119. IFBA-140 was assigned a failure frequency of 1E-1 per year (instead of a failure probability of 1E-2) because of the conservative method utilized to analyze the accident scenario.

VENT-AFS-119: The ventilation feeds to the scrubber contain entrained uranium that is removed from the offgas stream via liquid sprays. Due to the size of the reservoir, if sufficient uranium accumulated in a non-favorable geometry, a criticality could be possible. Several passive engineered IROFS were identified to prevent a large uptake of uranium into the scrubber system but may not prevent a slow chronic introduction of uranium into the scrubber system. Therefore, no specific credit for these IROFS were taken for this accident scenario. As noted in CSE-1-D, historically past scrubber inspections have found insignificant amounts of SNM accumulation.

As noted in ISA 1 CSE 1-D Event Probability Table - For the chronic accumulation of SNM in the scrubber the initiating event (chronic accumulation of SNM in the scrubber vessel reservoir) is assumed to conservatively occur once per year. VENT-AFS-119 is a protective mechanism for this event. VENT-AFS-119 is an annual inspection of the scrubber vessel reservoir and is performed to ensure that uranium does not accumulate in a non-solution form inside the reservoir over a period of time. This annual inspection is a major, planned activity every year through the maintenance planning and control system during a plant shutdown. Annual reviews of failure data performed since 2007 have not identified any reason to revise the failure value of VENT-AFS-119. Therefore, assigning a score of 1E-2 is appropriate for this IROFS.

ADUROD-153: Three failures of ADUROD-153 were identified in 2012. The weekly check on form CF-75A-041 was not performed. This was in the year following the implementation of this control form. Since repeated failures to perform ADUROD-153 were identified the failure value for this control was increased in the January 2013 ISA from 1E-2 to 1E-1. No failures of ADUROD-153 were identified since. As committed to in the CFFF License, failure data is reviewed periodically and probability numbers are revised if warranted based on this data.

ADUROD-153 is a weekly check by ADU ROD operators. VENT-AFS-119 is an annual scrubber inspection performed by Engineering during a planned system shutdown. The failure probability of VENT-AFS-119 has no relationship to the failure probability of ARUROD-153.

IFBA-140: As stated in the referenced RAI response, the fault trees diagrams serve a dual purpose for CSEs to show compliance with 10CFR70.61 performance requirements and to clearly show double contingency protection. Initiating events are not always modeled because of

this. Instead, one of the IROFS (usually one in the primary contingency) was designated as the initiator. This is the case for IFBA-140. Since this was designated as an initiator an occurrence rate of 1E-1/yr was utilized instead of the probability value of 1E-2. This is a very conservative method to analyze the accident sequence. Per the event description in CSE-12-C a frequency of once per year could have been utilized for the initiating event (significant accumulation of pellet chips), and a probability of failure of 1E-2 could have been utilized for the failure of IFBA-140 (annual inspection). IFBA-140 is described in more detail in the response to question 2. Also note that annual reviews of failure data performed since 2007 have not identified any failures of IFBA-140.

Westinghouse Response to Question 2:

ISAs are generated and maintained in accordance with Chapter 4 of our License Application, specifically in accordance with the Integrated Safety Analysis Handbook as described in section 4.1. According to CN-SB-18-001, Baseline Integrated Safety Analysis (ISA) and ISA Summary Handbook, The initiating event and mitigating events must be independent (i.e., no common features or coupling mechanisms exist between events that may cause multiple failures). Each example that was identified is addressed below to show that the administrative actions specified by the controls that were questioned are independent per the ISA Handbook.

Each control form discussed below has unique boxes for each inspection result and verifiers signature. In addition, there is a management review of all forms filled out that document IROFS. The manager review signature is included on the control form. This management review was an administrative control reliability effort implemented after the S-1030 scrubber event. The latest SSC failure trending report (LTR-EHS-22-23) was also reviewed. Trends over a 5-year period are evaluated in this report. In the last five years there were no failures of any of the controls listed below.

UN-130 and UN-150 UN-130 and UN-150 verify the results of the same sample taken per UN-107 for SOLX UN hold tanks and UN-106 for the dissolver UN Hold tanks. For SOLX this is performed in COP-830110 and COP-836025 for the dissolvers. The sample results are entered on CF-83-056 by an operator, who confirms the results meet requirements. A second operator verifies the analytical results match what has been documented on the CF-83-056 form and initials the form. See below:

Additionally, the results are input independently by each operator (operator puts in their badge number) into the HMI as shown below:

This is a single sample, but there are SSCs that require the laboratory equipment to be properly calibrated (UN-131), and a functional test of the equipment for each shift (UN-132).

Additionally, an independent evaluation of the sample results reported to the control room from the lab is also required per UN-133. These SSCs are captured in the fault tree presented in the ISA. These SSCs are discussed in the common mode failure section of the CSE for this scenario.

With these controls in place, the CSE concludes that the common mode failure potential is acceptable. There is no common mode between the primary and secondary contingencies, as the secondary contingency is an Active Engineered Control (AEC).

UN-148 and UN-149 UN-148 and UN-149 requires two different people to independently look at two different analyses of the UN received from offsite. One of these results is provided by the shipper of the UN (UN-117). The other result is from an analysis performed at CFFF (UN-118). COP-836047 requires the process engineer to confirm that these results do not exceed the 235U concentration and enrichment limits. The information is then incorporated and issued on CF-83-239. This covers UN-148. The operator performing the offload verifies that both results do not exceed the limits. These verifications are shown on the control form below:

The CSE concludes that there is no common mode failure for this scenario as there are independent sample analyses performed at different labs with independent verification that the sample results meet the limits performed by different personnel, and the secondary contingency is an AEC.

ADUBB-105, ADUBB-106, ADUBB-107, ADUBB-110, ADUBB-111, and ADUBB-112 The laboratory procedure (COCL-P04) for the sampling process implements dual independent analyses of first and second moisture samples by requiring (1) analysis on different instruments, or (2) analysis on the same instrument but each sample separated by a standard analysis.

The first moisture sample consists of a composite sample of 56 packs (one cart) that is obtained at the fitzmill by either the automatic sampler or manual samples taken by the line operator during the filling of each pak. Once the sample cup is filled, it is submitted to the Chem Lab to be analyzed for moisture per COCL-P04. The second moisture sample is an overcheck of MM1 and consists of a triplicate sample of three (3) randomly selected packs on the cart. The Chemical Area Manufacturing and Process System (ChAMPS) designates which polypaks are to be submitted and the three (3) packs are delivered to the Q.C. inspectors work area. The paks are opened and samples obtained per QCI-910222 by the Q.C. inspection personnel. Per COCL-P04

the three samples are analyzed and the highest individual result is reported as the MM2 sample result. These samples are generally separated by several hours and obtained by different personnel using different instrument and processes (i.e., operator/composite sample and QC inspector/triplicate sample). Once results are obtained, they are entered into the moisture analysis sample log sheet and entered into the Laboratory Information Management System (LIMS) by the lab technician. The software reflects the data back to the technician providing an opportunity to verify the accuracy of the input data.

Each of the samples are analyzed with Mitsubishi moisture meters using the Coulometric Karl Fischer Titration technique. The lab maintains three Mitsubishi moisture meters as independent measurement systems and monitors them separately using traceable standards. Each of the measurement systems was first qualified using a traceable weight of water and comparison to other acceptable methods. COCL-P04 also requires accuracy checks using a known volume of water. The accuracy verification is performed (1) before the first sample analysis on any shift, (2) following the last sample analysis on any shift, (3) each time reagent solution is changed, and (4) any other time the technician feels it is appropriate. Out of the three measurement systems, one is designated to analyze only MM1 samples. The other two instruments are designated to analyze only MM2 samples. The Analytical Services Laboratory technicians can distinguish between the first and second samples of each material type by the type of sample number or by sequential sample numbers of samples that come to the Analytical Services Laboratory at the same time. This ensures that the first and second samples are not analyzed on the same instrument.

The standard results are keyed into LIMS which indicates if the result exceeds pre-established limits. If limits are exceeded, immediate corrective action is required to return the measurement system to a state of statistical control. All samples measured, in the interval between the out-of-control standard and the previous standard, are evaluated and/or remeasured depending on whether the batch of material represented by the samples is still available (Ref. COCL-T13).

Technicians qualified to operate this instrument are trained to take corrective actions when an out-of-control incident occurs. Note that sample cups are retained, per COCL-P04, until results are entered into LIMS, posted to ChAMPS, confirmed by analysis of the closeout sample, and the entire process verified by an over-check/peer review. The overcheck/peer review ensures for each analyzed sample that the description and results have been entered onto the log sheet correctly, sample analysis has been properly verified with a closeout standard check, and that the results have been correctly entered into LIMS.

While all of these controls are similar and related, they are considered to be independent with minimal opportunity for common mode failure. The sample collection processes are different and separated by several hours in general. They are also performed by different personnel (i.e.,

operators and QC personnel). The technique used to measure the moisture in the different samples are the same; however, common mode failure is minimized by the use of separate instruments designated for each sample type and the accuracy verification that occurs at the beginning of each shift and after the last measurement of the shift. Data entry errors are

mitigated by software implemented data entry acknowledgement requirements and required overchecks/peer reviews. Any common mode failure potential is judged to be minimal and acceptable based of the number of different individuals performing various portions of the process, the different sampling process, the time window between obtaining each sample, and the redundancy involved.

PEL&BAEGRIND-138 and -139 These SSCs have been eliminated in 2022 due to the common container restructuring project, which was done to standardize the geometric NCS control of commonly purchased containers and equipment.

Each set of SSCs has now been effectively replaced in CSE-16-K with PROCUR-901 and -902.

The former ensures that "purchased items conform to specified requirements" in that they "shall only be purchased through the Maintenance, Repair, and Operations (MRO) Storeroom or a purchase order with Westinghouse Supply Chain Management." The latter ensures "that incoming items are not used or processed until they have been inspected or otherwise verified as conforming to specified requirements. Verification of conformance to the specified requirements shall be in accordance with documented procedures."

Dependence and common mode failure of these two controls is prevented because they are separated by time and performed by different personnel. PROCUR-901 is performed by Supply Chain personnel and documented through the purchase order, while PROCUR-902 requires that the equipment is verified and documented by Q.C. personnel upon receipt at the plant, but prior to release to the shop floor for use.

ADUROD-148 and -149 The purpose of these controls is to prevent accumulation of pellet chips in a non-favorable geometry at the rod loading station. Whenever a change is made to a rod line in preparation for the next manufacture order, the loading station is required to be cleaned. This preparation is generically referred to as an enrichment cleanout (ECO) although the enrichment of the following manufacture order may be the same. If the change is not made in accordance with procedure, there is a risk of pellets entering a rod of a different size or enrichment than the manufacture order requires. As such, cleaning of the loading station as part of the ECO requires documentation on controlled form CF-75A-001, shown below, independent verification, and a QC Check by a Team Manager Product Assurance Inspector. Dependency and common mode failure is prevented by procedural requirements, training, independent operator and management overchecks.

ADUROD-138, -139, -140 and -141 The purpose of these controls is to prevent accumulation of uranium in the unfavorable volume area of the vacuum used in the rod loading process. Any uranium accumulation is an unlikely event, as this operation is performed on encapsulated, welded fuel rods only. However, the bag requirements are maintained for the unlikely event that uranium is vacuumed with the equipment. Each set of controls requires a first inspection of both the bag integrity and the installation, followed by an independent action by a second individual to perform the same inspections. Dependency and common mode failure are prevented by strict guidance of procedure MOP-750929 to have different individuals perform these inspections and document the results on control form CF-75-001. This control form has unique boxes for each inspection result and verifiers signature, see below:

ADUSCRP-140 and ADUSCRA-114 Common mode failure between these two controls is mitigated by requiring each control to be performed by different individuals as reflected in the control wording and carried over into the associated procedure (COP-815114, excerpt below).

These two inspections/verifications are only applicable if new plates are procured and installed to ensure the new plates align with the evaluated dimensions and that the correct number of plates are installed prior to first use. These two controls are supplemented by an annual inspection mandated by ADUSCRA-115 and ADUSCRA-116 as noted below.

ADUSCRA-115 and ADUSCRA-116 Common mode failure between these two controls is mitigated by requiring each control to be performed by different individuals. These inspections are initiated by OM81238. The OM clearly states that the inspections are to be performed by separate individuals and provide separate signature blocks for each verification (i.e., one each for independent verification of plate dimensions and one each for verification of the correct number of plates installed). These inspections are performed at the same location and one after the other. Excerpts from OM81238 are included below:

ADUSCRP-141 and ADUSCRA-119 Common mode failure between these two controls is mitigated by requiring each control to be carried out by a different individual. The independence requirement is explicitly stated in the control wording and carried over into the associated procedure (COP-815114). This is supplemented by CF-81-243 (see below) which has two columns and explicit wording to inform personnel that one operator performs the inspection, and a different operator performs the independent overcheck.

IFBA-134 and -135 The purpose of these controls is to prevent accumulation of uranium in the unfavorable volume area (jail) of the drying oven. Any significant uranium accumulation is an unlikely event, as this would require oxidation of the pellets in an oven designed only to drive excess water off the pellets. However, the oven/jail inspection requirements are maintained for the unlikely event that uranium is deposited into the area. IFBA-134/-135 are routine inspections required prior to loading each drying oven, by a first operator and also by an independent verifier. Dependency and common mode failure are prevented by strict guidance of procedure MOP-963010 to have different individuals perform these inspections and document the results on control form CF 016. This control form has unique boxes for each inspection result and verifiers signature, see below:

IFBA-138 and -139 The purpose of these controls is to prevent accumulation of uranium in the unfavorable volume area of the line 7 drybox. Any significant uranium accumulation is an unlikely event, as this would require accumulation in a glovebox for loading finished pellets into fuel tubes. However, the drybox inspection requirements are maintained for the unlikely event that uranium does actually accumulate in the area. IFBA-138/-139 are routine inspections required during each enrichment clean-out process, which is performed between each manufacturing contract change, first by an operator and also by an independent verifier. Dependency and common mode failure are prevented by strict guidance of procedure COP-871090 to have different individuals perform these inspections and document the results on control form CF-87-125. This control form has unique boxes for each inspection result and verifiers signature, see below:

IFBA-144, -145, -140 and -141 The purpose of these controls is to prevent uranium from becoming available to any non-favorable geometry portion of the drybox that could be opened for maintenance. All four controls are to prevent any significant uranium mass from accumulating and thus, being able to move into a non-favorable geometry area that is subsequently opened. IFBA-144/-145 are inspections required prior to turning the drybox over to maintenance personnel, first by an operator and also by an independent verifier (team manager). Dependency and common mode failure are prevented by strict guidance of procedure MOP-962100 to have different individuals perform the cleanout/inspection, see below:

IFBA-140/-141 are non-routine inspections required annually to ensure full cleanout of each drybox, first by an operator and also by an independent verifier. These are performed at a separate time from the first inspections and are driven by a PM in the computerized maintenance management system (CMMS). Operation of the oven beyond the PM required date cannot continue until these inspections are performed. Dependency and common mode failure are prevented by strict guidance of OM83037 to have different individuals perform these inspections and document the results in the CMMS system. The system unique boxes for each inspection result and verifiers signature, see below: