05000251/LER-2010-007

LER-2010-007, Unplanned entry into TS 3.0.3 due to misalignment of Unit 3 HHSI pump discharge valves

Docket Number
Event date:	10-01-2010
Report date:	11-24-2010
Reporting criterion:	10 CFR 50.73(a)(2)(vii)(B), Common Cause Inoperability 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(v), Loss of Safety Function
Initial Reporting
ENS 46303	10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2512010007R00 - NRC Website

DESCRIPTION OF THE EVENT

On October 1, 2010, with Unit 3 in Mode 6 and Unit 4 in Mode 1 operating at 100% power, an unplanned entry into Technical Specification 3.0.3 occurred at approximately 09:51 due to a misalignment of the Unit Refueling Water Storage Tank (RWST) through the HHSI pumps to the Unit 3 cold leg injection lines, which were open to the refueling cavity. The event allowed the gravity drain of 1426 gallons of borated water from the Unit 4 RWST to the Unit 3 refueling cavity via the Unit 3 reactor coolant system (RCS) [AB] cold leg injection lines. Under these conditions, the Unit 4 HHSI System was inoperable for was in Mode 6 and the HHSI System was not required to be operable to support Unit 3. The event was discovered at approximately 10:05.

At 17:56, an 8-hour report (EN# 46303) was made to the NRC Operations Center in accordance with 10 CFR 50.72(b)(3)(v)(D) for a condition that could have prevented the fulfillment of a safety function of a system required to mitigate the consequences of an accident. This event was entered into the Corrective Action Program as AR 584026.

ANALYSIS OF THE EVENT

The primary purpose of the HHSI System is to automatically deliver cooling water to the reactor core in the event of a loss-of-cooling accident (LOCA). The HHSI pumps automatically start and develop sufficient head and flow to inject borated water to the RCS during the injection and recirculation phases of a LOCA.

This action replaces lost reactor coolant and supports short and long term emergency core cooling during reactor decay heat generation. The Turkey Point HHSI System design is a shared system with cross-connect capability and provides for all four HHSI pumps to be able to inject coolant into either Unit 3 or Unit 4.

The HHSI pumps and their associated power supplies are shared between Units 3 and 4. With one unit operating and one unit in an outage, plant Technical Specifications require three operable HHSI pumps (two from the operating unit and one from the outage unit), with each pump capable of being powered from its associated operable emergency diesel generator, and with the discharge of each pump aligned to the operating unit's RCS cold leg. During refueling outages, the outage unit's HHSI pump is aligned to take suction from the operating unit's RWST. This ensures a viable suction source is maintained for all three required HHSI pumps while the water volume in the outage unit's RWST is used for flooding-up the refueling cavity to support refueling activities.

On October 1, 2010, while hanging an Equipment Clearance Order (ECO) for valve and breaker work in the Unit 3 Safety Injection (SI) system, the two Unit 3 HHSI pump discharge Motor Operated Valves (MOVs) to the Unit 3 RCS cold legs (MOV-3-843A & MOV-3-843B - HHSI Cold Leg Injection) were manually opened prior to closing the manual isolation valve (3-867 - SI Boundary Isolation Valve) [BQ, ISV] in the discharge flow path to the Unit 3 cold legs. The action to close the manual isolation valve was a subsequent step in the ECO. The inadvertent failure to maintain the HHSI pump discharge to the Unit 3 RCS cold legs isolated created a flow path from the Unit 4 RWST through the HHSI pumps to the Unit 3 cold leg injection lines, which were essentially open to the refueling cavity. At approximately 10:05 hours on 10/01/2010, the Reactor Controls Operator noticed that the water level in the Unit 4 RWST was decreasing. Upon further investigation, it was determined that the RWST level had started decreasing at approximately 09:51 hours.

Immediate action was taken by the operating crew, and manual isolation valve 3-867 was closed at 10:27 hours, isolating the flowpath. The event allowed the gravity drain of 1426 gallons of borated water from the Unit 4 RWST to the Unit 3 refueling cavity via the Unit 3 RCS cold leg injection lines.

Following the inadvertent transfer of Unit 4 RWST inventory, it was not immediately recognized that the misalignment of the Unit 3 HHSI pump discharge valves could also have adversely affected Unit 4 which was operating in Mode 1 at 100% power. Specifically, the misalignment of the Unit 3 HHSI pump discharge valves affected the safety function of the HHSI pumps to automatically start on an SI signal and develop sufficient head and flow to inject borated water to the Unit 4 RCS for emergency core cooling. Had and 4 RCS cold leg injection lines would have been cross-connected and the majority of flow would have been directed to the outage unit refueling cavity, vice the operating unit RCS cold legs. Consequently, the safety function of the HHSI pumps to provide adequate water inventory to the Unit 4 RCS cold leg injection lines in the event of a LOCA was challenged during the time period that the Unit 3 HHSI pump discharge valves were open. This event rendered the HHSI System inoperable for Unit 4.

This potential Technical Specification impact on Unit 4, the operating unit, was identified by site management at approximately 16:00 hours on 10/01/2010 during further discussions of the details of the event. Based on these discussions, it was determined that the operating unit (Unit 4) had an unplanned entry into a 1-hour shutdown action statement of Technical Specification 3.03 for the period from the time of discovery of the RWST decreasing water level (09:51 hours) to the time the draindown event was terminated (10:27 hours), a period of 36 minutes. Since the HHSI System was inoperable during this period, this resulted in a required 8-Hour Notification Report to the NRC pursuant to 10 CFR 50.72(b)(3)(v)(D) for a condition that could have prevented the fulfillment of a safety function of a system required to mitigate the consequences of an accident.

CAUSE OF THE EVENT

The event was evaluated to determine the root cause and contributing causal factors. There were two root causes identified for the event:

1. Inadequate administrative control of the operating unit Safety Injection flowpath with one unit shutdown (and Safety Injection operability not required on shutdown unit).

2. Poor organizational processes led to a reliance on knowledge only and resulted in failure to recognize the requirements to maintain Emergency Core Cooling System (ECCS) flowpath integrity, through proper isolations during periods when the opposite unit is in a low pressure condition.

REPORTAB ILITY

Turkey Point Unit 3 was in Mode 6 and Unit 4 was operating at 100% power in Mode 1. For single unit operation, Technical Specification 3.5.2, "ECCS Subsytems — Tavg Greater than or Equal to 350 °F," requires three operable HHSI pumps (two associated with the operating unit and one from the opposite unit), each capable of being powered from its associated operable diesel generator, with discharge aligned to the RCS cold leg. The misalignment of the Unit 3 HHSI pump discharge valves created a flow path from the Unit 4 RWST through the HHSI pumps to the Unit 3 cold leg injection lines, which were open to the refueling cavity. Under these conditions, the Unit 4 HHSI System was inoperable since it would not have RCS and refueling cavity via the open flow path.

10 CFR 50.73(a)(2)(v) requires reporting of:

Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:

(A) Shut down the reactor and maintain it in a safe shutdown condition; (B) Remove residual heat; (C) Control the release of radioactive material; or (D) Mitigate the consequences of an accident.

Since the HHSI System safety function was prevented for the 36-minute period, the event is reportable in accordance with 10 CFR 50.73(a)(2)(v)(B) and (D) since the HHSI System functions to both remove residual heat and mitigate the consequences of an accident were affected.

10 CFR 50.73(a)(2)(vii) requires reporting of:

Any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to:

(A) Shut down the reactor and maintain it in a safe shutdown condition; (B) Remove residual heat; (C) Control the release of radioactive material; or (D) Mitigate the consequences of an accident.

While the HHSI System trains are not totally independent due to various piping cross-connections and common suction and discharge lines, the pumps are intended to be independent both electrically and mechanically so that a single failure of a pump can be tolerated. The HHSI System safety function of automatically delivering cooling water to Unit 4 was prevented for the 36-minute period due to the misalignment of the Unit 3 HHSI pump discharge valves creating a flow path from the Unit 4 RWST through the HI-ISI pumps to the Unit 3 cold leg injection lines. The event is reportable in accordance with 10 CFR 50.73(a)(2)(vii)(B) and (D) since the HHSI System functions to both remove residual heat and mitigate the consequences of an accident were affected.

ANALYSIS OF SAFETY SIGNIFICANCE

FPL performed a calculation to quantify and document the change in Core Damage Frequency (ACDF), change in Large Early Release Frequency (ALERF), the Incremental Conditional Core Damage Probability (ICCDP), and the Incremental Conditional Large Early Release Probability (ICLERP) associated with a 36­ minute period where HHSI was rendered unavailable for Unit 4.

The ICCDP and ICLERP were calculated from the results of four case studies using the Turkey Point Probabilistic Safety Assessment (PSA) model. The results are shown in the following two Tables, respectively.

Unit 4 ICCDP Description Result Baseline CDF (per year) 1.80E-06 CDF (HHSI out of service) (per year) 2.96E-03 ACDF (per year) 2.96E-03 HHSI outage duration (minutes) 36 ICCDP 2.0E-07 The resulting ICCDP value of 2.0E-07 falls well below the 1.0E-06 Green-to-White ICCDP threshold for the Significance Determination Process (SDP) specified in NRC Inspection Manual Chapter (IMC) 0609, "Significance Determination Process." Moreover, as indicated in NRC Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-Making: Technical Specifications," an ICCDP of less than 5.0E-07 is considered small and would be considered acceptable by the NRC for a change to a Technical Specification allowed outage time (AOT).

Unit 4 ICLERP Description Result Baseline LERF (per year) 1.56E-07 LERF (HHSI out of service) (per year) 3.76E-06 ALERF (HHSI out of service) 3.6E-06 HHSI outage duration (minutes) 36 ICLERP 2.5E-10 The resulting ICLERP value of 2.5E-10 falls well below the 1.0E-07 Green-to-White ICLERP threshold for the SDP specified in NRC IMC 0609. As indicated in RG 1.177, an ICLERP of less than 5.0E-08 is considered small and would be considered acceptable by the NRC for a change to a Technical Specification AOT.

Additionally, to approximate the effect of external events, the ACDF and ALERF were doubled, resulting in an ICCDP of 4.0E-07 and an ICLERP of 5.0E-10. Accordingly, these results still remain as a Green risk indicator per the SDP guidelines.

In summary, the risk associated with the unavailability of the HHSI System for the 36-minute period, results in the analysis finding of a Green risk indicator per the calculated ICCDP and ICLERP, as applied to the SDP guidelines based predominantly on the short duration.

CORRECTIVE ACTIONS

There were two corrective actions identified:

1. Utilize the Equipment Clearance Order (ECO) to control HHSI flowpath integrity (use of already in place cold shutdown placards, dual purpose to prevent Pressurized Thermal Shock and loss of HHSI discharge flowpath integrity). Use the electronic database eSOMS to track the position of cold shutdown placards (caution tags remain electronically hanging).

2. Revise procedure 3/4-0SP-202.1, "Safety Injection/Residual Heat Removal Flowpath Verification," Attachment 1 for the opposite unit to address the alignment requirements of the outage unit MOV- 3/4-843A/B valves to maintain the integrity of the HHSI discharge flowpath for the operating unit.

3. Update procedure 3/4-GOP-305, "Hot Standby To Cold Shutdown," to include information discussing why restrictions to the operation of valves are required. Update operator logs to include 12-hour readings to verify the alignment requirements of the outage unit MOV-3/4-843A/B valves to maintain the integrity of the HHSI discharge flowpath for the operating unit.

Corrective actions to address the event's contributing factors have been entered in the Turkey Point Corrective Action Program in AR 584026.

ADDITIONAL INFORMATION

component function identifier (if appropriate)].

Condition Report AR 584026 was initiated due to this event.

FAILED COMPONENTS IDENTIFIED: None PREVIOUS SIMILAR EVENTS: None