ML25104A006
| ML25104A006 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 04/15/2025 |
| From: | Jack Giessner NRC/RGN-III/DORS/RPB1 |
| To: | |
| Shared Package | |
| ML25104A008 | List: |
| References | |
| Download: ML25104A006 (1) | |
Text
1 MD 8.3 Evaluation Decision Documentation for Reactive Inspection (Deterministic and Risk Criteria Analyzed)
PLANT:
Quad Cities Unit 1 EVENT DATE:
4/5/2025 DETERMINISTIC CRITERIA EVALUATION DATE:
4/7-10/2025 Brief Description of the Significant Operational Event or Degraded Condition:
On 4/5/2025, following a Unit 1 refueling outage, the licensee discovered that both trains of Reactor Building to suppression chamber vacuum breakers (AOV 1-1601-20A & B) were simultaneously inoperable due to a configuration control event that occurred during the restoration of the pressure suppression system following local leak rate testing during the outage. Specifically, root valve 1-1601-84B was left closed, which isolates multiple pressure and level instruments.
Due to this inoperability, the system was in a condition that could have prevented the fulfillment of a safety function. The licensee restored operability to both trains upon discovery by opening the associated valve. The licensee will perform a causal evaluation of the configuration control issue.
The Reactor Building to suppression chamber vacuum breakers operate as follows:
1.
Condensing steam in the Torus could cause a vacuum to be formed in the suppression chamber.
2.
The Reactor Building to suppression chamber vacuum breakers will relieve pressure from the Reactor Building to the suppression chamber if the differential pressure is greater than 0.5 psid.
3.
The vacuum relief system consists of two 100 percent flow pipes, each containing two vacuum relief breakers (1-1601-20A/B in series with 1-1601-31A/B). Operation of either flow pipe will maintain the differential pressure less than 2 psi, the external design pressure of the primary containment. The provision of two lines ensures redundancy.
4.
The inboard vacuum breaker in each flow pipe (1-1601-20A/B) is air operated. These valves are actuated when a d/p switch senses 0.5 psid Reactor Building to Torus Pressure. These valves fail open on a loss of instrument air pressure but would not cause a loss of primary containment integrity due to the 1601-31A/B mechanical vacuum breakers also installed in the line. The 31A/B valves are mechanical vacuum breakers that operate similar to a check valve which self-actuate on 0.5 psid to relieve the d/p across the valve.
An alarm is provided in the control room for each valve when the valve opens. A control switch and position indication for each valve is also located in the control room. If the air operated vacuum breaker fails to open when needed, the control room would receive the Torus to Reactor Building negative dp alarm (control room annunciator, B-14) and PI 1-1602-1 would be indicating more negative than -1.0 Hg (0.5 psid). QCOA 1600-01, Failure of Reactor Building to Torus Vacuum Breakers, directs operators to open 1-1601-20A or B with the control switch until Torus pressure returns to zero.
Circumstances of Discovery: A licensee equipment operator on rounds noted the A Joy Air Compressor was running; loaded and receiver pressure was low out of spec at approximately 65#.
The B Joy Air Compressor was started, and the A Joy Air Compressor was secured per station procedure. The B Joy Air Compressor was also not able to maintain the receiver pressure.
2 Further investigation revealed that DP controller 1-1640-15 did not appear to be sensing the differential pressure between the Drywell and the Torus appropriately. Equipment operators were dispatched to look for potential leaks and verify system lineups. It was discovered that the 1/2 instrumentation line isolation valves 1-1601-84B and 1-1601-95 were closed. Both valves were directed to be opened immediately.
Note: While in this misaligned configuration, Unit 1 was in a number of Technical Specification (TS)
Action Statements, the most limiting being a 1-hour to restore or place the plant in a shutdown condition. The plant was in this configuration for about 6 days, which was a condition prohibited by TS.
1-1601-84B is a root valve that isolates several differential pressure and pressure instruments. Most notably, with 1-1601-84B closed:
1.
Differential Pressure Switch 1-1632-A/B would not have opened 1-1601-20A and 1-1601-20B on 0.5 psid as designed.
2.
Control room annunciator B-14, Torus to Reactor Building Negative Differential Pressure, would not have alerted operators to a rising vacuum in the suppression chamber.
3.
Pressure Instrument 1-1602-1 would not have indicated accurate Torus to Reactor Building pressure.
4.
QCOA 1600-01 would not have been effective given the lack of alarm and pressure indication in the control room to alert the operators to take action.
5.
With instrument air available, the pressure relieving capability of the mechanical vacuum breakers (1-1601-31A and 1-1601-31B) would be unavailable because the valves would be isolated from the suppression chamber by 1-1601-20A and 1-1601-20B, respectively.
1-1601-84B was shut during the outage to perform local leak rate testing in accordance with QCOS 0100-49, Drywell/Torus Purge Supply Local Leak Rate Test. The test was performed on or around March 28, 2025. QCOS 0100-49, section H.4, states:
WHEN testing is complete, THEN restore the system as follows OR as directed by the unit supervisor.
This section of the procedure contained the direction to verify open 1-1601-84B. The section was marked as being directed by the unit supervisor to be left closed. It is not known how 1-1601-95 became shut, but 1-1601-84B also isolates the instrument line that was isolated by 1-1601-95.
Y/N DETERMINISTIC CRITERIA
- 1. Involved operations that exceeded, or were not included in, the design bases of the facility Y
Remarks: The function of the reactor building-to-suppression chamber vacuum breakers is to relieve vacuum when primary containment depressurizes below reactor building pressure by mitigating the negative differential pressure via flow through the Reactor
3 Building to suppression chamber vacuum breakers and through the suppression chamber to drywell vacuum breakers. The external vacuum breakers are sized based on the air flow from the secondary containment that is required to mitigate the depressurization transient and limit the maximum negative containment (drywell and suppression chamber) pressure to within design limits. Operating with both trains of these vacuum breakers simultaneously inoperable due to valve misalignments results in the loss of that vacuum break function. Additionally, the control room did not have the alarm or pressure indication needed to identify the need for manual action in accordance with the sites abnormal operating procedure.
Typically, safety-related equipment is designed to be single failure proof such that one action/failure should not prevent a complete loss of safety function. However, this event appeared to demonstrate the design of the reactor building to suppression chamber vacuum breakers may not be single failure proof since the closure of one valve caused a complete loss of safety function.
- 2. Involved a major deficiency in design, construction, or operation having potential generic safety implications N
Remarks:
- 3. Led to a significant loss of integrity of the fuel, primary coolant pressure boundary, or primary containment boundary of a nuclear reactor N
Remarks:
- 4. Led to the loss of a safety function or multiple failures in systems used to mitigate an actual event Y
Remarks: The as-found condition of 1-1601-84B resulted in the loss of safety function of the Reactor Building to suppression chamber vacuum breakers. Additionally, one of two instruments used to indicate Torus level, LI-1640-10B, during Post Accident Monitoring was not operable.
- 5. Involved possible adverse generic implications N
Remarks:
- 6. Involved significant unexpected system interactions N
Remarks:
- 7. Involved repetitive failures or events involving safety-related equipment or deficiencies in operations N
Remarks: While there have historically been instances of inappropriately N/A-ing steps (See discussion below in question 8 for more detail on historical examples), in this instance, the steps were marked as left closed per US [Unit Supervisor], which appears to have been allowed by procedure; however, the breakdown appeared to have occurred as a result of a failure to ensure control via another process, as required by procedure.
4
- 8. Involved questions or concerns pertaining to licensee operational performance Y
Remarks: The restoration steps were lined out as not needing to be performed, being marked left closed per US. In such cases, there are additional procedural requirements for maintaining configuration control of equipment important to safety when components will be intentionally left out of the normally expected procedural alignment. Specifically, it appears as though the requirements of OP-AA-108-101, Control of Equipment and System Status, Revision 20, did not occur to ensure another formal process was tracking the position of 1-1601-84B when it was not in its normal position. Step 4.1, Abnormal Equipment Positioning, required that either an Abnormal Component Position Sheet (ACPS) or Equipment Status Tags (ESTs) be used to track components outside their normal configuration; neither appears to have been done in this case.
The site also has Human Performance procedures that outline what to do in a circumstance where a required procedural step is seen as not applicable.
It appears the human performance tools were not used effectively to prevent this configuration control event from occurring.
As a result, the affected components remained in their isolated position resulting in the pressure suppression system not being restored to operability prior to Unit 1 entering the TS modes of applicability (Modes 1, 2, and 3), until identified on 4/5/2025.
CONDITIONAL RISK ASSESSMENT RISK ANALYSIS BY: Josh Havertape DATE: 4/10/2025 Brief Description of the Basis for the Assessment (may include assumptions, calculations, references, peer review, or comparison with licensees results):
A regional senior reactor analyst (SRA), using SAPHIRE version 8.2.12, and the Quad Cities SPAR model version 8.82, completed a condition assessment for the degraded condition associated with the reactor building to suppression chamber vacuum breakers. The SRA noted that the containment incorporated a vapor suppression system that included a drywell and suppression chamber connected by vent pipes. In the event of a loss of coolant accident, steam and non-condensable gases would be directed from the drywell through these vent pipes into the suppression chamber, where the steam is condensed, reducing the pressure within the containment. The vapor suppression system is equipped with two different types of vacuum breakers to eliminate excessive pressure differentials that could compromise containment integrity and challenge the functionality of emergency core cooling systems:
Suppression chamber to drywell vacuum breakers, which prevent drywell pressure from being significantly less than the suppression chamber Reactor building to suppression chamber vacuum breakers, which prevent the suppression chamber pressure from being significantly less than the reactor building
5 The degraded condition resulted in a loss of the automatic function for the reactor building to suppression chamber vacuum breakers. These components were not explicitly represented in the Quad Cities SPAR model. However, they were noted by the SRA to support the vapor suppression system function for loss of coolant accidents as described by the technical specification bases for the reactor building to suppression chamber vacuum breakers. Specifically, they are required to be operable to satisfy safety analysis assumptions involving a loss of coolant accident followed by actuation of containment spray. Therefore, the analyst assumed the vapor suppression system function was not available in these scenarios. This was a key assumption in the evaluation and was recognized as potentially conservative. The following additional assumptions and factors were considered in the evaluation:
The degraded condition was represented by setting the basic events below to TRUE.
o Vapor suppression fails during large LOCA (VSS-SYS-FC-LLOCA),
o Vapor suppression fails during medium LOCA (VSS-SYS-FC-MLOCA), and o
Vapor suppression fails during small LOCA (VSS-SYS-FC-SLOCA).
The exposure period was assumed to be approximately 6 days.
No recovery credit was assigned because the degraded condition resulted in a loss of indication that would cue operators to open the vacuum breakers manually.
The degraded condition was judged to increase the conditional large early release probability but was not evaluated quantitatively. This was judged to be a key uncertainty in the evaluation since containment integrity significance determination guidance lists components important to suppression chamber integrity as important to LERF (IMC 0609, App H, Table 4.1).
This assessment did not account for contribution by external events, which were not expected to be dominant, but would increase the safety significance associated with the degraded condition.
The dominant core damage sequence in the evaluation was a medium loss of coolant accident that progressed to core damage. The estimated incremental conditional core damage probability (ICCDP) is 1.6E-6/year and places the risk in the overlap range of No Additional Inspection and Special Inspection.
RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION DECISION AND DETAILS OF THE BASIS FOR THE DECISION:
A special inspection is recommended based on outstanding questions regarding licensee operational performance, extent of condition, potential single point vulnerabilities, and the ICCDP of this event.
Licensee operational performance - Extent of cause issues may exist related to operational decision-making and inappropriate procedure use and adherence practices for more than just the one individual involved. A special inspection team would enable the Region to gather and assess
6 timely information regarding the licensees efforts in identifying and addressing any adverse safety culture behaviors demonstrated through this event and the entire local leak rate test work control process during the refueling outage.
Extent of condition -The possibility exists that the individual(s) involved with this configuration control event may have contributed to additional errors that have yet to be revealed, which may adversely impact the performance of additional safety functions. Based on the failure to restore, it is not known how the site controlled configuration overall during the outage. A special inspection team would enable the Region to gather and assess timely information regarding the licensees efforts in addressing the potential extent of condition, commensurate with the risk importance of the systems involved.
Single point vulnerability - This event appeared to demonstrate the design of the reactor building to suppression chamber vacuum breakers (a dual train safety system) may not be single failure proof since the closure of one valve caused a complete loss of safety function. A special inspection team would enable the Region to gather and assess information regarding this potential design issue.
ICCDP - 1.6E-6/year places the risk in the overlap range of No Additional Inspection and Special Inspection.
Given the totality of the circumstances, a special inspection is recommended to better understand if the operational performance behaviors, extent of condition, or potential single point vulnerabilities represent a significant safety concern at Quad Cities.
BRANCH CHIEF: Robert Ruiz DATE: 04/14/2025 SRA: Josh Havertape DATE: 04/14/2025 DIVISION DIRECTOR: Jason Kozal DATE: 04/14/2025 DIVISION DIRECTOR:
DATE:
RA: Jack Giessner DATE: 04/15/2025 ADAMS ACCESSION NUMBER: ML25104A006 ADAMS PACKAGE ACCESSION NUMBER: ML25104A008 EVENT NOTIFICATION REPORT NUMBER (as applicable):
Internal Distribution List is at the end of this document.
Signed by Ruiz, Robert on 04/14/25 Signed by Havertape, Joshua on 04/14/25 Signed by Kozal, Jason on 04/14/25 Signed by Giessner, Jack on 04/15/25
7 Decision Documentation for Reactive Inspection (Deterministic-only Criteria Analyzed)
PLANT:
EVENT DATE:
EVALUATION DATE:
Brief Description of the Significant Event or Degraded Condition:
REACTOR SAFETY Y/N IIT Deterministic Criteria 1.
Led to a Site Area Emergency N
Remarks:
2.
Exceeded a safety limit of the licensees technical specifications N
Remarks:
3.
Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission N
Remarks:
Y/N SI Deterministic Criteria N
4.
Significant failure to implement the emergency preparedness program during an actual event, including the failure to classify, notify, or augment onsite personnel Remarks:
Y 5.
Involved significant deficiencies in operational performance which resulted in degrading, challenging, or disabling a safety system function or resulted in placing the plant in an unanalyzed condition for which available risk assessment methods do not provide an adequate or reasonable estimate of risk.
Remarks: (See Deterministic questions 4 and 8 in previous section which discuss the loss of safety function which involved significant deficiencies in operational performance.)
8 RADIATION SAFETY Y/N IIT Deterministic Criteria 1.
Led to a significant radiological release (levels of radiation or concentrations of radioactive material in excess of 10 times any applicable limit in the license or 10 times the concentrations specified in 10 CFR Part 20, Appendix B, Table 2, when averaged over a year) of byproduct, source, or special nuclear material to unrestricted areas N
Remarks:
2.
Led to a significant occupational exposure or significant exposure to a member of the public. In both cases, significant is defined as five times the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)
N Remarks:
3.
Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use, which resulted in the exposure of a significant number of individuals N
Remarks:
4.
Involved byproduct, source, or special nuclear material, which may have resulted in a fatality N
Remarks:
5.
Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission N
Remarks:
Y/N AIT Deterministic Criteria 6.
Led to a radiological release of byproduct, source, or special nuclear material to unrestricted areas that resulted in occupational exposure or exposure to a member of the public in excess of the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)
N Remarks:
9 7.
Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use and had the potential to cause an exposure of greater than 5 rem to an individual or 500 mrem to an embryo or fetus N
Remarks:
8.
Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 10 rads/hr or contamination of the packaging exceeding 1000 times the applicable limits specified in 10 CFR 71.87 N
Remarks:
9.
Involved the failure of the dam for mill tailings with substantial release of tailings material and solution off site N
Remarks:
Y/N SI Deterministic Criteria
- 10. May have led to an exposure in excess of the applicable regulatory limits, other than via the radiological release of byproduct, source, or special nuclear material to the unrestricted area; specifically occupational exposure in excess of the regulatory limits in 10 CFR 20.1201 exposure to an embryo/fetus in excess of the regulatory limits in 10 CFR 20.1208 exposure to a member of the public in excess of the regulatory limits in 10 CFR 20.1301 N
Remarks:
- 11. May have led to an unplanned occupational exposure in excess of 40 percent of the applicable regulatory limit (excluding shallow-dose equivalent to the skin or extremities from discrete radioactive particles)
N Remarks:
- 12. Led to unplanned changes in restricted area dose rates in excess of 20 rem per hour in an area where personnel were present or which is accessible to personnel N
Remarks:
- 13. Led to unplanned changes in restricted area airborne radioactivity levels in excess of 500 DAC in an area where personnel were present or which is accessible to personnel and where the airborne radioactivity level was not promptly recognized and/or appropriate actions were not taken in a timely manner N
Remarks:
10
- 14. Led to an uncontrolled, unplanned, or abnormal release of radioactive material to the unrestricted area for which the extent of the offsite contamination is unknown; or, that may have resulted in a dose to a member of the public from loss of radioactive material control in excess of 25 mrem (10 CFR 20.1301(e)); or, that may have resulted in an exposure to a member of the public from effluents in excess of the ALARA guidelines contained in Appendix I to 10 CFR Part 50 N
Remarks:
- 15. Led to a large (typically greater than 100,000 gallons), unplanned release of radioactive liquid inside the restricted area that has the potential for ground-water, or offsite, contamination N
Remarks:
- 16. Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 5 times the accessible area dose rate limits specified in 10 CFR Part 71, or 50 times the contamination limits specified in 49 CFR Part 173 N
Remarks:
- 17. Involved an emergency or non-emergency event or situation, related to the health and safety of the public or on-site personnel or protection of the environment, for which a 10 CFR 50.72 report has been submitted that is expected to cause significant, heightened public or government concern N
Remarks:
11 SAFEGUARDS/SECURITY Y/N IIT Deterministic Criteria 1.
Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission N
Remarks:
2.
Failure of licensee significant safety equipment or adverse impact on licensee operations as a result of a safeguards initiated event (e.g., tampering).
N Remarks:
3.
Actual intrusion into the protected area N
Remarks:
Y/N AIT Deterministic Criteria 4.
Involved a significant infraction or repeated instances of safeguards infractions that demonstrate the ineffectiveness of facility security provisions N
Remarks:
5.
Involved repeated instances of inadequate nuclear material control and accounting provisions to protect against theft or diversions of nuclear material N
Remarks:
6.
Confirmed tampering event involving significant safety or security equipment N
Remarks:
7.
Substantial failure in the licensees intrusion detection or package/personnel search procedures which results in a significant vulnerability or compromise of plant safety or security N
Remarks:
12 Y/N SI Deterministic Criteria 8.
Involved inadequate nuclear material control and accounting provisions to protect against theft or diversion, as evidenced by inability to locate an item containing special nuclear material (such as an irradiated rod, rod piece, pellet, or instrument)
N Remarks:
9.
Involved a significant safeguards infraction that demonstrates the ineffectiveness of facility security provisions N
Remarks:
- 10. Confirmation of lost or stolen weapon N
Remarks:
- 11. Unauthorized, actual non-accidental discharge of a weapon within the protected area N
Remarks:
- 12. Substantial failure of the intrusion detection system (not weather related)
N Remarks:
- 13. Failure to the licensees package/personnel search procedures which results in contraband or an unauthorized individual being introduced into the protected area N
Remarks:
- 14. Potential tampering or vandalism event involving significant safety or security equipment where questions remain regarding licensee performance/response or a need exists to independently assess the licensees conclusion that tampering or vandalism was not a factor in the condition(s) identified N
Remarks:
13 RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION.
DECISION AND DETAILS OF THE BASIS FOR THE DECISION:
See section above.
BRANCH CHIEF:
DATE:
SRA:
DATE:
DIVISION DIRECTOR:
DATE:
DIVISION DIRECTOR:
DATE:
ADAMS ACCESSION NUMBER:
ADAMS PACKAGE ACCESSION NUMBER:
EVENT NOTIFICATION REPORT NUMBER (as applicable):
Distribution: Alejandro.Alen@nrc.gov; Scott.Morris@nrc.gov; Jason.Carneal@nrc.gov; John.Giessner@nrc.gov; Mohammed.Shuaibi@nrc.gov; Blake.Welling@nrc.gov; Ray.McKinley@nrc.gov; Mark.Franke@nrc.gov; Gregory.Suber@nrc.gov; Laura.Pearson@nrc.gov; LaDonna.Suggs@nrc.gov; Ravi.Penmetsa@nrc.gov; Jason.Kozal@nrc.gov; Billy.Dickson@nrc.gov; David.Curtis@nrc.gov; Jared.Heck@nrc.gov;Geoffrey.Miller@nrc.gov; Nick.Taylor@nrc.gov; Karla.Stoedter@nrc.gov; Doris.Chyu@nrc.gov; Joshua.Havertape@nrc.gov; Lionel.Rodriguez@nrc.gov; Matthew.Leech@nrc.gov; NRR_Reactive_Inspection.Resource@nrc.gov; Robert.Ruiz@nrc.gov