ML20212K930

Insp Rept 70-7001/99-10 on 990720-0907.Violations Noted. Major Areas Inspected:Plant Operations,Maint,Engineering & Plant Support

ML20212K930
Person / Time
Site:	07007001
Issue date:	10/04/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20212K899	List: ML20212K894 ML20212K916 ML20212K930
References
70-7001-99-10, NUDOCS 9910070102
Download: ML20212K930 (21)

Text

,

n U.S. NUCLEAR REGULATORY COMMISSION REGION lli Docket No: 70-7001 Certificate No: GDP-1 Report No: 70-7001/99010(DNMS)

Facility Operator: United States Enrichment Corporation Facility Name: Paducah Gaseous Diffusion Plant Location: 5600 Hobbs Road P.O. Box 1410 Paducah, KY 42001 Dates: July 20 through September 7,1999 Inspectors: K. G. O'Brien, Senior Resident inspector J. M. Jacobson, Resident inspector Approved By: Monte P. Phillips, Acting Chief, Fuel Cycle Branch Division of Nuclear Materials Safety E . . .

PDR ADOCK 07007001 C PDR

4 EXECUTIVE

SUMMARY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant NRC Inspection Report 70-7001/99010(DNMS)

Plant Operations e The inspectors determined that the plant staff appropriately implemented the Technical Safety Requirement Action Statements for the Building C-710 criticality accident alarm system following the discovery of system performance issues during the installation of an unrelated plant modification. (Section 01.1) e The plant staff effectively increased the operating power level of the gaseous diffusion cascade in order to retum the cascade to normal operating levels after the summer outage. As part of the power increase, additional cells were brought onstream in a well-planned and safe manner. (Section 01.2)

Maintenance e The plant staff developed interim compensatory measures for, identified the root causes of and developed comprehensive corrective actions for continued out-of-tolerance conditions for a Building C-360 cylinder accountability scale, in part, after questions were raised by the inspectors. (Section M1.1) e The inspectors identified that the plant staff's methods har conducting the Technical Safety Requirement-mandated cell shut downs and associated safety-related electrical breaker preventive maintenance were not sufficiently integrated to preclude the untimely completion of the preventive maintenance. As a result, preventive maintenance was not performed within the defined five-year interval for one safety-related breaker and delayed preventive maintenance appeared to contribute to two safety-related breakers failing to trip during a planned shutdown. (Section M1.2)

Enaineerina e The inspectors determined that the plant staffs replacement of resistors, incorrectly installed in a safety-related criticality accident alarm system, rectified an undocumented error in the design outputs for a previous modification to the system. (Section E1.1) e The inspectors determined that the engineering staffs response to anomalous installation testing results were appropriate and ccrrectly identified a similar issue with I an in-service criticality accident alarm system. l Plant Suooort e The plant staff identified and appropriately corrected an inadequacy in the radiation protection training process which had previously allowed certain individuals to routinely j work in radiological areas, under escort, without the appropriate training on the radiological hazards and the means to protect themselves. (Section R1.1) i i

2

o e The inspectors determined that the plant staff took appropriate actions to protect and control unmarked documents containing classified matter, once identified, that had been previously maintained outside the controlled access area. As a result, the potential for actual compromise of the classified information was minimal. (Section S1.1)

• The plant staff identified and promptly responded to a classified conversation that occurred in a meeting with an uncleared individual present. A subsequent granting of a security clearance to the individual minimized the potential consequences of the event.

(Section S1.2) e The inspectors identified a procedural violation, in that the plant staff did not ensure that all individuals allowed access to the plant site, had completed the required site-specific  !

training requirements or possess the proper training documentation.

(Section S1.3) l i

l l

I 1

3

I Report Deta'is I. Operations 1

01 Conduct of Operations 01.1 Qmations Response to Off-Normal Conditions involvina a Plant Modification

a. In=aaMon Scope (88100)

The inspectors reviewed the plant staff's handling of off-normal conditions discovered during the installation and testing of a revised criticality accident alarm system (CAAS) for Building C-746Q.~

b. Observations and Findinas On August 21, the plant staff were conducting installation activities for a new CAAS in Building C-746Q. The building housed drums and containers of waste materials.

During testing of the newly installed system, the system engineer noted that the system homs, used to alert personnel of a potential criticality event, were not operating within the minimum specifications. Specifically, the electric homs would not actuate within ,

one-half second after the criticality accident alarm system circuitry detected a simulated criticality accident condition.

Since the Plant Shift Superintendent (PSS) had not yet declared the newly installed system operable, the engineer's observations did not have an immediate impact for operations within Building C-746Q. However, the engineer alertly noted that some of the same homs were' utilized as a part of a past upgrade of the Building C-710 (plant laboratory) CAAS. An initialinvestigation of the Building C-710 homs performance, conducted during installation testing in June 1998, indicated that some of the horns may not have been time tested. As a result, the PSS declared the Building C-710 CAAS inoperable and entered the appropriate Limiting Conditions for Operation (LCO) Action Statement (AS).

The inspectors were informed of the pending issues with the Building C-746Q and the LCO AS actions for Building C-710 shortly after the engineer initia!!y identified the  ;

performance questions. The inspectors reviewed the applicable Technical Safety  !

Requirements (TSRs) and determined that the PSS's actions were consistent with the requirements. The inspectors also noted that the PSS took action to limit other plant activities that could have resulted in a need to analyze TSR-required cascade samples.

The plant staff maintained the TSR-required compensatory measures for an inoperable Building C-710 CAAS until the concems with the CAAS operability were resolved.

(See Section E1.1)

c. Conclusions The inspectors determined that the plant staff appropriately implemented the Technical Safety Requirement Action Statements for the Building C-710 criticality accident alarm system following the discovery of system performance issues during the installation of an unrelated plant modification.

4

01.2 Cell Startuos

a. Inspection Secoe (88100)

The inspectors reviewed the certificatee's process for starting up cells as part of increasing the cascade power level for the increased production planned during the fall, winter, and spring months,

b. Observations and Findinos The plant staff increased the power consumption of the gaseous diffusion cascade from 1 approximately 300 megawatts (MW) to approximately 650 MW during the inspection I period. The power level for the cascade was directly related to the amount of uranium hexafluoride being enriched in the gaseous diffusion process. As the power level was increased, the plant staff started and brought online an additional 30 cells. The plant staff conducted a daily meeting to discuss the celis scheduled for.startup, the completion of maintenance activities, and possible roadblocks to bringing cells onstream. Tha meeting focused on both potential safety issues as well as meeting production targets. The inspectors noted that the power increase occurred efficiently and safely with only one unexpected occurrence - a compressor deblade which did not result in a release.

c. Conclusion The plant staff effectively increased the operating power level of the gaseous diffusion cascade in order to return the cascade to normal operating levels after the summer outage. As part of the power increcse, additional cells were brought onstream in a well-planned and safe manner.

08 Miscellaneous Operations lasues 08.1 Certificatee Event Reports (9Q712J The certificatee made the following operations-related event reports during the inspection period. The inspectors reviewed any immediate safety concems indicated at the time of the initial verbal notification. In the case of retracted notifications, the inspectors reviewed the basis for the certificatee's retraction of the notification at the time of the retraction. The inspectors will evaluate the associated written report for each I of the events following submittal.

l Number Status litle 36051 Open Post-removal Non-Destructive Assay was not performed as required by NCSA [ Nuclear Criticality Safety Approval]

36057 Open New CAAS system did not pass the testing criteria for horn actuation time.

5

4 08.02 Bulletin 91-01 Reoorts (97012)

The certificatee made the following reports pursuant to Bulletin 91-01 during the inspection period. The inspectors reviewed any immediate nuclear criticality safety (NCS) concems associated with the report at the time of the initial verbal notification.

Any significant issues emerging from these reviews are discussed in separate sections of the report.

Number Rats Title 35941 7/20/99 During calibration of a C-335 air plant moisture meter, air was added to C-335 Unit 3 Cell 7 without independently verifying that enrichment was less than 1.0 weight percent asU.

II. Maintenance M1 Conduct of Maintenance M1.1 Ryiidina C-360 Scale Calibration issues

a. Insoection Scope (88102. 8810_3)

The inspectors followed up on a series of reports that the Building C-360 Scale Number 22, used to perform weight checks of cylinders received at Paducah, was identified to be out of tolerance during the daily functional tests of the scale.

b. Observations and Findinos i

During the daily checks of Scale Number 22, the primary sesle used to perform weight checks on inaming uranium hexafluoride cylinders, the plant staff identified on six occasions during June 1999 and eight occasions during July 1999 that the scale was out )

of tolerance. The problems were reported to plant management during the daily i tumover meeting. The inspectors noted that although the scale was declared inoperable following each day that an out of tolerance condition was observed, the plant staff did not impbment ccmpensatory measures to preclude the heating of a cylinder that may have been weighted since the previous daily check. The inspectors also noted that operations staff did not initiate a coordinated effort to identify a root cause for and develop a solution to the out of tolerance conditions until questions about the continued reports were raised by the engineering manager and the inspectors.

The system engineer for the cylinder accountability scales onsite indicated that troubleshooting efforts were undertaken for a number of the occurrences, but that the cause of the continued scale drift was difficult to determine. In addition to the troubleshooting activities, the plant staff initiated a process in which the Technical Safety ;

Requirement-specified functional test was performed after every five cylinder weights. i This process limited the potential that a cylinder would be weighed with an out-of-tolerance scale and not identified before being heated in an autoclave.

6

i I

Once a detailed review of the out of tolerance conditions was initiated, the plant staff i disassembled the scale and identified that the cause of the continued drift was a worn pivot point in the scale lever arm. The wear was a result of constant use of the scale l over a number of years and was not visible to the naked eye, but had to be measured I using a micrometer. Upon discovery of the worn pivot point, the plant staff ordered and installed a new lever arm from the manufacturer and re-assembled the scale. After assembly and calibration, the scale operated without additional identifications of out-of-tolerance conditions.

c. Conclusion The plant staff developed interim compensatory measures for, identified the root causes j of and developed comprehensive corrective actions for continued out-of-tolerance '

conditions for,a Building C-360 cylinder accountability scale, in part, after questions were raised by the inspectors.

M1.2 Preventive Maintenance Defetteln

a. Insoection Scope (88103)

As a followup to a cascade motor breaker (MB) operational failure described in NRC  !

Inspection Report 70-7001/99008, the inspectors reviewed the processes used by the I plant staff to ensure that cascade MBs and air cooled breakers (ACB) were able to I perform their intended safety function. l

b. Observations and Findinas On June 3,1999, an MB associated with Building C-331 Unit 3 Cell 5 failed to operate

, on demand. Fouowing the failure, the plant staff used an attemate means to shut down l the cell and the PSS declared the cell shuldown system inoperable. Subsequent to the i failure, the plant staff determined that tt a breaker did not trip initially. Inctead, the ;

breaker opened sluggishly, due presumably to decreased lubrication of the friction points within the breaker.

Based upon the plant staff's review of the breaker's failure to operate on demand, arcing noticed on the breaker contacts, and the past due preventive maintenance status for the breaker (greater that five years), the engneering staff informed the Cascade Coordinator of a potential need for operations staff to use an attemate means to shut down a cell. The inspectors reviewed the engineering notice and determined that the response actions were conservative, appropriate, and consistent with the TSR-specified response actions for an inoperable shutdown system. The inspectors also noted that the plant staff had deferred the once-every-five-year preventive maintenance for the bieaker. At the time of the failure to operate, the breaker had exceeded the preventive maintenance period by approximately two months.

On August 21, the plant staff attempted a planned shut down of Unit 3, Cell 7 in Building C-331. During the shutdown activities, one of the two cell Mas failed to operate ,

on demand. As a result, the plant staff used an attemate means to shut down the cell '

L and the PSS declared the cell shutdown system inoperable. During a review of this

,4 activity, the inspectors determined that the once every five-year preventive maintenance for the breakers had been deferred beyond the five-year limit. At the time of the failure l 7

to operate, the breaker had exceeded the preventive maintenance period by approximately 5 months.-

During review of the two failures of MB breakers to operate on demand, the inspectors also identified that the plant staff had approved a deferral for preventive maintenance on an ACB breaker associated with Building C-333. The deferral was processed two months after the preventive maintenance was due and extended the maintenance period to five years and nine months. Subsequent to the deferral request, the plant staff shut down the cell as a part of the summer outage.

The inspectors reviewed the TSRs, Safety Analysis Report (SAR), and plant procedures associated with operation and maintenance of the safety-related breakers in order to assess the plant staff's methods for ensuring the operability and the reliability of the cascade breakers. The inspectors noted that the TSRs required the cascade breakers to be operable and defined actions to be taken when specific conditions were present which would affect operability. The TSRs also included a requirement to test the cell shutdown system, which included the breakers, whenever a cell was shutdown in a planned manner. However, the TSRs did not specify a periodicity for the testing.

Instead, the inspectors noted that the TSRs referenced SAR Section 4.3.2.1.1, which included an assumption that: " Reliability of the manual shutdown system is verified through manual shutdown of each cell within a five-year period. It is estimated that all cells will be shut down at least one time within this time frame. Cell shutdowns are normally accomplished from the ACR [ Area Control Room)."

Given the SAR assumption, the inspectors discussed the time intervals between cell shutdowns with operations and maintenance staff. During the discussions, the inspectors were informed that the cell shutdown system for all operating cells had been tested within the past 5 years. However, the inspectors were also informed that preventive maintenance may not have been performed on some of the breakers within the past five years. Discussions with some of the plant power operations staff indicated that prior to the NRC assumption of regulatory authority, the plant staff shut down cascade cells for only two purposes; because of problems with the cells or to perform preventive maintenance on the breakers. Therefore, the periodicity with which cells were shut down and the cell shutdown system was verified functional appeared to have been determined by the preventive maintenance frequency for the breakers. The inspectors also noted that the periodic operation of the cell shutdown system would only demonstrate functionality of the system at the time of the shutdown. Reliability of the system between testing could only be assured through timely preventive maintenance of the system. l The inspectors reviewed the deferral bases developed for each of the two MBs that failed to operate and for the ACB. The inspectors noted that the deferral paperwork was inconsistent, in that, the ACB assessment determined that deferring the maintenance decreased the breaker's reliability; while the two MB deferrals determined that the action would have no effect on the breaker. The inspector's also noted that none of the deferrals assessed how the lengthened schedule would impact the grease used to lubricate the breakers. Finally, the inspectors determined that the plant staff had not implemented a method to track and coordinate the periodicity of the TSR surveillances, which demonstrated operability, with the preventive maintenance, which ensured reliability and operability of the breakers for the five-year surveillance period.

8

The inspectors discussed the findings with plant operations, maintenance, and engineering management. The inspectors were informed that the missed five-year preventive maintenance on the ACB was due, in part, to an error in the date recorded in a data based used to track the activity. However, the inspectors noted that the operations and maintenance staff had failed to implement a work order written in February 1997 for the preventive maintenance. In addition, the operations staff had failed to ensure that the preventive maintenance was performed when the cell was shut down on three separate occasions during 1998 and early 1999. The plant staff indicated that the MB performance failures were not typical of the historical data. The 3 inspectors were also informed that plant management was taking actions to ensure that l all safety-related breakers had received preventive maintenance within the last five '

years, including revisions to the tracking processes used to correlate the TSR surveillances and the preventive maintenance schedules for ACBs, and MBs.

During the discussions with the engineering staff, the inspectors noted that the ,

Boundary Definition Manual definition cf the cell shutdown system did not include the l cell ACB or MBs. Instead, the cell shutdown system quality boundary stopped at the breaker trip coil. The inspectors noted that the system boundary definition appeared to be inconsistent with ensuring the ability of the breaker to perform its intended safety 4 function. I

\

Condition 8 of the Certificate of Compliance, requires the certificatee to perform activities in accordance with the SAR. The SAR required the plant staff to ensure the reliability of the cell shutdown system through a manual shutdown of the system at least once every five years. Historically, this process, a manual shutdown of the cascade cells once every five years, included the performance of preventive maintenance on the cell breakers as a part of the cell shutdown tasks necessary to ensure system reliability.

Plant Procedure CP2-EG-EG1030, " Preventive Maintenance Program," defined preventive maintenance as an activity conducted for the purpose of increasing the

{

j reliability of equipment and required the plant staff to complete the preventive maintenance or to process a deferrel within the specified maintenance time period. The failure to perform preventative maintenance on or to develop a technical basis for extending the five-year preventive maintenance frequency for the Building C-333, Unit 3, Cell 10 ACB was a violation of minor safety significance and is not subject to formal enforcement action.

The plant staff's corrective actions to resolve differences in the tracking and scheduling of TSR surveillances, which demonstrate operability, and preventive maintenance, which ensures reliability, and their action to correct the apparent inconsistencies in the Boundary Definition Manual will be tracked as an inspector Followup Item (IFl 70-7001/99010-01).

c. Conclusions The inspectors determined that the plant staff's methods for tracking and performing the Technical Safety Requirement once-every-five-year cell shutdowns, required to demonstrate operability, and the related cell breaker preventive maintenance, necessary to ensure reliability of the breakers, were not sufficiently integrated to prevent the untimely performance of the preventive maintenance. As a result, preventive maintenance was not perform within the expected five year frequency for one breaker 9 l

E and delayed preventive maintenance for two breakers appeared to contribute to the breakers failure to trip during planned shutdowns.

II. Engineering E1 Conduct of Engineering E1.1 Buildina C-710 Criticality Accident Alarm System Chance

a. Insoection Scope (88100. 88020)

The inspectors reviewed a change made to the Building C-710 CAAS in response to I problems identified during a routine surveillance. I

b. Observations and Findinas On Ju!y 26, during routine testing of the Building C-710 CAAS, the plant staff noted that one of the system alarm lamps, located in Building C-300, did not illuminate.

Subsequent to the failure, the plant staff replaced the lamp, and retumed the system to service. On July 27, during a review of the circumstances of the lamp failure, the system engineering staff discovered an anomaly in the alarm circuitry for the Building C-710 CAAS. Specifically, the engineering staff identified that a voltage dropping resistor in the Building C-300 alarm circuit was undersized (0.5 watts versus 3.0 watts). Because the unsized resistor created a potential for the alarm circuit to malfunction during an actual criticality event, the PSS declared the system inoperable pending replacement of the resistors. The resistors were replaced with 3.0 watt components and the system was later declared operable following appropriate testing.

During and following the activities completed to authorize a change in the installed resistor rating, the inspectors monitored the plant staff's activities. The inspectors noted that the PSS's actions were appropriately conservative since the testing conducted 4 shortly after the issue was identified indicated that the alarm lamps would light with the  !

undersized resistor installed. The inspectors also noted that the engineering staff replaced the resistors in an expedited manner, in part, as a result of determining that the i changed rating for the resistors did not constitute a design change for the system.

Following management's approval of the engineering documentation used to replaced the resistors, the inspectors reviewed the materials. The inspectors noted that the

, engineering staff did not classify the circuitry change as a modification. Therefore, the change did not receive the same reviews and approvals as the original design package.

Instead, the engineering staff described the change as a "non-intent

• change. The staff indicated that a non-intent change was a revision to an original design that was consistent with the original design requirements, did not alter the design input criteria, did not change the approved method of reconciling the design input criteria with the design outputs, and did not alter the assumptions or results of the approved plant change review or safety evaluation.

The inspectors reviewed the engineering change notice (ECN), ECN-1999-0504, which documented the engineering staff's technical and regulatory bases for determining that the change was not a modification. The inspectors noted that the ECN stated that the change would bring the installed circuit into compliance with the design requirements 10

and was consistent with the original input design criteria. However, the inspectors noted that the ECN did not identify how that conclusion was reached. Specifically, the ECN did not reference or specify the original input design criteria or the original circuit design requirements that were not met by installation of the lower power-rated resistors. The inspectors noted that the ECN did include a calculation, using basic engineering principles, that demonstrated that the resistor needed to have a minimum power rating of approximately 1.7 watts.

After further independent review of the currently installed CAAS alarm systems for other portions of the site, the inspectors determined that installation of the 0.5 watt resistor was inconsistent with the currently installed systems. Specifically, the installed systems for all other areas of the plant used a 3.0 watt resistor. Also, the plant drawings for all of the other installed systems indicated that the same resistors were rated at 3.0 watts.

The inspectors also noted that the design package that originally installed the 0.5 watt resistors did not include calculations for sizing the resistors. Further, the plant staff were not aware of any plant documentation which provided calculations for the resistors used as a part of the CAAS initially installed in the building. Therefore, the engineering staffs assessment that the change was consistent with the original design inputs did not appear to be well supported, except through a walkdown of the currently installed components.

The inspectors discussed the findings with engineering management. The management acknowledged the inspectors identified weaknesses in the ECN documentation. The inspectors also noted that the engineering staffs classification of the resSor change as a non-modification appeM's be correct.

c. Conclusions The inspectors determined that the plant staffs change of resistors installed in a safety-related criticality accident alarm system corrected an undocumented error in the design outputs for a previous modification of the system. Although the errant design output specification was clearly inconsistent with the original system design and basic engineering principles; the inspectors determined that the engineering change notice included insufficient information to independently substantiate the technical and regulatory basis for the change.

E1.2 Buildina C-746Q Criticality Accident Alarm System Modification

a. Inspection Scooe (88100. 88020)

The inspectors reviewed the plant staffs installation of a new CAAS for Building C-746Q.

b. Observations and Findinas On August 21, during installation and testing of a new CAAS being installed in Building C-746Q, the system engineering staff identified that the system homs would not sound within 0.5 seconds of the CAAS detecting a simulated criticality event. At the l time of the observation, the old CAAS was still installed and operational; therefore, no specific response actions were required based upon the delayed horn sounding.

11

In researching possible causes for the delayed sounding of the CAAS horns, the system engineering staff identified an apparent generic problem with the response time of the 30 watt homs included in the new system. Specifically, the engineering staff believed that the hom's dual attemating and direct current capabilities caused a delay in the homs response capability. The engineering staff tentatively confirmed their hypothesis by reviewing the performance of other horns that did not have the dual current capabilities.

As a result of the problems identified with the horns for Building C-7460, the system engineering staff questioned the operability of the Building C-710 CAAS. The Building C-710 CAAS utilized similar dual current horns for a portion of the system's capability. To determine if the system was able to meet the 0.5 second response

. requirement, the system engineering staff reviewed the post-installation testing j conducted on the system. During their review of the testing data, the system engineering staff concluded that the previous post-installation testing did not include a response timing test of the dual current homs. Based upon an absence of post-installation test data for the dual current homs in Building C-710, the PSS declared the system inoperable and initiated the TSR-required Action Statements. In addition, the PSS limited cascade operational changes in an effort to preclude the occurrence of conditions which may require the staff to use the Building C-710 laboratories to conduct assay analyses.

During discussions with the inspectors, the plant management indicated a possible need for enforcement discretion to allow some plant operations to continue while the horn response time problems were resolved. Concurrent with these discussions., the plant staff initiated testing of the Building C-710 dual current horns to determins the appropriate response timss for the homs. The testing results demonstrated that all of the Building C-710 dual current horns responded within approximately 2.0 seconds.

In consideration of the test results, the plant staff analyzed the potential impacts from a delay response by the affected personnel. The analysis concluded that a delay of 1.5  ;

seconds in the response of personnel to a criticality event would not change the radio-biological consequences of the event since, in part, the incremental dose increase was less than one percent of the expected exposure of an individual within thirty feet of the event. Based on these analyses, the plant management processed a change to the SAR which revised the response time of the homs to two seconds. The NRC's Office of i Nuclear Materials Safety and Safeguards was reviewing this analysis as of the end date of this inspection to determine if the change constituted an unreviewed safety question. ,

Following the Plant Operations Review Committee and plant management's approval of the changed acceptance criteria for the CAAS horns, the plant staff exited the TSR Limiting Conditions for Operations Action Statements for Building C-710.

Given the several deficiencies noted with this design change, namely the apparent

' inadequate post-installation testing of the Building C-710 CAAS horns; the problems identified with the specification of design outputs for the same system, as discussed in Section E1.1 of this report; and past problems with the same design modification, as described in 1998 and 1999 NRC inspection reports; the inspectors discussed with engineering management the process used to develop and control this design change.

During these discussions, the engineering manager concurred with the inspectors' 12

observations and noted that this design change was conducted by an outside vendor.

As a result, the engineering manager planned to perform an independent review of the remaining facets of the vendor's design work. In addition, the engineering maneger planned to perform a root cause evaluation of the condition to determine which aspects of the design development, installation, and testing processes failed to ensure that the design could meet the specified codes and standards.

The inspectors' review of plant management's independent evaluation of the remaining facets of the design work and their root cause evaluation of the conditions which led to problems encountered with the design, installation, and testing of the rr afified Building C-710 CAAS, will be tracked as an Unresolved item (URI 70-7001/990iO-02).

c. Conclusions The inspectors determined that the engineering staff's response to anomalous installation testing results were appropriate and correctly identified a similar issue with an in-service criticality accident alarm system. The inspectors will track the plant staff's further assessment of the root causes for and extent of the observed conditions as an Unresolved item.

V. Plant Suppp_r1 R1.1 Radiation Protection Trainina for Contractors

a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding and corrective actions for an identification by plant staff that certain contractor employees working in restricted areas or on jobs involving potential exposure to radioactive materials had not completed the appropriate radiation protection training.

b. Observations and Findinas Title 10 of the Code of Federal Regulations, Part 19.12 (10 CFR 19.12) and the SAR required that appropriate training on the hazards and means to protect oneself shall be provided to radiation workers or individuals working in restricted or radiological areas. In June 1999, the plant staff identificci that certain contractor personnel, working in l radiological areas, had not received radiation protection training (General Employee j Radiological Training, RacCological Worker l Training, or Radiological Worker ll l Training) applicable to their area of work. In following up on the issue, the plant staff identified that certain plant staff had also not received the appropriate training and that there was confusion on the part of the plant staff as to which individuals needed training, what type of training, and how soon after the start of employment that training was to be i obtained. Plant procedures appeared to allow plant staff or contractor employees, who I were not trained to the proper level, to be escorted by a trained employee. However, i the procedures did not provide a limit as to how long an untrained individual, that j routinely worked in radiological areas, could be escorted. As a result, certain individuals were working in restricted areas or contaminated areas without the appropriate training I for those areas, and the plant staff identified that this practice was contributing to health I physics errors in the process buildings.

l 13 j

In response to the identification of a general uncertainty on radiation protection training requirements, the plant staff declared the issue to be a significant condition adverse to j quality. The plant staff identified and trained individuals who had not received the I appropriate initial or periodic training for the radiological areas. The plant staff developed a root cause assessment and also corrective actions for the findings. The corrective actions included the development of a requirement to ensure any new employee would be trained for the type of radiological area he or she might work in by the end of the first work week, and clarified that individuals routinely working in such l areas could not be escorted indefinitely. In addition, the plant staff indicated that )

increased management focus would be placed on appropriate implementation of training by oversight of field activities. The plant staff also undertook a program to develop a database for tracking contractor training requirements as opposed to tracking contractor ,

training by paper. This approach would eliminate the potential inconsistency between contractor training and that provided to the plant staff by providing a more reliable and accurate means of tracking the training requirements and the training provided from the initial start of work. As a result of the prompt followup by plant staff, this non-repetitive, certificatee-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/99010-03), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

c. Conclusions The plant staff identified and appropriately corrected an inadequacy in the radiation protection training process which allowed certain individuals to routinely work in radiological areas, under escort, but without the appropriate training on the radiological ,

hazards and means to protect themselves.

S1 Conduct of Security Activities S1.1 Classified Matter Found Outside of Controlled Access Area

a. Inspection Scope (88100)

The inspectors reviewed the plant staff's corrective actions and participated in further NRC evaluations of a situation involving the identification of unmarked documents containing classified information that were located outside the plant controlled access area (CAA). The issue previously was identified as Unrossived item (URI) 70-7001/99008-01 in NRC Inspection Report 70-7001/99008.

b. Observations and Findinas During a review of historical environmental and safety documents stored in Building C-743 as part of an ongoing lawsuit, the plant staff discovered that an unmarked letter written in 1956 contained classliied information. The documents, including intemal memoranda, environmental data, and letters with safety information, were not expected to contain classified matter based on the nature of the titles and general content. The letter appeared to pre-date the current classification scheme for the gaseous diffusion technology. The letter had not been referenced in a number of years. Because the letter and other documents subsequently identified in the notebooks were not marked, the classified nature of the information was not readily apparent, nor was it the primary focus. As a result, the plant staff concluded that an actual 14

i compromise was not likely and could not be confirmed. The inspectors considered the -

conclusion reasonable.

The plant staff took appropriate interim and long-term corrective actions to reduce the likelihood that an actual compromise of classified matter might occur. In response to I the Jscovery, the plant staff apptopriately marked and secured the letter. In additbn, the plani staff secured, in a classified repository, the other associated documents and

, notebooks which were located in Building C-743. A subsequent classification review of I

the documents identified additional examples of classified information. The inspectors reviewed each of the subsequent documents determined to contain classified information and independently determined that the classification assessment was l consistent with current regulatory guidance. The plant staff also brought l Building C-743, which could be transferred into or out of the CAA, within the CAA on a full-time bast. In addition, the plant staff developed a separate modification to bring other trailes in t' ne same area that were used for training into the CAA as well. This mod %::2 ion weJ under review as of the end date of the inspection.

Title 10 of the Code of Federal Regulations, Part 95, requires, in part, that the certificatee property mark and store classified information in a classified repository, consistent with the level of classification of the information. As a result of the NRC's review, the certificatee's prompt and comprehensive corrective actions, and the minimal potential for compromise of the unmarked documents, this certificatee-identified and corrected violation is being treated as a Ncn-Cited Violation (NCV 70-7001/99010-04),

consistent with Section Vll.B.1 of the NRC Enforcement Policy and Unresolved item 70-7001/99008-01 is considered closed.

c. Conclusion An Unresolved item, opened in NRC Inspection Report 70-7001/99008, conceming the discovery of unmarked documents containing classified matter in Building C-743 was closed as a Non-Cited Violation based upon the certificatee's prompt and comprehensive corrective actions and the minimal potential for an actual compromise of 1 the information. i S1.2 Comoromise of Classified Matter Durina Ftah Meetina

a. Inspection Scope (88100)

The inspectors reviewed the circumstances surrounding a potential compromise of  ;

classified matter during a staff meeting. j

b. Observations and Findinas During the inspection, the plant staff held a staff meeting which included a brief discussion of information classified as Confidential Restricted Data. The plant staff present at the meeting included one uncleared individual. The individual recently had been hired and was awaiting the approval of his security clearance. The classified information was discussed as part of another issue and the meeting continued to its conclusion without drawing attention to the classified information. After the meeting, some of the plant staff present realized that classified information had been discussed l

and notified the security staff and the PSS that a potential compromise of classified 15 L

7-i information had occurred. The PSS subsequently logged the event in accordance with applicable requirements and informed the inspectors of the event.

The next day a classified briefing was held with the cleared staff mambers present during the meeting to discuss the incident and idemify how conversations with potential classified concerns should be handled. The plant staff indicated that rather than attempt to talk around classified matter, any uncleared individuals present should be asked to leave the room when such conversations were required. in addition, the plant security staff developed a bulletin discussing the event and reiterating the requirement to ensure classified conversations took place only in secure areas and with appropriately cleared individuals.

Subsequent to the meeting, the uncleared individual that was present at the meeting received his clearance. During the plant management's initial briefing of the newly cleared individual of their responsibilities for the protection of classified information, the previous discussion of classified information was reviewed. The newly cleared staff member was informed of the classified aspects of the previous discussion and that the information was not further discussed. Thus, the plant staff concluded that an actual compromise of classified information had not occurred because the information was discussed in front of an uncleared individual who shortly thereafter received his security clearance.

As a result of the prompt followup by plant staff, this non-repetitive, certificatee-identified and corrected violation is being treated as a Non-Cited Violation (NCV 70-7001/99010-05), consistent with Section Vll.B.1 of the NRC Enforcement Policy.

c. Conclusion The plant staff identified that a classified conversation had occurred in a meeting with an uncleared individual present. The failure to properly safeguard classified matter was considered as a Non-Cited Violation based upon the certificatee's prompt and comprehensive corrective actions and the subsequent clearance of the individual which minimized the consequences of the event.

S1.3 Site Access Control

a. Inspection Scope (88100)

The inspectors reviewed the plant staff's implementation of site access controls designed to ensure that individuals allowed unescorted access to the plant had completed applicable site-specific training requirements.

b. Observations and Findinos During the inspection perica, the inspectors noted numerous examples of NRC Regional and Headquarters personnel being allowed access to the Controlled Access Area of the plant without the plant security staff ensuring that the personnel had received the proper site-specific training. The hspectors determined that in some cases, the NRC personnel had not received site-specific training, while, in other cases, the NRC personnel had expired General Employee Training cards. In a few cases, the NRC personnel had received site-specific training at the Portsmouth Plant; however, the 16

i l

Paducah plant staff had previously determined that the site-specific training between the two sites was not entirely transferrable.

As each example of the apparent inappropriate access was identified, the inspectors discussed the events with the site security management. The site security management concurred with the inspectors observations and took prompt actions to address the individual events. In addition, the plant security management initiated a detailed review of the processes to determine the root causes for the events and to identify the appropriate corrective actions to prevent recurrence of the events. The inspectors noted, based upon a brief review of past non-conformance reports, that similar access control problems have occurred involving both NRC and non-NRC personnel.

Technical Safety Requirement 3.9.1. requires that written procedures shall be implemented for activities described in Section 6.11, Appendix A of the Safety Analysis Report. Section 6.11, Appendix A of the Safety Analysis Report describes security and visitor control as an activity to be performed in accordance with written procedures.

Procedure CP4-SS-SP2200, " Access Control," Revision 4, Steps 8.3.6 and 8.4.1, required, in part, that personnel granted unescorted access to the controlled access area shall have received general employee or site-specific training and possess a valid general employee training (GET) card. The failure to ensure, during the inspection period, that all personnel entering the plant controlled access area had received general  ;

employee or site-specific training and possessed a valid general employee training card is a Violation (VIO 70-7001/99010-06).

1

c. Conclusions l The inspectors identified a procedural violation, in that, the plant staff did not ensure that all individuals allowed access to the plant site, had completed the required site-specific training requirements or possessed the proper training documentation.

S8 Miscellaneous Security lasues S8.1 Certificatge Security Reoorts (90712)

The certificates made the following security-related 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> reports pursuant to 10 CFR 95 during the inspection period. The inspectors reviewed any immediate security concems associated with the reports at the time of the initial verbal notification.

D.a.tg T_it!g 7/23/99 Unmarked Confidential Restricted Data stored outside the Controlled Access Area.

8/16/99 Blueprints dated 1951 and 1961 found containing Confidential Restricted Data but not marked CRD.

8/16/99 Two documents dated 1955-1959 found containing Confidential Restricted Data but not marked CRD.

17

8/24/90 Document dated from 1959 found in C-710 vault containing Confidential Riistricted Data but not marked CRD.

V. Manaaement Meetinas X1 Exit Meeting Summary The inspectors presented the inspection results to members of the plant staff and management at the conclusion of the inspection on September 7,1999. The plant staff acknowledged the findings presented. The inspectors asked the plant staff whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

I

)

1 i

18 e

f '. -

9 s4 PARTIAL LIST OF PERSONS CONTACTED i

United States Denartment of Enerav

~ G. A. Bazzell, Site Safety Representative United States Enrichment Corooration

• M. A. Buckner, Operations Manager

• L. L. Jackson, Nuclear Regulatory Affairs Manager

• J. A. Labarraque, Safety, Safeguards and Quality Manager

• S R. Penrod, Enrichment Plant Manager

• H. Pulley, General Manager U.S. Nuclear Reaulatory Commission

• J. M. Jacobson, Resident inspector

• K. G. O'Brien, Senior Resident inspector

• Denotes those present at the exit meeting September 7,1999.

Other members of the plant staff were also contacted during the inspection period.

INSPECTION PROCEDURES USED l lP 88020: Nuclear Criticality Safety IP 88100: Plant Operations l IP 88102 Surveillance Observations

~ IP 88103- Maintenance Observations IP 90712: In-office Review of Events l

19

4 ITEMS OPENED, CLOSED, AND DISCUSSED Coened 70-7001/99010-01 IFl Corrective actions to resolve differences in the tracking and scheduling of Technical Safety Requirement surveillances and associated preventive maintenance activities 70-7001/99010-02 URI Rev.aw of independent evaluation of the design work completed for Building C-710 and root causes for the conditions which led to th? problems with design, installation and testing of the Building C-710 criticality accident alarm system modification 70-7001/99010-06 VIO Failure to conduct access control activities in accordance with approved procedures Closed 70-7001/99010-03 NCV Inadequate radiological training of contractor personnel allowed escorted access to radiolgical areas 70-7001/99010-04 NCV Failure to properly mark and control matter containing classified matter that was previously stored outside the controlled access area '

70-7001/99008-01 URI Failure to properly mark and control matter containing classified matter that was previously stored outside the controlled access area 70-7001/99010-05 NCV Discussion of classified information in the presence of an uncleared individual Discussed l None l

l i

l 4

20

4 LIST OF ACRONYMS USED ACB Air Cooled Breaker ACR -Area Control Room AS Action Statement ATR Assessment and Tracking Report CAA Controlled Access Area CAAS Criticality Accident Alarm System CFR Code of Federal Regulations CRD Confidential Restricted Data DNMS Division af Nuclear Materials Safety ECN Engineering Change Notice GET General Employee Training IFl inspector Followup Item IP Inspection Procedure LCO Limiting Condition for Operation MB Motor Breaker MW Megawatt NCS Nuclear Criticality Safety NCSA Nuclear Criticality Safety Approval NCV Non-Cited Violation NRC Nuclear Regulatory Commission PDR Public Document Room PSS Plant Shift Superintendent SAR Safety Analysis Report TSR Technical Safety Requirement URI Unresolved item USEC United States Enrichment Corporation 21