ML19046A034

Final Accident Sequence Precursor Analysis - River Bend Station, Potential Loss of Safety Function and Condition Prohibited by TS Due to EDG Lube Oil Chiller Leak Caused by Design Deficiency (LER-458-2018-006) - Reject

ML19046A034
Person / Time
Site:	River Bend
Issue date:	02/11/2019
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
C. Hunter 415-1394
References
LER 458-2018-006
Download: ML19046A034 (11)

Text

Final ASP Program Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Potential Loss of Safety Function and Condition Prohibited by River Bend Station Technical Specifications due to Emergency Diesel Generator Lube Oil Chiller Leak Caused by Design Deficiency LER: 458-2018-006 Event Date: 7/6/2018 CDP = 8x10-7 IRs: TBD Plant Type: General Electric Type 6 Boiling-Water Reactor (BWR) with a Mark III Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% Reactor Power)

Analyst: Reviewer: Contributors: Approval Date:

Chris Hunter Matt Leech N/A 2/11/2019 EVENT DETAILS Event Description. On June 24, 2018, planned maintenance began on the division II emergency diesel generator (EDG). Maintenance was completed on July 4th, and after successful post-maintenance testing the division II EDG was declared operable at 4:27 a.m.1 Immediately after, the surveillance testing on the division I EDG began, rendering the EDG inoperable at 5:27 a.m. After successful completion of the surveillance test, the division I EDG was declared operable at 8:53 a.m. On July 5th, operators recognized that division II EDG lube oil filter differential pressure increased from 0.5 to 13 psid in less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. A subsequent lube oil test determined that this increase in differential pressure was caused by water intrusion in the lube oil system. The division II EDG was declared inoperable on July 6th at 2:43 a.m.

The division I EDG was checked and no water intrusion was identified in its lube oil system.

The licensee could not determine the exact amount of water in the division II EDG lube oil system; however, given the filter was severely restricted indicates a significant amount of water contamination. The division II EDG was repaired and restored to operability on July 9th at 11:09 p.m. Additional information is provided in licensee event report (LER) 458-2018-006 (Ref. 1).

Cause. The licensee determined that the water intrusion was caused by leakage past the floating tubesheet seals in the lube oil cooler. During maintenance, the lube oil system cools to ambient temperature and then is rewarmed, which can initiate new leakage past these seals.

Prior to this event, the licensee was unaware that EDGs were susceptible to this failure mechanism.

MODELING SDP Results/Basis for ASP Analysis. The Accident Sequence Precursor (ASP) Program uses Significance Determination Process (SDP) results for degraded conditions when available and applicable. An independent ASP analysis was required because both safety-related EDGs were unavailable at the same time due to different causes. To date, no performance deficiency 1 All times in this report are provided in Eastern Daylight Time.

1

LER 458-2018-006 associated with this event has been identified and, therefore, no evaluation was performed as part of the SDP. A search for additional River Bend LERs was performed to determine if any initiating events or additional unavailabilities existed during the exposure period of the division II EDG failure. No windowed events or concurrent degraded conditions were identified.

Analysis Type. A test/limited use version of the River Bend standardized plant analysis risk (SPAR) model, created on December 19, 2018, was used for this condition assessment. The key model changes in this test/limited used (TLU) model included event and fault tree logic for crediting FLEX mitigating strategies.

Exposure Period. LER 458-2018-006 states, There is no technical basis to be able to determine that the division II EDG would have been capable of meeting its mission, from 6/24/18 14:15 when the maintenance outage started until it was repaired and restored on 7/9/18 22:09. This analysis assumes the division II EDG was unable to fulfil its safety function when it was restored after maintenance on July 4th due to water contamination until it was repaired on July 9th.2 During this period, the division I EDG was unavailable during surveillance testing for approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> on July 4th. Therefore, two exposure periods were used for this analysis.

The first exposure period comprises the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> that the division I and II EDGs were unable to fulfil their safety function. The second exposure period consists of the 135 hours0.00156 days <br />0.0375 hours <br />2.232143e-4 weeks <br />5.13675e-5 months <br /> when the division II EDG was unable to fulfil its safety function from July 4th through 9th (excluding the time for the first exposure period).

SPAR Model Changes. The following base SPAR modifications were made to support this analysis:

• The base SPAR models provide credit for EDG repair for station blackout (SBO) scenarios; however, the analyst must determine whether credit should be applied given the specific circumstances surrounding the event being analyzed. The probabilities of successful repair of an EDG in the base SPAR models are calculated using the data from the unplanned unavailability mitigating system performance index (MSPI). There are questions on the applicability of this data. First, this repair data is not collected under SBO conditions (e.g., reduced lighting). Second, during postulated SBO scenarios, multiple EDG failures have occurred, thus further complicating troubleshooting activities, which would likely increase the time to repair. Third, if operators declare an extended loss of alternating current power (ELAP), personnel will be focused on implementation of FLEX mitigation strategies and, therefore, it is unlikely to have staffing resources to troubleshoot and repair an EDG. Given these uncertainties, repair credit for EDG failures is limited to cases where event information supports this credit. For the first exposure period, EDG recovery was determined to be possible given that the division I EDG was undergoing surveillance testing. Therefore, EDG recovery credit is provided during the first exposure period. The division II EDG was determined to not be repairable within the SPAR model mission time (i.e.,

2 ASP analyses do typically consider the risk of structures, systems, and components (SSCs) unavailable for planned maintenance unless other SSCs are failed during the same period.

2

LER 458-2018-006 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), so no repair credit was provided in the second exposure period.3 The issue of crediting EDG repair is noted as a key modeling uncertainty for this analysis and will be discussed with internal stakeholders to determine if consensus approach can be developed.

• The CVS (containment venting) fault tree was modified to include credit for containment venting via the personnel hatch. To incorporate this change, all the existing logic except for transfer gate CVS-XHE-EQK (operator fails to vent containment given seismic event) was moved under a new OR gate CVS6 (normal containment venting fails), which was subsequently inserted under a new AND gate CVS2 (both containment venting pathways fail). Gate CVS2 is located under the CVS top gate. A new basic event, CVS-XHE-XM-AIRLOCK (operators fail to vent containment via the personnel airlock) was inserted under gate CVS2. The revised CVS fault tree is shown in Figure B-1. A conservative screening value of 0.1 was used for this basic event.4 Any further refinement of this human error probability (HEP) has a minimal effect on the overall change in core damage probability (CDP) for this analysis. The CVS fault tree was inserted in place of the CVS-EXT (containment venting (SBO)) fault tree in the SBO and SBO-P1 event trees.

• The FLEX modeling located in the SBO-ELAP event tree was added to the River Bend SPAR model at the request of the analyst. The event tree and fault tree logic has been in development by the NRC and INL. While there is relative agreement on the event tree structure, key modeling uncertainties include equipment reliability and human reliability analysis (HRA) of the operator actions required to implement FLEX. In addition, there may be plant-specific differences that is not accounted for in the current event tree and fault tree logic. Given these considerations, screening values of 0.1 were used for the FLEX human failure events (HFEs), including:5

- FLX-XHE-XE-ELAP (operators fail to declare ELAP when beneficial)

- FLX-XHE-XL-RECOSP (operator fails to restore offsite power following FLEX operation (ELAP))

- FLX-XHE-XM-480 (operators fail to stage or run or load or refuel 480V portable FLEX diesel) 3 The applicable EDG recovery basic events: EPS-XHE-XL-NR30M (operator fails to recover emergency diesel in 30 minutes), EPS-XHE-XL-NR01H (operator fails to recover emergency diesel in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), EPS-XHE-XL-NR04H (operator fails to recover emergency diesel in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), EPS-XHE-XL-NR06H (operator fails to recover emergency diesel in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />), EPS-XHE-XL-NR12H (operator fails to recover emergency diesel in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />),

EPS-XHE-XL-NR24H (operator fails to recover emergency diesel in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), and EPS-XHE-XL-NR72H (operator fails to recover emergency diesel in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) were set to TRUE in the base SPAR model for the second exposure period.

4 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator HFEs.

5 The HFEs associated with continued operation of the reactor core isolation (RCIC) pump were not modified because these HFEs combine the failure of the instrument and control (I&C) system failure to automatically control the pump combined with the operator failure to manually control the pump given an I&C failure. Note that credit is not provided for continued RCIC pump operation without direct-current (DC) power.

3

LER 458-2018-006

- ADS-XHE-XM-MDEP-ELAP (operators fail to depressurize the reactor during ELAP)6

- FLX-XHE-XM-SPC (operators fail to align and operate SPC)

- FLX-XHE-XM-RPV (operators fail to stage or run or supply or refill FLEX RPV pump)

The FLEX equipment reliabilities in base SPAR model values should be considered placeholder values. However, they were not adjusted because there is not current data reliability data for FLEX equipment. These issues regarding FLEX modeling are noted as key modeling uncertainties for this analysis.

• Basic event CTM-INJ-VN-RIVB (containment failure causes loss of high pressure injection) was removed from the base SPAR model. This basic event accounts for potential uncontrolled containment venting will result in loss of high-pressure injection to the reactor. This failure mode assumes a rapid drop in containment pressure could result in net positive suction head (NPSH) concerns and the potential for pump trips.

This basic event was originally inserted into the applicable BWR SPAR models because licensee probabilistic risk assessment (PRA) cut sets had included it. However, subsequent reviews of licensee PRA cut sets by Idaho National Laboratory (INL) indicate that this basic event was subsequently removed from all BWR plants with HPCS. This basic event has been eliminated from all applicable SPAR models except for River Bend. The HPCS pumps have a low NPSH impeller, which prevents the loss of injection due to an uncontrolled venting of containment. In addition, HPCS does not have the same pump trip concerns of turbine driven pumps (e.g., RCIC and high-pressure core injection). A review of the River Bend Final Safety Analysis Report (FSAR) indicates the HPCS is available in all containment conditions.

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this condition assessment:

Exposure Period 1 (4 Hours)

• Basic event EPS-DGN-FR-DGB (diesel generator B fails to run) was set to TRUE because water intrusion in the lube oil system of division II EDG resulted in a loss of safety function.

• Basic event EPS-DGN-TM-DGA (diesel generator A is unavailable because of maintenance) was set TRUE because the division I EDG was unable to fulfil its safety function while undergoing surveillance testing.

- Although inoperable according to technical specifications, operators could readily align the division I EDG to its associated safety-related bus during a postulated loss of offsite power (LOOP) within 15 minutes. A conservative screening value of 0.1 was used for basic events: EPS-XHE-XL-NR30M, EPS-XHE-XL-NR01H, EPS-XHE-XL-NR04H, EPS-XHE-XL-NR06H, EPS-XHE-XL-NR12H, EPS-XHE-XL-24H, and EPS-XHE-XL-72HR. Any further refinement of these HEPs has a minimal effect on the overall CDP for this analysis.

6 This HFE replaces basic event ADS-XHE-XM-MDEP2 [operator fails to depressurize the reactor (MLOCA-ATWS-SBO)] in the TLU model. This substitution was made because ADS-XHE-XM-MDEP2 is used in non-ELAP scenarios that the screening value should not be applied. The use of the 0.1 is likely conservative given this operator action is not really FLEX specific and uses already installed equipment (i.e., the reactor safety relief valves); however, the use of the screening value has a negligible effect on the results.

4

LER 458-2018-006

• Basic events EPS-DGN-TM-DGC (DG C is unavailable because of maintenance) and EPS-DGN-TM-SBO (SBO diesel is unavailable because of maintenance) were set to FALSE because technical specifications would prevent multiple EDGs being made inoperable for testing/maintenance at the same time.

Exposure Period 2 (135 Hours)

• Basic event EPS-DGN-FR-DGB was set to TRUE because water intrusion in the lube oil system of division II EDG resulted in a loss of safety function.

- As previously stated, no credit for EDG repair was provided in this exposure period because the division II EDG was not repairable within the SPAR model mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

ANALYSIS RESULTS CDP. The CDP for this analysis is calculated to be 7.9x10-7. The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions; therefore, this event is a not a precursor.

The total CDP for this event is dominated by the risk from first exposure period (CDP =

7.7x10-7), which contributes approximately 97 percent of the total risk for this event. Whereas, the risk from first exposure period (CDP of 2.6x10-8) only contributes approximately 3 percent to the total risk for this event.

Dominant Sequence. The dominant accident sequence is LOOP/SBO sequence 59-12 (CDP = 3.3x10-7), which contributes approximately 42 percent of the total internal events CDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CDP are provided in the following table. The dominant sequence is shown graphically in Figure A-1 and Figure A-2 in Appendix A.

Sequencea CDP Percentage Description

-7 LOOP 59-12 3.33x10 42.0% A LOOP initiating event occurs; reactor scram is successful; the division I, II, and III EDGs fail resulting in a SBO; RCIC fails; operators fail to recover offsite power in 30 minutes LOOP 59-9-14 6.21x10-8 7.8% A LOOP initiating event occurs; reactor scram is successful; the division I, II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators successfully declare ELAP; the FLEX 480-volt diesel generators fail; operators fail to recover offsite power in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> LOOP 7 6.11x10-8 7.7% A LOOP initiating event occurs; reactor scram is successful; all EDGs successfully load to their associated safety-related buses; HPCS succeeds; suppression pool cooling fails; reactor depressurization succeeds; shutdown cooling fails; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; containment venting fails resulting in a loss of all injection LOOP 59-9-17 6.04x10-8 7.6% A LOOP initiating event occurs; reactor scram is successful; the division I, II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators fail to recover offsite power in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; operators fail to declare ELAP 5

LER 458-2018-006 Sequencea CDP Percentage Description

-8 TRANS 101-59-12 2.56x10 3.2% A transient occurs; reactor scram is successful; a consequential LOOP occurs; the division I, II, and III EDGs fail resulting in a SBO; RCIC fails; operators fail to recover offsite power in 30 minutes LOOPWR 59-9-7 2.40x10-8 3.0% A weather-related LOOP initiating event occurs; reactor scram is successful; the division I and II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators successfully declare ELAP; the FLEX 480-volt diesel generators succeed; operators successfully depressurize the reactor; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> LOOPWR 59-9-10 2.07x10-8 2.6% A weather-related LOOP initiating event occurs; reactor scram is successful; the division I and II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators successfully declare ELAP; the FLEX 480-volt diesel generators succeed; operators fail to depressurize the reactor; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> LOOPWR 59-9-2 1.69x10-8 2.1% A weather-related LOOP initiating event occurs; reactor scram is successful; the division I and II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators successfully declare ELAP; the FLEX 480-volt diesel generators succeed; operators successfully depressurize the reactor; operators successfully initiate alternate suppression pool cooling; operators successfully initiate low-pressure FLEX injection; operators fail to recover offsite power in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> LOOPWR 59-9-4 1.24x10-8 1.6% A weather-related LOOP initiating event occurs; reactor scram is successful; the division I and II, and III EDGs fail resulting in a SBO; RCIC succeeds; operators successfully declare ELAP; the FLEX 480-volt diesel generators succeed; operators successfully depressurize the reactor; operators successfully initiate alternate suppression pool cooling; low-pressure FLEX injection fails; operators fail to recover offsite power in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

a. The LOOP sequence results are a sum of all four LOOP types (e.g., weather, grid, switchyard, and plant centered) unless otherwise noted.

Key Modeling Uncertainties. The following are noted as key modeling uncertainties for this analysis:

• Crediting repair of postulated failures of the division I EDG in the second exposure period.

• Modeling of FLEX strategies, specifically equipment reliabilities and HRA.

The base SPAR models provide credit for EDG repair and recovery; however, it is up to the analyst to determine whether credit should be applied given the specific circumstances surrounding the event being analyzed. This ASP analysis credits EDG repair/recovery in the first exposure period for division I EDG because it was undergoing surveillance testing and, therefore, it could be aligned to its safety-related bus quickly. No credit was provided for the 6

LER 458-2018-006 repair of the division II EDG since the repair activities could not completed within the SPAR model mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). However, the question on whether repair of the postulated failures of the division I EDG be credited for the second exposure period using unplanned unavailability MSPI data remains. For this analysis, the lead analyst does not believe there is sufficient basis to use the MSPI data in SBO scenarios (see section on SPAR model changes for additional information), but acknowledges this assumption is subjective and could vary between analysts. A sensitivity analysis was performed crediting MSPI data for postulated failures of the division I EDG for the second exposure period. With this credit applied, the overall CDP decreases from 7.9x10-7 to 6.5x10-7 (approximately 17 percent).

As noted previously, the FLEX mitigation strategies were added to the River Bend SPAR model to support this ASP analysis. However, the event tree and fault tree logic are new and, therefore, have not been fully reviewed. The event tree and fault tree structure were determined appropriate by the analysis to provide a reasonable indication of the impact of these strategies have during ELAP scenarios. However, it is noted that there may be plant-specific features that could affect some of the model structures. In addition, key modeling uncertainties include equipment reliability and HRA of the operator actions required to implement FLEX. Currently, there is no information available to make a detailed evaluation of these parameters. As a modeling simplification given the lack of information, the analyst used a screening value of 0.1 in the applicable FLEX HFEs (see SPAR model changes for additional information). Given the uncertainty of this screening value and the other uncertainties associated with FLEX modeling, sensitivity analyses were performed using additional screening values of 0.5 and 5x10-2. These sensitivity analyses result in an overall CDP of 1.3x10-6 (an increase of approximately 62 percent) and 7.0x10-7 (a decrease of approximately 12 percent), respectively.

Seismic Contribution. Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc.7 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, beginning in 2018, seismic hazards will be evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for this analysis is CDP of 4x10-9. The following table provides the seismic bin results that contribute at least 1 percent of the total seismic CDP for this analysis.

Seismic Bin CDP Notes/Observations Seismic Event in Bin 3 1.9x10-9 Dominant scenarios are seismically-induced LOOP with (0.5-1.0 G) occurs subsequent SBO and/or small LOCA. Seismic RCIC, HPCS, and low-pressure injection failures result in core damage.

Seismic Event in Bin 1 1.1x10-9 Dominant scenarios are seismically-induced LOOP with (0.1-0.3 G) occurs postulated (random) failures of the division 1 EDG resulting in a SBO. Random failures of RCIC, HPCS, or offsite power recovery result in core damage.

Seismic Event in Bin 4 7.2x10-10 Dominant scenarios are seismically-induced LOOP with and (1.0-1.5 G) occurs without small LOCA. Seismic failures of both high-pressure and low-pressure injection sources result in core damage.

7 Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations associated to a specific hazard (e.g., degraded fire barrier) have historically been analyzed as part of ASP Program.

7

LER 458-2018-006 Seismic Bin CDP Notes/Observations Seismic Event in Bin 2 7.1x10-9 Dominant scenarios are the same as those from seismic bins 1 (0.3-0.5 G) occurs and 3.

Seismic Event in Bin 5 8.1x10-11 Dominant scenarios are seismically-induced LOOP, SBO, and

(>1.5 G) occurs SLOCA. Seismic RCIC and HPCS failures result in core damage.

TOTAL = 4.4x10-9 REFERENCES

1. River Bend Station, "LER 458/2018-006 - Potential Loss of Safety Function and Condition Prohibited by Technical Specifications due to Emergency Diesel Generator Lube Oil Chiller Leak Caused by Design Deficiency, dated September 4, 2018 (ML18247A460).

8

LER 458-2018-006 Appendix A: Key Event Trees LOSS OF OFFSITE REACTOR SHUTDOWN EMERGENCY POWER SRV'S CLOSE HPCS RCIC SUPPRESSION POOL MANUAL REACTOR LPCS LOW PRESSURE ALTERNATE LOW SUPPRESSION POOL MANUAL REACTOR SHUTDOWN COOLING CONTAINMENT HEAT CONTAINMENT LATE INJECTION # End State POWER INITIATOR COOLING DEPRESS COOLANT INJECTION PRESSURE INJECTION COOLING DEPRESS REMOVAL (FAN VENTING (Phase - CD)

(WEATHER-RELATED) FS = FTF-SBO COOLERS)

IE-LOOPWR RPS EPS SRV HCS RCI SPC DEP LCS LCI VA SPC DEP SDC CHR CVS LI 1 OK 2 OK 3 OK 4 OK 5 CD LI00 6 OK 7 CD LI01 8 OK 9 OK 10 CD LI00 11 OK 12 CD LI01 13 OK 14 OK 15 OK 16 OK 17 CD LI00 18 OK 19 CD LI01 20 OK 21 OK 22 OK 23 CD LI00 24 OK 25 CD LI01 26 OK 27 OK 28 OK 29 CD SDC1 LI00 30 OK 31 CD LI01 32 CD 33 CD 34 OK 35 OK 36 OK 37 OK 38 CD LI00 39 OK 40 CD LI01 41 OK 42 OK 43 OK 44 OK 45 CD LI00 46 OK 47 CD LI01 48 OK 49 OK 50 OK 51 OK SPC1 52 CD SDC1 LI00 53 OK 54 CD LI01 55 CD 56 CD 57 LOOP-1 P1 58 LOOP-2 P2 59 SBO 60 ATWS 61 CD Figure A-1. River Bend LOOP Event Tree A-1

LER 458-2018-006 EMERGENCY POWER SRV'S CLOSE RECIRC PUMP SEAL HPCS - SBO RCIC OFFSITE POWER DIESEL GENERATOR CONTAINMENT LATE INJECTION # End State INTEGRITY RECOVERED RECOVERY VENTING (Phase - CD)

FS = FTF-SBO FS = FTF-SBO EPS SRV RCPSL HCS02 RCI02 OPR DGR CVS LI 1 SBO-OP OPR-12H 2 OK 3 OK 4 CD OPR-12H LI00 5 OK DGR-12H 6 CD LI06 7 SBO-OP OPR-06H 8 OK 9 SBO-ELAP OPR-06H DGR-06H 10 SBO-OP OPR-30M 11 OK 12 CD OPR-30M DGR-30M 13 SBO-P1 14 SBO-P1 P1 15 SBO-P2 P2 Figure A-2. River Bend SBO Event Tree A-2

LER 458-2018-006 Appendix B: Modified Fault Tree CONTAINMENT VENTING CVS OPERATOR FAILS TO VENT BOTH CONTAINMENT VENTING CONTAINMENT GIVEN SEISMIC PATHWAYS FAIL EVENT CVS-XHE-EQK External CVS2 NORMAL CONTAINMENT OPERATORS FAIL TO VENT VENTING FAILS CONTAINMENT VIA PERSONNAL AIR LOCK CV-XHE-XM-AIRLOCK CVS6 1.00E-01 RIVER BEND INSTRUMENT AIR FAILURE OF CONTAINMENT FAILURE OF CONTAINMENT REACTOR PLANT VENTILATION SYSTEM FAULT TREE VENT VALVE 105 VENT VALVE 128 AOV/AOD 1HVR*AOD127 IAS CVS-AOV-CC-F0127 External CVS-105 CVS-128 7.55E-04 OPERATOR FAILS TO VENT CONTAINMENT CVS-XHE-XM-VENT 1.00E-03 Figure B-1. Modified River Bend CVS Fault Tree B-1