ML18072A326

High-Pressure Core Spray System Inoperable Due to Injection Valve Stem-Disc Separation- Precursor (LER 374-2017-003)

ML18072A326
Person / Time
Site:	LaSalle
Issue date:	07/09/2018
From:	Dale Yeilding NRC/RES/DRA/PRB
To:
Shared Package
ML18157A263	List: ML18072A326 ML18157A264 ML18180A326
References
LER 374-2017-001, LER 374-2017-002, LER 374-2017-003, LER 374-2017-003-01 IR 2017009
Download: ML18072A326 (11)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research LaSalle County High-Pressure Core Spray System Inoperable due to Injection Station, Unit 2 Valve Stem--Disc Separation 374-2017-003-01, 374-2017-001, LERs:

Event Date: 2/11/2017 374-2017-002 CDP = 2x10-5 IR: 05000374/2017009 Plant Type: General Electric 5 Boiling-Water Reactor (BWR) with a Mark II Containment Plant Operating Mode Mode 5 (0% Reactor Power)

(Reactor Power Level):

Analyst: DEY 3/22/2018 Reviewer: Approval Date:

Non-Concur: ADAMS ML18157A263 Christopher Hunter 6/27/2018 EXECUTIVE

SUMMARY

During a refueling outage with the reactor in mode 5, the Unit 2 high-pressure core injection (HPCS) system was declared inoperable on February 8, 2017, to support performance of a water leak rate test and stem lubrication/rotation check of the HPCS injection valve 2E22-F004.

On February 11th, while attempting to fill and vent the HPCS system, no flow was observed from the drywell vent valves or downstream of valve 2E22-F004. Valve 2E22-F004 was cycled to verify the valve was open; however, no air or water was observed from the drywell vents.

Trouble shooting revealed that there was no flow downstream of valve 2E22-F004. Operators determined that valve 2E22-F004 failed sometime after the successful leak rate tests on February 8, 2017, when the valve was cycled successfully five times, and most likely during the fill and vent sequence. Prior to this failure, valve 2E22-F004 was not operated since the plants last refueling outage in 2015. The licensee concluded the cause of the valve malfunction was due to stem-disc separation. The valve internal components were replaced prior to restart of the unit from the refueling outage.

This exposure period in which HPCS was unavailable is a significant modeling uncertainty for this accident sequence precursor (ASP) analysis. The duration of the exposure period is based on the length of time that the HPCS system would have been unavailable to perform its safety function. In this case, whether the HPCS system would have been able to perform its safety function is dependent on whether it would have been expected to cycle a greater number of times than it was successfully cycled since the 2015 refueling outage and prior to the observed failure. During a postulated loss of feedwater event with RCIC unavailable, the HPCS injection valve will automatically cycle a number of times after a reactor trip as reactor water level alternates between Level 2 (reactor water low level setpoint) and Level 8 (reactor water level high setpoint). If operators take manual control to maintain reactor water level, the number of HPCS/HPCI system cycles will increase depending on how close to the level setpoints reactor water level is maintained.

In licensee event report (LER) 374-2017-003-01 (Ref. 1), the licensee states that only four injection cycles are needed to maintain the design function of HPCS. No additional information was provided in the LER that supported this conclusion. Operating experience is limited on the number of HPCS cycles during loss of feedwater events with a RCIC unavailability because 1

LER 374-2017-003-01 they are relatively rare. In addition, data on the number of HPCS cycles is not typically included in LERs and other readily available data sources. However, a loss of offsite power (LOOP) event with a subsequent RCIC unavailabilty occurred at Perry Nuclear Power Plant in 2003 involving 16 HPCS cycles prior to operators initiating shutdown cooling. Relevant thermal-hydraulic calculations performed as part of NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, show that high-pressure coolant injection (HPCI) would cycle eight times given a loss of feedwater and RCIC at Peach Bottom Atomic Power Station. As such, because it is expected that valve 2E22-F004 would have needed to cycle more than five times to ensure completion of the HPCS safety function, HPCS was assumed to be unable to fulfill its safety function since the plants last refueling outage in 2015.

Therefore, the maximum exposure time of 1 year is used in this ASP analysis.

The point estimate increase in core damage probability (CDP) for this event is 1.8x10-5, which is considered a precursor in the ASP Program. According to the risk analysis modeling assumptions used in this ASP analysis, the most likely core damage scenarios involve initiating events that result in a loss of feedwater (include LOOP, loss of instrument air, etc.) and subsequent failures/unavailabilities of HPCS, reactor core isolation cooling (RCIC), and the failure of manual reactor depressurization. Collectively, these accident sequences account for approximately 62 percent of the CDP for the event.

Inspectors identified a licensee violation related to inadequate design control for the HPCS injection valve 2E22-F004; however, the NRC exercised enforcement discretion because no licensee performance deficiency was identified. Specifically, inspectors determined that this issue was not within the licensees ability to foresee and correct. The determination was partially based on the fact that it was a latent design issue that had not been previously identified within the industry. Since no licensee performance deficiency was identified for this event, an independent ASP analysis was required.

EVENT DETAILS Event Description. During a refueling outage with the reactor in mode 5, the Unit 2 HPCS system was declared inoperable on February 8, 2017, to support performance of a water leak rate test and stem lubrication/rotation check of the HPCS injection valve 2E22-F004. On February 11th, while attempting to fill and vent the HPCS system, no flow was observed from the drywell vent valves or downstream of valve 2E22-F004. Valve 2E22-F004 was cycled to verify the valve was open; however, no air or water was observed from the drywell vents. Trouble shooting revealed that there was no flow downstream of valve 2E22-F004. Prior to this fill and vent sequence, the HPCS system had been taken out of service for leak rate testing and then drained for relief valve work. The leak rate tests (which involved cycling the valve 2E22-F004 valve open and closed) all passed satisfactory. Upon completion of those tests, the system was drained from the drywell down to the pump suction. System parameters observed during the leak rate tests provided firm evidence that the HPCS injection isolation valve satisfactorily cycled as designed. Therefore, operators determined that valve 2E22-F004 failed sometime after the successful leak rate tests, when the valve was cycled successfully five times, and most likely during the fill and vent sequence. The licensee concluded the cause of the valve malfunction was due to stem-disc separation. The valve internal components were replaced prior to restart of the unit from the refueling outage. Additional information regarding this event can be found in LER 374-2017-003-01(Ref. 1) and inspection report (IR) 05000374/2017009 (Ref. 2).

2

LER 374-2017-003-01 Cause. The licensee determined the root cause of the HPCS injection valve 2E22-F004 malfunction was due to stem-disc separation. The valve stem threads and wedge pin were found to be damaged, causing separation from the valve disc. The stem-disc separation was due to to insufficient capacity of the shrink-fit stem collar, combined with multiple high-load closing cycles (with both axial thrust and torque components), resulting in loosening and eventual shear failure of the wedge pin and threads. A contributing cause was insufficient preload and insufficient capacity of the stem collar and wedge pin assembly. In particular, the collar axial load capacity was 50-60 percent of the normal applied loads, allowing collar slippage along the stem to occur. The inspection report stated that the licensee incorrectly identified the weak link of the valves as the valve stem, instead of the stem-to-wedge threaded and pinned connection, which had a more limiting structural capacity.

MODELING ASSUMPTIONS Basis for ASP Analysis/SDP Results. The ASP Program uses Significance Determination Process (SDP) results for degraded conditions when available and as applicable. However, an independent ASP analysis is performed for potentially risk significant events when no licensee performance deficiency is identified (i.e., no SDP risk analysis is completed).

The NRC conducted a special inspection for the event associated with LER 374-2017-003-01 in accordance with Management Directive 8.3, NRC Incident Investigation Program.1. A violation related to inadequate design control for the HPCS injection valve 2E22-F004 was identified; however, the NRC exercised enforcement discretion because no licensee performance deficiency was identified. Specifically, NRC inspectors determined that this issue was not within the licensees ability to foresee and correct. The determination was partially based on the fact that it was a latent design issue that had not been previously identified within the industry. See IR 05000374/2017009 for additional information. An independent ASP analysis is required because no licensee performance deficiency was identified for this event.

A search of LaSalle County Station (Unit 2) LERs revealed the following potential windowed events:

• LER 374-2017-001 (Ref. 3) is associated with a reactor scram that occurred on January 23, 2017. Operators manually scrammed the reactor due to a main generator run-back caused by a generator stator winding cooling system malfunction. All equipment functioned as designed in response to this event; however, HPCS would have failed to fulfill its safety function if demanded due to its failed injection valve 2E22-F004. An initiating event assessment shows that a reactor scram without HPCS results in a conditional core damage probability of 3x10-6. The risk of this initiating event assessment sensitivity case is lower than the CDP of the condition assessment of HPCS unavailable for 1 year (3x10-5). Therefore, this windowed event is not considered further as part of this analysis.

• LER 374-2017-002 (Ref. 4) is associated with a potential unavailability of the HPCS system caused by stem-disc separation of a diesel generator cooling water system backwash valve. Because the HPCS system was already unavailable due to the failed 1 Four deterministic criteria were met because the event: involved a major deficiency in design, construction, or operation having potential generic safety implications; led to the loss of a safety function or multiple safety failures in systems used to mitigate an actual event; involved possible adverse generic implications; and involved repetitive failures or events involving safety-related equipment or deficiencies in operations. The risk evaluation for this degraded condition resulted in a CDP of 2.5x10-5. Based on the deterministic criteria met and the results of the risk evaluation, a special inspection was performed.

3

LER 374-2017-003-01 injection valve 2E22-F004, this windowed event is not considered further as part of this analysis.

Analysis Type. A condition assessment was performed using a newly created trial and limited use LaSalle standardized plant analysis risk (SPAR) model Revision 8.52, created on February 21, 2017.

Exposure Period. On February 11, 2017, the HPCS injection valve 2E22-F004 was found to be failed in closed position due to stem-disc separation. This valve was successfully cycled just three days earlier on February 8th. Prior to this, valve 2E22-F004 was not operated since the plants last refueling outage in 2015.2 During postulated initiating events in which feedwater is unavailable, HPCS and RCIC system can provide a source of high-pressure inventory makeup to the reactor. If RCIC is available, it is typically the preferred source for reactor water level control because it is easier control (as compared to HPCS).3 The risk impact of HPCS being unavailable is minimal as long as RCIC is available for most scenarios (with the exception of loss-of-coolant accidents).4 If RCIC is unavailable, then HPCS is the sole source of high-pressure injection into the reactor.5 The duration of the exposure period is based on the length of time that the HPCS system would have been unavailable to perform its safety function. In this case, whether the HPCS system would have been able to perform its safety function is dependent on whether it would have been expected to cycle a greater number of times than it was successfully cycled since the 2015 refueling outtage and prior to the observed failure. During a postulated loss of feedwater event, the HPCS injection valve will automatically cycle a number of times after a reactor trip as reactor water level alternates between Level 2 (reactor water low level setpoint) and Level 8 (reactor water level high setpoint). In LER 374-2017-003-01, the licensee states that only four injection cycles are needed to maintain the safety function of HPCS. No additional information was provided for this assumption.

Operating experience is limited on the number of HPCS cycles during events where feedwater and RCIC are both lost because these events are relatively rare. In addition, data on the number of HPCS (or HPCI) system cycles is not typically included in LERs and other readily available data sources. However, an applicable event that included the relevant information occurred at Perry Nuclear Power Plant. Specifically, LER 440-2013-002-01 describes the LOOP event that occurred on August 14, 2003, due to the Northeast Blackout. During the event response, both HPCS and RCIC were initiating when reactor water level decreased to reactor water low level setpoint (Level 2). Use of RCIC was discontinued after one injection cycle because continued use would have resulted in an automatic isolation of RCIC due to high steam tunnel temperature (caused by a loss of ventilation as a result of the LOOP). HPCS was cycled a total of 16 times prior to operators initiating shutdown cooling.

2 The valve is only opened during testing when the plant is shutdown or actual system demands (i.e., HPCS inject to the reactor).

3 Typically, HPCS has a flow rate approximately an order-of-magnitude greater than RCIC.

4 During a small loss-of-coolant accident, RCIC can provide initial reactor inventory control; however, a source of low-pressure injection is needed to bring the plant to a safe/stable end-state. The HPCS system capacity is sufficient to bring the plant to safe/stable end state (along with suppression pool cooling) during a small loss-of-coolant accident.

5 The control rod drive system can also provide high-pressure inventory makeup to the reactor. However, its flow rate is typically not sufficient to provide reactor water level control immediately after a reactor trip. Therefore, it is not typically credited for early high-pressure injection in most PRAs.

4

LER 374-2017-003-01 Another source of information that provides an estimate on the number of HPCS/HPCI system cycle are thermal-hydraulic calculations. NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models Surry and Peach Bottom, provides some relevant calculations for Peach Bottom Atomic Power Station. Case 7, a LOOP and subsequent station blackout with RCIC unavailable, estimates that HPCI would cycle eight times. The Surry and Peach Bottom plants are relevant due to the availability of mature and well exercised MELCOR input models arising from the State-of-the-Art Reactor Consequence Analyses (SOARCA) project. This calculation assumes HPCI system is cycled automatically between Level 2 and Level 8 automatically. If operators take manual control to maintain reactor water level, the number of HPCS/HPCI system cycles will increase.6 Based on this information, the best estimate case for this ASP analysis assumes that HPCS was unable to fulfill its safety function since the plants last refueling outage in 2015. Therefore, the maximum exposure time of 1 year is used. This assumption is considered a key modeling uncertainty.

SPAR Model Modifications. The following SPAR model corrections (unrelated to the analysis) were made to update and create the test and limited use model for the condition analysis:

• Changes were made to the DG0 (LaSalle diesel generator 0) fault tree associated with the emergency diesel generator (EDG) 0 that can be aligned to either unit. The swing EDG will align preferentially to the unit that has a LOOP with an ECCS actuation signal.

To account for the potential that the swing EDG may be unavailable to Unit 2 due to a LOOP with a subsequent loss-of-coolant accident (LOCA), the modeling associated with the failure of the opposite unit safety relief valves (SRV) failure to reclose during a site-wide LOOP was modified. New basic events were added for the SRVs from the opposite unit to replace the modeling of the SRVs in the same unit undergoing the LOOP. The following basic events were inserted under the existing OR gate DG030 (see Figure B-1 in Appendix B):

PPR-SVR-OO-1VLVU1, One BWR SRV Fails to Close on Opposite Unit PPR-SVR-OO-2VLVU1, Two or More BWR SRV Fails to Close on Opposite Unit PPR-SVR-OO-3VLVU1, Three or More BWR SRV Fails to Close on Opposite Unit

• Additional changes were made to the DG0 fault tree to include the probability of the LOOP affecting both units that could result in the transfer of the swing EDG to the opposite unit in the event of stuck-open SRV(s) in the opposite unit during a site-wide LOOP. House basic events triggered by various site-wide LOOP events were inserted under new AND gates under the existing OR gate DG031 (see Figure B-1 in Appendix B):

OEP-VCF-LP-SITEGR, Site LOOP (Grid-Related)

OEP-VCF-LP-SITEWR, Site LOOP (Weather Related OEP-VCF-LP-SITESC, Site LOOP (Site LOOP (Switchyard Centered)

OEP-VCF-LP-SITEPC, Site LOOP (Plant Centered 6 Discussions with NRC inspectors indicate that the number of HPCS system cycles could be between 20-40 during a postulated loss of feedwater transients with RCIC unavailable. The number of cycles would depend on how close operators maintain reactor water level between the Level 2 and Level 8 setpoints and how quickly shutdown cooling could be initiated.

5

LER 374-2017-003-01 Key Modeling Assumptions. The following assumptions were determined to be significant to the modeling of this event:

• Basic event HCS-MOV-CC-F004 (HPCS injection valve fails to open) was set to TRUE because HPCS injection valve 2E22-F004 was failed in the closed position due to the stem-disc separation.

Dependency. The most likely core damage scenarios for this event involve initiating events with human performance aspects that result in a loss of feedwater (include LOOP, loss of instrument air, etc.) and subsequent failures/unavailabilities of HPCS, RCIC, and the failure of manual reactor depressurization using the automatic depressurization system. These three systems are designed to initiate automatically; however, if the automatic start/control functions fail (or under certain conditions) these systems can be control manually by operators. Generally speaking, dependence may exist when the failure of a human action in an accident sequence or cut set potentially increases the likelihood of failure of a later human action. The dominant cut sets for this analysis that contained multiple human failure events were reviewed to determine the potential for dependency. Based on this review, it was concluded that dependency was either unlikely for the applicable cut sets or the explicit treatment of dependency would not result in a significant change in the numerical results of the analysis..

ANALYSIS RESULTS CDP. The point estimate CDP for this event is 1.75x10-5. The ASP Program acceptance threshold is a CCDP of 1x10-6 for degraded conditions. Therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequence is a loss of main feedwater sequence 59 (CDP = 4.81x10-6) that contributes approximately 27 percent of the total internal events CDP. This sequence is shown graphically in Figure A-1. The sequences that contribute at least 1 percent of the total internal events CDP are provided in the following table.

Dominate Sequences with Event Descriptions Sequence CDP Percentage Description Loss of main feedwater; successful reactor trip; SRVs operate and successfully close; HPCS LOMFW 59 4.81x10-6 27.49%

fails; RCIC fails; and reactor depressurization fails Loss of offsite power (all types); successful reactor trip; EDG loads; SRVs operate and LOOP 40 2.22x10-6 12.70%

successfully close; HPCS fails; RCIC fails; and reactor depressurization fails Loss of offsite power; successful reactor trip; EDG loads; SRVs operate and successfully close, HPCS fails; RCIC injects; suppression LOOP 19 1.56x10-6 8.91%

pool cooling fails; successful depressurization; shutdown cooling fails; containment spray fails; containment venting fails Loss of instrument air; successful reactor trip; offsite power available, SRVs operate and LOIAS 56 1.06x10-6 6.06%

successfully close; HPCS fails; RCIC fails; and reactor depressurization fails 6

LER 374-2017-003-01 Dominate Sequences with Event Descriptions Sequence CDP Percentage Description Medium loss of coolant accident; successful MLOCA 14 9.25x10-7 5.29%

reactor trip; HPCS fails; depressurization fails General transient; successful reactor trip; offsite power available; SRVs operate and successfully TRANS 66 7.17x10-7 4.10% close; turbine bypass fails to remove heat, feedwater failure, HPCS fails; RCIC fails; and reactor depressurization fails Loss of offsite power (all types), successful reactor trip; onsite emergency power fails; SRVs operate and successfully close; recirculation LOOP 43-25 5.92x10-7 3.38% pump seal fails; HPCS fails; RCIC injects; refill condensate storage tank (CST) to extend RCIC; successful DC load shed; recover offsite power in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, recover EDG in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> Loss of service water; successful reactor trip, offsite power available, SRVs operate and successfully close, HPCS fails, RCIC injects; LOSWS 27 4.78x10-7 2.73% suppression pool cooling fails; successful depressurization; low pressure injection succeeds; shutdown cooling fails; service water recovery fails; low pressure injection fails Loss of main feedwater; successful reactor trip; LOMFW 60-29 4.65x10-7 2.66% offsite power available; HPCS fails; RCIC fails; failure to depressurize Loss of service water, successful reactor trip; offsite power available; loss of feedwater; HPCS fails; RCIC injects; low pressure injection LOSWS 58-12 3.75x10-7 2.14%

succeeds; suppression pool cooling fails; containment spray fails; service water recovery fails Loss of Service Water, successful reactor trip; offsite power available; SRVs operate and LOSWS 57 3.73x10-7 2.13%

successfully close; HPCS fails; RCIC fails; and reactor depressurization fails Loss of instrument air; successful reactor trip; offsite power available; loss of feedwater; HPCS fails; RCIC injects; low pressure injection LOIAS 57-12 3.65x10-7 2.09%

succeeds; suppression pool cooling fails; containment spray fails; instrument air recovery fails General transient; successful reactor trip; Consequential loss of offsite power; EDG loads; TRANS 69-40 2.89x10-7 1.65% SRVs operate and successfully close; HPCS fails; RCIC fails; and reactor depressurization fails Loss of vital DC bus, successful reactor trip, offsite power available, SRVs operate and LODCA 69 2.47x10-7 1.41% successfully close; turbine bypass fails to remove heat, main feedwater fails; HPCS fails; RCIC fails; and reactor depressurization failsl 7

LER 374-2017-003-01 Dominate Sequences with Event Descriptions Sequence CDP Percentage Description Loss of instrument air; successful reactor trip; offsite power available; SRVs operate and successfully close; HPCS fails; RCIC injects; LOIAS 26 2.36x10-7 1.35% suppression pool cooling fails; deppressurization successful; low pressure injection succeeds; shutdown cooling fails; instrument air recovery fails; late injection fails Loss of condenser heat sink; successful reactor trip, offsite power available; SRVs operate and LOCHS 65 1.97x10-7 1.13% successfully close; main feedwater fails; HPCS fails; RCIC fails; and reactor depressurization fails Grid-related LOOP; successful reactor trip; emergency power fails; SRVs operate and successfully close; recirculation pump seals LOOPGR 43-31 1.81x10-7 1.03%

maintained; HPCS fails; RCIC fails; offsite power recovery in 30 minutes fails, emergency power recovery in 30 minutes fails Grid-related LOOP; successful reactor trip; SRVs operate and successfully close; HPCS fails; RCIC fails; successful depressurization; LOOPGR 31 1.80x10-7 1.03% low pressure injection succeeds; suppression pool cooling fails; shutdown cooling fails; containment spray fails; containment venting fails; late injection fails REFERENCES

1. LaSalle County Station, LER 374/2017-003 High Pressure Core Spray System Inoperable due to Injection Valve Stem-Disc Separation, dated August 9, 2017 (ADAMS Accession No. ML17236A160).

2. U.S. Nuclear Regulatory Commission, LaSalle County Station, Units 1 and 2 - Special Inspection Team Report and Exercise of Discretion: Inspection Report 05000374/2017009, dated August 31, 2017 (ADAMS Accession No. ML17243A098).

3. LaSalle County Station, LER 374/2017-001 - Manual Reactor Scram due to Turbine-Generator Run-Back Caused by Stem-Disc Separation in Stator Water Cooling Heat Exchanger Inlet Valve, dated March 24, 2017 (ADAMS Accession No. ML17083A122).

4. LaSalle County Station, LER 374/2017-002 - High Pressure Core Spray System Declared Inoperable due to Cooling Water Strainer Backwash Valve Stem-Disc Separation, dated March 31 (ADAMS Accession No. ML17089A657) 8

LER 374-2017-003-01 Appendix A: Key Event Tree LOSS OF FEEDWATER REACTOR PROTECTION CONSEQUENTIAL LOSS OF SRV'S CLOSE HPCS RCIC SUPPRESSION POOL MANUAL REACTOR CRD INJECTION (2 PUMP) CONDENSATE LOW PRESSURE INJECTION ALTERNATE LOW PRESS RESIDUAL HEAT REMOVAL POWER CONVERSION CONTAINMENT VENTING LATE INJECTION # End State SYSTEM OFFSITE POWER COOLING DEPRESS INJECTION SYSTEM RECOVERY (Phase - CD)

IE-LOMFW RPS OEP SRV HCS RCI SPC DEP CRD CDS LPI VA RHR PCSR CVS LI 1 OK 2 OK 3 OK 4 CD LI-VENT-SUCCESS 5 OK 6 CD LI-VENT-FAILURE 7 OK 8 OK 9 OK 10 OK 11 CD LI-VENT-SUCCESS 12 OK 13 CD LI-VENT-FAILURE 14 OK 15 OK 16 OK 17 CD LI-VENT-SUCCESS 18 OK 19 CD LI-VENT-FAILURE 20 OK 21 OK 22 OK 23 CD LI-VENT-SUCCESS 24 OK 25 CD LI-VENT-FAILURE 26 OK 27 OK 28 OK 29 CD SPC1 LI-VENT-SUCCESS 30 OK 31 CD LI-VENT-FAILURE 32 CD 33 OK 34 OK 35 OK 36 CD LI-VENT-SUCCESS 37 OK 38 CD LI-VENT-FAILURE 39 CD 40 OK 41 OK 42 OK 43 CD LI-VENT-SUCCESS 44 OK 45 CD LI-VENT-FAILURE 46 OK 47 OK 48 OK 49 CD LI-VENT-SUCCESS 50 OK 51 CD LI-VENT-FAILURE 52 OK 53 OK 54 OK 55 CD SPC1 LI-VENT-SUCCESS 56 OK 57 CD LI-VENT-FAILURE 58 CD 59 CD 60 1SORV P1 61 2SORVS P2 62 LOOPPC 63 ATWS Figure A-1. LaSalle Loss of Main Feedwater Event Tree A-1

LER 374-2017-003-01 Appendix B: Model Changes LASALLE DIESEL GENERATOR 0 FAULT TREE DG0 DIESEL GENERATOR DG0 DC FAILURE OF DG0 DUE TO LOCA FAILURES OF DIESEL GENERATOR 0 SUPPORTS FAULTS CONCURRENT WITH LOOP (ASP ANALYSIS)

DG0-DC-SS Ext DG0-LOOP-LOCA DG0-2 EDG FAILURE FROM SEISMIC EVENT EPS-SYS-EQ Ext FAILURE TO CLOSE OF SRV ON SITE LOOP OCCURS LASALLE STANDBY COOLING WATER OPPOSITE UNIT FAILS TO DG0 DG030 DG031 DGN-SCW0 Ext ONE BWR SRV FAILS TO CLOSE ON OPPOSITE UNIT PPR-SRV-OO-1VLVU1 9.60E-02 DG0114 DG0115 DG0116 DG0117 TWO OR MORE BWR SRVS FAIL TO CLOSE ON OPPOSITE UNIT PPR-SRV-OO-2VLVSU1 2.00E-03 HOUSE EVENT - LOSS OF OFFSITE SITE LOOP (GRID-RELATED) HOUSE EVENT - LOSS OF OFFSITE SITE LOOP (WEATHER-RELATED) HOUSE EVENT - LOSS OF OFFSITE SITE LOOP (SWITCHYARD- HOUSE EVENT - LOSS OF OFFSITE SITE LOOP (PLANT-CENTERED)

THREE OR MORE BWR SRVS FAIL TO POWER IE HAS OCCURRED (GRID- POWER IE HAS OCCURRED POWER IE HAS OCCURRED CENTERED) POWER IE HAS OCCURRED CLOSE ON OPPOSITE UNIT RELATED) (WEATHER-RELATED) (SWITCHYARD-RELATED) (PLANT-CENTERED)

HE-LOOPGR False OEP-VCF-LP-SITEGR 4.23E-01 HE-LOOPWR False OEP-VCF-LP-SITEWR 3.60E-01 HE-LOOPSC False OEP-VCF-LP-SITESC 1.60E-01 HE-LOOPPC False OEP-VCF-LP-SITEPC 2.50E-02 PPR-SRV-OO-3VLVSU1 2.00E-04 Figure B-1. Revised DG0 Fault Tree B-1

ML18157A263 *Non-Concurrence date (NCP-2018-002)

OFFICE RES/DRA/PRB RES/DRA/PRB RES/DRA/PRB RES/DRA NAME D. Yeilding A. Gilbertson F. Gonzalez M. Cheok Non-Concur (via email)

DATE 03/22/18* 06/05/18 06/27/18 06/28/18