05000250/LER-2012-002

LER-2012-002, Non-compliance with TS 3.4.9.3 due to Manual Isolation Valve Found in Incorrect TS Configuration

Docket Number
Event date:	6-25-2012
Report date:	8-21-2012
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(i)
2502012002R00 - NRC Website

DESCRIPTION OF THE EVENT

On 6/25/12, Unit 3 was in Mode 5. The High Head Safety Injection (HHSI) manual isolation valve, 3-867 was closed, but not locked while the HHSI Cold Leg isolation valves [BQ,ISV], MOV-3-843NB were closed and de-energized.

Technical Specification (TS) 3.4.9.3 Limiting Condition for Operation (LCO) requires that the high pressure safety injection flow path to the Reactor Coolant System (RCS) be isolated by means of locked closed manual valves or by closed valves with power removed in Modes 4 (with RCS cold leg temperature less than 275 °F), 5 and 6 (with the reactor vessel head on.) TS 3.4.9.3, Action (a) states that with the high pressure safety injection flow paths to the RCS unisolated, restore isolation of these flow paths within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

At approximately 1710 on 6/25/12, as the portion of the Engineered Safeguards Testing energized MOV-3-843A/B during the course of hanging Equipment Clearance Order (ECO) 3-063-062 (referred to as ECO 63-62) with 3-867 closed but not locked, Turkey Point Unit 3 entered into an unplanned 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> TS Action for not meeting TS 3.4.9.3 LCO. This condition was recognized on 7/1/12, at approximately 1000, while the Unit 3 Reactor Controls Operator (RCO) was reviewing TS requirements for an upcoming evolution involving TS Overpressure Mitigating System (OMS) operability, when he noted the requirement for manual isolation valve 3-867 to be locked closed. Operations recognized that Turkey Point Unit 3 had been in TS 3.4.9.3 Action (a) since the time that ECO 63-62 closed the breakers for MOV-3-843A/B on 6/25/12.

Operators restored 3-867 to its correct TS configuration by locking it closed.

On 7/1/12 at approximately 1045, Unit 3 exited TS 3.4.9.3 Action (a) and complied with TS 3.4.9.3 LCO. It was discovered that several days prior to hanging ECO 63-62, on 6/21/12 at 0342, an administrative clearance ECO 3-062-3­ 867 ADMIN (referred to as ECO 3-867 Admin) had hung a caution tag on 3-867 in the closed position (but unlocked) for supporting post-maintenance testing (PMT) on MOV-3-843A/B. At that time, Turkey Point Unit 3 was in Mode 6 with the Reactor Vessel Head off, and TS 3.4.9.3 was not in effect. When ECO 63-62, which included a caution tag with a note to lock close 3-867, was subsequently authorized, the clearance "tag shared" with the administrative ECO on 3-867.

Although the caution tag note instruction fields differed (closed versus locked closed), the caution tag position field was the same 'Hang Tag' for each ECO. The electronic clearance module eSOMS is unable to differentiate the tag note field.

Consequently, there was no new caution tag generated for 3-867 since eSOMS automatically credited the earlier tag placement signatures into ECO 63-62's tag hang list sheet. Additionally, the existing caution tag instructions to close 3­ 867 for MOV-3-843A/B testing coincidentally matched the section of safeguards testing that was being prepared for at the time. Condition Report 1781044 was initiated to determine causes and corrective actions.

This report is submitted in accordance with 10 CFR 50.73(a)(2)(i)(6), any operation or condition which was prohibited by the plant's Technical Specifications.

CAUSE OF THE EVENT

The root cause identified that the Engineered Safeguards Testing lacked rigorous control process to ensure verification of 3-867 is in its required Tech Spec 3.4.9.3 configuration prior to energizing MOV-3-843A/B.

The following programmatic and organizational contributing causes were identified:

1. Turkey Point clearance program allows caution tags to "tag share" despite having in the notes different and even conflicting component positioning instructions.

2. No guidance exists for managing tag sharing in eSOMS or for dealing with warnings on conflict checks.

3. Operations practice is to not use actual tag positions when hanging caution tags. Component positioning information is contained only in the tag notes field.

4. Vague and conflicting guidance exists on using the Special Instruction field.

5. Pre-outage Operations training did not include a review of TS 3.4.9.3.

ANALYSIS

System Description:

The HHSI system is designed to supply borated water to the RCS system to make up for any loss of inventory and to maintain core cooling during a Loss of Coolant Accident (LOCA). Safety Injection boundary isolation valve, 3-867 is downstream of the HHSI pumps. Valve 3-867 is located in the Containment Spray Pump room with a reach rod handwheel located on the Auxiliary Building roof. The HHSI Cold Leg Injection Isolation valves, MOV-3-843A/B, are located downstream of 3-867 in a parallel arrangement and actuate open upon a Safety Injection signal. During Modes 1-3, valve 3-867 is locked open and MOV-3-843A/B are closed with their associated power supply breakers energized. While shutdown in Modes 4-6, MOV-3-843A/B are required to be closed with the breakers de-energized or 3-867 is required to be locked closed in order to prevent pressurized thermal shock in the event of an inadvertent safety injection and subsequent over- pressurization of the RCS. The following schematic represents the configuration for the manual isolation valve 3-867, and the HHSI Cold Leg Injection Isolation valves MOV-3-843A/B:

013 - TO 1 TOS/SAS bo n 010 13.

DISCHARGE

1C, RO3= 13-41E7 / 3/4..3/9 v V L S/8" 3-10:78 V) UOV-3-11438 3fir B.SiC

COLD LEG

3-11.185� 3-4488 Technical Specification 3.4.9.3:

In Modes 4 (when the temperature of any RCS cold leg is less than or equal to 275 °F), 5, and 6 with the reactor vessel head on, the high pressure safety injection flow paths to the RCS shall be isolated pursuant to T.S. 3.4.9.3. If this Limiting Condition for Operation (LCO) is not met, i.e., with the high head safety injection flow paths to the RCS unisolated, isolation to these flow paths is required to be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> per the corresponding action statement. T.S. 4.4.9.3.3 is the surveillance requirement for T.S. 3.4.9.3, which requires that high pressure injection flowpath isolation to the RCS is verified at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> by de-energized closed valves (i.e., MOV-3-843NB) or by locked closed manual valves (i.e., 3­ 867).

Event Analysis

On 6/25/2012, Turkey Point Unit 3 was inadvertently placed in a 4-hour action statement, pursuant to Technical Specification 3.4.9.3 Action (a), due to the cold leg safety injection flow path to the RCS being unisolated in Mode 5. Even though 3-867, manual isolation valve was closed, it failed to meet Surveillance Requirement 4.4.9.3.3 definition of isolation, which requires a "locked closed manual valve".

Previously, on 6/17/12, Equipment Clearance Order (ECO) 3-063-062 (referred to as ECO 63-62) was prepared to support Train B Engineered Safeguards Testing. The purpose of this ECO was to keep cold leg safety injection isolated while testing safety injection signals to cold leg isolation Motor Operated Valves (MOVs) MOV-3-843A/B. The ECO accomplished this by containing a step to hang a caution tag on 3-867 locked closed and a special instruction note, which stated "Valve 3-867 MUST BE LOCKED CLOSED prior to turning breakers ON for MOV-843's". ECO 63-62 includes the entire line up from locking 3-867 closed, to energizing MOV-3-843A/B during its execution. Compliance with TS 3.4.9.3 requirements is encapsulated within the hang execution sequence of the ECO. Due to plant conditions, Train B Safeguards was postponed for 7 days, which caused ECO 63-62 to remain unapproved. Meanwhile, clearance ECO 3-062-3-867 ADMIN (referred to as ECO 3-867 Admin) was authorized on 6/21/12, hung a caution tag on valve 3-867 stating "Closed by Shift Manager (SM) direction for testing MOV-3-843A/B".

On 6/21/12 at 2311, when the Reactor Head was set on the flange, TS 3.4.9.3 was applicable to Turkey Point Unit 3. In Modes 4 (when the temperature of any RCS cold leg is less than or equal to 275 °F), 5, and 6 with the reactor vessel head on, T.S. 3.4.9.3 LCO requires that the high pressure safety injection flow paths to the RCS be isolated to prevent inadvertent pressurization. If the LCO cannot be satisfied, the flow path isolation is required to be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The associated surveillance T.S. 4.4.9.3.3 defines this isolation as closed valves with power removed (i.e., closed and de­ energized MOV-3-843A/B) or by locked closed manual valves (i.e., locked closed 3-867) and requires this lineup to be verified at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. At the time the vessel head was set, both MOV-3-843A/B were closed and de-energized in compliance with TS 3.4.9.3 LCO.

Subsequently, on 6/24/12, the Engineered Safeguards Testing clearance, ECO 63-62 was approved, but because the caution tag from the Admin ECO 3-867 was already hanging, the eSOMS Clearance program database tag-shared with the existing caution tag on 3-867 Admin. As such, eSOMS did not generate a caution tag for 3-867 specifically for ECO 63-62, which would have included the tag note instructions to "Lock Close for 3B Safeguards." The existing Admin caution tag hanging on 3-867 had note instructions that read "Closed by Shift Manager direction for MOV-3-843A/B testing.

Additionally, the tag hang sheet checklist for ECO 63-62 was updated with the verification signatures from ECO 3-867 Admin making it appear as though the caution tag from ECO 63-62 was hanging.

This tag-sharing occurred because the high level tag position on both Caution Tags was "Hang Tag," instead of having an actual position directed. Per procedure OP-AA-101-1000, Clearance and Tagging, tag sharing is a "system software feature that shares tags between clearances when a common component is tagged with the same tag type (Danger, Caution, etc.).

When a tag is shared between active clearances, the component tag is hung only when the first clearance is authorized. All subsequent clearances that share this common tag will electronically reflect the initial component tag as being in place.

The Work Control Center Supervisor approving the ECO 63-62 was aware of this tag sharing and contacted the Senior Nuclear Plant Operator (SNPO), who reported that 3-867 was locked in the open position. Previously, on 6/22/12, the manual valve 3-867 was cycled to the locked open position in accordance with procedural guidance as part of a test evolution. The Work Control Center Supervisor changed the Special Instructions section to add that "(3-867 is currently open).

During dayshift on 6/24/12, a briefing was held for hanging ECO 63-62 and the special instructions were discussed, but the ECO hang never commenced. On 6/25/12 midshift, a different crew was briefed by the Field Supervisor (FS) for ECO 63-62 and the special instructions were discussed including the need to have 3-867 locked closed. Following an ECO walkdown, the operators identified that 3-867 was locked open and reported back-to the FS. Since the ECO hang sheet did not have a step to reposition the valve, the FS directed the operators to the Safeguards team lead for further guidance. The team lead instructed the operators to reposition the valve according to the instruction from the existing caution tag hanging on 3-867 without mentioning the requirement to lock it. The FS then sent the operators to the control room to validate the repositioning instruction they had received. The ensuing control room discussion with the Shift Manager (SM) concentrated on 0-ADM-051, Outage Risk Assessment and Control, requirements to keep the cold leg injection flowpath available, and concluded with SM direction to close 3-867 with no mention of locking.

At the end of midshift on 6/25/12 at 0641, 3-867 was positioned closed but left unlocked due to the existing caution tag instruction and previous team lead and control room discussion. The remainder of ECO 63-62 hang was turned over to dayshift to perform. The new dayshift crew was then briefed to complete the hang of ECO 63-62 and believed that 3-867 was already verified in the position required by the special instructions.

At approximately 1710 on 6/25/12, MOV-3-843A was energized when breaker (30738) was closed by ECO 63-62, and Turkey Point Unit 3 entered a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action statement per TS 3.4.9.3 LCO Action (a) because valve 3-867 was not in the Technical Specification required configuration of locked closed.

On 7/1/12 at approximately 1000, while reviewing T.S. 3.4.9.3 requirements for an upcoming evolution involving Overpressure Mitigating System (OMS) operability, the Unit 3 RCO noted the requirement to have 3-867 locked closed.

Realizing that the operator rounds had been crediting the valve as caution tagged closed, he dispatched a field operator to check the configuration of 3-867. The field operator reported back that the valve was closed but unlocked. The manual isolation valve 3-867 was locked closed at 1045, at which time Turkey Point Unit 3 exited T.S. 3.4.9.3 Action (a).

Reportability The unplanned entry into Turkey Point Unit 3 TS 3.4.9.3 Action (a) lasted from approximately 1710 on 6/25/12 to 1045 on 7/1/12. This event exceeded the TS allowed time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to address the TS 3.4.9.3 LCO non-compliance. The event is reportable in accordance with 10 CFR 50.73 (a)(2)(i)(B), for any operation or condition which was prohibited by the plant's Technical Specifications.

ANALYSIS OF SAFETY SIGNIFICANCE

The High Head Safety Injection manual isolation valve 3-867 was found in the required closed position but was not administratively locked. With 3-867 physically closed, the potential for inadvertently transferring water from the Refueling Water Storage Tank (RWST) or actually injecting water into the reactor vessel during the safeguards testing procedure when the downstream motor operated valves MOV-3-843A/B were opened did not exist. Since the unit was in Mode 5 and 3-867 was in the required closed position, there was no risk to personnel safety, radiological safety, or nuclear safety. As such, there is no safety significance associated with this event.

CORRECTIVE ACTIONS

Corrective actions are in accordance with Condition Report 1781044 and include the following:

1. Process and procedural changes to add verification step just prior to energizing MOV-3/4-843A/B breakers to ensure locally that manual isolation valve 3/4-867 is locked closed along with procedurally disallowing the breakers from being included on the ECO.

2. ECO Process changes related to tag position of manual isolation valve 3/4-867.

3. Add procedural guidance regarding the use of tag position on caution tags.

4. Add procedural guidance on using tag sharing with caution tags and instructions for handling the various types of soft or warning ECO conflicts.

5. Provide guidance on use of Special instructions for component manipulations FAILED COMPONENTS IDENTIFIED:�None PREVIOUS SIMILAR EVENTS: The following Turkey Point station condition reports have been identified as similar events involving manipulation of HHSI cold leg injection manual isolation valve (867): ARs: 403629,405606, 584026. The corrective actions for these events did not focus on the process and programmatic changes to strengthen 3-867 configuration control to prevent this event.