Sellafield Inspection of FGMSP Pond Liquor Controls
- Site: Sellafield - DEC
- IR number: 14-115
- Date: September 2014
- LC numbers: 10, 23, 24, 27, 28, 34
Purpose of intervention
This intervention was to inspect the liquor control system in place on Sellafield Ltd's (SL) First Generation Magnox Storage Pond (FGMSP), to verify that the system and its operation remains adequate to manage the hazards that are present. This is one of 8 FGMSP systems identified on the Sellafield systems inspection register, reflecting the high hazard posed by this plant. This inspection was carried out in line with the PP3 planned inspection programme for the Decommissioning Division. It was conducted by the ONR site inspector, supported by ONR Chemical Engineering and Environment Agency Specialist Inspectors.
Interventions Carried Out by ONR
I carried out a safety case-based system inspection of the FGMSP liquor control systems. Beginning with the facility safety case, I examined the safety case, inspected the key safety measures and operational controls claimed, to verify if these were effective on the plant, and to confirm if adequate maintenance and training are adequate to support its safe operation. Through examination of this system I inspected compliance against Licence Conditions 10 (Training), 23 (Operating Rules), 24 (Operating Instructions), 27 (Safety Mechanisms, Devices and Circuits), 28 (Examination, Inspection, Maintenance and Testing) and 34 (Containment).
Explanation of Judgement if Safety System Not Judged to be Adequate
N/A - The silo liquor control system was judged adequate based on this inspection. Although compliance with one Licence Condition was rated as below standard, this was based on administrative compliance and does not affect safety performance of the plant.
Key Findings, Inspector's Opinions and Reasons for Judgements Made
- Overall I was satisfied that the system meets its safety case functions. The liquor control system has no credible means of breaching the safety case Operating Rule and it comfortably operates within an operating envelope which has significant margin from any safety limits. I was satisfied that SL demonstrated adequate level management and operational control of pond liquors, and also demonstrated good pH and pond activity/chemistry management.
- SL demonstrated an adequate understanding of the condition and behaviour of liquors in the pond and other areas on the plant; it has adequate means to recognise anomalies from normal plant behaviour and has arrangements for responding if any deviations occur.
- Staff consistently demonstrated a clear recognition of the Operating Rules, which included one relevant to pond liquor level. Control room operators demonstrated an adequate understanding of the normal plant operating parameters, control panel readings and how these relate to the safety limits. Control room operators also demonstrated adequate understanding of alarms and the response required under emergency conditions. The Operating Rule was identified in the Clearance Certificate and it was demonstrated that the engineered system (alarms and trips) and the Operating Instructions provide adequate means of complying with this Operating Rule. Not all Operator Instructions were available in paper copy on the plant, which I considered not to be duly robust should the IT system fail. SL agreed to improve the availability of these on the plant.
- I inspected the Safety Mechanisms (SM) associated with the liquor control system for cave level detection and frost protection. These were shown to be adequately defined within the safety documentation and references to these were connected to the operational documentation. The Safety Mechanisms were shown to be adequately installed, maintained and labelled during the inspection. The Cave 1 level system was shown to be in good working order and whilst the frost protection system was out for maintenance during the inspection, this was shown to be adequately controlled, being planned and recorded on the Plant status, safety dashboards and ACEMAN briefs.
- I inspected the Examination, Inspection, Maintenance and Testing (EIM&T) arrangements related to the liquor control system. It was encouraging to note that Systems Health Reports had been completed for the main pond level and the containment systems and I considered these reports to be a reasonable assessment of the systems. The combination of these two documents along with the condition assessments demonstrated reasonable control over the condition and performance of the containment and liquor control systems.
- ONR expects licensees to have a Plant Maintenance Schedule (PMS) which defines the EIM&T of plant which affect safety. However the FGMSP PMS only defines proof tests and therefore falls short of guidance expectations. Maintenance tasks are managed separately through SL's Movex maintenance system. It was good to see that the PMS had already been updated to include new purge pumps, which had recently been installed, which demonstrates that the PMS is actively updated as the plant configuration changes.
- I considered the work on Systems Engineering to be a positive development, but this has further to mature to provide tangible benefits. SL has established increased control of pond configuration and asset condition through this programme of work. There appeared to be some overlap between the Systems Engineering and Configuration Management work undertaken by Safety & Reliability Department, which hasn't yet been well integrated. SL agreed there are opportunities to further improve by linking these activities together.
- Containment of the system was considered adequate. The liquor control system has no credible engineered means of causing a significant breach of containment which could exceed safety limits (the main containment risk being associated with the civil structures which has been subject to a separate System Inspection). We explored the potential routes for siphoning through various connections, and my questions were all answered adequately. Good control was demonstrated on the detection of potential leaks.
- SL has also developed good proposals to further improve containment through lowering of the pond level. This will provide additional ullage and increased margin below penetrations in the containment structure, which would improve operating flexibility and increase the ability to cope with extreme rainfall events. Pond lowering would also provide improved margins between level alarms and engineered trips, which would improve operational control. The lowering trials were however paused following failure of one of the pond purge pumps. Now this has been successfully repaired, it would be good to see pond lowering successfully implemented.
- SL demonstrated good control of pond chemistry and has been undertaking analysis to understand how pond activity and pH change as a result of purging and dosing. This has enabled better understanding of liquors throughout the main pond and other plant areas. The use of Remotely Operated Vehicles (ROVs) to improve sampling, and the pond chemistry regime was considered good practice. SL also demonstrated good use of Quality Plans to agree liquor controls and define the interface arrangements with other parts of Sellafield. These were considered good practice in ensuring control between interfacing plants.
Conclusion of Intervention
Overall, I was satisfied that SL was able to demonstrate that it had adequately implemented the safety case through the engineered measures and operation of the system. SL demonstrated appropriate understanding of the state and behaviour of liquors in the cells and sumps on the plant and showed it could recognise anomalies from normal plant behaviour and has arrangements for responding if any deviations occur. A number of minor actions and recommendations were identified during the inspection, which will be tracked through ONR's Regulatory Issues database and followed up by the ONR Site Inspector as part of normal regulatory interactions.