EA-97-442 - Westinghouse Electric Corporation

 January 6, 1998  
 EA 97-442 
 Westinghouse Electric Corporation 
 Commercial Nuclear Fuel Division 
 ATTN: Mr. J. B. Allen, Columbia Plant Manager 
 P.O. Drawer R 
 Columbia, SC 29250 
SUBJECT:  NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL
          PENALTY - $13,750 
          (NRC INSPECTION REPORT NO. 70-1151/97-205) 
 
 Dear Mr. Allen: 
 This refers to the criticality safety inspection conducted on August 25 - 29, 1997, at the Westinghouse Commercial Nuclear Fuel Division facility in Columbia, South Carolina, to review the circumstances surrounding the June 23 and August 25, 1997, loss of criticality control events. The findings of this inspection were discussed with yourself and members of your staff during two exit meetings, the last of which was held on September 22, 1997. The inspection report documenting the issues was sent to you by letter dated October 2, 1997, and the pre-decisional enforcement conference was conducted at NRC Headquarters on October 29, 1997. 
 Based on the information developed during the inspection, and the information that you provided during the conference and in your November 6, 1997, letter, NRC has determined that violations of NRC requirements occurred. These issues are cited in the enclosed Notice of Violation and Proposed Imposition of Civil Penalty (Notice), and the circumstances surrounding them are described in detail in the subject inspection report. 
 On June 23, 1997, Westinghouse Columbia Plant staff identified that the volume control assumed by the Line 1 granulator hopper criticality safety analysis (CSA) had not been established. By early August, discussions between NRC and your staff indicated that the corrective actions and recommendations identified by your Root Cause Analysis (RCA) Team had not yet been completed. During the NRC inspection to review the RCA and determine whether appropriate corrective actions had been implemented in a timely manner, a second case was identified by your staff on August 25, 1997, involving the failure to establish a volume control assumed in a CSA. The NRC inspection subsequently revealed significant weaknesses with the implementation of your Nuclear Criticality Safety (NCS) Program. Based on the results of this inspection, six violations were identified. 
 Collectively, the violations demonstrate that Westinghouse failed to implement a comprehensive program to ensure that plant operations involving the processing of special nuclear material (SNM) were conducted in accordance with the safety requirements specified in the renewed license. NRC intervention was necessary to identify the scope and magnitude of the problems and to assure that appropriate corrective actions were taken to establish that the as-exists plant conditions regarding engineered controls matched the plant safety basis. The various audit, surveillance, and self-assessment programs implemented by Westinghouse were ineffective in identifying these problems. Prior notice of this failure was documented in NRC Inspection Report No. 70-1151/96-204 which raised several issues involving the performance of your self-assessment program and noted in the cover letter that "no mechanism was developed to assure that specific license requirements were being implemented in accordance with management's expectations." 
 Briefly, the violations that are the subject of this proposed enforcement action, involved the failure to: (1) conduct adequate incident investigations, identify root causes, and take timely corrective actions; (2) conduct adequate criticality safety evaluations; (3) functionally verify that installed safety controls matched the design documents; (4) update criticality safety evaluations following changes; (5) control criticality safety evaluation records; and (6) develop or implement various NCS procedures and policies that cover certain license conditions, including notification requirements. These violations are significant because they substantially degraded the approved processes in the license used to establish and maintain the safety program for processing SNM and are indicative of a significant lack of attention or carelessness towards licensed responsibilities. Therefore, these violations are classified in the aggregate in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600, as a Severity Level III problem. 
 At the October 1997 pre-decisional conference, you generally acknowledged the occurrence of the violations, with the exception of Violation 1.c, and disagreed with one of the potential violations. You stated that the programmatic root causes relevant to the two incidents were: (1) Regulatory Engineering activities were not implemented in a disciplined, timely, and well-documented manner; (2) the issues were not identified in a timely manner by the Columbia Fuel Fabrication Facility (CFFF) self-assessment process; and (3) management oversight and review activities did not elevate these issues to produce corrective actions on a programmatic basis. Additionally, you provided your perspective on the safety significance of the two incidents, asserting that "Double Contingency Protection (DCP), in reality , [existed] at all times." NRC does not agree with your perspective on the safety significance of the two events. While it was fortuitous that the actual safety margin could be demonstrated after the fact, your licensing basis requires the identification, establishment, and maintenance of appropriate safety controls prior to and during the processing of SNM. 
 At the enforcement conference, you disagreed with Violation 1.c on the basis, among other things, that your criticality engineers confirmed and verified that the components could be operated safely. However, following the conference, you could not find a documented review or technical verification. A judgement call by criticality engineers is not an acceptable substitute for completing the formal safety evaluation and review process required by your license. Regarding the seventh potential violation identified in the subject inspection report and discussed during the conference, after considering the exercise of reasonable engineering judgment on the part of your staff, NRC has determined that the granulator hopper event was adequately reported. Therefore, this example has not been included in the enclosed Notice. The second example of the potential violation also is not included in the Notice because we have determined that an example cited in the Violation 6 already encompasses this issue. 
 In accordance with the Enforcement Policy, a base civil penalty in the amount of $13,750 is considered for a Severity Level III problem. Because your facility has been the subject of an escalated enforcement action within the last 2 years, (1) NRC considered whether credit was warranted for Identification and Corrective action in accordance with the civil penalty assessment process in Section VI.B.2 of the Enforcement Policy. No credit was given for identification of the violations because they were identified by NRC as a result of the inspection into the adequacy and timeliness of your corrective actions for the June 1997 event. As to the factor of Corrective action , credit was warranted because your immediate corrective actions and plans for long-term actions, once the violations were identified by NRC, were considered prompt and comprehensive. These actions included: (1) the August 29, 1997, shutdown of the pellet processing area; (2) the conduct of a comprehensive investigation and root cause analysis for each event; (3) establishment of a Regulatory Process Review Team to initially focus on the nuclear criticality safety process; (4) implementation of procedure revisions and personnel training; (5) initiation of an ongoing facility-wide field verification to demonstrate that the as-built or installed equipment conforms to the safety documentation; (6) verification that the documentation conforms to the analyses; (7) increased pace for conducting Process Hazards Analyses for remaining systems; and (8) specific commitments to increase management oversight and control. Finally, due to the scope and complexity of the identified issues, you committed to providing a finalized plan and schedule for lasting corrective actions by December 15, 1997. Therefore, to emphasize the importance of maintaining a comprehensive program to assure that SNM operations are conducted in accordance with NRC safety requirements, I have been authorized, after consultation with the Director, Office of Enforcement, to issue the enclosed Notice of Violation and Proposed Imposition of Civil Penalty in the amount of $13,750. 
 You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. Additionally, NRC continues to be concerned that inadequate management attention has been directed toward ensuring that an appropriate level of communications with NRC is established and maintained by your staff. Specifically, during the pre-decisional enforcement conference, it was noted that NRC representatives, who were onsite at the time of the discovery that two fuel rods had been inadvertently shipped to a foreign plant, were not informed of the event. Then, again in August 1997, plant personnel did not inform NRC inspectors, who were onsite at the time, of the moisture drop-out tank event until 2 days after the system was restarted. Your response also should address actions taken or planned to address this concern. NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements. 
 In accordance with 10 CFR 2.790 of NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be placed in the NRC Public Document Room. 
                              Sincerely, 


                              Elizabeth Q. Ten Eyck, Director 
                              Division of Fuel Cycle Safety
                                and Safeguards, NMSS
 
 Docket No. 70-1151 
 License No. SNM-1107 
 Enclosure: Notice of Violation 
 
 
 
 NOTICE OF VIOLATION
 AND
 PROPOSED IMPOSITION OF CIVIL PENALTY  Westinghouse                                                Docket No.  70-1151
Commercial Nuclear Fuel Division                            License No. SNM-1107
Columbia, South Carolina                                    EA 97-442
 
 During an NRC inspection conducted on August 25-29, 1997, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below: 
Condition S-1 of Special Nuclear Materials License No. SNM-1107, Authorized Use, requires use of licensed materials in accordance with statements, representations, and conditions in the License Application dated April 30, 1995 (License Application), and supplements dated May 11, May 18, August 4, August 25, and September 25, 1995; and July 25 and August 11, 1997. 
1. Section 3.7 of the License Application, Incident Investigations, states, "At the Columbia Fuel Fabrication Facility (CFFF), the organizational structure... and procedures... will provide for: systematic investigation of abnormal events; making decisions on corrective measures to prevent recurrence of such events; and, follow-up on the implementation of preventive measures. Further, CFFF will have in place a structured methodology for determining and categorizing the root cause(s) of the failure(s) that led to investigated events." 
 Contrary to the above, the licensee failed to conduct adequate incident investigation and followup actions, as evidenced by the following: 
 a. As of August 29, 1997, the licensee failed to adequately determine and categorize the root cause(s) of the failure(s) that led to the June 22, 1997, loss of volume control for the Line 1 granulator hopper. Specifically, the root cause analysis focused narrowly on the material accumulation in the hopper and did not address the broader problems of the loss of volume control (i.e., did not address the reason the Criticality Safety Evaluation assumed a favorable volume when the "as-built" configuration was a non-favorable volume), system restart authorization after exceeding a defined mass control limit without approval by the Nuclear Criticality Safety (NCS) group, and the failure of the Criticality Safety Evaluation (CSE) to meet the technical requirements specified in Section 6.0 of the License Application. 
 b. As of August 29, 1997, the licensee had not followed up on the implementation of preventive measures for the June 22, 1997, loss of volume control for the Line 1 granulator hopper. Specifically, the recommendations of the Root Cause Analysis Team, which was formed to review this safety significant event, had not been reviewed or approved by site management [the organizational structure]. 
 c. On August 25, 1997, the licensee experienced a safety significant event involving the loss of a criticality control for the pellet area ventilation moisture drop-out tanks in that the tanks were erroneously assumed to have been favorable geometry (and no other controls were identified in the existing CSE), and no root cause analysis was initiated prior to the restart of the system on August 26, 1997. (01013) 
 
2. Section 6.2.1 of the License Application, General Control Program Practices, requires, in part, that "For each significant portion of the process, a defense of one or more system parameters will be employed and documented within the Criticality Safety Evaluation (CSE).... CSEs are utilized to identify the specific controls necessary for the safe and effective operation of a process. Nuclear Criticality Safety controls will be incorporated into the process design criteria documentation." 
 Section 6.4.3(e) of the License Application, Technical Review, requires, in part, that an independent technical review be performed for criticality safety assessments, criticality safety evaluations, or calculations in support of limits specified in CSAs (Criticality Safety Approvals) or CSEs by a qualified reviewer. 
 Contrary to the above, the licensee failed to conduct an adequate criticality safety evaluation and technical review for each significant portion of a process to identify the specific controls necessary to assure safe operation, and incorporate those controls into the process design criteria, as evidenced by the following: 
 a. On June 23, 1997, it was discovered that the granulator hopper CSE performed in 1996 developed criticality safety controls based on assumed favorable volume, reportedly in documents that could not be located, when the actual hopper volume was 43 liters, which is unfavorable. Both the original evaluation and the independent technical review failed to identify that the dimensions on the system print [process design criteria] did not match the dimensions necessary to assure favorable volume for this significant portion of the process. 
 b. On August 26, 1997, it was discovered that the Pellet Area Ventilation System CSE, conducted for a 1993 modification, developed controls based on an assumed criticality favorable volume of less than 5 gallons, when the actual volume was 20 gallons, which is unfavorable. Both the original evaluation and the independent technical review failed to identify that the dimensions on the system print [process design criteria] did not match the dimensions necessary to assure favorable volume for this significant portion of the process. (01023) 
 
3. Section 6.2.1 of the License Application, General Control Program Practices, requires, in part, that prior to use in any process, controls necessary for the safe operation of a process will undergo a functional verification to assure that the controls selected and installed match the requirements identified in the design criteria. 
 Contrary to the above, the licensee failed to functionally verify that controls necessary for the safe operation of a process were installed to match the requirements identified in the design criteria, as evidenced by the following: 
 a. On June 23, 1997, the licensee determined that the installed granulator hopper was not a favorable volume as assumed in the nuclear criticality safety analysis. Since favorable volume was an analyzed contingency necessary for the safe operation of this system, this constitutes a design requirement that was not functionally verified prior to use. 
 b. On August 26, 1997, the licensee determined that the installed pellet grinder ventilation system moisture drop-out tanks were not favorable volumes as assumed in the nuclear criticality safety analysis. Specifically, the analysis identified the volume as less than 5 gallons, but the actual installed volumes were about 20 gallons each. (01033) 
 
4. Section 6.2.4 of the License Application, Criticality Controlled Safety Parameters, requires that the CSE process will identify the significant parameters affected within a particular system and that all assumptions relating to process/equipment/material theory, function, and operation, including credible upset conditions, will be justified, documented, and independently reviewed. 
 Contrary to the above, the licensee failed to assure that all assumptions relating to process/equipment/material theory, function, and operation, including credible upset conditions are justified, documented, and independently reviewed as evidenced by the following: 
 a. As of August 29, 1997, the Granulator Hopper CSE was not updated following the June 23, 1997, event to reflect the physical changes made to the system and no independent review was conducted. 
 b. As of August 29, 1997, the Pellet Area Ventilation System CSE was not updated to reflect all of the analytical changes and new controls added to the moisture drop-out tanks on August 26, 1997, and no independent review was conducted. 
 c. As of August 29, 1997, the CSEs for the Granulation & Compaction, Pellet Press Area and Sintering Furnace processes did not document or justify the assumptions relating to process/equipment/material theory, function, and operation, including credible upset conditions. (01043) 
 
5. Section 3.8.1 of the License Application, Records, requires, in part, that written procedures will specify the management program for licensed activity records including: (e) Nuclear Criticality Safety Evaluations, Analyses and Methodology Validations. Further, records of nuclear criticality safety analyses are required to be retained for the lifetime of the facility. 
 CA-004, Columbia Plant Records Management Policy, Revision 6, defines policies and procedures that establish records management programs for Columbia plant departments, and assures the implementation of required Quality Assurance records systems. CA-004 was identified by the licensee as the implementation procedure for Section 3.8.1 of the License Application. 
 Contrary to the above: 
 a. As of August 29, 1997, the licensee failed to establish adequate written procedures to specify the management program for licensed activity records involving nuclear criticality safety evaluations and analysis. Specifically, nuclear criticality evaluations, analyses and methodology validations are not listed as examples of Columbia Plant Quality Assurance Records under the program specified in CA-004, the procedure identified by the licensee as addressing the requirements of Section 3.8.1 of the License Application. 
 b. The original Nuclear Safety Analysis for the Pellet Area Grinder Hopper, a nuclear criticality safety analysis, was not maintained for the life of the plant, in that it could not be located during the week of August 25-29, 1997. (01053) 
 
6. Section 6.1.1(b) of the License Application, Facility Procedures - Regulatory Affairs Guidance Procedures, requires, in part, that "Regulatory-Significant procedures define the policies of the Regulatory Component, including nuclear criticality safety, and identify the requirements for implementation of applicable NRC regulations and license conditions." 
 Contrary to the above, as of August 29, 1997, the licensee failed to develop or implement nuclear criticality safety procedures and policies that identify the requirements for implementation of applicable NRC regulations and license conditions, as evidenced by the following examples: 
 a. RA-311, NCS Program Review, provides criteria for performing and documenting program reviews to assess the effectiveness of all components of NCS programs to comply with Section 6.1.2 of the License Application. The scope of the NCS program that is required to be reviewed did not include the following NCS license elements: the Verification Program, the Maintenance Program, methods of criticality safety control, use and implementation of all the controlled parameters defined in the license, and control of criticality safety documentation. 
 b. No procedure covered the development and implementation of passive engineered controls, such as geometry and volume, to assure that they are analyzed and evaluated for fabrication tolerances and dimensional changes that may occur through corrosion, wear, or mechanical distortion. In addition, they did not include provisions for the periodic inspection, if credible conditions exist for changes in dimensions of the equipment that may result in the inability to meet NCS limits, as specified in License Application Section 6.2.4(a). 
 c. RA-305, Evaluations Using the NITAWL-XSDRN-KENO Codes, and no other procedure provided to the inspectors, provided guidance for computer software and hardware configuration control, as specified in License Application Section 6.4.3(d). 
 d. RA-303, Control of Moderating Materials for NCS, nor any other procedure provided to the inspectors, provided guidance for establishing a program to maintain the quality of the outermost moderator barrier and to conduct routine inspections, as specified in License Application Section 6.2.4(c.2). 
 e. RA-304, Criticality Accident Alarm System, did not provide any guidance concerning the suspension of special nuclear material movement within 4 hours following the placement of the alarm system out of service, as specified in License Application Section 6.3.1. 
 f. RA-310, Regulatory Affairs Technical Reviews, did not provide appropriate guidance for conducting independent reviews, as exemplified by no requirement to: 
 1. Verify that the proposed calculational geometry model and configuration adequately represented the system being analyzed, as specified in License Application Section 6.4.3.e; 
 2. Have the NCS Function Manager review and approve the technical review, as specified in License Application Section 6.4.3.e; or 
 3. Verify that the as-built passive controls, such as geometry and volume, matched the design criteria, as specified in License Application Section 6.2.1. 
 
 g. RA-107, Internal Reporting and NRC Notification of Unusual Occurrences, Revision 6, did not address the requirements contained in the Westinghouse letter of 
 August 14, 1996, and approved by NRC letter of October 30, 1996. (01063) 
 
 
 These violations represent a Severity Level III Problem (Supplement VI); Civil Penalty - $13,750. 
 
 Pursuant to the provisions of 10 CFR 2.201, Westinghouse Electric Corporation is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation, (2) the reasons for the violation if admitted, and if denied, the reasons why, (3) the corrective steps that have been taken and the results achieved, (4) the corrective steps that will be taken to avoid further violations, and (5) the date when full compliance will be achieved. Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation. 
 Within the same time as provided for the response required above under 10 CFR 2.201, the Licensee may pay the civil penalty by letter addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, with a check, draft, money order, or electronic transfer payable to the Treasurer of the United States in the amount of the civil penalty proposed above, or the cumulative amount of the civil penalties if more than one civil penalty is proposed, or may protest imposition of the civil penalties, in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the Licensee fail to answer within the time specified, an order imposing the civil penalty will be issued. Should the Licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violation(s) listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty, in whole or in part, such answer may request remission or mitigation of the penalty. 
 In requesting mitigation of the proposed penalty, the factors addressed in Section VI.B.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing civil penalty. 
 Upon failure to pay any civil penalty due which subsequently has been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234(c) of the Act, 42 U.S.C. 2282c. 
 The response noted above (Reply to Notice of Violation, letter with payment of civil penalty, and Answer to a Notice of Violation) should be addressed to: James Lieberman, Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint, North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region II. 
 Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21. 
 Dated at Rockville, Maryland 
 this 6th day of January 1998 
 
 1. A Notice of Violation for a Severity Level III problem (EA 97-244) was issued without a civil penalty on July 28, 1997, for violations related to the unauthorized shipment of two SNM fuel rods in a replica assembly to a foreign plant.