05000317/LER-2012-001

LER-2012-001, Valve Surveillance Reauirement Not Met Due to Leaacv Issues

Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No. Calvert Cliffs, Unit 2 05000 318
Event date:	05-18-2012
Report date:	07-17-2012
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
3172012001R00 - NRC Website

, Calvert Cliffs Nuclear Power Plant, Unit 1 05000 317 2012� -- 001 --�� 00 2� of� 07 I.� DESCRIPTION OF EVENT:

A. PRE-EVENT PLANT CONDITIONS:

On May 18, 2012, Unit 1 was operating at 100 percent rated thermal power and Unit 2 was operating at 99.5 percent rated thermal power. There were no systems, structures, or components inoperable that would have impacted this event.

B. EVENT:

On May 18, 2012, a past condition within the low pressure safety injection (LPSI) system was evaluated and determined to be reportable.

Calvert Cliffs' LPSI system functions to inject borated water into the Reactor Coolant System (RCS) in the event of a loss-of-coolant accident (LOCA) and to provide shutdown cooling flow through the reactor core and shutdown cooling heat exchangers. The LPSI system for each Unit consists of two LPSI pumps that have separate suction headers but come together into a common discharge header that ultimately branches off into four injection paths that go to each of the four RCS cold legs. Located within each Units' LPSI system common discharge header is a flow control valve (1CV306 for Unit 1 and 2CV306 for Unit 2). This valve is a fail open valve which is held open by actuator spring force and requires air pressure to close the valve. If the valve was to go shut, both LPSI pump headers would be unable to provide flow to the RCS.

Calvert Cliffs Nuclear Power Plant Technical Specification Surveillance Requirement (SR) 3.5.2.1 requires operators to verify that the Unit Nos. 1 and 2 LPSI flow control valves are in an open position with power to their valve operator removed whenever the Unit is in Modes 1 and 2, and Mode 3 with pressurizer pressure >1= 1750 psia. This SR is performed on a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> frequency.

The method used to remove power from the CV306 valve operator has changed several times ,during the life of the plant. Prior to Unit l's startup 1CV306 was identified as a single-point vulnerability for LPSI flow. To address a single-active failure, Calvert Cliffs inserted a jackscrew in the valve body of 1CV306 to mechanically prevent valve closure. However, no requirement for use of a jackscrew was included for Unit 2 when its Technical Specifications were initially issued in August 1976. In approving the Unit 2 Technical Specifications the Nuclear Regulatory Commission (NRC) accepted our proposal to remove power from the valve operator. Shortly after Unit 2 startup, Calvert Cliffs requested a change that deleted the requirement for using a jackscrew on 1CV306. This change was approved by the NRC in February 1977.

Following this change the method used to remove power from CV306 was to isolate the electric signal going to the valve's current to pneumatic (I/P) transducer with a key switch located in the Control Room. This method left air pressure supplied to the I/P and the valve positioner. The valve positioner would require an air pressure signal from the I/P to close the valve.

On December 1, 2010 a plant technician, while in the process of conducting routine maintenance, inadvertently bumped into the current to pneumatic (I/P) transducer for 2CV306.

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (10-2010)J LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

I REV Calvert Cliffs Nuclear Power Plant, Unit 1 _05000 317 2012J-- 001 --J00 3JofJ07 The bumping damaged the I/P such that a control air signal was supplied to the valve positioner causing the valve to partially shut. A subsequent engineering analysis determined that the LPSI system still would have been able to deliver more than its required accident flow rate through this partially shut valve. The valve was returned to its full open position and the site continued to remove power from CV306 by isolating the electric signal going to the I/P with a key switch in the Control Room.

An NRC Problem Identification and Resolution sample inspection in the Fall of 2011 questioned whether the method Calvert Cliffs used to remove power from CV306 complied with the Technical Specification SR. In December 2011, while the issue was being evaluated, Calvert Cliffs shifted our method of removing power to the valve operator by removing instrument air to CV306 positioner by locking shut its instrument air supply manual valve. This action put in place a more robust method of removing power from the valve operator and provided greater margin in assuring CV306 remained in the full open position.

On May 18, 2012, a condition report (CR-2012-005390) was initiated that determined the pre- December 2011 method of removing power from the valve operator did not meet Technical Specification SR 3.5.2.1. Because the surveillance test was not adequate to meet the requirement of SR 3.5.2.1 it is considered a failure to meet the Limiting Condition for Operation (LCO) for Technical Specification 3.5.2. Since the site did not recognize the LCO was not met, the Required Actions stated in the Technical Specification were not performed. As a result, unknowingly, both Units were in a condition prohibited by Technical Specifications.

TO THE EVENT:

There were no inoperable structures, components, or systems that contributed to this event.

D. DATES AND APPROXIMATE TIMES OF MAJOR OCCURRENCES:

May 4, 1973 Supplement No. 1 of the Safety Evaluation for Calvert Cliffs Nuclear Power Plant. Section 3.2.2.2 describes CV306 as a single locked open, air operated valve. The locked open feature is provided through use of a key-lock in the Control Room. However, because of the concern of a single active failure, the NRC required a modification to the valve. Calvert Cliffs Nuclear Power Plant added a plug inserted through the bottom of the valve body that mechanically prevents closure of the valve. The NRC determined that this modification was acceptable.

May 4, 1973 Original Unit 1 Technical Specifications. Section 3.3.0 — The jackscrew preventer on CV306 of the LPSI header shall be in place whenever the reactor coolant temperature exceeds 300F.

April 16, 1975JLong-Term Emergency Core Cooling System (ECCS) Operation. This letter provided our procedures to address core flush for long-term cooling NRC FORM 366A� U.S. NUCLEAR REGULATORY COMMISSION (10-2010)� LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

I�SEQUENTIAL I�REV NO.

Calvert Cliffs Nuclear Power Plant, Unit 1 05000 317 2012�-- 001 --�00 4�of�07 capability. The attachment to the letter described CV306 operation for long-term core flush. For hot leg suction, it says that CV306 or Safety Injection valves -615, 616, 617, and 618 needs to be shut. However, if the differential pressure between containment and the RCS is less than 20 psi, then shutting CV306 is the only option. It also provides the qualification of CV306, noting that it is an air operated globe valve, fails open, must shut for long-term core cooling, and is located outside containment and so is not qualified for post-LOCA environments.

August 10, 1976 Supplement No. 5 to the Safety Evaluation Report for Calvert Cliffs Nuclear Power Plant, Unit 2. Section 7.5.3 says, "To satisfy the single failure criterion, the applicant has proposed to lock out power to the motor operator of LPSI discharge valve CV306 in the open position. We will include this requirement in the Technical Specifications." Section 7.6 discusses the method of core flush. It references the April 16, 1975 letter and describes the NRC review of the procedures contained in that letter.

It concludes that the procedures are acceptable. It also notes that the core flush methods are not single-failure proof, but no single-failure can disable both methods. Therefore, it found the ECCS overall single-failure proof.

August 13, 1976 Issuance of facility operating license for Unit 2. Issued Unit 2 Technical Specifications, including Technical Specification 4.5.2.a which says the ECCS shall be demonstrated operable at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> by verifying that the following valves are in the indicated positions with power to the valve operators removed: CV306, LPSI Flow Control, Open. The Technical Specification Bases do not discuss any details about CV306.

February 11, 1977�Issuance of Amendment 20 for Unit 1, Conversion to Standard Technical Specification. This change deleted the requirement to install the jackscrew on CV306 and changed the SR wording to match Unit 2.

March 31, 1978 � Long-Term Cooling following LOCA. We stated that the hot leg suction method of core flush was no longer proposed. Instead, we would use a hot leg injection path.

May 17, 1982�Boron Precipitation during Long-Term ECCS Operation. We provided descriptions and drawings of the primary and alternate flow paths for ECCS flushing. Our description of the primary flow path (hot leg injection) shows that flow is directed through an open CV306.

June 2, 1982 �Letter from the NRC. This letter accepted our revised ECCS long-term operation lineup.

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (10-2010) LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

December 1, 2010 2CV306 was inadvertently bumped by a technician resulting in the valve going 25 percent shut. Subsequent evaluation determined LPSI trains were still capable of providing required accident flow rate despite the partially shut valve.

December 2011 Calvert Cliffs isolated instrument air to the valve operator.

May 18, 2012 CR-2012-005390 was initiated that determined the pre-December 2011 method of removing power to the valve operator did not adequately meet Technical Specification SR 3.5.2.1 and thus the event is reportable.

E. OTHER SYSTEMS OR SECONDARY FUNCTIONS AFFECTED:

No other systems or secondary functions were affected by this event.

F. METHOD OF DISCOVERY:

This condition was evaluated based on questions raised during an NRC inspection. Following further review and discussion, determination was made that the method of removing power to the valve operator employed by Calvert Cliffs, prior to December 2011, did not meet the stated requirements of SR 3.5.2.1.

G. MAJOR OPERATOR ACTION:

Calvert Cliffs shifted to isolating instrument air to the valve operator by locking shut an instrument air manual hand valve. This method removes power to the valve operator and meets the requirement stated in SR 3.5.2.1.

H. SAFETY SYSTEM RESPONSES:

There were no demands for safety system actuations during this event. Although determination was made that 1CV306 and 2CV306 did not meet SR 3.5.2.1, both valves were always verified in the full open position (with the exception of the bumping incident) which allowed LPSI to be capable of performing its safety function.

II. CAUSE OF EVENT:

This event is documented in the site's Corrective Action Program under CR-2012-005390. The apparent causes of this event involved: 1) technical inaccuracies/omission of relevant information and 2) approved document changes completed with inadequate reviews and limited documentation that occurred during the mid to late 1970s. The site and regulatory cultures in the 1970s did not require as much rigor in the documentation and review for changes to the licensing basis as exists today. Current Calvert Cliffs Licensing procedures and Engineering procedures require significantly more internal review and interaction with the NRC in order to implement a change to the licensing basis.

NRC FORM 366A � U.S. NUCLEAR REGULATORY COMMISSION (10-2010)� LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

I� REV Calvert Cliffs Nuclear Power Plant, Unit 1 _05000 317 2012� -- 001 --�� 00 6� of� 07 III.� ANALYSIS OF EVENT:

This event is reportable in accordance with the following:

10 CFR 50.73(a)(2)(i)(B); "Any operation or condition which was prohibited by the plant's Technical Specifications.

Calvert Cliffs Nuclear Power Plant Technical Specifications, SR 3.5.2.1 requires Operators to verify CV306 in the listed (open) position with power to the valve operator removed. While performance of this SR was successful in verifying the valve remained in the full open position it did not, because of the method chosen to remove power, ensure that the valve could not be inadvertently moved from its full open position. The surveillance test method did not fully achieve the requirement of SR 3.5.2.1. Not meeting the requirements of SR 3.5.2.1 is a failure to meet LCO 3.5.2. Since the site was unaware the LCO was not met, the Required Actions stated in the Technical Specification were not performed. As a result each Unit existed in a condition prohibited by Technical Specifications whenever the Unit was in an applicable mode of operation.

The condition existed since at least 1982 when the site did not reevaluate the appropriateness of the method used to remove power from the valve operator in light of no longer requiring CV306 to be shut during long-term ECCS operations. As a result this event is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B).

This event did not result in any actual nuclear safety consequences. Performance of the surveillance tests during this timeframe verified the valve remained in its full open position which would allow LPSI system to perform its safety function.

In Calvert Cliffs probabilistic risk analysis CV306 is analyzed in the following accident sequence:

A large or very large break LOCA occurs and CV306 spuriously closes. This prevents inventory control to the RCS and core damage occurs.

Although operator recovery at CV306 is plausible, that recovery is not modeled.

Using industry data from the Equipment Performance and Information Exchange database the failure rate of the valve to spuriously close over its mission time was assessed at 2E-5. The probability of a large or very large break initiating event is 6E-6. This then results in a core damage frequency of 1.2E-10. This postulated accident sequence has less than a 0.01 percent contribution to overall core damage frequency. This is a very small contribution to risk. Even if the industry failure rate is increased by a factor of 100, core damage frequency only increases to 1.2E-8, and the accident sequence contribution to overall core damage frequency only increases to 1.0 percent. Therefore the overall risk is not considered significant.

This event has no impact on the NRC Reactor Oversight Process Performance Indicators.

NRC FORM 366A � U.S. NUCLEAR REGULATORY COMMISSION (10-2010)� LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

I�SEQUENTIAL I�REV Calvert Cliffs Nuclear Power Plant, Unit 1 _05000 317 2012�-- 001 --�00 7�of�07 IV.�CORRECTIVE ACTIONS:

A. ACTION TO RETURN AFFECTED SYSTEMS TO PRE-EVENT NORMAL STATUS:

1.�Operators locked shut the manual valve on the instrument air line leading to CV306 valve positioner. The applicable Operating Instruction was revised to indicate this instrument air valve's normal operating position as locked shut.

B. ACTION TAKEN OR PLANNED TO PREVENT RECURRENCE:

1.�Revise Technical Specification Basis for SR 3.5.2.1 to identify the acceptable method used to remove power from CV306 valve operator.

If information is subsequently developed, that would significantly affect the understanding of this event, a supplemental licensee event report will be submitted.

V.�ADDITIONAL INFORMATION:

A. FAILED COMPONENTS:

None.

B. PREVIOUS LERS ON SIMILAR EVENTS:

A review of Calvert Cliffs reportable events during the last three years was performed. Although there were other LERs that involved conditions prohibited by Technical Specifications none of them involved the same underlying concern or reason for this event.

C. THE ENERGY INDUSTRY IDENTIFICATION SYSTEM (EllS) COMPONENT

REFERRED TO IN THIS LER:

COMPONENT� IEEE 803�IEEE 805 EllS FUNCTION SYSTEM ID �1CV306, LPSI Flow Control Valve FCV� BP 2CV306, LPSI Flow Control Valve FCV BP

D. SPECIAL COMMENTS:

None