ML20217F370

Submits Reissued Cover Ltr for Insp Rept 70-1151/97-205 on 970825-29.Violations Being Considered for Escalated Enforcement Action.Original Submittal Was Dtd 971003

ML20217F370
Person / Time
Site:	Westinghouse
Issue date:	10/02/1997
From:	Ten Eyck E NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS)
To:	Allen J WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
References
70-1151-97-205, NUDOCS 9710080165
Download: ML20217F370 (4)

Text

_ _ - - _ _ - - - -

1

• . [o.usog%

a -- t UNITED STATES

!* [

t

-.NUC LEAR REGULATORY COMMISSION

. WASHINGTON, D.C. 20$55-0009

,6

• • "* ' October 2, 1997 (reissued with corrected date) l Westinghouse Electric Corporation i Commercial Nuclear Fuel Division ATTN: Mr. J. Allen, Columbia Plant Manager P.O. Drawer R Columbia, SC 29250

SUBJECT:

NRC INSPECTION REPORT NO. 70-1151/97 205

Dear Mr. 'Al'en:

This refers to the critical ty safety inspection conducted on August 25 - 29,1997, by the Nuclear Regulatory Commission (NRC) at the Westinghouse Commercial Nuclear Fuel Division facility in Columbia, South Carolina. The inspection included a review of your root cause analysis .and implementation of corrective actions following the June 23,1997, loss of volume control for the

!- Line 1 granulator hopper. The scope of the inspection was subsequently expanded to review your actions concerning the August 25,1997, loss of volume control for the pellet area ventilation system moisture dropout tanks.

At the conclusion of this inspection, the findings were discussed with Mr. J. Bush, Acting Plant idanager, and other members of your staff. During that exit meeting, a conference callwas held between Mr. Bush and others of your staff and Messrs. D. Collins of Region 11 and W. Brach of my staff, concerning the current status of your compliance with facility license conditions pertaining to the criticality safety evaluations for the granulator hopper and moisture L dropout tanks. During that conference call, you informed NRC that you were proceeding to shutdown the pelleting lines and identified other actions as described in your letter of August 29,1997.

Based on the results of this inspection, seven apparent violations were identified and are being considered for escalated enforcement action in accordance with the " General Statement of Policy and Procedures for NRC Enforcement Actions"(Enforcement Policy), NUREG-1600.

Accordingly, no Notice of Violation is presently being issued for these inspection findings. In addition, please be advised that the number and characterization of apparent violations, described in the enclosed inspection report, may change as a result of further NRC review. j/,/

j OS

9710000165 971002 PDR ADOCK 07001151 C PDR ll Il Ill,II.Ill. IlIl se mE CEMER CWY

Westinghouse Electric Corporation 2' We are concerned about the apparent violatlons of NRC requirements because they involved deficiencies with the implementation of the criticality safety requirements in Section 6.0 of your license arid also involve the apparent failure to properly report the two events to the NRC Operations Center. Searal of the apparent violations appear to share underlying root causes that are similar to those identified during the EA 97 244 enforcement conference. We are further concerned about the failure to promptly communicate the occurrence of the second event to the NRC inspectors, who were onsite, prior to the system restart on August 26,1997.

This occurred despite the assurances given during the EA 97-244 enforcement conference that future communications would be improved.

Subsequent to the inspection of August 25,1997, the Chief, Fuel Cycle Operations Branch, and other members of his staff conducted a re-exit via telephone on September 22,1997, with your staff. The purpose of the discussion was to review the seven apparent violations and inform you of the need and process for a predecisional enforcement conference.

You are invited to a predecisional enforcement conference to discuss these apparent violations on October 29,1997, at 1:00 p.m. in the NRC Headquarters Office in Rockville, Maryland. You should also be prepared to discuss the status of your actions to assure that the as exists geometry and volume criticality safety controls used in the facility match the assumptions in your design documents. The decision to hold a predecisional enforcement conference does not mean that the NRC has determined that a violation has occurred or that enforcement action will be f aken. This conference is being held to obtain information to enable the NRC to make an enforcement decision, such as common understanding of the facts, root causes, missed opportunities to identify the apparent violations sooner, corrective actions, significance of the issues and the need for lasting and effective corrective action. In addition, this is an oppertunity for you to point out any discrepancies in our inspection report and for you to provide any information concerning your perspective on (1) the violations and their severity, (2) the -

application of the factors that the NRC considers when it determines the amount of a civil penalty that may be assessed in accordance with Section VI.B.2 of the Enforcement Policy, and (3) any other application of the Enforcement Policy to this case, including the expreise of discretion in accordance with Section Vll. In presenting your corrective action, you should be aware that the promptness and comprehensiveness of your actions will be considered in assessing any civil penalty for the apparent violations Please note Enclosures 2 and 3 for additional enforcement policy and corrective action informatioit 4

Y d)

% e Westinghouse Electric Corporation 3 You will be advised by separate correspondence of the results of our deliberations on this matter. No written response regarding the apparent violations being considered for enforcement action is required at this time.

Should you have any questions concerning this letter, please contact us, Sincerely, g,I 6

./ cre u fy Elizabeth O.' Ten Eyck, Director Division of Fuel Cycle Safety

/ and Safeguards, NMSS Docket No. 70-1151 License No, SNM-1107

Enclosures:

1. Inspection Report 97-205

2. General Statement of Policy and Procedures for NRC Enforcement Actions (NUREG-1600)

3. NRC Information Notice 96 28, " Suggested Guidance Relating To Development And implementation of Corrective Action"

4 .

. Westinghouse Electric Corporaan 3 You will be sdvised by separate correspondence of the results of our deliberations on this matter, No written response regarding the apparent violations being considered for enforcement action is required at this time.

Should you have any questions concerning this letter, please contact us.

Sincerely, Original signed by E.W. Brach for Liz Ten Eyck Elizabeth Q, Ten Eyck, Director Division of Fuel Cycle Safety

, and Safeguards, NMSS ,

Docket No. 70-1151 License No. SNM 1107

Enclosures:

1. Inspection Report 97-205

2. General Statemc.-t of Policy and Procedures for NRC Enforcement j Actions (NUREG-1600)

3. NRC Information Notice 96-28, " Suggested Guidance Relating To

}

Development And implementation of Corrective Action" DISTRIBUTION w/ Enclosure 1:

NRC File Center NMSS r/f PDR/LPDR CCSS r/f EBrach FCOB r/f MWeber Case File EMcAlpine, Rll Docket File 70-1151 MMessier, T-9E10 (w/o encl)

DAyres, Ril MRodgers, PMDA (w/o encl)

Documents: a:Troskoski:97-205r. wet 0FC FCOB FCOB [ FCOB C OE , FCOB 6" FCSS/

NAME PHaricb# WTrosksIi:th JDaviEN> NMamjs[ PTi M chwink (TkEyck

, DATE -1/#/97 //P/97 #

9/#/97 / f /97 f/9/97 /,h l /97 C= COPY E = COVER & F.NCLOSURE- N = NO COPY f f 0FFICIAL RECORD COPY 9/3#/f 7 V'Y c.0

//

l

e U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS Docket No: .70-1151 License No : SNM 1107 Report No.: 70 1151/97-205

j. Licensee: Westinghouse Electric Corporation -)

. Commercial Nuclear Fuel Division Location: Bluff Road Columbia, SC

- Dates: August 25 - 29,1997 (on site) and September 22,1997 (re-exit via telephone call)

Inspectors: W Troskoski, Sr Engineer, inspection Section J. Davis; Criticality Safety inspector, inspection Section D. Ayres, Fuel Facility inspector, Region ir Approved t,y: P. Ting, Chief Operations Branch ..

Division of Fuel Cycle Safety .

and Safeguards, NMSS -

)

s Enclosure 1

. 4 er^ _ M j Q'

~ .

D

~. .

2 EXECUTIVE

SUMMARY

WESTINGHOUSE COLUMBIA FUEL FABRICATION FACILITY NRC INSPECTION REPORT 70-1151/97-205 The NRC performed an announced crit!cality safety inspection at the Westinghouse Columbia Fuel Fabrication Facility (CFFF)in Columbia, South Carolina, from August 25-29,1997. The objective of the inspection was initially to review the licensee's root cause analysis and corrective action implementation following the June 23,1997, Pellet Line 1 Greulator Hopper loss of volume control event. The inspection was subsequently expanded to review the licensee's handling of the August 25,1997, Line 1 Pellet Grinder Ventilation Accumulator loss of volume control. As a result of the inspection, seven apparent violations were identified as follows:

1. Inadequate incident investigations of eve,1ts as evidenced by:

a. The failure to adequately implement a structured methodology for determining and

! characterizing the root causes of the June 22,1997, Granulator Hopper loss of mass contingency event (Detail 3.b.2 ).

b. The failure to adequately implement RA-111, Safety Significant Investigations, requirements for implementing corrective actions for the identified root causes in a timely manner (Detail 3.b.1).

c. The failure to determine the root cause(s) for the August 25,1997, Pellet Area Ventilation System Moisture Dropout Tank unanalyzed condition prior to system restart on August 26,1997 (Detail 5.b.1).

2. The failure to conduct adequate criticality safety evaluations (CSE) for each significant portion of a process to identify the specific controls necessary to assure safe operation, and incorporate those controls into the process design criteria docunwntation, as evidenced by the following:

a. The 1996 Granulator Hopper CSE identified volume control as necessary to assure safe operation for this significant portion of the process, even though the system print reflected the actual unfavorable volume dimensions, and did not incorporate that control into process design criteria as of June 22,1997 (Detail 4.b.1).

b. The 1993 Pellet Area Ventilation System CSE identified volume control for the moisture dropout tank modification as necessary_ to assure safe operation for this significant -l portion of the process, even though the system print reflected the actual unfavorable volume dimensions, and did not incorporate that control into process design criteria as of August 25,1997 (Detail 5.b.2).

l

. . 3

- 3. The failure to functionally _ verify that controls identified as necessary for the safe operation of a process were installed to rnatch the requirements identified in the design criteria, as evidenced by;

a. The installed granulator hopper volume assumed in the CSE as favorable (about 39 liters), was found to be actually unfavorable (43 liters) on June 23',1997 (Detail 4 b.2). '

b. - The installed moisture dropout tank volume assumed in the CSE as favorable l(5 gallons), was found to be actually unfavorable (about 20 gallons) on August 25,1997 (Detail 5.b.3).

4. The failure to update CSEs to assure that all assumptions, including credible unset

_ conditions, are justified, documented and independently reviewed, as eviderved by:

a. As of August 29,1997, the Granulato_r Hopper CSE was not updated following the June 23,1997, event to reflect the physical changes made to the system and the independent review was inadequate (Detail 4.b.4).

b. The Pellet Area Ventilation System CSE was not updated to reflect all of the analytical changes and new controls added to the moisture dropout tank, and no independent review was conducted prior to restart of the system on August 26,1997 (Detail 5.b.4).

c. As of August 29,1997, the CSEs for the Granulation & Compaction, Pellet Press Area and Sintering Furnace processes did not document or justify the assumptions used, including credible process upsets, ar.d the indeoendent reviews were inadequate (Detail 6.b).

5 The failure to control Nuclear Criticality Safety Evaluations, Analyses and Methodology Validations in accordance with written procedures that specify the management program for -

licensed activity records, and maintain those records for the life of the facility in that:

a.- CA 004, Columbia Records Management Policy, the procedure identified by the

, licensee as implementing the management program, was inadequate in that it did not

identify Nuclear Criticality Safety Evaluations, Analyses and Methodology Validations as records to be included under the program. In addition, the program established under CA-004 would be inadequate for the control of those records in that it estabh;hed no guidance / requirements for the maintenance and control of the safety basis de uments (Detail 7.b).

- b. The original Nuclear Safety Analysis for the Granulator Hopper, a prior nuclear criticality safety anclysis, was not maintained for the life of the plant, in that it could not be located during the week of August 25-29,1997 (Detail 7.b).

6. The failure to notify the NRC Operations C' enter within four hours of the determination that a criticality safety analysis or evaluation was deficient and that double contingency protection, in fact, does not exist, as evidenced by:

i

)

i

a. The August 25,1997, discovery that the Pellet Area Ventilation System moisture dropout tanks were not volume controlled. Double contingency protection did not exist in that no controls were established in accordance with the requirements of Section 6.0 of the license. No four hour report was made to the NRC Operations Center (Detail j 8.b.1).

b. The June 23,1997, discovery that the Granulator Hopper was not volume controlled.

Less than Double Contingency protection remained (volume), greater than a safe mass was involved (the accumulated Uranium Dioxide (UO2) mass exceeded the 100 kilogram (kg) mass contingency limit identified in the fault tree analysis), and double contingency protection was not restored within four hours. The event should have been reported by 11:00 a.r..., instead of 11:40 p.m., on June 23,1997 (Detail 8.b.2).

7. The failure to develop or implement nuclear criticality safety procedures and policies that identify the requirements for implementation of applicable NRC regulations and license conditions, as evidenced by the following (Detail 9.b):

a. The Verification Program (License Section 6.2.1(a)), Maintenance Program (License Section 6.2.1(b)), methods of criticality control (License Section 6.2.2), and other NCS program elements of License Section 6.0 are not covered under RA 311, NCS Program Review.

b. There is no procedure covering the development and implementation of geometry and volume controls and other related provisions covered by License Section 6.2.4(a).

c. Computer software and nardware configuration controls specified in License Section 6.4.3(d) are not covered.

d. Outermost moderator barrier quality and routine raaintenance controls specified in License Section 6.2.4(c.2) are not covered.

e. Suspension of SNM movement within four hours due to an inoperable criticality accident

,. alarm system, as specified in License Section 6.3.1, is not covered. .,

f. RA-310, Regulatory Affairs Technical Reviews, does not cover verification that the proposed calculation geometry model and configuration adequately represented the system being analyzed. nor does it require the NCS Function Manager to review and approve the technical review, as required by License Section 6.4.3(e).

g. RA-107, internal Reporting and NRC Notification of Unusual Occurrences, reporting requirements and criteria have not been updated to reflect the current reporting requirements of License Section 3.7.3.

h. RA-111, Safety Significant Investigations, did not provide guidance for when Regulatory Affairs approval is required to restart a shutdown process (unanalyzed systems), and ensuring compliance with license conditions, as required by License Section 2.1.3(c),

prior to restart.

I

5 DETAILS 1.0 Introduction

a. Pellet Line 1 Granulator Screen Incident At 2340 hours0.0271 days <br />0.65 hours <br />0.00387 weeks <br />8.9037e-4 months <br /> on June 23,1997, the licensee reported under NRC Bulletin 91-01 that one of two nuclear safety controls associated with the Line 1 granulator hopper had been lost. The event involved the discovery of about 165 kilograms (kgs) of dry UO:

powder in the granulator hopper due to a mechanical failure. A nuclear criticality safety (NCS) review was not conducted until after the powder had been removed and the system restarted-I When the review was subsequently conducted, it was determined that the two controls applied to the hopper were moderation and volume. However, the Regulatory Engineer (Nuclear Criticality Safety) could not confirm that the hopper was a favorable volume system (i.e., would not support a criticality for the given system enrichment) because the original backup data / documentation could not be located. A reanalysis determined that the "as-built' volume of 43 liters exceeded the calculated favorable volume limit of-l 38 liters (based on ARH-600, lll B.3-5) and the operating lines were shutdown.

Each hopper was subsequently modified by the insertion of a " volume limiter" and Lines 1-3 were restarted on June 24,1997. The following day, a Root Cause Analysis

l. (RCA) team was established by the licensee to review the event. The NRC monitored the licensee's progress in addressing this issue through conference calls held every other week. As of the week of August 11,1997, the licensee had not yet addressed the RCA team recommendations. Consequently, a NRC inspection team was dispatched to the tita during the week of August 25-29,1997, to determine the adequacy of the licensee's corrective actions and to conduct a separate root cause analysis evaluation.

b. Pellet Line Ventilation Moisture Drocout Tank Volume Control On August 25,1997, a solenoid operated valve (SOV) to the Line 1 venglation system dropout tank overheated and melted plastic and rubber components associated with the drain line. During the investigation of this event, the licensee determined that the SOVs on each of the 5 lines had apparently experienced an electrical malfunction. The licensee, already aware of the NRC inspection team's concerns involving geometry / volume control, determined that the "as-built" 20 gallon tank volume did not '

match the 5 gallon volume assumed in the CSE. Subsequent inspection of each tank found an unexpected accumulation of UO2 powder that ranged from 1-4 kgs. It was also determined that the tank level probes, which were believed to provide an automatic engineered control, had never been functionally tested.

By the end of August 26,1997, the powder had been removed, the level probes had been functionally tested, and the systems were restarted. However, the licensee did not verbally inform the NRC inspection team of this incident until 12:30 p.m. on August 28,1997. No notification was made to the NRC Operations Center.

l

9 6

2.0 Seauence of Events-

a. Pellet Line 1 Granulator Screen Inciderf June 22,1997 2200 2345 hour0.0271 days <br />0.651 hours <br />0.00388 weeks <br />8.922725e-4 months <br />s: UO, powder observed not being processed through the roll compactor and granulator into a favorable geometry polypack. System is shutdown and plant personnel find that the roll screen is not in place and that there is a significant accumulation of powder.

June 23,1997 y ? 00 - 0300 hour0.00347 days <br />0.0833 hours <br />4.960317e-4 weeks <br />1.1415e-4 months <br />s: Screen holding rods were found worn and in need of replacement. About 165 kgs powder (g poly packs) were subsequently removed from above the granulator, below the roll compactor.

l 0430 hour0.00498 days <br />0.119 hours <br />7.109788e-4 weeks <br />1.63615e-4 months <br />s: Team Manager authorized restart.

- 0430 - 0530 hour0.00613 days <br />0.147 hours <br />8.763227e-4 weeks <br />2.01665e-4 months <br />s: Team Manager informed of 165 kgs of accumulated powder, and consults with another manager to determine whether Regulatory Engineering should be notified. Plant rule of-thumb for notification is any accumulation of powder greater than 40 kgs.

0530 hour0.00613 days <br />0.147 hours <br />8.763227e-4 weeks <br />2.01665e-4 months <br />s: Team Manager notified Regulatory Engineering, 1 0628 hour0.00727 days <br />0.174 hours <br />0.00104 weeks <br />2.38954e-4 months <br />s: Team Manager memo to management identifies event, notes mechanical problems, and states that a similar event involving " lots of material backing up* had occurred in the past.

0700 hour0.0081 days <br />0.194 hours <br />0.00116 weeks <br />2.6635e-4 months <br />s: Regulatory Engineer onsite, discusses issue with Team Leader and makes initial determination that the system is safe.-

Criticality Safety Evaluation (CSE) reviewed to confirm favIrable volume of system, but backup data / documentation supporting assessment could not be located.

Four-hour NRC notification clock should have started at this time.

1300 hour0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />s: Site management informed of incident. Regulatory engineer indicates an oversight occurred in the original analysis, which the independent review process had not identified. A reanalysis is initiated.

1800 hour0.0208 days <br />0.5 hours <br />0.00298 weeks <br />6.849e-4 months <br />s: Technical Services Manager informs Chemical Process Engineers (CPEs) of possible need for passive engineered controls. Design and fabrication work initiated to replace the granulator hopper deflector panel with a volume limiter.

e . 4I ._

4 ,_

7:

1800 -2400 hours +: Deflector panel from line 4 found on wrong side of bar stop, and no panel found in Line 5 (both lines had not been operating).

Configuration change concept to use the volume limiter as a passive engineered control under development in parallel with reanalysis.

= 2016 hour0.0233 days <br />0.56 hours <br />0.00333 weeks <br />7.67088e-4 months <br />s: Regulatory Engineer concludes powder prep is not favorable volume, and unsafe condition confirmed for 5.0% enrichment. Current production is

~

4,0 - 4.4%. -

4-hour NRC notification time clock started.

~ 2322 hour0.0269 days <br />0.645 hours <br />0.00384 weeks <br />8.83521e-4 months <br />s: . Memo from Manager of Regulatory Affairs to site managament directs shut down of alllines until modifications can be made, at which time L normal operations can resume on each ine.

2340 hours0.0271 days <br />0.65 hours <br />0.00387 weeks <br />8.9037e-4 months <br />; _ NRC notified (verbal, followed by fax).

June 24,1997 l

0115 hour0.00133 days <br />0.0319 hours <br />1.901455e-4 weeks <br />4.37575e-5 months <br />s: Line 13 changes completed.

0219 hour0.00253 days <br />0.0608 hours <br />3.621032e-4 weeks <br />8.33295e-5 months <br />s: ~ Operation of lines 13 resumed.-

1535 hour0.0178 days <br />0.426 hours <br />0.00254 weeks <br />5.840675e-4 months <br />s: Written notification faxed to NRC, 1700 hour0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br />s: Drawing package and operating procedure changes submitted for review, June 25,1997 Root Cause Analysis (RCA) Team established.

- June 26,1997 ,

Drawing updated and approved, operating procedures approved and issued.

June 27,1997 CSE update identified as pending.-

June 30,1997 Drawing approved by NCS.

4

\

~=

8 July 21,1997

- RCA findings presented to management.

August 5,1997 -

RCA findings approved.

August 7. ;997 RCA findings to the two groups responsible for identifying corrective actions.

- August 28,1997 l

Corrective actions not yet reviewed and approved by management.

b. Pellet Area Ventilation Moisture Drocout Tank Event of August 25'- 26.1997.

j August 25,1997

-0000 hours: Line 1 moisture accumulator tank solenoid operated drain valve over-heated and separated from the valve. Plastic and rubber material melted and powder buildup observed plugging the valve.

0730 hour0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />s: - Plant management notified it was subsequently discovered that the :

actual. volume was about 20 gallons instead of the assumed 5 gallons.

-and the RF probes which were believed to provide an automatic-engineered control had not been functionally tested.

1300 hour0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />s:- NRC Inspection Team arrived onsite to review Granulator - Hopper event corrective actions.

Licensee shut down and inspected each line, finding about 1 kg powder in the moisture dropout tanks for Lines 2,3 and 5, and 4 kgs for Lines 1 _

and 4, August 26,1997-

" Preliminary" criticality safety evaluations were conducted, and Lines 1-3  !

were restarted.

U

3 4-.

9 August 28,1997

' 1230 hour0.0142 days <br />0.342 hours <br />0.00203 weeks <br />4.68015e-4 months <br />s: - Licensee informed NRC inspection team of event and the August 25, 1997, shutdown for the first time. Licensee did not believe event was

- reportable.

~ August 29,1997L

- 1100 hour0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br />s: NRC notes that all license requirements for completing a Nuclear Criticality Safety Analysis (NCSA) had not been met.

Licensee initiated pellet area shutdown at about 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br /> and subsequently issued letter to NRC committing to completing all license required actions and to notify the NRC prior to restart.-

3.0 Granulator Hoooer incident Investiaation and Root Cause Analysis

a. Scope The inspectors conducted a review of the licensee's incident Investigation and Root-Cause Analysis (RCA) for the Granulator Hopper event of June 23,1997, to assure that a systematic, thorough and adequate investigation was conducted; a written report was

-issued to plant management in a timely manner; the report identified recommendations, that when implemented, would reduce the likelihood of recurrence; and the facility

. management system was functioning to ensure that the recommendations are, have been, or are being brought to closure in a timely manner, b.' Observations and Findinas

1. 'The inspectors requested a copy of the licensee's RCA and were provided with a flow chart that identified three causal factors and fouritems of note. Each caysal factor ar'd item of note was in table form with columns for " Paths Through Root Cause Tree" and

" Recommendations." The inspectors noted that the RCA causal factors included:

(1) loss of backup documentation supporting the favorable volume assessment for the

-hopper, (2) en oversight in the June 1996 analysis that assumed that the bottom portion

- was safe based on a former unreferenced analysis, and (3) the independent review process did not identify the error. Each of these causal factors had been sent to

- Regulatory Affairs for evaluation. None had been addressed as of the date of the:

inspection. The four items of note had also been fonuarded to a Product Process improvement Team, but no action had been taken as of August 29,1997, although the licensee continued to operate the granulator hopper up until the time of the NRC inspection, p

L U - . .-

r 10 i

in summary, the RCA recommendations had not been approved by management,

. prioritizedi ar implemented.- During discussions with senior plant management, the it,apectors were informed that while management. was cognizant of the RCA recommendations, other priorities had diverted their attention and resources.

I License Section 3.7, incident Investigations, requires;in part, that procedures provide for: systematic investigation of abnormal events, making decisions on corrective measures to prevent recurrence of such events:-and follow up on the implementation of the preventive measures. The failure to_ develop and implement coirective measures to prevent recurrence prior to restart, is an Apparent Violation (70-1151/97 205-01).

l- 2. Review of the RC/, identified several techni:alinadequacies with the licensee's evaluation. Specifically, the RCA did not address the following:

. Various management control processes failed to assure that the "as-built" volume / geometry of criticality controls matched the design documents as required by license Section 6.2.1.

1 The CSE process did not assure that the criticality safety controlled parameter - 1 requirements specified in license Section 6.2.4 were met.

. - The system restart authorization was given without the concurrence of

,", Regulatory Engineering after the removal of 165 kgs of powder, when plant " rule-of thumb" guidance requires such notification after any discovery of 40 kgs of powder accumulation. In addition, the CSE fault tree analysis for the pellet roll compactor hopper contingency protections identified 100 kgs UO, as the mass contingency for the system.

The CSE reanalysis did not meet the license requirements prior to restart of the -

system.

The discovery that the Line 4 oeflector panet was incorrectly insta) led and the

. Line 5 deflector was missing.

Section 3.7 further states that CFFF will have in place a structured methodology for determining and characterizing the root cause(s) of the failure (s) that led to safety-significant events. The failure to adequately determine and characterize the root cause(s) of the granulator hopper event of June 22,1997,'is another example of Apparent Violation (70-1151/97-205-01).

3. Discussions with licensee personnel who setved on the RCA indicated that they did not have a formal charter to direct their activities. While the incident investigation process i did consider whether the other granulator hoppers were susceptible to the same

. problem, as 'ihey were, the RCA was of limited scope and did not address the items

I s

- . I1 l

described in section 2, above, The inspector reviewed RA 111, Revision 2. Safety Significant incident Investigations, and noted that it did not contain adequate guidance or policy statements regarding:

. The timely development and management disposition of recornmendations.

• Expanding the scope of the RCA based on developed information to assure that all of the root causes of the failure (s) were addressed, including the failure to comply with license conditions.

• Event recovery and restart authority. In particular, no detailed guidance addressed the resolution of unnalyzed conditions and assuring tense compliance prior to reinitiation of operations.

The adequacy of procedures defining the policies of the Regulatory Component, including enticality safety, and identifying the requirements for implementation of applicable NRC regulations and license conditions, is further discussed in Detail 9 of this report.

c. C.0DclusQD The lice 1see did not conduct an adequate root cause analysis and identify end implemiint appropriate corrective actions for the June 22,1997, event in a timely manner, Management stated that the corrective actions had not been completed in a more tiniely manner due to recent downsizing activities at the plant and the NRC enforcement action for the mis shipment of two fuel rods to the Czech Republic.

4.0 Granulator Hoooer Criticality Safetv Evaluation (CSE)

a. Sragg '

The inspectors reviewed the CSE to verify (1) that the licensee had identi,fied the specific controls necessary for the safe operation of the process and the actions required to assure that those controls would be available and reliable if called on to function, and (2) that the assumptions related to process / equipment / material theory, function, and operation, including credible process upsets, were justified, documer%d and independently reviewed, b, Observations and Findinos

1. The inspectors reviewed the original and reanalyzed Granulator hopper CSEs and conducted discussions with the analysts. The original CSE (1996) bentified two controls to protect against an inadvertent criticality: moderation and volume.

Moderation control was based on the physical enclosure of the system and the powder dryness resulting from the previous procesaing. The analyst informed the ;nspectors that volume control was based on a prior Nuclear Safety Analysis (NSA, a forerunner to

~ - - _ - - - . - - - - . - - . -

. . 12 the current NCS analysis and evaluation process). There was no specific cross reference to the NSA so that an adequate independent review could be performed.

Furthermore, the independent review failed to identify that the CSE technical content did not meet all of the license requirements.

The inspectors were informed that the original NSA had been lost and its adequacy could not be determined. Control of nuclear criticality safety analysis recoris is discussed further in Detail 7 of this report. Notwithstanding the content and accuracy of the lost NSA, the as-built hopper volume o' 43 liters did not meet the criteria for fas . able volume, as demonstrated by licensee calculations and independent inspector analysis.

License Section 6.2.1, General Control Program Practices, requires that a defense of i one or more system parameters will be employed and documented within the Criticality Safety Evaluation (CSE), which identify the specific controls necessary for the safe operation of a process The failure to perform an adequate evaluation of the granulator .

hopper in 1996 and resultant failure to establish appropriate controls necessary for safe-operation, even though the system print reflected the actual unfavorable volume ,

dimensions,is an Apparent Violation (701151!97 205 02).

2. The inspectors noted that the correct hopper dimensions were shown on the system's print. Had the print been adequately reviewed during the CSE development and review process, the "as built" volume of 43 liters could have been calculated, in addition to the ,

licensee's incorrect conclusion that the hopper was of favorable volume, there was no r documented field verification that the as built hopper matched the design documents. l Furtr rmore, there was no management mechanism in place which would have required a venfication that previously installed volume or geometry controls matched the values assumed in the CSE and other current design documents.

License Section 6,2.1, General Control Program Practices, requires that prior to use of a nuclear cri'.icahty safety control, a functional verification process will be performed to aswre that the controls selected and installed match the requirements identified in the design criteria. The failure to assure that the hopper volume control identjfied in the CSE matched the as built configuration in the field is an Apparent Violation (70 1151/97 205 03),

3. As a result of the above findings, the inspectors requestod the licensee to provide their position regarding the safety bases for the continued safe opa> ration of the facility. The licensee indicated that they had started a general CSE upgrr.de program in support of their License Renewal effort in accordance with the schedule provided in license ,

condition S-2. This condition prioritized the various plant systems in accordance with safety risk. The licensee stated that the new CSEs were being conducted to a more rigorous methodology than past evaluations, which provided reasonable assurance that the assumptions had been verified. The only exception would be for any CSE which referenced a prior NSA as part of its basis, in addition, there were several systems which are considered to be of Icw risk for which the NRC had approved a later reanalysis schedule.

l l-t 4

I

. D The inspectors noted that the later scheduling of ' low risk" systems was based on the best knowledge that was available to the NRC at the time of license renewal. Since then, new information has surfaced regarding the adequacy of various geometry / volume passive criticality safety controls. The inspectors noted that an expeditious review of CSEs which referenced older Nuclear Safety Analyses (NSAs) and for those systems which had not yet been upgraded to the new CSE process, appeared warranted to

- assure that the geometry / volume control *as built

• matched design documents. The licensee acknowledged the inspectors comments and stated that this concern would be promptly reviewed. This will be tracked as an inspector Followup Item (701161/97 206 08).

i

4. The inspectors also reviewed the licensee's reanalysis which calculated the favorable volume as 39 liters. No problems were identified with this calculation, which the licensee used as the design basis for the fiva hopper volume limiters used to restore volume control. However, the rest of the reanalysis was considered inadequate in that:

It did not discuss all reasonable or expected process upsets.

. It did not cover the process / operational flow in sufficient detail so that an independent reviewer could determine the adequacy of the analysis.

+

-It had not been adequately reviewed by a qualified peer.

In essence, the reanalysis was limited to calculational notes documenting the K eff of a model representing the "as found" condition of the system.

License Section 6.2.4, Criticality Controlled Sajety Parameters, requires that the CSE

process willidentify the significant parameters affected within a particular system and all assumptions relating to process / equipment / material theory, function, and operation, including credible upset conditions, will be justified, documented and independently reviewed. The failure to assure that all assumptions relating to process / equipment / material theory, function, and operation, including credible upset conditions for the granulator hopper were justified, documented, and adeguately reviewed prior to restarting the system following the June 23,1997, event, is an Apparent Violation (701161/97 206-04).

c. Conclusions

- The original granulator hopper CSE was inadequate in that it did not esthblish

. appropriate volume control safety limits. No program was in place to assure that passive geometry / volume criticality safety control *as built

• configurations matched the design criteria. Further, the reana;ysis of the granulator hopper system following -

restarted after the June 23,1997, event did not meet license requirements for content and review.

r

14 5.0 Eejlet Area Ventilation Syttem Mois'urtQmpsut Tanks

a. Scgggt After being informed by the licenses at 12:30 p;m. on August 28,1997, that the pellet area ventilation system's five moisture dropout tanks were greater than a favorable volume, the inspectors reviewed the CSE and conducted discussions with licensee personnel to determine the safety significance and cause of the event and assess the adequacy of the licensee's response actions (see Detail 1.b for background information),

b. Observations and Findinos

1. The licensee restarted the pellet area systems without performing a root cause analysis.

This is of concern because this was the second recent instance where an event occurred that involved the unexpected identification of an unfavorable geometry / volume component where special nuclear material had accumulated.

Section 3.7, incident Investigations, requires, in part, that procedures provide for:

systematic investigation of abnormal events, making decisions on corrective measures to prevent recurrence of such evei 's; and followup on the implementation of the preventive measures. RA 111, Safety Significant incident Investigations, establishes the procedure for investigating safety significant incidents, including the determination of the root cause(s) and the identification of oppropriate corrective actions. Section 2.0, Policy and Scope, further defines a safety significant incident criteria as including the loss of multirst.g criticality controls (as identified in the current process or equipment CSE). The failure to initiate an incident investigation for a safety significant incident involving the failure to establish criticality controls for the moisture dropout tank (since the curreret system CSE only assumed favorable geometry) and develop and implement

• corrective measures to prevent recurrence, is another example of Apparent Violation (70 1161/97 205-01).

2. The inspectors reviewed the CSE associated with the 1993 installation gf the moisture dropout tank and found it to be inadequate in that:

• It assumed that each pellet line would have a dropout tank of less than 5 gallons, However, the attached process and instrument diagram sketches showed the correct dimensions for the as built 20 gallon tanks. Had these values been adequately considered during the CSE development or peer review, appropriate safety limits could have been developed.

• The CSE did not consider the possibility that special nuclear material could accumulate in the dropout tanks. From 1-4 kgs of UO, powder were found in each.

4 l

15 License Section 6.4.1, Criticality Safety Evaluation (CSE), requires the identification and ,

i documentation of the basis of nuclear criticality safety for a particular system, including i

a safety analysis which includes a comprehensive review of each component within the defined system. The Criticality Safety Analysis (CSA) will be included within the CSE and will define the safety limits for coch component within the system. The failure to perform an adequate review of the pellet area ventilation system moisture dropout tanks in 1993 and resultant failure to establish appropriate safety limits, even though the system print reflected the actual unfavorable volume dimensions, is another example of Apparent Violation (701151/97 205 02).

3. The licensee failed to conduct a functional verification to assure that the as hu.ill configuration matched the design documents (CSE assumptions). The bilure to assure that the moisture dropout tank volume controlidentified in the CSE matched the as built configuration in the field is ant.,ther example of Apparent Violation (701151/97 205-03).

4. The pellet area ventilation system reanalysis conducted on August 26,1997, was reviewed by the inspectors and was found to be inadequate in that:

. It did not consider or discuss all process upsets.

. It did not cover the process / operational flow in sufficient detail so that an independent reviewer could determine the adequacy of the analysis.

. It had not been independently reviewed.

As with the granulator hopper reanalysis discussed previously, the dropout tank reanalysis was limited to calculational notes documenting the K eff of a model representing the "as found" condition of the system.

The failure to assure that all assumptions relating to process / equipment / material theorj function, and operation, including credible upset conditions for the pellet,;irea ventilation system dropout tanks were justified, documented and independently reviewed prior to restarting the system following the August 25,1997, event is another example of Apparent Violation (701151/97 205-04).

c. Conclusions The licensee failed to implement plant incident inwstigation procedures to establish the root cause of the unanalyzed pellet area ventilation system moisture dropout tank event prior to restart. An inadequate safety review in 1993 resulted in the failure to establish appropriate safety limits. No check was performed to confirm that the "as-built" configuration of the tanks matched the design documents. The technical content of the reanalysis performed prior to the restart of the system on August 26,1997, did not meet the license conditions.

~

o

- . 16 6,0 Review of Other CSEs

a. Scopa '

The inspectors reviewed other selected CSEs to confirm that they were technically adequate and in conformance to license requirements for content and approval.

b. Observations and Findinas By letter dated June 28,1996, the licensee responded to a license condition requiring summary CSE and fault tree information for the pelleting process. The summary information for the Compaction and Granulation process stated that *the Nuclear Criticality Safety Analyses relied on passive engineered and administrative controls, and process limitations applied to geometry to ensure suberiticality and a large margin of safety. These controls and limitations make a criticality situation not credible.

Therefore, no fault tree is required." The Pellet Press and Sintering Furnace process descriptions were similar and also provided no fault tree analyses.

RA 310, Regulatory Affairs Technical Reviews, establishes the minimum requirerlents for performing technical reviews of NCS documentation. Section 7.2.1 provides guidance for the independent technical reviews of CSEs and CSAs, including the evaluations of normal operations plus expected upsets, credible process upsets, discussions of parametric studies, margins of suberiticality and safety, and an evaluation of agreement with the license with respect to the criticality saft.ty basis and bounding assumptions.

The inspectors reviewed the CSEs for the above processes and found that RA 310 had not been properly implemented, as each CSE was inadequate because they did not consider all appropriate process upsets, the process / operational flow was not covered in sufficient detail so that an independent reviewed could determine the adequacy of the analysis, and the independent reviews conducted were inadequate. These are other examples of Apparent Violation (701151/97 205 04).

c. Conclusions The CSEs for the Granulation and Compaction, Pellet Press and Sintering Furnace processes provided an insufficient documented safety basis in that each one did not address all of the technical requirements specified in the license. RA-310 was not effectively implemented, and the peer review process failed to assure that three CSEs reviewed met the current license requirements for content.

L

17 i

7.0 Bugida

a. Ec. ope The inspectors reviewed the licensee's program for the control and maintenance of l safety bases documents to assure that identifiable and retrievable records are available l to demonstrate the safety margin of the various processes involving the storage, handi.ng and processing of special riuclear material,

b. Observations and Findinas f During the course of the inspection, the licentee informed the inspectors that the l otyinal Nuclear Safety Analysis (NSA) that was used for the 1996 Granulator Hopper l Criticahty Safety Evaluation (CSE), but not specifically referenced in it, had been lost.

This document was part of the safety basis documentation for that system. Subsequent discussions were conducted with the licensee concerning the identification and control of such records. The inspectors were provided with a copy of CA 004, Columbia Plant Records Management Policy, and were informed that this was the procedure used to meet the requirements of license Section 3.8.1.

Review of CA-004 revealed that the system was directed toward the Quality Assurance records (finished product quality). The procedure required that the various originating departments identify the categories of records to be retained and to utilize a Westinghouse Records Flow Schedule. However, the main thrust of the procedure was the preparation and transmittal of prescribed records to long term storage. Nuclear Cnticality Evaluations, Analyses, and Methodology Validations were not listed t,s an example of a quahty record. The inspectors further reviewed the actual NCS record storage and control practices and were informed by the licensee that those records were last inventoried in 1995. Based on these observations, the inspectors determined that no procedures were in place to control storage and access to NCS records. There was no other requirement for the periodic checking of NCS documents, and there was no method to distinguish between current and obsolete documents. ,,

License Section 3.8.1, Records, requires, in part, that written procedures will specify the management program for Nuclear Criticality Safety Evaluations, Analyses, and Methodology Validations, and that records of nuclear criticality safety analyses will be maintained for the lifetime of the facility. The failure to develop an adequate written procedure to specify the management program for NCS evaluations and the loss of the original granulator hopper NSA are examplos of an Apparent Violation (701151/97 205 05).

c. CQnelusions The licensee had not established an adequate management program to maintain the safety. bases NCS documents and had lost an NSA.

)

s 4 t

. . 18 8.0 Event Reogrting

a. Stappt The inspectors reviewed the licensee's process for assuring that safety significant items are promptly reviewed, evaluated and reported to the NRC in accordance with regulations and license conditions.

l

b. Observations and Findngg

1. On August 25,1997, the licensee discovered that the Pellet Area Ventilation System Molsture Dropout Tank volume was not favorable volume, as assumed. Each of the five pellet lines were brought offline, inspected, cleaned of accumulated UO, powder, functionally tested and restarted by the end of August 26,1997. The licensee verbally ~

informed the NRC inspection team of the event at 12:30 p.m. on August 28,1997.

During that meeting, the inspectors asked the licensee representatives why they had not notified the team prior to the restart of the five lines, especially in light of the teams review of a pr9vious loss of volume control event. The licensee indicated that the NCS 2roup recommended NRC notification, but that licensee management had made the decision not to inform the team until after a review could be completed and all the information gathered. However, the team noted that the completion of.that review did not holdup production resta.1, and the lack of that notification prevented the NRC from conducting a real time inspection of how the licensee handled unanalyzed conditions.

Furthermore, RA 107, internal Reporting, and NRC Notification of Unusual Occurrences, Section 7.8, Courtesy Calls, states *lt is important that NRC be notified of events related to criticality safety, if there is any doubt as to whether an event should be reported, the NRC should be contacted." The licensee did no,' implement this notification in a timely manner.

The team also asked whether the licensee planned to make a Bulletin 91-01 report, and were informed that they had not reached a final decision, The licensee was requested to complete their review and inform the team of the reportability determin'ation and the basis for that determination. During a second meeting on August 29,1997, the licensee stated that they had completed their review and that the event was not reportable.

. The reason given for the unreportable determination was that the event involved an unanalyzed condition for which there was defacto double contingency protection.

However, the inspectors noted that the original analysis was deficient and a reanalysis was necessary before controlled criticality parameters could be established and maintained. Further, NRC Bulletin 9101, Supplement 1, issued July 27,1993, Attachment 1, addresses questions and answers concerning reportability as follows:

i  ?

l ,

19 i Q3. S cases where a deficiency in the criticality safety analysis is found, and in the same analysis a mitigating condition not previously identified is found, is the l deficient criticality safety analysis reportable?

A3. Yes. The licensee should report it. In addition, the licensee should prepare a corrected analysis. j License Section 3.7.3, Notification of Regulatory Agencies, Section (b.3) requires a l

. four hour notification of any determination that a criticality safety analysis or evaluation was deficient and that double contingency protection, in fact, does not exist.

Section 6.2.1, General Control Program Practices, states that 'The Double Contingency ,

Principle (ANSI /ANS 8.1 1993 (R 1988)) will be the basis for design and operation of processes... For each significant portion of the process, a defense of one or more i system parameters will be employed and documented within the Criticality Safety a' l Evaluation.'

l Section 6.2.3, Table of Plant Systems & Parametric Controls, identifies mass and geometry as the criticality safety basis for the ventilation system.

j- Section 6.2.4, Criticality Safety Controlled Parameters, identifies the specific control ,

parameters that will be considered during the review process. For mass, the evaluation will consider normal operations and expected process upsets for determination of the l

actual mass limit for the system and for the definition of subsequent controls. For

! moderation, the minimum protection will be two independent barriers, including i establishment of a method to detect a failure of the outermost barrier and a program to g maintain the quality of the barrier and routine barrier inspections. .

The Pellet Area Ventilation System moisture dropout tanks, a significant portion of the process in that the licensee had net previously demonstrated that a criticality was an incredible event, was not analyzed and system mass and moderation controls were not established in accordance with Section 6.0 requirements. Therefore, the failure to notify the NRC within four hours of the discovery that the moisture dropout tank was unanalyzed, and hence, no double contingency protection established pri'6r to operation of that component,is an Apparent Violation (701.151/97 205 06).

2. _ As a result of the inspectors review of the licensee's reporting process, a second l _ example of a potential violation involving NRC notification was identified regarding the

June 22,1997, Granulator Hopper event. The inspectors noted that powder accumulation was first noted at about 2345 hours0.0271 days <br />0.651 hours <br />0.00388 weeks <br />8.922725e-4 months <br /> on June 22,1997, and that removal

activities were undertaken from 0100 - 0300 hours0.00347 days <br />0.0833 hours <br />4.960317e-4 weeks <br />1.1415e-4 months <br /> on June 23,1997. The Team .

Manager authorized restart at 0430 hours0.00498 days <br />0.119 hours <br />7.109788e-4 weeks <br />1.63615e-4 months <br />, even though 165 kgs of powder had accumulated, which was in excess of the 100 kg mass contingency limit identified in the licensee's fault tree analysis for that system. ' At 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />, a Regulatory engineer determined that an oversight occurred in the original analysis and a re-evaluation confirmed the unfavorable volume at 2016 hours0.0233 days <br />0.56 hours <br />0.00333 weeks <br />7.67088e-4 months <br />. It was at this point that the licensee

, started the four hour reportability time clock.

.. _ . _, . __ __ _u. __ _ _ , _ _ _ _ _~ ._

t

. 20 l NRC was subsequently notified of this event at 2340 hours0.0271 days <br />0.65 hours <br />0.00387 weeks <br />8.9037e-4 months <br />. The licensee's operations 1 group had actualinformation that the UO, mass had unexpectedly accumulated in excess of the station's 40 kgs NCS notification limit prior to restarting the system, and the Regulatory engineer should have been informed of the actual mass found when notified at 0530 hours0.00613 days <br />0.147 hours <br />8.763227e-4 weeks <br />2.01665e-4 months <br />. Therefore, the actual four hour time clock should have started upon the notification of the Regulatory engineer at 0700 hours0.0081 days <br />0.194 hours <br />0.00116 weeks <br />2.6635e-4 months <br /> as this was when the knowledgeable individual responsible for evaluating nuclear criticality safety arrived on site to follow up on the Team Managers call.

License Section 3.7.3 (b.2) requires a four hour report of any nuclear criticality safety incident for which less than double contingency protection remains (multi parameter j con _ trol or single parameter control) and greater than a safe mass is involved and double l contingency protection is not restored within four hours. The failure to notify the NRC of l this event within fot;r hours is another example of Apparent Violation (701151/97 205-06).

c. Conclusions The licensee's system for the timely evaluation and reporting of criticality safety events appeared weak, as evidenced by the failure to conduct a prompt review and notification for the pellet area ventilation system moisture dropout tank event of August 25,1997, and the Granulator Hopper event of June 22,1997.

9.0 . Etparam Administration - Facility Prncedures

a. Scope The inspectors reviewed the Regulatory Affairs guidance procedures, including those for nuclear criticality safety (NCS), to assure that effective management controls were established for implementation of applicable NRC regulations and license conditions,

b. Observations and FindjDES The inspectors conducted discussion with the licensee's techn'ical staff c6ncerning what procedures or policies were available to provide appropriate guidance for implementing the various criticality safety requirements defined in Section 6 of the license. The inspectors were informed that there was r;o NCS administrative manual and that they were aware of only three different " policy" papers. The inspectors conducted further discussions with the Manager of Regulatory Affairs, to whom the NCS group directly reports. The Manager stated that the facility complied with the requirements of license Section 6.1.1(b), Regulatory Affairs Guidance Procedures, through various Regulatory

• t 21 Affairs (RA) procedures. The inspectors requested a copy of all RA procedures that were used to r*eet the requirements of Section 6.1.1(b), and were provided with the following:

RA 102, Regulatory Compliance inspections (Rev 9).

RA 104, Regulatory Review of Configuration Change Request (Rev 9). .

RA 106, Internal Program Audits (Rev 5).

RA 107, Internal Reporting and NRC Notification of Unusual Occurrences (Rev 6).

RA 108, Safety Significant Interlocks (Rev 6).

RA 110, Identification and Reporting of Substantial Safety Hazards (Part 21) (Rev 3).

RA 111, Safety S'3nificant incident Investigations (Rev 2).

RA 112, hocess Safety Management Compliance Audits (Rev 2).

RA 113 Regulatory Commitment Tracking (Rev 0).

RA 301, Floor Storage of Special Nuclear Material (Rev 12).

- RA 302, Cnticality Signs (Rev 8).

RA-303, Control of Moderating Materials for NCS (Rev 8).

RA 304, Criticality Accident Alarm System (Rev 5).

RA 305, Evaluations Using the NITAWL XSDRN KENO Codes (Rev 3).

RA 306, Movable Non Favorable Geometry (NFG) Containers in the Chemical Area (Rev 4).

RA 310, Regulatory Affairs Technical Reviews (Rev 2).

RA 311, NCS Program Review (Rev 0).

Based on a limited review of the above documents, the inspectors identified the following problems and concerns:

1. The stated purpose of RA 311, NCS Program Review, is to provide criteria for I

performing and documenting program reviews to assess the effectiveness of all components of NCS programs. The aspects of the NCS program that are required to be reviewed are analysis and evaluation; criticality alarm system; implementation of requirements for movable NFG containers, neutron absorbing materials, mass control, moderation control; monthly RA compliance inspections, and, data packs (event investigations).

The inspectors determined that in total, the RA procedures did not provide adequate guidance to assure that all aspects of the NCS program defined in Section 6 were adequately implemented. The guidance was inadequate in that it was limited to several broad areas and did not cover such NCS license topics as the Verification Program, the Maintenance Program, methods of criticality safety control, use and implementation of all the controlled parameters defined in the license, and control of criticality safety documentation (i.e., maintenance of the safety basis documentation).

2. RA-107, Intemal Reporting, and NRC Notification of Unusual Occurrences, was last updated in 1994, prior to the 1995 license renewal and several amendments, which

22 included changes to the reporting requirements. Consequently, the section on t,eneral guidanco in preparing a notification no longer matched the current reporting requirements contained in license Section 3.7.3.

3. RA-108, Safety Significant Interlocks, and no other procedure provided to the inspectors, provided guidance on the development and implementation of passive engineered controls, such as geometry and volume, to assure that they are analyzed and evaluated for fabrication tolerances and dimensional changes that may occur through corrosion, wear, or mechanical distortion. In addition, it did not include provisions for the periodic inspection if credible conditions exist for changes in dimensions of the equipment that may result in the inability to meet NCS limits as specified in license Section 6.2.4(a).

4. RA 111, Safety Significant investigations, did not provide guidance on: (1) when

} Regulatory Affairs approvalis required prior to the restart of a shutdown system, l (2) ensuring compliance with license conditions prior te restart (License

} Section 2.3.1(c)), or (3) how an "unreviewed safety question

• is to be reviewed and l resolved (i.e., unanalyzed conditions and discovered deviations from license Section 6.2.1).

5. RA 305, Evaluations Using the NITAW1. XSDRN KENO Codes, and no other procedure reviewed by the inspectors, provided guidance for computer software and hardware configuration control as specified in license Section 6.4.3(d).

6. RA 303, Control of Moderating Materials for NCS, nor any other procedure provided to the inspectors, provided guidanco ict establishing a program to maintain the quality of the outermost moderator barrier and to conduct routine ir.spections as specified in license Section 6.2.4(c.2).

7. RA-304, Criticality Accident Alarm System, did not provide any guidance concerning the suspension of special nuclear material movement within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the placement of the alarm system out of service as specificd in license Section G.3.1.

8. RA 310, Regulatory Affairs Technical Reviews, did not provide any guidance for venfying that the as built passive controls, such as geometry and volume, matched the design criteria as specified in license Section 6.2.1.

Section 6.1.1(b), Regulatory Affairs Guidance Procedures, requires, in part, that Regulatory-Significant procedures define the policies of the Regulatory Component, including nuclear criticality safety, and identify the requirements for implementation of applicable NRC regulations and license conditions. The failure to develop NCS policies or procedures to identify the requirements for implementation of alllicense conditions is Apparent Violation (701151/97-205 07),

l 1

j u

t- ,

o ,

, 4 .

. 23  ;

c, Conclusions t

The licensee has not established a management control program for assuring that adequate procedures or policies are provided that Uentify and cover the license requirements related to nuclear criticality safety.

i

10. Exit Meetina and Conference Call The inspectors presented the inspection scope and findings to members of licensee management during and at the conclusion of_this inspection on August 29,1997. Seven potential violations were identified. The inspectors noted that further NRC management review would be required before a determination can be made regarding characterization of any violation.

During the exit meeting, the licensee was asked whether they were in compliance with the license conditions regarding the updated Criticality Safety Evaluations for the Granulator Hopper and Pellet Area Ventilation systems. A conference call was held with ,

Mr. W. Brach and others of the NRC Fuel Cycle Safety and Safeguards Division (HQ),

Mr. D. Collins and others of NRC Region ll Office, and Mr. J. Bush, Acting Westinghouse Plant Manager and others of the plant staff. At the conclusion of that  :

, conference call, Mr. Bush stated that the pellet area lines would be immediately; shutdown and not restarted until the CSEs were brought into compliance with the license requirements.

A second exit meeting was conducted with the Manager of Regulatory Affairs by I conference call on September 22,1997. The seven apparent violations identified in the -

Executive Summary were discussed, along with the need and process for a predecisional enforcement conference.

g. 6 h

l, l -- ,

y gg w w *1"im:9N ^e- w F- '-

weg,><y* ' 'm --' g wye

• t=1---W*5-@W - "" -' Wg -T- .-.-ur w- t t' ap' - -

. _ . . . - _ . . . . . . - _ . .-- - - - - . - . _ - - - . - - . _ _ _ ~ - - ,

t e

24 l

PARTIAL LIST OF PERSONS CONTACTED Licennes J. Allen, Plant Manager J. Bush", Manufacturing Manager (Acting Plant Manager) l R. Ervin*, Technical Services D. Goldbach*, Chemical Operations Manager W. Goodwin", Regulatory Affairs Manager ,

E. Keelen*, Product Assurance Manager

. N. Kent *, Regulatory Affairs (NCS)

' R. Lacy *,- Plant Orvices Engineering Manager N. Parr*, Chemical Processing Engineering Manager T, Shannon*, Regulatory Affairs (NCS Technical Support)

R. Williams", Regulatory Affairs Advisory Engineer NRG l

D. Ayres", Project inspector, Region 11 J. Davis", Criticality inspector, FCOB W Troskoski". Sr. Chemical Engineer, FCOB

• Participated in the exit meeting:

" Also participated in the telephone conference. .

ACRONYMS USED CFFF Columbia Fuel Fabrication Facility .

CPE Criticality Process Engineer CSA- Criticality Safety Analysis CSE Cnticality Safety Evaluation NCS Nuclear Criticality Safety s Nuclear Criticality Safety Analysis

.NCSA. l' NSA Nuclear Safety Analysis RA Regulatory Affairs RCA Root Cause Analysis

, SNM Special Nuclear Material SOV Solenoid Operated Valve

' UO, Uranium Dioxide ,

l.

l l -_. _

._,. _