ML17102A999

Final ASP Analysis-Hatch 2 (LER 366-2016-003)

ML17102A999
Person / Time
Issue date:	04/14/2017
From:	Michael Cheok NRC/RES/DRA
To:	Ross-Lee M Office of Nuclear Reactor Regulation
Chris Hunter 301-415-1394
Shared Package
ML17102A998	List: ML17102A999
References
LER 366-2016-003
Download: ML17102A999 (11)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Edwin I. Hatch Emergency Diesel Generator 2C Fails during Surveillance Test Nuclear Plant, Unit 2 LERs: 366-2016-003 Event Date: 8/18/2016 CDP = 1x10-5 IRs: TBD Plant Type: General Electric BWR/4 with a Mark I Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% Reactor Power)

Analyst: Reviewer: Contributors: BC Review Date:

Christopher Hunter Ian Gifford N/A 4/14/2017 EXECUTIVE

SUMMARY

On August 18, 2016, at 10:06 a.m., with Unit 2 at approximately 100 percent power, emergency diesel generator (EDG) 2C tripped due to low lube oil pressure about 30 minutes into a surveillance test. The station entered a 72-hour required action statement for limiting condition of operation 3.8.1.b of Hatch Unit 2 technical specifications (TS), which requires two Unit 2 EDGs to be operable. The other four EDGs were successfully started in accordance with TS to preclude a common-cause failure mode, and no issues were identified. EDG 1B was inhibited from automatically aligning to Unit 1 on August 19th at 11:57 a.m., in order to allow 14 days to restore EDG 2C to operable status.

Inspection of EDG 2C revealed that the cross-drive shaft between the pump flexible drive gear and the engine driven lube oil pump was found sheared. A new cross-drive assembly was installed, along with the replacement of associated damaged parts, and EDG 2C was declared operable on August 24th at 11:34 p.m.

According to the risk analysis modeling assumptions used in this accident sequence precursor (ASP) analysis, the most likely core damage scenarios involve a non-recoverable loss of offsite power (LOOP) and subsequent station blackout (SBO) due to the failure of the EDGs, and operators failing to recover offsite power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. These accident sequences account for approximately 70% of the increase in core damage probability (CDP) for the event. The point estimate CDP for this event is 1x10-5, which is considered a precursor in the ASP Program.

To date, no performance deficiency associated with this event has been identified and, therefore, an independent ASP analysis was performed.

EVENT DETAILS Event Description. On August 18, 2016, at 10:06 a.m., with Unit 2 at approximately 100 percent power, EDG 2C tripped due to low lube oil pressure about 30 minutes into a surveillance test. The station entered a 72-hour required action statement for limiting condition of operation 3.8.1.b of Hatch Unit 2 TS, which requires two Unit 2 EDGs to be operable. The other four EDGs were successfully started in accordance with TS to preclude a common-cause failure mode, and no issues were identified. EDG 1B was inhibited from automatically aligning 1

LER 366-2016-003 to Unit 1 on August 19th at 11:57 a.m., in order to allow 14 days to restore EDG 2C to operable status.

Further inspections of EDG 2C revealed that the cross-drive shaft between the pump flexible drive gear and the engine driven lube oil pump was found sheared. Further troubleshooting identified that the cross-drive assembly had excessive bearing wear (as indicated by excessive movement in the shaft). A new cross-drive assembly was installed, along with the replacement of associated damaged parts, and EDG 2C was declared operable on August 24th at 11:34 p.m.

Additional information is provided in Licensee Event Report (LER) 366/2016-003 (Ref. 1).

Cause. The licensee determined that based on physical indications and failure analysis taken from the damaged cross drive shaft, associated drive gears, and cylindrical roller bearing, the shaft failed due to rotational bending fatigue caused by premature bearing failure. The most likely cause of bearing failure was due to an overload condition such that the bearing was no longer able to adequately support the shaft to reduce rotational friction and support radial and axial loads. See LER 366/2016-003 for additional information.

MODELING ASSUMPTIONS Analysis Type. The Hatch Unit 1 and 2 Standardized Plant Analysis Risk (SPAR) model Version 8.20 dated May 20, 2014, was used for this condition assessment. Note that this model is set up for Unit 1; therefore, when using it to perform an analysis of the Unit 2 event, Unit 1 basic events are used as surrogates that represent applicable basic events on the other unit.

SDP Results/Basis for ASP Analysis. The ASP Program uses Significance Determination Process (SDP) results for degraded conditions when available (and applicable). To date, no inspection reports have been released that provided additional information on this event.

Discussions with Region 2 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed given the lack of an identified performance deficiency and the potential risk significance of this event.

A search for additional Hatch (Unit 2) LERs was performed to determine if additional unavailabilities existed during the exposure period of EDG 2C. LER 366-2016-001 (Ref. 2) also identified the potential inoperability of EDG 2C due to a leaking fuel oil relief valve. However, this potential inoperability of EDG 2C was only applicable during a potential design-basis earthquake. Given the low probability of a design-basis earthquake during the exposure period of the leaking relief valve and given that the analysis of LER 366/2016-003 already considers the inoperability of EDG 2C during the same exposure period, the leaking fuel oil relief valve it is not expected to cause a significant increase in the risk. Therefore, it is not considered as part of this ASP analysis of LER 366/2016-003.

SPAR Model Modifications. The following SPAR model modification was made:1

• For exposure period 8 (explained in the following section), EDG 1B was inhibited from Unit 2 during maintenance of a Unit 1 EDG. Although inhibited from immediate alignment during a postulated LOOP affecting Unit 2, operators could manually align EDG 1B to support the 1 The applicable EDG recovery basic events (e.g., EPS-XHE-XLNR30M, EPS-XHE-XL-NR01H, EPS-XHE-XL-NR04H, EPS-XHE-XL-NR05H, EPS-XHE-XL-NR07H, and EPS-XHE-XL-NR12H) were set to TRUE in the base SPAR model. In ASP analyses, these basic events are only used (in the change case) if the event information indicated that a failed EDG is recoverable and, therefore, recovery credit is warranted.

2

LER 366-2016-003 unit. To account for this, a new AND gate, DG1B-1 (EDG 1B inhibited from Unit 2) was inserted under the top gate of the DG1B (diesel generator 1B is unavailable) fault tree. Two new basic events were inserted under DG1B-1, DG1B-INHIBIT (EDG 1B is inhibited to Unit 2) and DG1B-INHIBIT-RECOVERY (operators fail to align EDG 1B to Unit 2). Both of these events were set to IGNORE. Figure B-1 in Appendix B provides the modified DG1B fault tree.

Exposure Period. According to LER 366/2016-003, EDG 2C successfully passed its 24-hour surveillance in January 2016. Therefore, the maximum potential exposure time would be approximately 7 months. However, EDG 2C successfully passed its monthly surveillance tests from February through July. The following table provides the EDG 2C run history from January 17th through August 18th.

Date Description Run Duration 1/17/2016 Successful 24-hour surveillance test > 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 2/18/2016 Successful monthly operability test ~1 hour 3/17/2016 Successful monthly operability test and post-maintenance testing ~3 hours 4/22/2016 Successful monthly operability test ~1 hour 5/17/2016 Successful monthly operability test ~1 hour 6/16/2016 Successful monthly operability test ~1 hour 7/21/2016 Successful monthly operability test ~1 hour 8/18/2016 Failed monthly operability test ~30 minutes 8/24/2016 EDG 2C is repaired and returned to operable status In addition to the EDG 2C failure, LER 366/2016-003 also reported two periods of time in which EDG 1B (the swing EDG) was declared inoperable due to maintenance activities, thus potentially causing two EDGs to be concurrently unavailable. The most significant of these exposure periods was when EDG 1B was inoperable for approximately 109 hours0.00126 days <br />0.0303 hours <br />1.802249e-4 weeks <br />4.14745e-5 months <br /> from April 24th through 29th. In addition, the EDG 1B was inhibited from Unit 2 while EDG 1C was undergoing maintenance from April 10th through 15th. While inhibited, EDG 1B was not immediately available to Unit 2; however, it could be manually realigned within approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Based on this information, the following exposure periods (provided in the following table) were developed for this condition assessment.

Exposure Date Range Duration Credited Run Time for EDG 2C Period #

1 8/18/2016-8/24/2016 157 hours0.00182 days <br />0.0436 hours <br />2.595899e-4 weeks <br />5.97385e-5 months <br /> No credit; EDG is failed 2 7/21/2016-8/18/2016 660 hours0.00764 days <br />0.183 hours <br />0.00109 weeks <br />2.5113e-4 months <br /> ~30 minutes 3 6/16/2016-7/21/2016 843 hours0.00976 days <br />0.234 hours <br />0.00139 weeks <br />3.207615e-4 months <br /> ~1 hour and 30 minutes 4 5/18/2017-6/16/2016 727 hours0.00841 days <br />0.202 hours <br />0.0012 weeks <br />2.766235e-4 months <br /> ~2 hours and 30 minutes 4/22/2016-5/17/2016 5 479 hours0.00554 days <br />0.133 hours <br />7.919974e-4 weeks <br />1.822595e-4 months <br /> (excluding EP-6) ~3 hours and 30 minutes 6 4/24/2016-4/29/2016 109 hours0.00126 days <br />0.0303 hours <br />1.802249e-4 weeks <br />4.14745e-5 months <br /> 3/17/2016-4/22/2016 7 757 hours0.00876 days <br />0.21 hours <br />0.00125 weeks <br />2.880385e-4 months <br /> ~4 hours and 30 minutes (excluding EP-8) 8 4/10/2016-4/15/2016 111 hours0.00128 days <br />0.0308 hours <br />1.835317e-4 weeks <br />4.22355e-5 months <br /> ~4 hours and 30 minutes 9 2/18/2016-3/17/2016 673 hours0.00779 days <br />0.187 hours <br />0.00111 weeks <br />2.560765e-4 months <br /> ~7 hours and 30 minutes 3

LER 366-2016-003 Exposure Date Range Duration Credited Run Time for EDG 2C Period #

10 1/17/2016-2/18/2016 769 hours0.0089 days <br />0.214 hours <br />0.00127 weeks <br />2.926045e-4 months <br /> ~8 hours and 30 minutes Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

• For all exposure periods, basic event EPS-DGN-FR-DG1C (diesel generator 1C fails to run) was set to TRUE to represent the failure of EDG 2C to provide is safety function for the complete 24-hour mission time.

• For exposure period 6, basic event EPS-DGN-TM-DG1B (diesel generator 1B is unavailable because of test or maintenance) was set to TRUE because EDG 1B was unavailable from April 24th to April 29th while undergoing planned maintenance.

• For exposure period 8, basic event DG1B-INHIBIT was set to TRUE because EDG 1B was inhibited from Unit 2 during maintenance activities for a Unit 1 EDG.

- To credit the manual alignment of EDG 1B to Unit 2, the probability of DG1B-INHIBIT-RECOVERY was set to a screening value of 0.1.2,3 Further refinement of this recovery probability would have a minimal effect on the overall results of this analysis.

• To provide some credit for the potential run time of EDG 2C, the probabilities of the following offsite power recovery basic events were adjusted to account for the potential run time (provided in previous section) for each applicable exposure period:4,5

- OEP-XHE-XL-NR30MGR (operator fails to recover offsite power in 30 minutes for grid-related LOOP),

- OEP-XHE-XL-NR30MSC (operator fails to recover offsite power in 30 minutes for switchyard-centered LOOP),

- OEP-XHE-XL-NR01HGR (operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for grid-related LOOP),

- OEP-XHE-XL-NR01HSC (operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for switchyard-centered LOOP),

- OEP-XHE-XL-NR01HWR (operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for weather-related LOOP),

- OEP-XHE-XL-NR05HGR (operator fails to recover offsite power in 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for grid-related LOOP),

2 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator HFEs. Note that the use of lower failure probability for recovery has a negligible effect on the results.

3 This recovery probability is applied to the 30 minute SBO sequences and, therefore, is potentially non-conservative. However, removing the recovery from these sequences would not affect the overall results; therefore, no further adjustments were performed.

4 Probability adjustments to the other offsite power recovery events contained in the model would have a negligible effect on the analysis results.

5 The credit of the other EDGs to run for a certain period of time is provided in convolution basic events that account for the additional time available for offsite power recovery.

4

LER 366-2016-003

- OEP-XHE-XL-NR05HSC (operator fails to recover offsite power in 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for switchyard-centered LOOP),

- OEP-XHE-XL-NR05HWR (operator fails to recover offsite power in 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for weather-related LOOP),

- OEP-XHE-XL-NR07HGR (operator fails to recover offsite power in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for grid-related LOOP),

- OEP-XHE-XL-NR07HPC (operator fails to recover offsite power in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for plant-centered LOOP),

- OEP-XHE-XL-NR07HSC (operator fails to recover offsite power in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for switchyard-centered LOOP), and

- OEP-XHE-XL-NR07HWR (operator fails to recover offsite power in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for weather-related LOOP).

Basic Event EP-2 EP-3 EP-4 EP-5&6 EP-7&8 EP-9 EP-10 OEP-XHE-XL-NR30MGR 6.59E-1 3.92E-1 2.50E-1 1.69E-1 1.19E-1 5.01E-2 3.92E-2 OEP-XHE-XL-NR30MSC 4.02E-1 2.24E-1 1.45E-1 1.02E-1 7.61E-2 3.77E-2 3.12E-2 OEP-XHE-XL-NR01HGR 5.03E-1 3.10E-1 2.04E-1 1.41E-1 1.01E-1 4.42E-2 3.48E-2 OEP-XHE-XL-NR01HSC 2.92E-1 1.78E-1 1.21E-1 8.76E-2 6.65E-2 3.42E-2 2.85E-2 OEP-XHE-XL-NR01HWR 6.14E-1 5.16E-1 4.50E-1 4.02E-1 3.65E-1 2.88E-1 2.70E-1 OEP-XHE-XL-NR05HGR 1.01E-1 7.50E-2 5.70E-2 4.42E-2 3.48E-2 1.85E-2 1.54E-2 OEP-XHE-XL-NR05HSC 6.65E-2 5.21E-2 4.18E-2 3.42E-2 2.85E-2 1.76E-2 1.53E-2 OEP-XHE-XL-NR05HWR 3.65E-1 3.34E-1 3.09E-1 2.88E-1 2.70E-1 2.27E-1 2.16E-1 OEP-XHE-XL-NR07HGR 5.70E-2 4.42E-2 3.48E-2 2.79E-2 2.26E-2 1.28E-2 1.08E-2 OEP-XHE-XL-NR07HPC 3.09E-2 2.52E-2 2.09E-2 1.76E-2 1.49E-2 9.74E-3 8.57E-3 OEP-XHE-XL-NR07HSC 4.18E-2 3.42E-2 2.85E-2 2.40E-2 2.05E-2 1.34E-2 1.18E-2 OEP-XHE-XL-NR07HWR 3.09E-1 2.88E-1 2.70E-1 2.54E-1 2.40E-1 2.06E-1 1.96E-1 ANALYSIS RESULTS CDP. The point estimate CDP for this event is 1.0x10-5, which is the sum of all exposure periods.6 The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions.

The CDP for this event exceeds this threshold; therefore, this event is a precursor. The CDP breakdown for each exposure period is provided in following table.

Exposure Period #

CDP Notes EPS-DGN-FR-DG1C set to TRUE and no credit for additional run time 1 3.6E-7 provided for this exposure period.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 2 1.4E-6 probabilities adjusted to credit an additional 30 minutes.

6 The analysis results were calculated in the SAPHIRE event and condition assessment workspace. The single pass (with cut set update) solve setting was used to ensure the offsite power recovery convolution factors were correct. Using the multi-pass solve setting in an analysis when a EDG fail-to-run basic event is set to TRUE can lead to duplicate cut sets with different convolution factors.

5

LER 366-2016-003 Exposure Period #

CDP Notes EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 3 1.6E-6 probabilities adjusted to credit an additional 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 4 1.2E-6 probabilities adjusted to credit an additional 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 5 7.4E-7 probabilities adjusted to credit an additional 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C and EPS-DGN-TM-DG1B set to TRUE and applicable 6 1.7E-6 offsite power recovery probabilities adjusted to credit an additional 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 7 1.1E-6 probabilities adjusted to credit an additional 4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C and DG1B-INHIBIT set to TRUE; 8 2.6E-7 DG1B-INHIBIT-RECOVERY set to 0.1; and applicable offsite power recovery probabilities adjusted to credit an additional 4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 9 7.9E-7 probabilities adjusted to credit an additional 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

EPS-DGN-FR-DG1C set to TRUE and applicable offsite power recovery 10 8.3E-7 probabilities adjusted to credit an additional 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Dominant Sequence. The dominant accident sequence is weather-related LOOP/SBO Sequence 38-18 (CDP = 5.0x10-6), which contributes approximately 50 percent of the total internal events CDP.7 The dominant sequence is shown graphically in Figures A-1 and A-2 in Appendix A. The dominant sequences that contribute at least 1.0 percent to the total internal events CDP for this analysis are provided in the following table.

Sequence CCDP CDP CDP  % Description Weather-related LOOP initiating event; successful reactor trip; emergency power system fails LOOPWR 38-18 5.19E-06 2.18E-07 4.98E-06 49.7% resulting in a SBO; reactor core isolation cooling (RCIC) succeeds; operators fail to recover offsite power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> Grid-related LOOP initiating event; successful reactor trip; emergency power system fails resulting in a LOOPGR 38-18 1.37E-06 8.14E-08 1.29E-06 12.9%

SBO; RCIC succeeds; operators fail to recover offsite power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> 7 This sequence contribution is from all four LOOP initiating event types: grid-centered, weather-related, switchyard-centered, and plant-centered.

6

LER 366-2016-003 Sequence CCDP CDP CDP  % Description Transient initiating event; successful reactor trip; power conversion system fails; RCIC and high-pressure coolant injection (HPCI) fail; operators successfully TRANS 61 9.26E-07 3.36E-08 8.92E-07 8.9% depressurize the reactor coolant system (RCS); low-pressure injection (including core spray) and alternate sources of low-pressure injection (e.g., firewater, condensate) fail Switchyard LOOP initiating event; successful reactor trip; emergency power system fails resulting in a LOOPSC 38-18 7.23E-07 3.83E-08 6.86E-07 6.8%

SBO; RCIC succeeds; operators fail to recover offsite power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> Weather-related LOOP initiating event; successful reactor trip; emergency power system fails LOOPWR 38-30 3.85E-07 1.47E-08 3.70E-07 3.7%

resulting in a SBO; RCIC fails; HPCI succeeds; operators fail to recover offsite power within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> Loss of startup transformer A initiating event; successful reactor trip; power conversion system fails; RCIC and HPCI fail; operators LOSUTD 34 3.85E-07 2.55E-08 3.60E-07 3.6% successfully depressurize the RCS; low-pressure injection (including core spray) and alternate sources of low-pressure injection (e.g.,

firewater, condensate) fail Loss of condenser heat sink initiating event; successful reactor trip; power conversion system fails; RCIC and HPCI fail; operators LOCHS 52 1.72E-07 8.88E-09 1.63E-07 1.6% successfully depressurize the RCS; low-pressure injection (including core spray) and alternate sources of low-pressure injection (e.g.,

firewater, condensate) fail Grid-related LOOP initiating event; successful reactor trip; emergency power system fails resulting in a LOOPGR 38-30 1.23E-07 4.68E-09 1.18E-07 1.2% SBO; RCIC fails; high-pressure coolant injection succeeds; operators fail to recover offsite power within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> Uncertainties. The treatment of EDG 1C failure is a potential modeling uncertainty for this ASP analysis. Typically, ASP analyses use the failure memory approach in which successful operation of equipment is not credited. However, success is credited in this analysis by adjusting the offsite power recovery probabilities based on surveillance test run times for the 7

LER 366-2016-003 applicable exposure periods from January 17th through August 18th. Note that these probability adjustments are in addition to the convolution factors already applied to the other EDGs. A sensitivity analysis was performed assuming that EDG 2C failed for the complete exposure period (i.e., 220 days) without adjusting the offsite power recovery probabilities. This sensitivity case results in a CDP = 1.2x10-5, which is approximately 20 percent greater than the best estimate case. While not greatly affecting the result of this analysis, other cases in which there are longer run times of the affected EDG would yield larger differences.

REFERENCES

1. Edwin I. Hatch Nuclear Plant, "LER 366/16-003 - 2C Emergency Diesel Generator Inoperable Due to Low Lube Oil Pressure, dated October 13, 2016 (ML16287A788).

2. Edwin I. Hatch Nuclear Plant, "LER 366/16-001 - 2C EDG Fuel Oil Relief Valve Leakage Caused Train lnoperability, dated June 8, 2016 (ML16160A247).

8

LER 366-2016-003 Appendix A: Key Event Tree LOSS OF OFFSITE POWER REACTOR SHUTDOWN EMERGENCY POWER SRV'S CLOSE HIGH PRESSUIRE SUPPRESSION POOL MANUAL REACTOR CRD INJECTION (2 PUMPS) LOW PRESSURE INJECTION ALTERNATE LOW PRESSURE RESIDUAL HEAT REMOVAL CONTAINMENT VENTING LATE INJECTION # End State INITIATOR (WEATHER- INJECTION (RCIC or HPCI) COOLING DEPRESS (CS or LPCI) INJECTION (Phase - CD)

RELATED)

IE-LOOPWR RPS EPS SBO-FTF SRV HPI SPC DEP CRD LPI VA RHR CVS LI 1 OK 2 OK 3 OK LI05 4 CD 5 OK LI01 6 CD 7 OK 8 OK LI05 9 CD 10 OK LI01 11 CD 12 OK 13 OK LI00 14 CD 15 OK LI01 16 CD 17 CD 18 OK 19 OK LI00 20 CD DEP4 21 OK LI01 22 CD 23 CD 24 OK 25 OK LI05 26 CD 27 OK LI01 28 CD 29 OK 30 OK LI00 31 CD 32 OK LI01 33 CD 34 CD 35 CD P1 36 LOOP-1 P2 37 LOOP-2 38 SBO 39 ATWS 40 CD Figure A-1. Edwin I. Hatch Nuclear Plant LOOP Event Tree (Weather-Related)

A-1

LER 366-2016-003 EMERGENCY POWER SRV'S CLOSE RCIC (SBO) ACCTIONS TO EXTEND HPCI (SBO) MANUAL REACTOR FIREWATER INJECTION OFFSITE POWER DIESEL GENERATOR CONTAINMENT VENTING LATE INJECTION # End State ECCS OPERATION DEPRESS RECOVERED RECOVERY (Phase - CD)

EPS SBO-FTF SRV RCI-SBO FTF-SBO EXT FTF-SBO HCI-SBO FTF-SBO DEP-EXT FTF-SBO FWS-EXT FTF-FWSEXT OPR DGR CVS-EXT LI 1 SBO-OP 2 OK 3 OK OPR-12H LI-EXT 4 CD DGR-12H 5 OK LI01 6 CD 7 SBO-OP 8 OK 9 OK OPR-12H LI00 10 CD DGR-12H 11 OK LI01 12 CD 13 SBO-OP 14 OK OPR-07H DGR-07H 15 CD 16 SBO-OP 17 OK OPR-07H DGR-07H 18 CD 19 SBO-OP 20 OK 21 OK OPR-12H LI00 22 CD DGR-12H 23 OK LI01 24 CD 25 SBO-OP 26 OK OPR-05H DGR-05H 27 CD 28 SBO-OP 29 OK OPR-05H DGR-05H 30 CD 31 SBO-OP 32 OK OPR-30M DGR-30M 33 CD 34 SBO-OP 35 OK 36 OK OPR-12H LI-EXT 37 CD DGR-12H 38 OK LI01 39 CD 40 SBO-OP 41 OK 42 OK OPR-12H LI00 43 CD DGR-12H 44 OK LI01 45 CD P1 46 SBO-OP 47 OK OPR-04H DGR-04H 48 CD 49 SBO-OP 50 OK 51 OK OPR-12H LI00 52 CD DGR-12H 53 OK LI01 54 CD 55 SBO-OP 56 OK OPR-04H DGR-04H 57 CD HCI1 58 CD 59 SBO-OP 60 OK OPR-01H DGR-01H 61 CD P2 62 SBO-OP 63 OK OPR-01H DGR-01H 64 CD HCI1 65 CD Figure A-2. Edwin I. Hatch Nuclear Plant SBO Event Tree A-2

LER 366-2016-003 Appendix B: Modified Fault Tree HATCH 1 & 2 DIESEL GENERATOR 1B FAULT TREE DG1B EDG B INHIBITED FROM UNIT 2 HATCH 1 & 2 DIESEL GENERATOR 1B DIESEL GENERATORS FAIL FROM CONTROL POWER FAULT TREE COMMON CAUSE TO START DG1B-1 DG1B-DCP Ext EPS-DGN-CF-START 1.14E-05 HATCH 1 & 2 DIESEL GENERATOR 1B DIESEL GENERATORS FAIL FROM SERVICE WATER FAULT TREE COMMON CAUSE TO RUN EDG1B IS INHIBITED TO UNIT 2 DG1B-SSW Ext EPS-DGN-CF-RUN 1.41E-04 DIESEL GENERATOR 1B FAILS TO RUN DG1B-INHIBIT Ignore OPERATORS FAIL TO ALIGN EDG 1B EPS-DGN-FR-DG1B 3.01E-02 TO UNIT 2 DG 1B IS UNAVAILABLE BECAUSE OF TEST OR MAINTENANCE DG1B-INHIBIT-RECOVERY Ignore EPS-DGN-TM-DG1B 1.43E-02 DIESEL GENERATOR 1B FAILS TO START EPS-DGN-FS-DG1B 2.89E-03 DIESEL GENERATORS FAIL FROM COMMON CAUSE TO START EPS-DGN-CF-FSALL 1.59E-06 DIESEL GENERATORS FAIL FROM COMMON CAUSE TO RUN EPS-DGN-CF-FRALL 1.98E-05 Figure B-1. Modified DG1B Fault Tree B-1