- Inspection date(s): 20/09/2022
Purpose of inspection
The aim of the inspection is to determine whether the safety systems, structures and components (SSCs) associated with the Hunterston A Site WILWREP are able to adequately fulfil their safety duties (safety functional requirements), in line with the claims made within the safety case for the project.
The required outcome of the inspection is to gain assurance that the basic elements of safety case for the WILWREP are implemented in Safety Systems, Structures and Components and fulfil their safety functional requirements.
The following actives were the subject of this inspection:
- LC10 – Training – Rating – Green
- LC23 – Operating rules – Rating – Green
- LC24 – Operating instructions – Rating – Green
- LC27 – Safety mechanisms, devices and circuits – Rating – Green
- LC28 – Examination, inspection, maintenance and testing – Rating – Green
- LC34 – Leakage and escape of radioactive material and radioactive waste – Rating – Green
The purpose of this inspection was to undertake an SBI to determine whether the safety systems, structures and components (SSCs) associated with the Hunterston A Wet Intermediate Level Waste Encapsulation Plant (WILWREP) adequately fulfil their safety functional requirements in line with the claims made within the safety case for the project, and to ascertain compliance against Licence Conditions 10, 23, 24, 27, 28 and 34.
The inspection team comprised the Site Inspector for Hunterston A Site, a Nuclear Liabilities Regulation Nuclear Equivalent Inspector, and a secondee to ONR from the Nuclear Regulation Authority of Japan.
In order to determine the adequacy of the Licensee’s implementation of the safety case claims in respect for WILWREP, we examined evidence to verify the adequacy of the implementation of Magnox Ltd’s arrangements for the six pre-defined Licence Conditions (LCs); these LCs have been selected due to their importance to nuclear safety and are defined within ONR’s formal process for SBIs, listed below.
The inspection involved reviewing the applicable claims in the safety case for WILWREP and then sampling evidence to determine compliance against the selected LCs at the facility. This was achieved through a combination of document reviews, plant inspection and discussion with Magnox Ltd staff.
We assessed compliance against the following LCs by using applicable ONR inspection guidance documents:
LC10 – Training (NS-INSP-GD-010)
LC23 – Operating rules (NS-INSP-GD-023)
LC24 – Operating instructions (NS-INSP-GD-024)
LC27 – Safety mechanisms, devices and circuits (NS-INSP-GD-027)
LC28 – Examination, inspection, maintenance and testing (NS-INSP-GD-028)
LC34 – Leakage and escape of radioactive material and radioactive waste (NS-INSP-GD-034)
We found that operating limits and conditions necessary in the interests of safety are clearly identified in the operational safety report for the WILWREP facility. The Magnox Ltd safety document defines the safety assumptions and associated safety measures and dose reduction measures (DRMs) that control and protect operators against the hazards on plant.
We found that Magnox Ltd has adequately implemented the limits and conditions within the safety case for the Hunterston A WILWREP Facility; the instructions to operators are sufficiently clear and unambiguous and set out the expectations for safe operations during retrievals activities.
We confirmed that examination, inspection, maintenance and testing of the sampled safety related equipment has been completed. We sampled recent maintenance records and confirmed that where defects are identified, these are adequately recorded, and that maintenance records have an appropriate level of sign-off and control.
We confirmed that the safety documentation identifies the safety measures that protect against leak and escape of radioactive material during WILWREP operations and these systems are appropriately maintained to confirm their availability.
We were satisfied that the training records demonstrated that appropriate training is being provided to the operating team, and that the personnel whose records were sampled have received training on the specific activities relevant to their role and that this was appropriately recorded on the site wide training records systems. In addition to this, plant operator training workbooks been developed to formally record on the job training and provide evidence for sign off of operators as a suitably qualified and experienced person (SQEP).
Our findings from the intervention were presented to and accepted by Magnox Ltd on completion of the inspection.
From the evidence sampled during the inspection, we judge that Magnox Ltd has adequately implemented the relevant claims in the safety case for the WILWREP Facility and that it demonstrated compliance with LCs 10, 23, 24, 27, 28 and 34.
Overall, we judge the safety systems for WILWREP are adequate and fulfil the requirements of the safety case. Consequently, it is our opinion that for this system-based inspection a rating of GREEN (no formal action) is appropriate for LCs 10, 23, 24, 27, 28 and 34.
The WILWREP Safety Case
During the introductory session of the inspection, Magnox Ltd provided an overview of the WILWREP safety case, including the current status of the facility, the key claims and safety related plant, and the future acid retrievals activities.
The inspection included a visit to the WILWREP facility. ONR visited the WILWREP control room and were able to observe the SCADA system plant mimics on the control panel that enable the current status of plant, alarms and system diagnostics to be viewed easily by control room operators. Magnox Ltd stated that the activities undertaken during each shift and any abnormal conditions are recorded in the WILWREP log book and kept for a period of 2-years. In addition to this, a diary is also kept to record the operations undertaken each day on site, however this is not a formal record and is instead used as an operating aid/memo by the operators.
I confirmed that all the operating instructions relevant to WILWREP are available as a hard copy in the WILWREP control room. In addition to this, the Work Order Cards (WOC) for the operators for that week’s work are located in the control room for operators to collect and take onto plant. I was able to sample some WOCs for planned work and confirmed that the relevant operating instructions were attached.
Following the visit to the control room, ONR visited the C0 and C1 areas of the plant which included the operating area above the acid buffer tanks and the operating area adjacent to the canyon. There was a good level of housekeeping on plant, and equipment was appropriately labelled.
During the visit to the control room, ONR identified that the lock on the electrical cabinet containing Programmable Logic Controller (PLC) Panel 02-X-02102 was broken and being held closed with tape. ONR raised this safety issue with Magnox Ltd staff who stated that it had been broken for around a year but that this had been raised. ONR did not consider this to be acceptable and advised that the issue be formally recorded and resolved as soon as possible. Prior to the end of the inspection Magnox Ltd raised the issue on the ‘Q-Pulse’ system for recording events and identifying actions to be taken (ID number HNA-6978). ONR was satisfied that the issue had been formally recorded and that a work order card (WOC215183) had been raised to repair it.
Site Licence Condition 23 – Operating Rules, Rating GREEN, and Site Licence Condition 24 – Operating Instructions, Rating GREEN
Prior to the inspection, Magnox Ltd provided a safety case to demonstrate the safety of WILWREP that identifies the conditions and limits necessary in the interest of safety (LC23(1)), (HNA-8100-2017-SS-1337 – Wet Intermediate Level Waste Retrieval and Encapsulation Plant Operational Safety Report, Issue 1). I reviewed the safety case and confirmed that it provides a justification for the safe operations and provides evidence of the derivation of suitable safety measures to support these operations.
Within Magnox Ltd documentation (Management Control Procedure for the Management of Safety Cases, HNA/MCP 29, Issue 14), Operating Rules (ORs) are referred to as safety case conditions and limits, while Operating Instructions (OIs) are the method of implementing them. The potential faults at WILWREP have been assessed as low consequence and DB0 faults; these are controlled by Category 3 Limits and Conditions which are implemented by Plant Operating Instructions (POIs).
The key hazard at WILWREP is mobile ILW material; this is controlled by the active ventilation system, shielding and administrative controls that restrict access to areas of high ambient dose rate during drum export operations. In order to target the inspection, I chose to sample:
- the safety assumption that the ventilation system is operational prior to starting retrievals (ESA14)
- the safety measure requiring operators to wear cut resistant gloves during deployment and recovery of sludge retrieval equipment (SM1.01)
- the administrative controls preventing operator access to areas of high ambient dose rate during drum export operations.
In order to confirm that these limits and conditions were adequately implemented on plant, I sampled the POIs for drum import and export into and from the WILWREP canyon, drum filling, and use of the sludge deployment rig.
I confirmed that the POI for drum filling includes checks that the ventilation system is operational prior to the commencement of waste retrievals, implementing safety assumption ESA14. Through discussion with Magnox Ltd, I confirmed that additional engineered controls are in place via interlock systems that prevents operation of the plant if the ventilation system is not operational. Magnox Ltd demonstrated this via the WILWREP Control Room SCADA mimic.
I confirmed that the POI for the sludge deployment rig, which is used to pump sludge from the sludge tanks for drum filling activities, includes a specific warning to the operator to wear cut resistant gloves during operations and the reason for this (to prevent contaminated wounds). I was satisfied that the warning was clearly highlighted and explained within the instruction and stands out from the other steps.
I confirmed that the process for using the ‘Crane Enable Key’, which is an interlock key that prevents the roller shutter door being lifted during crane operations, is captured in the POIs for drum import and export. This system prevents access of personnel into the area adjacent to the canyon during drum lifting movements, thus preventing operators being exposed to high ambient dose rate.
I noted that the POIs do not explicitly tell the operator to contact the shift supervisor in the case of abnormal conditions on plant, but Magnox Ltd advised that operators know to do this as a general operational expectation and that the Team Leader is present on plant to oversee activities and confirm that the POIs are being followed.
In addition to this, I sampled the POI for operator response to alarms at WILWREP and consider that the required operator actions in response to alarms are clearly stated. During the visit to the WILWREP control room, I confirmed that the POI includes a figure that mimics the alarms on the control panel to help operators identify the alarm and associated response instructions. The Key Alarms for WILWREP are identified as those associated with drum fill level sensor and the canyon sump level detector which alert the operators to loss of containment of sludge and/or resin in the WILWREP canyon (FS 3.10 and 3.11, HNA-8100-2017-SS-1337). The Key Alarms are distinctive from other alarms as they are shown as a BLUE Window on the Annunciator Panel in the WILWREP Control Room, and in the POI they are also shown with a blue shaded background to allow them to be easily identified by the operator.
From the evidence sampled, I confirmed that the safety documentation for WILWREP defines the safe operating envelope for the operator to implement, identifies the fault scenarios on plant and defines the control measures to ensure that, should a fault occur, the facility will remain safe. I judged that Magnox Ltd adequately implements the limits and conditions specified in the safety case and that the limits and conditions, and the instructions to operators, are sufficiently clear and unambiguous.
Based on the evidence sampled in this SBI we conclude a green rating against LC23 and 24 is appropriate.
Site Licence Condition 27 – Safety Mechanisms, Devices and Circuits, Rating GREEN, and Site Licence Condition 28 – Examination, Inspection, Maintenance and Testing, Rating GREEN
Prior to the inspection, I reviewed the safety case for WILWREP (HNA-8100-2017-SS-1337, HNA-1200-TC-NSS-002) and identified the equipment that is designated as safety-related equipment or as having a safety function for the purpose of nuclear safety or radiological protection. There are no formally claimed safety mechanisms, devices and circuits (SMDCs) at WILWREP, but the WILWREP building fabric and ventilation system are claimed as dose reduction measures (DRMs). In addition to this, the WILWREP Package Handling Crane has a number of interlocks that control the movements of the crane during drum handling operations.
I have confirmed that the DRMs have been identified and taken into account during the hazard analysis process where appropriate and that Magnox Ltd has identified appropriate safety measures for the fault sequences with consequences greater than DB0 in accordance with Magnox Ltd arrangement S-259.
Prior to the inspection, Magnox Ltd provided the Nuclear Maintenance Schedule (NMS), Environmental Maintenance Schedule (EMS) and the Statutory Maintenance Schedule (SMS) (HNA/3306/ED/CMS/001, 002 and 003, respectively) for Hunterston A Site. I sampled the maintenance schedules and confirmed that the maintenance of civil structures which provide DRMs in the form of containment and shielding is included on the NMS, and that maintenance of the ventilation system is included on the EMS.
I sampled the instructions (HNA/8100/SO/WI/4031) and most recent record (Work Order 206092) for the electrical maintenance of the WILWREP Package Handling Crane and Grapple. Minor defects had been identified on the system (a split in the cover of the brake actuator neoprene cover) which had been recorded and confirmed not to affect operations. In addition to this, minor repairs had been recorded and confirmed as successful.
I also sampled the instructions and most recent record for the testing and calibration of the canyon bund level switch (HNA/8100/SO/WI/2008, Work Order 206120), and the filling station level transmitter (HNA/8100/SO/WI/3007, Work Order 206118). I confirmed that the work instructions for the maintenance were clear and that they identified the points where the maintenance record should be completed. The maintenance records were complete and had been certified by the LC28 Supervisor and signed off by the WILWREP DAP.
The next stage of retrievals at WILWREP will be the retrieval of 6% nitric acid waste arising from pond skip cleaning operations, currently stored in the Acid Storage Tanks. The acid will be neutralised and encapsulated within 3m3 drums. Magnox Ltd has undertaken a study to qualify the WILWREP plant for handling dilute nitric acid and identify any plant modifications required prior to retrievals (Project Report: Chemical Compatibility of WILWREP Equipment with Dilute Nitric Acid, HNA/8100/PJ/PR/727, Issue 1).
The study identified that the ventilation system may not be compatible with nitric acid due to the neoprene gasket seals and galvanised carbon steel in the equipment. Magnox Ltd has modified the ventilation equipment and added a coalescer and set of carbon filters to protect the downstream equipment from acid attack. This equipment has been installed to make the plant suitable for processing of acids and ensure that the ventilation system is still able to operate during the processing of acids. As the new equipment has not yet been commissioned, it is not yet included on the maintenance schedule, however, based on discussion with Magnox Ltd, and the sampling of the existing maintenance schedule, I am confident that the new equipment will be adequately maintained to ensure its availability to support the ventilation system.
Based on the evidence sampled as part of this SBI, we found that the safety related systems, structures and components have been identified in the safety case, and examination, inspection, maintenance and testing on this equipment has been completed. We sampled recent maintenance records and confirmed that where defects are identified, these were adequately recorded, and that maintenance records have an appropriate level of sign off and control. We therefore concluded that green ratings against LC27 and LC28 are appropriate.
Site Licence Condition 34 – Leakage and escape of radioactive material and radioactive waste, Rating GREEN
Prior to the inspection, I reviewed the safety case for WILWREP (HNA-8100-2017-SS-1337, HNA-1200-TC-NSS-002) and identified the supporting HAZANs. Magnox Ltd hazard analysis identified two fault scenarios that could result in leakage and escape of radioactive material during drum filling operations in WILWREP; FS 3.10 loss of containment of sludge and/or resin within the WILWREP canyon, and FS 3.11 overfill of a drum during filling.
For the loss of containment of sludge or resin in the WILREP canyon, Magnox Ltd has identified the hardwired cell sump leak detector as a safety measure to protect against this fault (SM3.01). In the case that a leak is detected, the sump leak detector trips the pumps and closes the valves associated with drum filling in order to stop operations and prevent further transfer of material to the drum and initiates a facility alarm.
I reviewed the POI for response to alarms in WILWREP (HNA-8100-SO-POI-826) and confirmed that the alarm (LSH 31256 CILWPP Sump Level High) is identified as a key alarm on plant and operators are required to activate the Emergency Stop and evacuate the facility without delay upon activation of any alarm indicating a loss of system containment in the WILWREP canyon.
For overfill of a drum, a drum level sensor is located on the drum filling station to detect if the drum has been overfilled. Magnox Ltd identifies the hardwired trip on the drum high level sensor which prevents further transfer of material to the drum as a safety measure to protect against this fault (SM3.02).
Safety Measures SM 3.01 and 3.02 no longer meet the criteria for Safety Mechanisms, Devices and Circuits as they are claimed against LC faults (SMDCs are claimed for an Operating Rule or a DB1 or DB2 fault) (Management Control Procedure for the Management of Safety Cases, HNA/MCP 29, Issue 14). However, maintenance associated with the two safety measures SM3.01 and SM3.02 is currently included on the NMS (HNA/3305/ED/CMS/001). I was satisfied that Magnox Ltd could demonstrate that these safety measures were adequately maintained to perform their safety function in order to prevent leakage and escape of radioactive material outside of the WILWREP containment (see section on LC28).
Based on the evidence sampled as part of this SBI, we conclude a green rating against LC34 is appropriate.
Site Licence Condition 10 – Training, Rating GREEN
ONR sampled the Agresso training records and authorisation records for two plant operators (192131 and 188408). I confirmed that the operators had completed all their standard operator training and had appropriate authorisations in place related to their roles on plant e.g. authorisations related to forklift truck driving and health physics monitor activities.
Magnox Ltd stated that the company has introduced a new system (VIP) which is used to record training for appraisal purposes, so there are now two training record systems running in parallel (VIP and Agresso). Magnox Ltd stated that when they had checked the systems prior to the inspection, they had identified that the on the job training recorded in the Plant Operator Training Workbooks (HNA/1700/HR/RSLP/MU307F) was no longer recorded electronically on Agresso but hasn’t been replicated on VIP. Magnox Ltd stated that they would rectify this.
I noted that there were potential issues with consistency and maintaining accurate training records between the two systems and will raise this with ONR Magnox Corporate Inspector.
I sampled the Plant Operator Training Workbooks (HNA/1700/HR/RSLP/MU307F) for two plant operators (192131 and 188547) and confirmed that they had been completed and signed of by the Team Leader and DAP in order to confirm the operator as SQEP for WILWREP. While less experienced operators are completing the on the job training, they are paired with SQEP operators via a ‘buddy’ system. I reviewed the workbooks and noted they include the following useful information for operators:
- Description of the different plant areas and the processes undertaken at plant.
- Summaries of the POIs used at WILWREP.
- Check sheets to sign off operators as being able to complete different tasks on plant
Magnox Ltd stated that the workbooks will be updated and reissued for the acid retrievals campaign and that these will be completed by operators prior to the start of active commissioning.
I noted that the operating team for WILWREP also works on the Solid Active Waste Bunker Retrievals (SAWBR) facility. Magnox Ltd stated that resource is decided based on work priorities and that the WILWREP DAP and Team Leader have flagged potential issues with resourcing retrievals at WILWREP and SAWBR moving forward via the HAW meetings on site.
I was satisfied that the site-wide training records system (Agresso) demonstrated that appropriate training is being provided to the WILWREP operating team, and that the personnel whose records were sampled have completed the on the job training required for working at the WILWREP facility.
Based on the evidence sampled as part of this SBI, we conclude a green rating against LC10 is appropriate.