NUREG- 1 784

Operating Experience

Assessment - Effects of Grid

Events on Nuclear Power Plant

Performance

U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Washington, DC 20555-0001

*ORV REG,,
-I

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access

NUREG-series publications and other NRC records at

NRC's Public Electronic Reading Room at

http:l/www.nrc.pov/readinp-rm.html.

Publicly released records include, to name a few,

NUREG-series publications; Federal Register notices;

applicant, licensee, and vendor documents and

correspondence; NRC correspondence and internal

memoranda; bulletins and information notices;

inspection and investigative reports; licensee event

reports; and Commission papers and their attachments.

NRC publications in the NUREG series, NRC

regulations, and Title 10, Energy, in the Code of

Federal Regulations may also be purchased from one

of these two sources.

1. The Superintendent of Documents

U.S. Government Printing Office

Mail Stop SSOP

Washington, DC 20402-0001

Internet bookstore.gpo.gov

Telephone: 202-512-1800

Fax: 202-512-2250

2. The National Technical Information Service

Springfield, VA 22161-0002

www.ntis.gov

1-800-553-6847 or, locally, 703-605-6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: Office of the Chief Information Officer,

Reproduction and Distribution

Services Section

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

E-mail: DISTRIBUTION@nrc.gov

Facsimile: 301-415-2289

Some publications in the NUREG series that are

posted at NRC's Web site address

htto://www.nrc.pov/readinq-rm/doc-collections/nuregs

are updated periodically and may differ from the last

printed version. Although references to material found

on a Web site bear the date the material was accessed,

the material available on the date cited may

subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical

libraries include all open literature items, such <.s

books, journal articles, and transactions, Fedeial

Register notices, Federal and State legislation, and

congressional reports. Such documents as theses,

dissertations, foreign reports and translations, and

non-NRC conference proceedings may be purchased

from their sponsoring organization.

Copies of industry codes and standards used in a

substantive manner in the NRC regulatory process are

maintained atThe NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852-2738

These standards are available in the library for

reference use by the public. Codes and standards are

usually copyrighted and may be purchased front the

originating organization or, if they are American

National Standards, fromAmerican National Standards Institute

11 West 42'd Street

New York, NY 10036-8002

www.ansi.org

212-42-4900

Legally binding regulatory requirements are soated

only in laws; NRC regulations; licenses, including

technical specifications; or orders, not in

NUREG-series publications. The views expre ssed

in contractor-prepared publications in this series are

not necessarily those of the NRC.

The NUREG series comprises (1) technical and

administrative reports and books prepared by the

staff (NUREG-XXXX) or agency contractors

(NUREG/CR-XXXX), (2) proceedings of

conferences (NUREG/CP-XXXX), (3) reports

resulting from nternational agreements

(NUREGIIA-XXXX), (4) brochures

(NUREG/BR-XXXX), and (5) compilations of egal

decisions and orders of the Commission and Atomic

and Safety Licensing Boards and of Directors'

decisions under Section 2.206 of NRC's regulations

(NUREG-0750).
NUREG-1784

Operating Experience

Assessment - Effects of Grid

Events on Nuclear Power Plant

Performance

Manuscript Completed: December 2003

Date Published: December 2003

Prepared by

W.S. Raughley, G.F. Lanik

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001
ABSTRACT

Deregulation of the electrical industry has resulted in major changes to the structure of the

industry over the past few years. Whereas before, electric utilities produced the electricity and

operated the transmission and distribution system, that is no longer the case. In many states,

the electric utilities have split into separate generating companies, and transmission and

distribution companies. Most nuclear power plant (NPP) operators no longer have control of

the transmission and distribution system operations. NPPs rely on outside entities to maintain

adequate reactive and voltage support for NPP operation. An assessment was completed by

the Office of Nuclear Regulatory Research (RES) to identify changes to grid performance

relative to NPPs which could impact safety. The assessment also provides some numerical

measures to characterize grid performance before and after deregulation - in particular, those

related to loss of offsite power (LOOP).

The information gathered' provides a baseline of grid performance to gauge the impact of

deregulation and changes in grid operation. The period 1985-1996 was considered ubefore

deregulation" and 1997-2001 after deregulation." The assessment found that major changes

related to LOOPs after deregulation compared to before include the following: (1) the

frequency of LOOP events at NPPs has decreased; (2) the average duration of LOOP events

has increased; (3) where before LOOPs occurred more or less randomly throughout the year,

for 1997-2001, most LOOP events occurred during the summer; and (4) the probability of a

LOOP as a consequence of a reactor trip has increased.

The assessment re-enforces the need for NPP licensees and NRC to understand the condition

of the grid throughout the year to assure that the risk due to potential grid conditions remains

acceptable.

1 This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.

iii
CONTENTS

ABSTRACT ..................................... iii

EXECUTIVE SUMMARY ...................................... vii

FOREWORD.............................................................. xi

ABBREVIATIONS.......................................................... xii

1 INTRODUCTION ............................................... 1

2 BACKGROUND ..................................... 2

2.1 Principal Design, Operating and Maintenance Criteria and Risks. 2

2.1.1 Principal Offsite Power System Design and Reliability Criteria. 2

2.1.2 Principal Risks and Regulatory Expectations. 3

2.1.3 Control of Risks From Running EDG Tests to The Grid. 4

2.2 Reactor Trips Degrade the Grid and Result in Regulatory Actions. 5

2.3 Nuclear Power Plant Voltages Based on Grid Electrical Parameters. 7

2.4 Effects of Deregulation of the Electric Power Industry

on Nuclear Power Plants .7

3 DISCUSSION ..... ................ 10

3.1 Methods for Data Collection and Risk Analyses . . 10

3.2 Risk Insights and General Observations ....... I ..... ................. 13

3.2.1 Risk Insights ............................................ 13

3.2.2 General Observations ..................................... 17

3.3 Nuclear Plant Voltages Not Always Analyzed for Grid

Conditions Experienced ......................... 19

3.3.1 Grid Loading and Equipment Out of Service ..................... 19

3.3.2 Grid Reactive Capability Weakened .21

3.3.3 Transmission System Faults May Involve Miltiple Reactor Trips 23

3.4 Licensees Should Contract for Adequate Voltage Support . .24

3.5 Emergency Diesel Generator Test With Grid Degraded May Compromise

Independence .. 25

3.6 Potential Damaging Effects of Current Unbalances From Grid Disturbances . .26

3.7 Grid Transients May Degrade Scram and Anticipated Transient

Without Scram Capabilities .27

3.8 Effects of Overfrequency on Reactor Integrity ........... ............. 27

4 ASSESSMENT .................................. 28

5 REFERENCES .................................. 30

v
APPENDICES

A Grid Events ................................................... .A-1

B Risk Analysis .................................................... B-1

C LOOP and Scram Data ............................................... C-1

D Resolution of Comments ............................................... D-1

FIGURES

1 Risk Profile . .................................................... 13

B-1 Simplified Event Tree for a Reactor Trip-Consequential LOOP ..... ............ B-3

B-2 Simplified Event Tree for a LOOP Event Tree ........ ...................... B-4

B-3 Risk Profile .................................................... B-7

TABLES

1 Grid Event Summary .................................................. 12

2 Changes in Risk After Deregulation ...................................... 14

3 Pennsylvania, New Jersey, Maryland Interconnection

Base-Line Voltage Limits .............................................. 24

A-1 Types and Number of Grid Events 1994-2001 ........ .................... A-24

A-2 Event Summary .................................................. A-27

A-3 Event Causal Factors ............................................... A-40

A-4 Summary of Event Group Causal Factors ......... ....................... A-41

B-1 Operating Data From LOOPs At Power Before and After Deregulation ..... ...... B-5

B-2 Changes in Risk After Deregulation .............. ........................ B-8

C-1 LOOPs While at Power 1997-2001 .............. ........................ C-1

C-2 Consequential LOOPs 1985-1996 .............. ........................ C-2

C-3 Grid-Related or Initiated LOOPs While at Power 1985-1996 ...... ............ C-2

C-4 Plant Related LOOPs While at Power 1985-1996 ........ ................... C-3

C-5 Weather Related LOOPS While at Power 1985-1996 ....... ................. C-4

C-6 Non-Initiating LOOPs While at Power 1985-1996 ........ ................... C-4

C-7 Annual Scrams and Critical Reactor Years 1985-2001 ...... ................. C-5

vi
EXECUTIVE SUMMARY

Deregulation of the electrical industry has resulted in major structural changes over the past

few years. Whereas before, electric utilities produced the electricity and operated the

transmission and distribution system, that is no longer the case. In many states, the electric

utilities have split into separate generating companies, and transmission and distribution

companies, thereby increasing the coordination times to operate the grid from involvement of

different companies. In addition, generating companies have daily open access to the grid and

this changes the grid power flows and voltages so as to change the grid parameters in the

nuclear power plant (NPP) design and grid operating configurations that were established

before deregulation. NPPs now rely on outside entities to maintain safety bus voltage within

limits for NPP operation. The Office of Nuclear Regulatory Research (RES) completed an

assessment that is intended to identify changes to grid performance relative to the safety

performance of NPPs. The assessment also provides some numerical measures to

characterize grid performance before and after deregulation - in particular, those related to

loss of offsite power (LOOP).

The information gathered' provides a baseline of grid performance to gauge the impact of

deregulation and changes in grid operation. 'The period 1985-1996 was considered before

deregulation" and the 1997-2001 "after deregulation." The assessment found that major

changes related to LOOPs after deregulation compared to before include the following: (1) the

frequency of LOOP events at NPPs has decreased; (2) the average duration of LOOP events

has increased - the percentage of LOOPs longer than 4 hours2 has increased substantially;

(3) where before LOOPs occurred more or less randomly throughout the year, following

deregulation, most LOOP events occurred during the summer months (May-September); and

(4) the probability of a LOOP as a consequence of a reactor trip has increased during the

summer months.

Simplified event trees were developed to assess the impact of grid changes on overall NPP

risk, and to include the impact of the LOOP as a consequence of a reactor trip. The findings

indicate: (1) the average yearly risk from LOOPs and reactor trips 'decreased, and (2) a small

number of events over the first 5 years of deregulated operation indicate that most of the risk

from LOOPs occurs during the summer months. 'Sensitivity studies indicate that the risk

reduction goals from SBO implementation have been maintained, except during summertime

operations with the emergency diesel generator (EDG) out of service or with the grid degraded.

The assessment re-enforces the need for NPP licensees 'and NRC to understand the condition

of the grid throughout the year to assure that the risk due to potential grid conditions remains

acceptable. To elaborate:

(1) The NRC does not regulate the grid; however, the performance of offsite power is a

major factor for assessment of risk. With respect to maintaining the current levels of

safety, offsite power is especially important when considering EDG maintenance and

This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.

2 Implementation of the station blackout (SBO) rule (10 CFR 50.63) has resulted in NPPs having an SBO

coping capability of at least 4 hours to ensure safety of plant equipment and allow time to restore ac power.

vii
outage activities. Consequently, NRC and licensee assessments of risk that suppc rt

EDG maintenance and outage activities should include: (a) assessment of offsite power

system reliability, (b) the potential for a consequential LOOP given a reactor trip, and (c)

the potential increase in the LOOP frequency in the summer (May to September).

Regarding (a) above, the assessment of the power system reliability and risks from plant

activities can be better managed though coordination of EDG tests with transmission

system operating conditions.

(2) Another important aspect of the changes to the electrical grid is the impact on the

electrical analyses of NPP voltage limits and predictions of voltages following a reactor

trip and whether a reactor trip will result in a LOOP. Recent experience shows that

actual grid parameters may be worse than those assumed in previous electrical

analyses due to transmission system loading, equipment out-of-service, lower than

expected grid reactive capabilities, and lower grid operating voltage limits and acticn

levels. NPP design basis electrical analyses used to determine plant voltages should

use electrical parameters based on realistic estimates of the impact of those conditions.

(3) With the structural and operational changes that have occurred in the industry, it is

important to have formal agreements, such as contracts between the NPP and

transmission company, in place to ensure grid operators will maintain adequate rea ctive

and voltage support. Some regional grid operating entities manage and control

operational and engineering activities in real time to maintain grid availability and

reliability. Since external factors impact the ability of licensees to manage risks and

understand the condition of the grid, some NPP licensees have implemented contractual

agreements with grid operators to provide a mechanism for maintaining secure electrical

power in the deregulated environment. Contractual arrangements should include

specific regulatory requirements or commitments; electrical performance requirements

under normal, transient, and accident conditions; communication protocols; operating

procedures and action limits; maintenance responsibilities; responsibility for station

blackout (SBO) (alternate ac) power supplies not owned by the licensee; and NPP and

grid technical parameters necessary to maintain adequate electrical supply to the NPP.

Within its proper roles and responsibilities, the NRC should communicate with the

industry about the possible need for formal agreements.

Additional insights from this study include the following:

(1) The California Independent System Operator (CAISO), the Pennsylvania-New JerseyMaryland (PJM) Interconnection, and Callaway experiences provide an opportunity for

the industry and NRC to develop lessons to be learned. As examples, CAISO found it

needed to manage and control regional operational and engineering activities in real

time to maintain adequate reactive and voltage support to NPPs, PJM identified

numerous corrective actions for the root causes of low voltage conditions following a

1999 heat wave, and Callaway modified the plant and its grid operating protocols with

the transmission entity as a result of low voltage conditions from operating in a

deregulated environment.

(2) While the data set is small, the number, types, and duration of LOOPs have changad

since 1997. Recent experience indicates that there are fewer LOOPs. Whereas most

viii
-of the 1985-1996 LOOPs were of short duration and plant-centered, most of the recent

LOOPs are longer and had major grid involvement from the reactor trip, severe weather

or lightning that affected the NPP switchyard and transmission lines, or NPP switchyard

equipment failures. Further, based on historical data, power restoration times following

a LOOP were generally less than 4 hours; more recent LOOPs have lasted significantly

longer. Also, recent grid events, although not directly associated with LOOPs, indicate

that grid recovery times are longer. For example, in the Northeast, it took the grid

operator (of 12 NPPs) 10 hours to resolve problems from unexpected behavior of the

grid, despite implementation of planned voltage and load management programs;

investigation found insufficient reactive capacity to quickly restore voltages. In the

Mid-West, the grid operator needed 12 hours to change regional power flows and

restore voltage to an NPP. Longer restorations for most of the events challenge the

assumptions and capabilities used in assessing plant risk from LOOPs.

(3) LOOPs, partial LOOPs, and voltage degradations below the technical specification low

limit following or coincident with a reactor trip may indicate potential electrical

weaknesses in the grid and a need for followup to prevent more serious events.

(4) Realistic assessment of the risk from grid events will need to consider the impact of a

grid event on multiple NPPs. For example, a 1996 transmission system disturbance

resulted in the simultaneous trip of four NPPs.

(5) Experience indicated that transmission system operation or disturbances may cause

sustained or frequent current unbalances that result in damage to electrical equipment.

It is common practice to protect expensive or important non-safety equipment from

current unbalances. Safety equipment should also have the same level of protection.

(6) Grid-induced reactor transients can effect scram capability. Operating experience

identified an instance where anticipated transient without scram mitigation based on

end-of-cycle recirculation pump trip logic failed to operate correctly during a

transmission system fault that produced large electrical load fluctuations.

(7) Grid conditions which result in over-frequency conditions can have unexpected

consequences. At one plant, over-frequency conditions following a load rejection

caused speed-up of the reactor coolant pumps which increased flows that generated

forces to within a small margin of those causing uplift of the fuel rods. The

over-frequency condition was not properly accounted for by the plant protective relay

control logic.

(8) The synergistic effects of reduced reactive grid capability on NPPs from hot weather or

multiple reactor power uprates should be evaluated to determine the impact on the

capacity and capability of the grid to maintain adequate NPP voltages.

(9) Attention to non-safety related equipment could improve the response of an NPP to a

grid electrical transient or LOOP. The availability of non-safety related voltage

controlling equipment, such as station power transformer automatic tap changers that

control safety bus voltage levels, is important as these are assumed to be functional in

the analyses of internal voltages and by the grid controlling entity for the range of

external voltages maintained at the NPP. In addition, attention to non-safety related

ix
NPP protective setpoints may reduce the chance of a premature NPP trip during a grid

disturbance. For example, experience caused one licensee to lower RCP undervollage

and underfrequency setpoints to better coordinate with grid relay setpoints. In othe,-

instances, inappropriate NPP main generator voltage regulator and volts per hertz

protective relay setpoints caused unnecessary reactor trips during a grid disturbance.

x
FOREWORD

This report identifies changes to grid performance which could impact nuclear power plants

(NPP) safety. This work was completed prior to the August 14, 2003, blackout that affected

several states and Canada. The information gathered provides a baseline of grid performance

to gauge the impact of deregulation and changes in grid operation. The report provides a

comparison and assessment of loss of offsite power (LOOP) experience over two distinct

periods of time, before deregulation (1985-1996) and after deregulation (1997-2001). The

assessment found that major changes related to LOOPs after deregulation compared to before

include the following: (1) the frequency of LOOP events at NPPs has decreased; (2) the

average duration of LOOP events has increased - the percentage of LOOPs longer than

4 hours has increased substantially; (3) where before LOOPs occurred more or less randomly

throughout the year, following deregulation, most LOOP events occurred during the summer

months (May-September); and (4) the probability of a LOOP as a consequence of a reactor trip

has increased during the summer months.

The report notes important aspects of risk assessments, that support emergency diesel

generator maintenance, and outage activities should include: (a) assessment of offsite power

system reliability, (b) the potential for a consequential LOOP given a reactor trip, and (c) the

potential increase in the LOOP frequency in the summer (May to September). In addition,

changes to the electrical grid could impact previous electrical analyses of NPP voltage limits

and predictions of voltages following a reactor trip and whether a reactor trip will result in a

LOOP. Recent experience shows that actual grid parameters may not be consistent with

parameters assumed in electrical analyses due to transmission system loading, equipment outof-service, lower than expected grid reactive capabilities, and lower grid operating voltage limits

and action levels. NPP design basis electrical analyses used to determine plant voltage needs

to reflect realistic estimates of those parameters.

Best practices indicate formal agreements between the NPP and transmission company, will

help ensure that grid operators will provide reliable electrical power. Some regional grid

operating entities manage and control operational and engineering activities in real time to

maintain grid availability and reliability. Since external factors impact the ability to fully manage

risks and understand the condition of the grid, some utilities have implemented contractual

agreements with grid operators to provide a mechanism for maintaining secure electrical power

in the deregulated environment. These contractual arrangements include specific electrical

requirements, communication protocols, operating procedures and action limits, maintenance

responsibilities, station blackout (alternate ac) power supply responsibilities, and NPP and grid

technical requirements necessary to maintain adequate electrical supply'to the NPP.

This report provides the basis and a new perspective for assessing grid performance and

associated best practices. Insights from this report will be used to establish a collaborative

effort with the nuclear and electric industries to collect grid reliability data, complete a field

survey of NPPs and grid operators best practices to bridge the gap between power producers

and transmission entities, and investigate variations in grid domains that could impact NPP

offsite power performance.

Farouk Eltawila, Director

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

xi
ABBREVIATIONS

ASP accident sequence precursor

CAISO California Independent System Operator

CCDP conditional core damage probability

CDF core damage frequency

CFR Code of Federal Regulations

DAWG Disturbance Analyses Working Group

DOE Department of Energy

EDG emergency diesel generator

EOC end of cycle

EPRI Electric Power Research Institute

FERC Federal Energy Regulatory Commission

FSAR final safety analysis report

FTR failed to run (load)

GDC General Design Criterion

GL generic letter

IN Information Notice

INPO Institute of Nuclear Power Operations

LER licensee event report

LOOP loss of offsite power

MTC moderator temperature coefficient

MVAR megavolt-ampere-reactive

MWe megawatt electric

MW megawatt

MWt megawatt thermal

NERC North American Electric Reliability Council

NPP nuclear power plant

NRC Nuclear Regulatory Commission, U.S.

OOS out of service

PCM percent millirho

PJM Pennsylvania, New Jersey, Maryland Interconnection

RCP reactor coolant pump

RES Nuclear Regulatory Research, Office of (NRC)

RIS Regulatory Issue Summary

RPT recirculation pump trip

xii
RY reactor-year

SBO station blackout

TCV turbine control valve

TS technical specification

VOPT variable overpower trip

xiii
1 INTRODUCTION

Deregulation of the electrical industry has resulted in major changes to the structure of the

industry over the past few years. Whereas before, electric utilities produced the electricity and

operated the transmission and distribution system, that is no longer the case. In some states,

the electric utilities have split into separate generating companies, and transmission and

distribution companies. More companies are likely to lead to increased coordination times to

operate the grid. In addition, generating companies have daily open access to the grid and this

changes the grid power flows and voltages so as to change the grid parameters in the nuclear

power plant (NPP) design, and the grid and operating configurations that were established

before deregulation. NPPs now rely on outside entities to provide reliable electrical power for

NPP operation.

The Nuclear Regulatory Commissions' (NRC) Office of Nuclear Regulatory Research (RES)

completed the work described in this report to identify and provide an assessment of grid

events and loss of offsite power (LOOPs) at NPPs before deregulation (1985-1996) and after

deregulation (1997-2001). The objectives of the work were to use accumulated operating

experience from various sources to identify and assess: (1) the numbers, types, and causes of

these events; (2) potential risk-significant issues; (3) potential challenges to the effectiveness of

the NRC regulations; and (4) lessons learned. This assessment is intended to identify changes

to grid performance relative to NPPs that could impact safety. The assessment also provides

simplified numerical measures to characterize grid performance before and after deregulation

- in particular, those related to LOOPs. The information gathered' provides a baseline of grid

performance to gauge changes in grid operation by operating in a deregulated environment.

For the purposes of this assessment, grid events include: (1) losses of electric power from any

remaining power supplies as a result of,- or coincident with, a reactor trip; (2) reactor trips,

LOOPs, or partial LOOPs in which the first event in the sequence of events occurred in the

transmission network (i.e., the NPP switchyard or the transmission and generation system

beyond the NPP switchyard); and (3) events of interest" that provide an insight into the plant

response to a grid initiated event.

Since our focus is on aspects of grid performance, some events are defined differently here

than in other assessments - a number of the events which are defined in this assessment as

grid related LOOPs or grid initiated reactor trips based on transmission network equipment

failures, personnel errors, or dependence on grid operator for recovery, are referred to in other

event studies as plant-centered. For the purposes of this assessment a reactor trip from full

power operation is a random test of the capacity and capability of the grid, and as such a LOOP

as a consequence of a reactor trip may be a grid-related LOOP.

As an overview, Section 2 , "Background," provides basic information necessary to understand

the work. Section 3, "Discussion," provides the analyses and discussion to satisfy the

objectives of the work. The numbers, types, and causes of these events were developed from

Appendix A, "Grid Events," as explained in Section 3.1. Section 3.2 compared the risks from all

LOOP events before and after deregulation on an equal basis using Appendix B. Event Trees,"

and actual operating data which were gathered in Appendix C, "LOOP and Scram Data,

1 This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.

1*
1985-2001." Sections 3.2 to 3.8 provide risk insights and lessons learned and finish with

assessments that are consolidated in Section 4, "Assessment." Appendix D, Resolution of

Comments, provides for the resolution of comments to an earlier revision of the report.

2 BACKGROUND

The NPP offsite power system is the typically "preferred source" of ac electric power for all

conditions, including accident and post accident, and is often referred to as the grid. The safety

function of the offsite power system is to provide power to ac safety loads required to shut down

the NPP, including loads in the reactor core decay heat removal system that are required ':o

preserve the integrity of the reactor core and containment following a reactor trip. For the

purposes of this assessment, the grid includes the switchyard or substation at the NPP, the

offsite generating and transmission systems, and the offsite loads. Redundant onsite ac

emergency power supplies, usually emergency diesel generators (EDGs), automatically provide

power to the safety buses following a LOOP.

2.1 Principal Design, Operating and Maintenance Criteria and Risks

The NRC has no jurisdiction over the grid. However, NRC regulations and NPP Technical

Specifications (TS) provide controls over the licensing bases, design criteria, NPP activities,

and risks relative to the grid as discussed below.

2.1.1 Principal Offsite Power System Design and Reliability Criteria

The principal design criteria for the licensing basis of the offsite electric power system are set

forth in Title 10 Code of Federal Regulations (CFR) Part 50, "Domestic Licensing of Production

and Utilization Facilities," Appendix A, "General Design Criteria for Nuclear Power Plants"

(Ref. 1).

General Design Criterion (GDC) 17, Electric power systems," of Appendix A states in part, that

An onsite electric power system and an offsite electric power system shall be provided

... The safety function for each system (assuming the other system is not functioning)

shall be to provide sufficient capacity and capability ...

Provisions ... to minimize the probability of losing electric power from any of the

remaining supplies as result of, or coincident with, the loss of power generated

by the nuclear power unit, the loss of a power from the transmission network, or

the loss of power from the onsite electric power supplies.

Common capacity and capability terms are power, voltage, and frequency. While a detailed

electrical engineering discussion of these terms is beyond the scope of this report, it suffices to

understand that power (mega-volt-amperes or MVA) has two components, real and reactive,

measured in megawatts (MW) and megavars (MVAR), respectively. The real power component

supplies resistive loads such as lights and heaters. The real power component flow between

two points depends primarily on the relative voltage phase angles. The reactive power

2
component supplies inductive loads such as motors. The reactive power component flow is a

direct function of the difference in the magnitude of the voltage at these points.

The GDC 17 requirements are intended to ensure that the NPP connects to a sufficiently robust

and reliable grid and are part of the licensing bases. The GDC 17 provision to minimize the

probability of losing electric power is a common grid design practice for any generating plant.

The industry uses the same measures as GDC 17 to define grid reliability. The North American

Electric Reliability Council (NERC), an industry organization that promotes and assesses grid

reliability, defines grid reliability in terms of the "adequacy" of the generation system and the

"security" of the transmission system. The adequacy of the generation system is measured by

the amount of reserve power available to provide uninterruptible power. Grid operating entities

maintain spinning reserves" synchronized to the grid for immediate use. Voltage reductions

and interrupting loads (rolling blackouts) also'help to maintain minimum reserves in an

emergency. The security of the transmission'system is defined in terms of the ability of the

system to'withstand sudden disturbances, such a'reactor trip or transmission line fault. Grid

operating entities typically perform analyses to determine the requirements and limits that are

used in the operation of the system to ensure adequate levels of power, voltage, and frequency

following a disturbance. Spinning reserves, the results of analyses, as well as voltage and load

management programs are important factors for grid operators to maintain system stability,

adequate NPP voltages and frequencies, and recover from grid events in a timely manner.

In addition, the NRC Standard TS (Ref. 2), which are typical of NPP TS, provide for verification

of the availability of the offsite power supplies every 7 days. The TS imposes limiting conditions

of operation including shutdown of the reactor should offsite power not be restored in a timely

manner, typically in times up to 72 hours for loss of individual offsite power supplies and shorter

times for loss of multiple offsite power supplies. The NRC TS states that the operability of ac

electrical power supply considers the capacity and capability of the remaining sources,

reasonable time for repairs, and the low probability of a design basis accident occurring in this

period. Continued operation for 72 hours generally requires, consistent with Regulatory

Guide 1.93, Availability of Electric Power Sources," 1974, that licensees assess that system

stability and reserves are such that a single failure (including a reactor trip) would not cause a

LOOP.

2.1.2 Principal Risks and Regulatory Expectations

10 CFR 50.63, "Loss of All Alternating Current Power," is commonly referred to as "the station

blackout rule." A station blackout (SBO) is defined in 10 CFR 50.2 as the "complete loss of

electric power to the essential and nonessential electric switchgear buses in an NPP

(i.e., a LOOP concurrent with a turbine trip'and unavailability of the emergency ac power

system)." The SBO rule requires that NPPs be'capable of withstanding an SBO by maintaining

core cooling for a specified duration (coping time) and recover from the SBO event. The

principal parts of an SBO accident sequence are: (1) the initiating LOOP - the frequency of a

LOOP, (2) the loss of onsite power - the unreliability of the onsite ac emergency power

supplies and common cause failure unreliability, (3) recovery - the likelihood that ac power will

be restored before the core is damaged, and (4) core damage probability - the sequences that

result in core damage from the failure to recover ac power and consequently, the failure of

decay heat removal or support systems necessary to safely shutdown. Core cooling failures, or

loss of reactor core cooling integrity can occur in 1 to 2 hours. Failures can also occur in 4 to

8 or more hours from support system failures (e.g., batteries, compressed air, heating,

3
ventilation, and air conditioning) or design limitations (e.g., high suppression pool

temperatures).

The SBO rule was based on NUREG-1032, Evaluation of Station Blackout Accidents at

Nuclear Power Plants," June 1988 (Ref. 3). According to NUREG-1 032, the estimated range

for the frequency of core damage as a result of an SBO accident is 1 E-6 to 1 E-4 per

reactor-year (RY). NUREG-1032 focused on the reliability of the onsite power system based on

the judgement that it would be easier to implement modifications, if required, on the onsite

power system rather than the grid. NUREG-1032 stated that offsite power system reliability

was dependent on a number of factors, such as repair and restoration capability, that were

difficult to analyze and control.

A RES report, "Regulatory Effectiveness of the Station Blackout Rule," August 15, 2000

(Ref. 4), assessed whether or not the SBO rule achieved the desired outcome. The RES report

compared the risk reduction expectations from SBO rule implementation as established in

NUREG-1 109, "Regulatory/Backfit Analysis for the Resolution of the Unresolved Safety ls3ue

A-44, "Station Blackout," June 1988, to the estimated risks from an SBO as documented in the

licensee probabilistic risk assessments of that era. The RES report shows that SBO rule

implementation resulted in a risk reduction in the mean SBO core damage frequency (CDIF) of

3.2E-05/RY, slightly better than the 2.6E-05/RY expected.

NUREG-1 032 concludes that "the capability to restore offsite power in a timely manner (le3s

than 8 hours) can have a significant effect on accident consequences." NUREG-1 032 stu Jied

LOOP event frequency and duration data in three categories (i.e., plant-centered, weathelrelated, and grid-related events) and found the median recovery times to be 18, 210, and

36 minutes respectively, based on data from 1968 through 1985. NUREG-1032 found the

overall median recovery time to be 36 minutes. NUREG-1032 data shows that prior to SBO

rule implementation, of the 59 LOOPs at power which were identified, only four (7 percent) were

more than 4 hours; one was a grid event, three were weather-related events, and the longest

plant-related event was 165 minutes. NUREG-1032 expected "enhanced recovery times" for

grid-related and severe weather LOOPs based on the availability of plant recovery procedures

and at least one source of ac power.

NUREG-5496, "Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:

1980-1996," June 1998 (Ref. 5), found the median recovery times to be 20, 204, and

140.5 minutes for plant-centered, weather-related, and grid-related events. NUREG-5496

indicates the overall median recovery time for LOOPs at power is 60 minutes. More

specifically, NUREG-5496 identified six grid-related LOOPs from 1986 to 1989 with a median

recovery time of 140 minutes and no grid-related LOOPs from 1990 to 1996. NUREG-5496

found that up to 1996, the number of grid-related LOOPs was quite low and the recovery times

were longer but the data set was small. The NUREG-5496 executive summary concluded that

the recovery times for SBO type events were well below the minimum SBO coping time.

2.1.3 Control of Risks From Running EDG Tests to The Grid

EDGs are periodically tested (monthly) to the grid one at a time, for 60 minutes, and

approximately every 18 months for 24 hours, as specified in the TS. NRC standard TS

surveillance requirements state that testing one EDG at a time avoids common-cause failures

that might result from offsite circuit or grid perturbations. The 60 minute run stabilizes engine

4
temperatures, while minimizing the time the EDG is connected to the offsite source. The

Standard TS notes that the 24-hour test is not performed with the reactor at power but may be

performed to reestablish operability provided an assessment determines the safety of the plant

is maintained or enhanced. The TS bases state the assessment shall consider potential

outcomes and transients associated with a perturbation of the offsite or onsite system when tied

together and measure these risks against the avoided risk of a plant shutdown and startup to

determine that plant safety is maintained or enhanced when the surveillance is performed while

at power.

10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power

plants," commonly referred to as the "maintenance rule," requires licensees to assess and

manage risk when performing maintenance activities as follows:

(a)(4) Before performing maintenance activities (including but not limited to surveillance,

post-maintenance testing, and corrective and preventative maintenance), the licensee

shall assess and manage the increase in the risk that may result from the proposed

maintenance activities. The scope of the assessment may be limited to structures,

systems, and components that a risk-informed evaluation process has shown to be

significant to public health and safety..

NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at

Nuclear Power Plants, May 2000 (Ref. 6), provides guidance on implementing the provisions of

10 CFR 50.65 (a)(4) by endorsing Section 11 'to NUMARC 93-01, "Nuclear Energy Institute 

Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,

February 22, 2000 (Ref. 7). Section 11 to NUMARC 93-01 addresses offsite power in several

areas. For example, Section 11.3.2.8 states "Emergent conditions may result in the need for

action prior to conduct of the assessment, or could change the conditions of a previously

performed assessment. Examples include ... significant changes in external conditions

(weather, offsite power availability)."

2.2 Reactor Trips Degrade the Grid and Result in Regulatory Actions

All reactor trips from full power operation are a random test of the capacity and capability of the

grid and as such are potentially grid-related events. Under GDC 17 the grid should have

sufficient capacity and capability to allow the NPP to pass this test. When a reactor trips, the

voltage in the vicinity of the NPP drops from the loss of NPP main generator reactive power

supply. The voltage normally recovers quickly as "spinning reserves' and other reactive power

supplies immediately supply power: LOOPs, partial LOOPs, and voltage degradations below

the plant specific low limit following or coincident with a reactor trip are evidence of potential

electrical weaknesses in the grid.

The NRC took generic actions consistent with GDC 17 after two reactor trips in summer months

resulted in degraded NPP voltages below the levels needed to respond to a design basis event.

One of the events involved two occurrences, 2 weeks apart, in July 1976 at an NPP in the

Northeast. In the first occurrence, when the reactor tripped the 345 kV voltage dropped

approximately 5 percent from 352 kV to 333 kV for 1 hour. This system voltage degradation

along with the voltage drops through the NPP transformers, reduced the voltage at safetyrelated equipment to levels that were insufficient to operate the equipment. In addition, certain

non-safety related equipment did not start due to blown fuses. Corrective action included

5
raising undervoltage relays setpoints to assure the plant would be separated from a degraJed

grid before the voltage dropped to a point where equipment operability could no longer be

assured.

A few weeks later, the inrush current from the start of a non-safety 1500 horsepower motcr

resulted in low voltage and the EDGs automatically started and loaded. However, during

automatic load sequencing the inrush current from safety motor starts caused the bus voltage

to drop below the new undervoltage setpoints. The conditional core damage probability

(CCDP) for this event was 1 .4E-02 due to the lack of plant procedures to respond to the event.

This event resulted in an NRC generic letter (GL) (not numbered at the time) dated June 2,

1977 (referenced in Ref. 8), requiring licensees to add degraded voltage relays to trip the offsite

power supply to safety buses and start the emergency onsite power supplies at or above te

calculated minimum voltage levels needed to withstand a design basis event.

The second reactor trip occurred in September 1978 at a dual unit NPP. When the reactor

tripped, the transfer of the station loads tripped a transmission system auto-transformer that

was already feeding the other NPP's station power transformer. The loads from both NPPs

transferred to, and overloaded, a "back-up" NPP transformer. Power was restored in

approximately 88 minutes and the CCDP was less than 1.OE-06. The licensee's review of the

event found that degraded voltage conditions would result at the safety buses following a

design basis event and that the safety loads might not transfer to the EDGs. After this event,

the NRC issued GL 79-36, Adequacy of Station Electric Distribution System Voltages," August

8, 1979 (Ref. 8), which expanded the NRC review of the adequacy of the electric power system

to include the results of plant-specific analysis using NRC guidelines for voltage drop

calculations.

The GL 79-39 guidelines for voltage drop calculations require licensees to consider a reaa:or

trip and the minimum expected" and maximum expected" grid voltage as follows:

Separate analyses assuming the power source to the safety buses is . . . (c) other

available connections to the offsite network one by one assuming the need for electric

power is initiated by (1) an anticipated transient (e.g., unit trip) or (2) an accident,

whichever presents the largest load demand situation.

The voltage at the terminals of the safety loads should be calculated based on . . . :he

assumption that grid voltage is at the minimum expected value" . . . and selected

based on the lowest of the offsite circuit, (b) the minimum voltage expected at the

connection to the offsite circuit due to contingency plans which may result in reduced

voltage from the grid, or (c) the minimum predicted grid voltage from grid stability

analysis (e.g., load flow studies).

Provide assurance the actions to assure adequate voltage levels for safety loads do not

result in excessive voltage, assuming the maximum expected value of voltage at th a

connection of the offsite circuit ...

....requests licensees to state planned actions including any limiting conditions of

operation for TS in response to experiencing voltages below analytical values.

6
;'."' 1,i ' 't 

2.3 Nuclear Power Plant Voltages Based on Grid Electrical Parameters

The North American electric power supply grid consists of four nearly independent large major areas that are interconnected. Approximately 160 control centers perform the load dispatching and switching operations. Current flows freely within each interbonrhected system according to the laws of electricity. Since the capacity and capability of the power system cannot be measured or tested except when challenged, grid operating entities typically perform analyses to determine the requirements and limits that are used in the operation of the system to ensure

adequate levels of power, voltage, and frequency following a disturbance. The grid operating or transmission entity analyzes this system for stability, short circuits, load flows, and voltages to ensure that the grid security is maintained.- Typically, thousands of grid operating configurations are analyzed, assuming numerous initial conditions and contingencies, such as the availability of the generators, sudden loss of the large generators or loads, the minimum

and peak transmission system loading, equipment out of service (OS), and faults.

The results of the grid analyses are typically summarized for the NPP in terms of the minimum

and maximum expected voltages and impedances at the high-voltage terminals of the NPP

power transformers. The NPP uses these parameters to calculate whether NPP internal

voltages are within equipment ratings and the minimum voltages using the GL 79-36 guidelines. Licensees periodically revise these analyses with updated external voltages and impedances from the grid operating entity. If the NPP internal voltages are not adequate (i.e., expecting that

a unit trip or other condition would result in operating voltage too close to the degraded voltage relay and alarm setpoint), the licensees and grid operating entities may adjust their systems (e.g., move NPP or grid transformer voltage taps) or establish compensatory measures

(e.g., procedure revisions) to avoid potentially adverse conditions or configurations. In some

cases, the NPP or the grid operating entity may need to add equipment such as a transformer

with an automatic load tap changer (LTC) or capacitors or other reactive supply.

2.4 Effects of Deregulation of the Electric Power Industry on Nuclear Power Plants

In 1992, the National Energy Policy Act encouraged competition in the electric power industry. The National Energy Policy Act requires, in part, open generator access to the transmission

system and statutory reforms to encourage the formation of wholesale generators. The electric industry began deregulating after the April 1996 issuance of Federal Energy Regulatory Commission (FERC) Order 888, Promoting Wholesale Competition Through Open Access

Non-discriminatory Transmission Services by Public Utilities, Recovery of Stranded Costs by Public Utilities and Transmitting Utilities," which requires that utility and non-utility generators have open access to the electric power transmission system.

Prior to economic deregulation of the electrical system, NRC licensees were both electrical

generators and transmission system operators. With economic deregulation, NRC licensees no

longer control the transmission system - typically, generation, and transmission and

distribution are separate corporations, or independent subsidiaries or affiliates of the same

corporation. Wholesale generators resulted mostly from state legislation that removed the

generators from the regulated rate base so as to allow them to compete for the sale of power in

an open market. Utilities also divested the generating assets; typically the switchyard remained

part of the transmission company. As a result of these changes there are more entities

involved in grid recovery that must be coordinated following any disturbance. A detailed stateby-state status is available on a Department of Energy (DOE) Web site and shows about

7
50 percent of the state utility regulatory commissions have (or plan to) deregulate, and

50 percent have no plans to deregulate or have put deregulation on hold.

Initial licensing of NPPs included analyses of electrical system performance with certain

contingencies to assure reliable offsite power. Open access transmission generally result. in

changes to the grid design and operation that could challenge operating limits and grid

reliability. Predicting the voltages and current paths requires analyses of the conditions being

experienced and the original NPP assumptions about the grid and associated analyses may no

longer be valid. The power market results in power transactions and transmission of electricity

over longer distances. Grid operating entities and NPPs not involved in the power transaction

may see their operation affected by unexpected power flows. Regardless of their restructuring

status or participation in the power market, all states and NPPs are exposed to design and

operating challenges from the revised power flows due to open transmission line access.

Deregulation is of interest to the NRC. The appendices of NRC, "Strategic Plan, Fiscal Year

2000 - Fiscal Year 2005," October 4, 2000 (Ref. 9), note that one of the major external factors

that could significantly affect achievement of Strategic or Performance Goals is the ongoirg

economic deregulation and restructuring of the electric power industry. The NRC has not

asked its licensees to analyze electrical system performance under the current conditions.

However, SECY-01-0044, Status of Staff Efforts Regarding Possible Effects of Nuclear

Industry Consolidation on NRC Oversight," March 16, 2001 (Ref. 10), recommends in the area

of grid stability and reliability issues that the staff monitor the developments unfolding in

different parts of the country and continue the current efforts to assimilate information.

A RES study, "The Effects of Deregulation of the Electric Power Industry on The Nuclear Plant

Offsite Power System: An Evaluation," June 30, 1999 (Ref. 11), was the basis for the

information in SECY-99-129, "Effects of Electric Power Industry Deregulation on Electric Grid

Reliability and Reactor Safety," May 1999 (Ref. 12), in response to Commissioners' questions.

The RES study was based on NPP operating experience, the staff's review of NERC reliability

forecasts, visits to 17 grid control entities, and the actions of two licensees with the California

Independent System Operator (CAISO). The RES study and SECY-99-129 identified the

following potential impacts of deregulation of the electric industry on grid reliability that are

relevant to this assessment:

* The risk from the potential grid unreliability due to deregulation is likely to be minirral,

although individual plants might have an increase in the CDF due to deregulation cf as

much as 1.5E-05/RY.

* The assumptions about both grid design and operating configurations that ensure

correct voltages on both the grid and at NPPs typically date from before the electric

power industry was deregulated. Failure to analyze and reconfigure the grid under

changing conditions could result in abnormal voltages or frequencies at the NPPs.

Deregulation may result in unanalyzed grid operating conditions from open access to

the transmission system; these conditions change the current flows and voltages

throughout the grid according to fundamental (Kirchoff's) laws of electricity. Today,

more blocks of power are being transmitted over greater distances; and grid operating

entities not involved in the power transaction may see their operation affected by

8
unexpected power flows. Predicting the amount and path of the current and power and

the voltage throughout the grid requires analyses.

The duration of a LOOP or an SBO may increase. Changes in ownership and control of

generation and transmission and distribution facilities add to the number of entities that

must be coordinated and is likely to increase recovery times following a grid disturbance.

The NRC issued Information Notice (IN) 98-07, "Offsite Power Reliability Challenges From

Industry Deregulation," February 27, 1998 (Ref. 13), to alert licensees to the potential adverse

effects of deregulation of the electric power industry on the reliability of the off site power

source. The NRC also issued IN-2000-06: Offsite Power Voltage Inadequacies," March 27,

2000 (Ref. 14), to inform licensees of events that caused concerns about the voltage adequacy

of offsite power sources, especially in case of NPP trips.

At an industry/NRC meeting on May 18, 2000 (Ref. 15), the industry discussed the initiatives of

Pennsylvania, New Jersey, Maryland (PJM) Nuclear Owners/Operators (grid operator for

12 NPPs), CAISO, (the grid operator for 8 NPPs), and the Institute of Nuclear Power

Operations (INPO) to help maintain GDC 17, the SBO rule, and TS compliance in a deregulated

environment. The industry initiatives include a plant-by-plant review to ensure each NPP has

established appropriate interface with the grid operator, verified procedural adequacy for a

LOOP or degraded grid, verified responsibility for NPP and switchyard high voltage equipment

maintenance, confirmed the validity of grid reliability and design assumptions and the degraded

voltage trip settings, and trained operators; these actions were detailed in a letter from the

Nuclear Energy Institute (NEI) to the NRC on June 26, 2000, "Electric Grid Voltage Adequacy"

(Ref. 16). A followup meeting was held on October 27, 2000 (Ref. 17), to discuss the status of

NRC and industry grid reliability activities including the Electric Power Research Institute (EPRI)

Power Delivery Initiative for developing tools to enhance grid reliability. The meeting resulted in

actions to prepare for an industry uGrid Reliability Workshop" that took place in April 2001.

The NRC issued Regulatory Issue Summary (RIS) 2000-24, "Concerns About Offsite Power

Voltage," December 21, 2000 (Ref. 18), to inform addressees of concerns about grid reliability

challenges as a result of industry deregulation, potential voltage inadequacies of offsite power

sources, and actions the industry had committed to address this issue. The RIS also stated

that the NRC is continuing to work with the nuclear power industry to address this matter and

acknowledged that the Nuclear Energy Institute would take the following steps as an industry

initiative: (1) provide guidance to utilities on the need for, and acceptable techniques available

to ensure, adequate post-trip voltages; (2) establish provisions to log and evaluate unplanned

post-trip switchyard voltages to help verify and validate that the intent of Item 1 is met; and

(3) determine plant-specific risks of degraded voltage and double sequencing scenarios.

The NRC is periodically reviewing the status of industry initiatives under RIS-2000-24. The

industry and the NRC met on March 15, 2002 (Ref. 19), to discuss the status of industry, INPO,

EPRI, CASIO, and PJM activities. The industry concluded that their initiatives verify that

barriers are in place to ensure NPPs are protected from a degraded grid; however, the details

of plant-specific results are not available to the NRC.

9.
3 DISCUSSION

For purposes of this work some events were classified differently than in other assessmen:s. A

number of events that are defined in this assessment as grid related LOOPs are referred t in

other event studies as plant-centered as discussed below.

The executive summary of NUREG-5496, which estimates the LOOP frequency and duration

based on operating experience from 1980-1996 states " . . . For this study, the event was

considered an initiating event if the LOOP caused the reactor to trip or if both the LOOP arid the

reactor trip were part of the same plant transient, resulting from the same root cause. It was

not an initiating event if no reactor trip occurred, or the cause of the reactor trip did not directly

cause the LOOP event, but the reactor trip subsequently caused the LOOP event. All events

included in this study are LOOP events, but only the initiating events were used in the

frequency analysis."

Consider the following example. An event initiated by a turbine trip which resulted in a LOOP

would be considered a plant-centered event in most instances. For our purposes, this event

was classified as grid related if the plant disconnected from the grid following the turbine trip

and the grid voltage decreased because of the loss of the plant's own generating capacity or

other reasons attributed to the grid. One of the goals of GDC 17 is to assure that a plant tip

will not result in a LOOP. Reactor trips are random tests of the capacity and capability of the

grid. If due to lack of capacity or capability to withstand a sudden disturbance, the grid is in a

condition such that the lost generation due to the NPP trip causes conditions which lead to a

LOOP, our interpretation is that the LOOP is grid related. For purposes of this assessment, the

initiating event may be a turbine trip, but the root cause of the LOOP is the degraded condition

of the grid.

This distinction may be important from a risk perspective. The typical risk analysis considers a

reactor trip and a LOOP to be independent initiating events - the probability of a LOOP

initiating event is not impacted by the reactor trip. However, if the grid were in a condition such

that a loss of generation leads to degraded voltage and a consequential LOOP, the risk impact

of a reactor trip would increase.

Consider another example. Most risk assessments are performed for individual NPPs wit[

limited consideration of the impact at other NPPs. Thus, it is generally assumed that a reactor

trip will not lead to a LOOP at a different NPP. However, if grid conditions were such that loss

of generating capacity from an NPP trip leads to degraded voltage and a LOOP at another site

or plant, the LOOP is considered to be grid related. Again, the risk implications of a single

reactor trip would be greater, particularly if several units were affected.

3.1 Methods for Data Collection and Risk Analyses

For the purposes of this assessment, before deregulation was assumed to be 1985-1996 and

after deregulation was assumed to be 1997-2001. As 1997 was the first full year of NPP

operation with the grid deregulated, it was selected as the starting point for deregulation; in

April 1996, FERC Order 888 required that generators have open access to the transmission

system.

10
To be consistent with other NRC assessments, this assessment considered an event to be a

LOOP when all available EDGs started and loaded. A partial LOOP was indicated by the start

and loading of one or more, but not all the EDGs. Partial LOOPs are generally not risk

significant unless complications set-in; however, they helped to identify potential NPP

sensitivities to a grid-related event.

For the purposes of this study a line of demarcation was drawn between the plant and the grid

at the NPP main and station power transformer high-voltage terminals. The grid was defined to

include: (a) the high-voltage switchyard or substation nearest the NPP which is typically under

the control of the transmission organization, (b) the transmission and generation system beyond

the switchyard or substation, and (c) the protective relaying and control circuits of the

switchyard and transmission system which are often located inside the NPP. The boundary

between the NPP and the grid was based on typical organizational responsibility for equipment

design, maintenance, and operational control. In a deregulated environment this boundary is

typically the boundary between the regulated transmission system company and the

deregulated nuclear generating company.

Appendix A provides summaries of grid events that affected NPP performance from 1994

through 2001. Although deregulation did not start until 1997, RES selected 1994 as a starting

point for the collection of events; RES was aware of at least one grid entity that used

1994-1996 grid events that affected its NPPs, in part, to obtain the lessons learned for its

future operation in a deregulated environment, so it was judged RES should do the same. The

events were identified and summarized from licensee event reports (LERs) in the NRC

Sequence Coding and Search System, NRC inspection reports,- NRC preliminary notification

(PNO) reports, NERC Disturbance Analysis Working Group (DAWG) reports, and CAISO and

PJM reports, which are discussed below. The LER, PNO, and DAWG event dates were crossreferenced to identify the events affecting multiple NPPs. It is emphasized the CAISO and PJM

reports were used not to be critical, but to gain insights; these entities are proactive with

comprehensive programs and actions for operating large, robust grids in a deregulated

environment.

The DAWG reports helped identify when the NPP event was part of a larger grid disturbance

when this was not evident from the LER. The NERC DAWG analyzes a subset of the grid

events reported to the DOE under 10 CFR, Chapter II, Section 205.351, "Report of Major

Electric Utility System Emergencies," "Reporting Requirements" (Ref. 20). Section 205.351

requires electric utilities or other entities engaged in the generation, transmission, or distribution

of electric energy for delivery or sale to the public to report to DOE certain losses of system

"firm" loads, voltage reductions or public appeals, vulnerabilities that could impact system

reliability, and fuel supply limitations. Some of the DOE events that involve the transmission

system are of interest for this report. The DOE events and NERC DAWG reports are available

on their Web sites.

The Appendix A events were defined and grouped as follows:

* R events are losses of electric power from any remaining power supplies as a result of,

or coincident with, a reactor trip at power. Losses of electric power with a reactor trip

include any LOOPs, partial LOOPs, or voltage degradations below the plant specific low

limit.

11
I

* S events are reactor trips where the first event in the sequence of events leading to the

reactor trip was in the switchyard or substation nearest the plant.

* T events are reactor trips where the first event in the sequence of events leading to the

reactor trip was in the transmission system beyond the switchyard or substation nearest

the plant.

* L events are LOOPs where the first event in the sequence of events leading to the

LOOP was in the switchyard or transmission network. LOOPs at zero power are

indicated by a zero suffix.

* PL events are partial LOOPS where the first event in the sequence of events leadir g to

the partial LOOP was in the switchyard or transmission network.

* I events are events of interest that provide insights into the plant response to a

switchyard or transmission network-initiated event, but did not involve a unit trip, LOOP,

or partial LOOP.

The S and T events described in Appendix A are reactor trips having major switchyard or

transmission network involvement and were not used in the risk analyses since they did not

result in a LOOP. Past NRC studies typically viewed S and T as plant centered events due to

the major role the plant played in the event, (e.g., turbine trips).

Table 1 Grid Event Summary," gives the numbers, types, and dominant causes of the reactor

events from 1994 to 2001 based on detailed information in Appendix A, Tables A-1 and A-4.

The R and L event groups LOOPs that are potentially risk significant are analyzed in

Section 3.2 and discussed in Section 3.3.

Table 1 - Grid Event Summary

Event group Number of reactor events per year (1994-2001) Dominant causes

94 95 96| 97 98 99 | 00 01 Total

R 0 0 2 3 1 3 1 10 3 LOOPs, 6 partial LOOPs, &

one voltage degradation fom

plant/grid electrical weaknesses

S 4 7 2 2 2 2 4 2 25 Grid equipment malfunctic ns

T 4 4 7 3 2 1 21 Grid equipment malfunctic ns

power 1 1 Grid equipment malfunctic ns

0 power 1 1 1 1 4 Human error

PL 3 1 2 1 2 9 Grid equipment malfuncticns

Total 12 11 11 10 6 7 10 3 70 Grid equipment malfuncticns

12
3.2 Risk Insights and General Observations

Section 3.2.1 provides risk insights from the LOOP data. Simplified event trees were developed

in Appendix B, "Risk Analyses," for the purposes of estimating and comparing the average

industry CDF from an SBO before deregulation (1985-1996) and after deregulation

(1 997-2001) using actual operating data from Appendix C, "LOOP and Scram Data

1985-2001." Appendix B explains the risk methodology. Appendix C tables identify all LOOPs

from 1985-2001. Appendix C, "Table C-1" shows the LOOPs from 1997-2001. Eight of the

LOOPs in Appendix C were accompanied by a reactor trip and used to assess the risk after

deregulation; the risk from LOOPs not involving a reactor trip were assumed to be negligible.

Section 3.2.2 provides general observations from all of the data.

3.2.1 Risk Insights

The results of the Appendix B assessment of the risk are summarized in Table 2, "Changes In

Risk After Deregulation," and Figure 1, "Risk Profile. Table 2 shows the results in terms of a

"delta CDF that was obtained by subtracting the CDF "BEFORE" deregulation from the CDF

for the particular case being analyzed. Figure 1, shows the CDF/RY "Before" deregulation and

the CDF/RY for the particular case being analyzed. The before deregulation cases establish

baselines to evaluate changes after deregulation. The average risk reduction "delta CDFP from

SBO implementation was estimated to be 3.2E-05/RY (Ref. 21). In Table 2, a negative "delta

CDF" indicates decreased risk since deregulation and the risk reduction goals from SBO rule

implementation have been maintained; and a positive "delta CDF" indicates an increased risk

since deregulation and that a portion of the risk reduction from SBO rule implementation has

been offset. Table 2 also summarizes the change in the "delta CDF in terms of key data (the

number of reactor trips per RY; the

number of LOOPs/RY; the

P(LOOP/RT), and the LOOPs Risk Profile

more than 4 hours as a X

percentage and as a number per Before and After Deregulation

RY). ° 1.OOE-03

0 U : C P 3.E0&05 Appendix B, Table B-1 shows the a - 14&y=

key summer data for 1985-1996. a) 1.OOE-04

Typical assessments of the risks a. - - i VI

from an SBO use yearly averages O)

to calculate risk and do not 1 I.00E-05 -

consider that the key parameters E

affecting risk are different in the D 1.00E-06 - -

summer. Also, those a)

assessments do not account for 0 -

long outage times on EDGs or for 'O 1.OOE-07 -- E-i--1--+- -+ i - X

potential degraded grid conditions - Jan Mar May Jul Sep Nov Jan

as measured by P(LOOP/RT), a) Before After summer

both in the summer. This - IL -

assessment noted that seven of --. DG/Ave -- 30ay E EDGWC

the eight LOOPs (87 percent)

involving a reactor trip since 1997 Figure 1 - Risk Profile

13
occurred in the summer - May to September - in contrast to 23 of 54 (44 percent) LOOPs in

the summers of 1985-1996. Prior to deregulation, there was only a small difference in the

likelihood of a LOOP between the summer and the rest of the year. Thus the base case does

not make a difference between the summer and the year round.

Table 2 Changes in Risk After Deregulation

Observation Baseline Change

-Delta CD-IRY

BEFORE Risk reduction from SBO rule 3.2E-05IRY 0

deregulation -Reactor trips/RY = 3.4

1985-1996 -LOOPs/RY = 0.05

-Probability (LOOP/reactor trip) = 0.002

-Percent LOOPs >4hours =17%

-(LOOPs > 4hours)/RY = 0.0074

AFTER Risk reduction from SBO rule implementation maintained. -O.9E-C 5

deregulation CDF decreased below baseline due to offsetting changes:

1997-2001 -Reactor trips/RY =1.0

-LOOPs/RY = 0.014

-Probability(LOOP/reactor trip) = 0.0045

-Percent of LOOPs > 4 hours = 67%

-(LOOPs > 4 hours)/RY = 0.011

SUMMER Risk reduction from SBO rule implementation maintained. -0.5E-05

After deregulation CDF decreased below baseline due to offsetting changes:

1997-2001 -Reactor trps/RY = 1.1

-LOOPs/RY = 0.021

-P(LOOP/reactor trip) = 0.01

-Percent LOOPs > 4 hours = 67%

-(LOOPs > 4 hours)/RY = 0.027

SUMMER Risk reduction from SBO rule implementation partially or fully offset:

SENSITIVITY -EDG out-of-service for 14 days with a 0.01 chance of a degraded grid 0.8E-05

1997-2001 -Increase time grid degraded to 30 days (based on experience) 1.1E-05

-EDG out-of-service for 14 days with the grid degraded 7.7E-0 

In general, comparison data before and after deregulation shows significant changes in the key

data related to summer time LOOPs: the frequency of LOOP events at NPPs has decreased,

the average duration of LOOP events has increased, and P(LOOP/RT) has increased. Te net

effect of these changes is that the risk reduction goals from SBO rule implementation have

been maintained, except during summer time operations with EDG OOS or with the grid

degraded. The discussion below provides a detailed comparison.

Table 2 indicates a negative "delta CDF" "AFTER" deregulation indicating that

deregulation has not eroded the risk reduction from SBO rule implementation.

Comparison of the key factors in Table 2 before and after deregulation help to explain

the decrease in the risk (i.e., the decreases in the number of reactor trips/RY and

number of LOOPs/RY have more than offset the increases in percentage of LOOF's

more than 4 hours and probability of a LOOP given a reactor trip). P(LOOP/RT) is

0.0045 (as compared to 0.002 before deregulation) and corresponds to the grid bE ing in

this condition approximately 40 hours per year. Figure 1 shows the CDF/RY "AfteI'

deregulation (1997-2001) have decreased below the risk "Before."

14
Table 2 indicates that the "delta CDF' during the SUMMER" is negative indicating that

deregulation has not eroded the risk reduction from SBO rule implementation.

Comparison of the key factors in Table 2 before and after deregulation help to explain

the decrease in the risk (i.e., when averaged over the summer months [5/12's of the

each year from 1997-2001]) the decreases in the number of reactor trips/RY and

number of LOOPs/RY have more than offset the increases in the percentage of LOOPs

more than 4 hours and the probability of a LOOP given a reactor trip. P(LOOP/RT) is

0.01 and corresponds to the grid being in this condition approximately 88 hours per

year, all during the summer months (Appendix B, Table B-1 shows P(LOOP/RT) was

0.0015 during the summers of 1985-1996). Figure 1 shows the CDF/RY for the

uSummer" after deregulation peaks from May to September, 1997-2001, slightly below

that uBefore" deregulation. The peak reflects that 1997-2001 the summer data has

been averaged over 5/12ths of the year rather than the entire year.

SUMMER SENSITIVITY studies performed to gauge the potential changes by averaging

the data over the summer for plant operations assuming (1) an EDG out of service

(OOS) for 14 days with a likelihood that the grid will be in degraded condition based on

operating experience, (2) increasing the amount of time that the grid is degraded to 30

days, and (3) an EDG taken OOS for 14 days with the grid degraded. TS approved

EDG OOS times typically range from 3 to 14 days. Operating experience shows that

the grid is degraded approximately 88 hours per year, (i.e. P[LOOP/RT]=0.01). Thirty

days was assumed to gauge the change in the risk during those times that a reactor trip

will result in a LOOP; specific analyses of the grid conditions being experienced would

provide the actual time a reactor trip may cause a LOOP.

Table 2 delta CDFs indicates that in each of these three cases, the risk is positive

indicating that the risk reduction from SBO rule implementation may be partially or fully

offset. In each of these cases, this risk increase may not be explicitly evaluated unless

the assessment considers (a) a consequential LOOP i.e. the results of electrical

analyses to determine whether a reactor trip will cause a LOOP (discussed in

Section 3.3) and other LOOPs separately (b) summer time operation and (c) actual

demand performance under LOOP conditions. Figure 1 indicates that in each of the

three cases, the risks are represented as point estimates over portions of the summer

months. The discussion follows:

(1) The first sensitivity study estimated a change in risk as a result of having one of two

EDG OOS with a 0.01 chance that the grid is degraded, i.e. P(LOOP/RT=0.01). Table 2

indicates the udelta CDF' is slightly positive indicating the risk reduction from SBO

implementation has been partially offset. Figure 1 shows this as a 14 day point estimate

in the risk as "DG/Ave" that is just above the risk "Before" deregulation. Figure 1 also

shows the corresponding CCDP of 1.1 'E-06 that was obtained by multiplying 14/365 and

the CDF/RY for this case. As stated above plant specific analyses may yield different

results.

(2) The second sensitivity study evaluated the risk from an increase in the time that a

LOOP would have resulted from a reactor trip to approximately 30 days. Table 2

indicates the delta CDP' is positive indicating the risk reduction from SBO

implementation has been partially offset thus indicating that understanding the

percentage of the time a reactor trip can potentially cause a LOOP can be important.

15
Figure 1 shows CDF/RY for this case as U30 day" that is above the risk "Before"

deregulation.

(3) The worst case sensitivity study increases the risk above the "Before" deregulation

values by assuming one EDG is unavailable for 14 days with the reactor at power and

the grid is degraded, (i.e., P[LOOP/RT]) is 1.0. As previously discussed, TS typically

allow one EDG to be unavailable for allowed outage times (AOTs) of up to 72 hours,

and in some cases with compensatory measures, up to 14 days. Table 2 indicates the

udelta CDF' is positive and indicates the risk reduction obtained from SBO rule

implementation has been fully offset. Figure 1 shows this as a point estimate,

"EDG/WC," that is above the values before deregulation. Figure 1 also shows the

corresponding CCDP of 3.OE-05 that was obtained by multiplying the 14/365 and the

CDF/RY for this case.

(4) Appendix B evaluated changes to the risks in Figure 1 from: (a) recent

improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by

approximately 19 percent; (b) potentially shorter LOOP recovery times from

consideration of NRC data that assumes offsite power was available sooner than the

actual restoration time so as to reduce the risk by approximately 25 percent; (c) miltiple

reactor trips (see Section 3.3.3.) that increase the risk by approximately 200-400

percent.

The NRC does not regulate the grid; however, the performance of offsite power is a major

factor for assessment of risk. As previously discussed the licensees are expected to asse 3s

and manage the increase in the risk that may result from maintenance and outage activities;

NPPs should understand the condition of the grid before scheduling EDG, maintenance or

AOTs.

Assessment

The assessment found that major changes related to LOOPs after deregulation compared to

before include the following: (1) the frequency of LOOP events at NPPs has decreased, (2) the

average duration of LOOP events has increased, (3) where before LOOPs occurred more or

less randomly throughout the year, for 1997-2001, most LOOP events occurred during tho

summer, and (4) the probability of a LOOP as a consequence of a reactor trip has increas d.

Simplified event trees were developed to assess the impact of grid changes on overall NP?

risk, and to include the impact of the LOOP as a consequence of reactor trip. The findings

indicate: (1) the average yearly risk from LOOPs and reactor trips decreased, and (2) a small

number of events over the first 5 years of deregulated operation indicates that most of the risk

from LOOPs occurs during the summer months. Sensitivity studies indicate that the risk

reduction goals from SBO rule implementation has been maintained, except during summer

time operations with the EDG OOS or with the grid degraded.

With respect to maintaining the current levels of safety, offsite power is especially important

with regard to the risk associated with emergency diesel generator (EDG) maintenance ard

outage activities. Consequently, assessments of risk that support EDG maintenance and

outage activities should include: (a) assessment of offsite power system reliability, (b) the

potential for a consequential LOOP given a reactor trip, and (c) the potential increase in the

16
LOOP frequency in the summer (May to September). Regarding (a) above, the assessment of

the power system reliability and risks from plant activities can be better managed though

coordination of EDG tests with transmission system operating conditions.

3.2.2 General Observations

1. The Table 1 R, S, and T events show approximately 50 grid-initiated or grid-related

reactor trips starting in 1994. Actions to prevent recurrence appear to be justified as

there are risk benefits from a reduction in the number of trips.

Table 1 shows that grid problems that effect the NPP can occur. Table 1 shows that

grid equipment failures and malfunctions were the dominant causal factor for every

event group except the R event group, which was dominated by grid and plant electrical

equipment weaknesses (see Section 3.3.1). Appendix A indicates that most of the grid

equipment failures and malfunctions were in high-voltage circuit breakers and protective

relays of the switchyard and transmission system.

2. Some NPPs and transmission companies used experience (events 1, 2, 37 in

Appendix A) to establish or strengthen interface agreements to better control operating,

maintenance, and design activities that potentially affect the NPP. Similar agreements

could be used to enhance the maintenance of high-voltage circuit breaker and protective

relays which were previously noted to be a dominant causal factor.

In event 2, the SBO alternate ac power supply failed to start during an NPP test and the

NPP discovered that the transmission company, who owned the SBO alternate ac

power supply, installed a modification 4 months earlier that defeated its safety function.

This is an example where a contractual agreement requiring NPP review and approval

of transmission company SBO alternate ac power supply modifications may have

ensured their operability.

3. While the data set is small, the nature of the numbers, duration, and types of the

LOOPs have changed since 1997. Table 2 above shows the number of LOOPs has

decreased from .05/RY in 1985-1996 to 0.014/RY after 1997. Based on historical data,

power restoration times following a LOOP were generally less than 4 hours. Table 2

shows the percent of LOOPs lasting more than 4 hours has increased from 17 percent

(six weather related and one plant centered) in 1985-1996 to 67 percent after 1997.

The 1985-1996 data is dominated by short plant centered LOOPs (median

approximately 20 minutes). The general absence of the short duration plant centered

LOOPs and longer duration LOOPs involving the grid now dominate the frequency.

Appendix C, Table C-1, indicates that nine of the ten LOOPs since 1997 involved the

grid or severe weather that affected the grid and included: two severe weather events

affecting the NPP switchyard, three events involving lightning strikes to the transmission

lines, one wildfire involving scheduled burning of brush under transmission lines, one

event due to a 230 kV switchyard circuit breaker failure, one event involving heavy

power system demand and transmission company equipment OOS, and one involving

the lack of communication between the NPP and the grid operator.

Further analyses of the data in Appendix C found the median LOOP recovery time

increased from approximately 60 minutes before 1997 to approximately 688 minutes

17
after 1997. As another perspective, Appendix C, Table C-1 shows NRC data that

assumed offsite power was available before it was actually connected to one safety bus;

this data shows 50 percent of the eight LOOPs involving a reactor trip lasted more Ihan

4 hours and the median LOOP recovery time was estimated to be 326 minutes.

4. Three of the events summarized in Appendix A reached thresholds of interest (1 x1(6)

from a risk perspective under the NRC accident sequence precursor (ASP) Program.

The ASP Program found the CCDPs of events 16, 33, and 58 to be 2.8E-06, 9.6E-06,

and 9.1 E-05, respectively. The CCDPs reached a threshold interest because of NF2P

conditions, not because of grid anomalies.

5. Events indicated the sensitivity of NPP equipment to low voltage and changes in gr'd

voltages.

In event 20, the main generator voltage regulator did not respond to a system grid

disturbance created by the loss of two hydro units 15 miles from the NPP. The NPI'

voltage could not be maintained within acceptable ranges as the main generator vcItage

regulator had been miscalibrated in 1994. The voltage dropped to 80 percent of

nominal, tripping the reactor coolant pumps (RCPs) and the reactor.

Three events in Appendix A (8, 20, 34) identified microprocessor-controlled equiprrent

that was sensitive to low voltage as follows: a radiation monitor lost program memory

(event 8); several programmable controllers swapped from auto to manual following a

voltage transient (event 20); and voltage-regulating transformers shut down following a

voltage transient, and the licensee found they automatically shut down when voltage

drops to 20 percent of nominal for 6 to 8 cycles (event 34). Microprocessor-controlled

equipment has been used to replace analog equipment, and the voltage characteristics

of the replacement equipment appear to warrant attention.

Two events in Appendix A (17 and 45) show that circulating water pump synchronous

motor trips are sensitive to momentary low voltages due to switchyard and transmission

line faults. Optimizing synchronous motor protective trips may avoid some reactor trips.

In event 54, modification work at a substation in an adjacent state tripped 15 high

voltage circuit breakers and 290,000 customers lost electric service. The load

dispatcher requested the NPP to raise the generator voltage to help stabilize the glid;

however, the reactor tripped due to actuation of a non-safety related volts/hertz relay

that was set low approximately 8 years before the event.

Assessment

It is important to have formal agreements in place to ensure that grid operators will provide

reliable electrical power. Because external factors impact the ability of licensees to fully

manage risks and understand the condition of the grid, some NPP licensees have implemented

contractual agreements with grid operators to provide a mechanism for maintaining secure

electrical power in the deregulated environment. Contractual arrangements should include

specific communication protocols, operating procedures and action limits, maintenance

18
. . 1 " 

responsibilities, responsibility for an SBO (alternate ac) power supply not owned by the

licensee, and NPP and grid technical parameters.

While the data set is small, the number, types, and duration of LOOPs have changed since

1997. Recent experience indicates that there are fewer LOOPs. Whereas most of the

1985-1996 LOOPs were plant-centered, most of the recent LOOPs also had major grid

involvement from the reactor trip, severe weather or lightning that affected the NPP switchyard

and transmission lines, or NPP switchyard equipment failures. Further, based on historical

data, power restoration times following a LOOP generally occur in less than 4 hours; more

recent LOOPs however have lasted significantly longer. Longer restoration for most of the

events challenge whether either the NPP or the grid operator could actually restore power to an

NPP in time under accident conditions such as an SBO and challenge the assumptions and

capabilities used in assessing plant risk from LOOPs.

Inappropriate NPP main generator voltage regulator and volts per hertz protective relay

setpoints caused a spurious reactor trip during a grid disturbance.

3.3 Nuclear Plant Voltages Not Always Analyzed for Grid Conditions Experienced

The review of the R events in Appendix A found three LOOPs (events 3, 16, and 33), five partial

LOOPs (events 15, 22, 38, 60, 62, and 64) and a voltage degradation below the minimum

voltage required by the TS for 12 hours (event 74 ) occurred coincident with, or as a result of, a

reactor trip. These events were similar as follows:

(1) Up to the time of the reactor trip, the offsite power supplies were operable per NPP control

room voltage readings that verified the TS minimum voltage requirements. In addition,

analyses of the offsite power system following a unit trip did not predict these events.

(2) A review of the previous and subsequent reactor trips at the NPPs with R events in

Appendix A found that LOOPs, partial LOOPs, and voltage degradations were not coincident

with these reactor trips. The initial grid and plant electrical conditions at the time of the R

events were different from previous and subsequent reactor trips and did not include heavy

transmission line loading, switchyard and transmission OOS, and degraded plant voltagecontrolling equipment. This is discussed further in Section 3.3.1.

(3) Eight of the 10 R events took place in June, July, and August. Seven of the 10 events were

in the Northeast (Maryland, New York, New Jersey, Pennsylvania, and Vermont where there is

a total of 20 NPPs). In the summer, the increased system loading associated with the

temperature lowers the voltage at the ends of transmission lines. This is discussed further in

Section 3.3.2.

(4) The partial LOOPs (events 15, 22, 38, 60, 62, and 64) and a voltage degradation below the

minimum voltage required by the TS for 12 hours (event 74) are not risk significant but provide

early indication that NPPs may not have fully analyzed the grid for the conditions experienced.

3.3.1 Grid Loading and Equipment Out of Service

Ideally, NPPs determine NPP voltage limits that are based on electrical system analyses that

account for the most limiting transmission system loading conditions and equipment OOS.

19
In event 74 in Appendix A, the licensee found that their failure to properly consider the impacts

of deregulation (i.e., heavy grid loading coupled with the loss of voltage support from the NPP

generator) resulted in lower than expected NPP safety bus voltage. In addition, it took 12 hours

to change power flows between Canada and Texas and get the required voltages to the NPP.

This helps to confirm the SECY-99-129 hypothesis that changes in ownership and control Df

generation and transmission facilities add to the number of entities that must be coordinated

and is likely to increase recovery times following a grid disturbance. In event 3, the licensoe

attributed the LOOP to the combined effects of heavy grid loading, a 500 kV substation OOS,

loss of voltage support from the NPP generator (resulting in a 4.5 percent voltage drop) ar d the

transfer of the NPP load (which resulted in an additional 3 to 6 percent voltage drop). The

severity of the grid condition revealed that the NPP station power transformer automatic tap

changer had not been set consistent with the design analyses so it could not compensate for

the degraded grid.

Transmission analyses typically assume at least one major pre-event equipment OOS or

contingency. Events 15, 33, 38, and 60 in Appendix A involved multiple contingencies or very

abnormal operating conditions. Event 15 involved a transmission line outage and a substation

outage that left one of two available power generation paths, and a transmission line OOS that

disabled an NPP protective trip. In event 33, the licensee attempted sustaining NPP operation

with major current unbalances in both high-voltage generator output circuit breakers. In event

38, a switchyard high-voltage circuit breaker was inadvertently closed during troubleshooting

with one of three offsite transmission lines OOS and a latent failure in a high-voltage circuit

breaker control system. In event 60, one of two high-voltage generator circuit breakers was

OOS, a latent failure existed on a switchyard disconnect switch, and NPP electrical equipment

malfunctioned.

In some events, plant equipment (such as station power transformer automatic LTC, which

control safety bus voltage levels) is assumed to be functional in the analyses of internal

voltages and by the grid controlling entity for the range of external voltages maintained at :he

NPP. Thus, an inoperable NPP transformer automatic LTC is a problem for both the NPP plant

and the grid operators. As mentioned earlier in event 15 in Appendix A, an NPP transformer

automatic LTC had not been set consistent with the design analyses. In event 16 in

Appendix A, an NPP transformer automatic LTC had been in manual for approximately

11 months due to a degraded relay and procedures that allowed its manual operation without

compensatory measures. Normal practice in these cases would be that the grid operator Would

be notified and maintain the NPP voltage so as to compensate for the inoperable startup

auxiliary transformer LTC. In addition, the licensee analyses credit the startup auxiliary

transformer automatic LTC and grid operator action to raise the NPP safety bus voltage u 3ing

an upstream transformer LTC following a unit trip. Alarms that would draw operator's attention

to inoperable safety bus voltage controlling equipment can help NPP operators identify thi

need to request additional voltage support from the grid operators. Periodic verification of NPP

transformer automatic LTC or other voltage controlling equipment operability could also help

reduce the likelihood and impact of low voltage damage to plant equipment. In addition, NPP

procedures that allow manual operation of this equipment should require compensatory

measures such as a request for voltage adjustment from the grid control entity prior to

operation.

Four events in Appendix A were also random tests of the grid that resulted in unexpected

voltage drops; these types of events may provide early signs of weaknesses in offsite power

20
system capacity and capability. In event 22, the offsite power system could not support the

simultaneous restart of two 5500 HP feedwater pump motors with a partial LOOP. In event 59

the restart of a reactor recirculation pump motor caused an unexpected voltage transient. In

event 57 the electrical perturbation from Unit 1 reactor trip, tripped a Unit 2 heater drain pump

motor and caused a Unit 2 load reduction. In event 67 seven safety and some non-safety

motors tripped, and did not restart following the voltage drop from the bus transfer and start of

two auxiliary feedwater pump motors. In events 22 and 67 if the grid does not have the

capability, automatic control circuitry could be used to minimize the probability of a LOOP.

3.3.2 Grid Reactive Capability Weakened

Several of the R events occurred in the summer in the Northeast. The PJM Interconnection

issued a publicly available study, "Results of Heat Wave 1999: July 1999 Low Voltage

Condition Root Cause Analysis," March 21, 2000 (Ref. 22), for the purposes of identifying and

correcting the root causes of low-voltage conditions on two exceptionally hot days on July 6

and 19,1999. On both occasions the 500 kV system voltage at multiple sites dropped

approximately 5 percent from highs ranging from 545 kV to 525 kV, to lows ranging from 515

kV to 495 kV. Short-term (30 minutes) grid anomalies during periods of high load are not

uncommon while the grid operating entity determines and completes response actions. PJM

was concerned that the peak load was not predicted and noted that it took several hours to

restore voltage after implementing all load management programs and 5 percent voltage

reductions. The PJM concerns are consistent with those in SECY-99-129, IN-98-07, and

IN-00-06.

The PJM data show that, in both cases, widespread system voltage degradations began near

1 Oam and voltages dropped sharply at noon. The voltages were restored to the 1 Oam and

noon levels in approximately 10 and 6 hours, respectively, on July 6 and in 7 and 2 hours on

July 19.

PJM found that the low-voltage conditions occurred because reactive demand exceeded

reactive supply due to record usage of electricity from high temperatures in much of the eastern

half of the U.S. Reactive supply was insufficient because some generators were unavailable or

unable to meet their rated reactive capability due to ambient conditions. Specifically, 54 PJM

generators reached a limit that restricted MVAR output to 72 percent of the reported capability

and weakened the grids capability to maintain adequate levels of voltage.

The PJM system did not have sufficient reactive capacity as required by GDC 17 and

consequently was unable to restore voltages as quickly as expected. The analyses of grid

voltage levels were incorrect because generator reactive capability design limits were used

instead of the actual capabilities. Consequently, NPP voltages used to determine operability

and analyses of offsite voltage performance after a reactor trip are likely to be optimistic unless

they consider realistic capabilities. Alternatively compensating reactive capability can be

purchased, obtained from new reactive power sources such as new generation or capacitor

banks or other reactive supply.

As another consideration, reactor power uprates also reduce generator reactive capability and

collectively weaken the grid's capacity to maintain or restore voltages as it did on the PJM

system. Licensees have been using power uprates to increase the output of their NPPs. As of

May 1, 2002, the NRC has completed 62 reviews, and the industry has collectively gained

21
approximately 3760 megawatt thermal (MWt) or 1200 megawatts electrical (MWe), an average

of approximately 20 MWe increase per NPP. However, the main generator reactive capability

decreases as the power (MW) output increases. For example, if a generator had a nameplate

rating of 1000 MVA, 95 percent power factor at rated voltage, it would correspond to an

operating point of 950 MW and 312 MVAR. If the power output increased approximately

20 MW to 970 MW, the reactive capability would decrease to 243 MVAR, a difference of

approximately 70 MVAR. Collectively, the 1200 MW increase on 62 reactors has been

accompanied by a 4340 MVAR decrease.

Assessment

An important aspect of the changes to the electrical grid is the impact on the electrical analyses

of NPP voltage limits and predictions of voltages following a reactor trip and whether a reactor

trip will result in a LOOP. Recent experience shows that actual grid parameters may be worse

than those assumed in previous electrical analyses due to transmission system loading,

equipment out-of-service, lower than expected grid reactive capabilities, and lower grid

operating voltage limits and action levels. NPP design basis electrical analyses used to

determine plant voltages should use electrical parameters based on realistic estimates of tne

impact of those conditions.

Lessons learned include:

* LOOPs, partial LOOPs, and voltage degradations below the TS low limit following or

coincident with a reactor trip are evidence of a potential electrical weakness in the grid.

* The synergistic effects of reduced reactive grid capability on NPPs from hot weather and

multiple reactor power uprates should be evaluated to determine the impact on the

capacity and capability of the grid to maintain adequate NPP voltages. In addition, PJM

identified numerous corrective actions for the root causes of low voltage conditions

following a heat wave.

* In some events, non-safety related plant equipment (such as station power transformer

automatic LTCs, which control safety bus voltage levels) is assumed to be functional in

the analyses of internal voltages and by the grid controlling entity for the range of

external voltages maintained at the NPP. Periodic verification of NPP or other voltage

controlling equipment operability may be necessary to ensure their availability and

require compensatory measures such as a request for voltage adjustment from the grid

control entity should availability be compromised.

* Under some circumstance degraded grid recovery times may take several hours. In the

Northeast, it took the grid operator for 12 NPPs 10 hours to resolve grid problems I rom

the unexpected behavior of the grid after planned voltage and load management

programs had been implemented and investigation found the grid power restoration

procedures did not work because the grid did not have the reactive capacity to quickly

restore voltages. In the Mid-West it took grid operations 12 hours to change regional

power flows and restore voltage to an NPP after the grid was stressed. These events

support the concern identified in SECY-99-129 (as discussed in the background section)

that the time needed to coordinate grid operations may increase in a deregulated

environment.

22
3.3.3 Transmission System Faults May Involve Multiple Reactor Trips

The review of the T events found that transmission system faults may involve multiple reactor

trips (events 24, 25, 48, and 53 in Appendix A). None of the events caused a LOOP. Events

48 and 53 were similar: two reactors at a dual-unit site tripped after a remote transmission line

fault opened multiple high-voltage circuit breakers, including the generator output breakers in

the switchyard.

In events 24 and 25, multiple reactors tripped, and other NPP operations were affected in a

minor way, during a grid disturbance due to the operation of common protective and/or designfeatures. The licensee final safety analysis reports (FSARs) demonstrated the adequacy of the

offsite power system by summarizing the results from power system analyses without

discussing operation of these features. In event 24, two pressurized-water reactors tripped

simultaneously due to RCP bus undervoltage during a transmission system disturbance. As a

corrective action, one of the NPPs lowered the RCP bus undervoltage and underfrequency

setpoints to the minimum allowed by the TSs. In event 25, four pressurized-water reactors

tripped simultaneously: at one site, two reactors tripped due to RCP bus undervoltage; and at

another site, two of three reactors exceeded the variable overpower trip (VOPT) setpoint during

the load swing at the NPP from the transmission system fault.

Differences in the moderator temperature coefficient (MTC) levels explain why two of three

reactors tripped at one site. The MTC is a measure of the reduction in the core reactivity as the

primary system water temperature increases. Two of the three reactors tripped when load

fluctuations (a 700 MW decrease and significant load increase due to the grid instability)

caused the steam bypass control system valves to open and exceed the VOPT setpoint within

the core protection calculators. The third reactor spiked to 102 percent power without reaching

the VOPT setpoint. The MTCs for the two reactors that tripped were -34 and -23.5 pcm per

degree Fahrenheit and near the end of core condition. The MTC for the reactor that did not trip

was more positive (-9 pcm per degree Fahrenheit) and near the beginning of core conditions.

The core protection calculator VOPT is an expected response to the load change, as are the

opening of the steam bypass control system valves, the increased steam demand, and the

resulting power increase due to decreasing temperature with a negative MTC. However, the

closer the unit is to the end of cycle (EOC), the more rapid the power increase and more likely

that VOPT will trip the reactor.

The significance of multiple unit events is that (in the cases above) the total risk from an event

would be approximately equal to the sum of the risks from the individual plants affected. Thus,

the risk in the cases above is the sum of the risks from the NPPs involved (i.e., which may be

2-4 times the individual plant risks).

As summarized in Appendix A, industry analyses of events 24 and 25 resulted in a total of 65

recommendations to address improved regional operational and engineering activities to

maintain grid reliability. The events resulted in recommendations that helped CAISO, which

was under development at the time of these events, to develop and implement a very broad

and comprehensive grid reliability program to manage and control regional operational and

engineering activities in real time. The program includes a continuous update of analyses to

reflect operating conditions and changes in operating configurations.

23
Assessment

The significance of a grid event will need to take into consideration the impact of multiple

reactor units. In addition, NPP licensee analysis of the effects of transmission system

disturbances had not been updated to account for current grid conditions. Also, one licensee

lowered RCP electrical setpoints to the minimum allowable to minimize the chance of a

premature NPP trip during a grid disturbance. Further, operation in a deregulated environnent

may be better served by a comprehensive grid reliability program to manage and control

regional operational and engineering activities in real time, as is the case with the California

ISO to maintain adequate reactive and voltage support to NPPs.

3.4 Licensees Should Contract for Adequate Voltage Support

As a result of the July 1999 events, PJM identified 20 corrective actions including one in th3

area of voltage operating criteria. The PJM Web site provides the "Voltage Criteria and Vc Itage

Limits Working Group Report," September 11, 2000 (Ref. 23), that contains the "PJM-BaseLine Voltage Limits," which are duplicated below in Table 3. Table 3 shows the PJM

transmission system voltage levels and the voltage limits for various conditions on that system.

The voltage limits are shown as a magnitude, and a decimal that is the voltage limit divided by

the system voltage. These voltage limits were part of FERC Docket No. EROO-2993-000,

"Order Accepting Tariff Filing," August 31, 2000, which

amends the PJM Operating Agreement to permit and accommodate requests that PJM

schedule and dispatch generation to meet voltage limits (in Table 4). These voltage limits are

more restrictive than those PJM otherwise determines are required for the reliable operation of

the transmission system in the PJM control area, but less than required for NPP voltage

support.

Table 3 Pennsylvania, New Jersey, Maryland Interconnection

Base-Line Voltage Limits

Voltage level Load Dump* Emergency Low* Normal Low Normal High Voltage

(kV) (kV) (kV) (kV) (kV) Drop**

500 475 485 500 550 5%

0.95 0.97 1.00 1.10

345 310 317 328 362 5-8%

0.90 0.92 0.95 1.05

230 207 212 219 242 5-8%

0.90 0.92 0.95 1.05

138 124 212 131 145 5-10%

0.90 0.92 0.95 1.05

115 103 106 109 121 5-10%

0.90 0.92 0.95 1.05

69 62 63.5 65.5 72.5 5-10%

0.90 0.92 0.95 1.05

* = post-contingency 5 minute Emergency Limit

** = post-contingency 15 minute Emergency Limit

24
Table 3 uNormal" voltages of 0.95 nominal are likely to be below plaht specified limits.

Consequently, NPPs will have to request more restrictive'voltage limits per the tariff.' The entity

making the request will be responsible for all icremental generation and other costs, and PJM

will post on its Internet site its current determination of the voltage criteria that it will employ for

transmission grid reliability. In its filing, PJM used NPP voltage requirements to demonstrate

the need for the amendment to the operating agreement, stating that NPPs may have internal

plant requirements that require voltage limits different from the generic voltage limits necessary

for the transmission system.

RES previously found (Ref. 10) that CAISO and its NPP generators have implemented binding

"transmission control agreements" to ensure, in part, that the appropriate technical parameters

in the NPP analyses are explicitly stated. In a meeting between the NRC and the industry on

May 18, 2000 (Ref. 13) one of the west coast NPPs discussed the status of an NPP "grid

specification" for the grid operator. The specification gives technical details that the grid

operators need, such as NPP transient and steady state loads, as a function of time, to ensure

the 230 kV offsite power system voltage Would not go below 218 kV. The grid specification

requires inspection and preventive maintenance of 230 kV switchyard equipment under the

control of the transmission entity and important to the adequacy of the NPP off site power

system.

Assessment

Some grid operating entities that supply offsite power to NPPs, such as PJM and the CAISO,

maintain comprehensivegrid reliability programs. 'They manage and control regional

operational and engineering activities through activities such as: electrical analysis of the grid

in real time, development of time-based voltage criteria, and implementation of binding

contracts to supply electrical power to meet NPP specifications. These programs help NPPs

maintain the validity of TSs, recovery times consistent with the SBO rule, and their obligations

under GDC 17. These programs have been, in part, implemented through contractual

agreements between NPPs and grid operators so as to provide a mechanism for maintaining

some assurance of adequate reactive and voltage support for NPPs in a deregulated system to

include specific grid and NPP electrical requirements necessary to analyze and monitor the grid

for the NPP.

3.5 Emergency Diesel Generator Test With Grid Degraded May Compromise Independence

Operating experience (events 7, 24, and 56) shows that an EDG failed one of three times while

running to the grid for test given a grid transient such as one i the transmission system or from

reactor trip. In event 7, the EDG tripped as transmission system switching operations were

being performed. In event 24, the EDG was exposed to a transmission system fault while

protective relaying was ObS to allow transmission test activities. In events 7 and 24, the' EDG

tripped and realigned to the safety buses as designed. 'However, in event 24 the' EDG tripped

later in the event when attempting to restore offsite power. Better coordination of EDG test and

transmission test and operating activities might have minimized the potential for tripping'the

EDG.

In event 56, the EDG overloaded after attempting to assume a greater share of the load on the

grid when the reactor tripped. The licensee estimated that the EDG current exceeded 600

amps for 5 minutes (at least 133 percent above its continuous rating and 113 percent above its

25
short-time rating) which was just below its overcurrent trip. No EDG damage was found during

follow-up inspection and tests. It could be argued that the EDG could have been restarted

immediately, if required. Better protective relaying would trip the EDG from an overcurrert

within a few seconds of the reactor trip.

Assessment

Experience shows that running an onsite EDG connected to the grid for testing with the reactor

at power can potentially result in (a) the loss of an offsite and onsite emergency power supply,

or (b) damage to the EDG. The potential for these incidents could be reduced if the NPP and

the transmission company would better coordinate activities so that the EDG is not tested to the

grid when the grid is in a degraded condition.

3.6 Potential Damaging Effects of Current Unbalances From Grid Disturbances

A RES report "Operating Experience Assessment-Energetic Faults in 4.16 kV To 13.8 kV

Switchgear and Bus Ducts That Caused Fires In Nuclear Power Plants 1986-2001,"

February 22, 2002 (Ref. 24), discussed an event that occurred on March 18, 2001, at a nuclear

plant in Taiwan, involving a fire and SBO due to an energetic electrical fault in 4.16 kV

switchgear with an insulation failure. The CCDP for the event was 2.2E-03. The damage was

so extensive that the exact cause could not be determined. A University of Texas consultant

reviewed the NPP station logs and found that frequent unbalanced transmission line voltages

since 1985 may have resulted in current unbalances (also termed negative phase sequence

current) that prematurely aged the switchgear insulation. The utility suspected that

ferromagnetic resonance - NPP plant and transmission system equipment electrical

interactions - may have resulted in damaging levels of voltage. The available informatio,

indicated there was no safety bus protective relaying to quickly detect the conditions.

In events 33, 50, 75, and 78 in Appendix A, phase current unbalances from grid-initiated events

tripped the reactor. In three of the four events (50, 75, 78), reactor trips were initiated as a

result of current unbalances from grid events that tripped non-safety-related RCP motors,

circulating water pump motors, or the main generators. In these events, alarms also alerted

operators to abnormal current unbalances.

Event 33 shows the damaging effects of phase current unbalance on NPP switchyard

equipment. In June 1997 a switchyard relay technician reported unbalanced phase current

readings on phase B of the generator 230 kV output circuit breakers GB1 -02 and GB1 -12. The

readings for GB1-02 were 1020, 420, and 1080 amps; normally these readings are within a few

percent of each other but these readings indicate a 60 percent current unbalance. The current

readings for GB1-12 were 1182, 2100, and 1140 amps and indicate an 80 percent current

unbalance. The plant operated at 100 percent power for 2 days when the GB1-02 circuit

breaker failed and the generator and reactor tripped.

Assessment

Experience indicated that transmission system operation or disturbances may cause sustained

or frequent current unbalances that result in damage to electrical equipment. It is common

practice to protect expensive or important non-safety equipment from current unbalances.

26
Safety equipment does not always have the same level of protection. RES will further analyze

this issue in the future.

3.7 Grid Transients May Degrade Scram and Anticipated Transient Without Scram

Capabilities

Grid-induced reactor transients can effect scram capability. Events 64 and 65 in Appendix A

show that the boiling-water reactor scram or the EOC reactor recirculation pump trip (RPT) may

not occur during large load swings (approximately 800 MW) from a grid disturbance. In events

64 and 65, faults and equipment problems at an offsite 500 kV switchyard that directly feeds an

NPP 500 kV switchyard resulted in generator load fluctuations, fast closure of the turbine

control valves, and a reactor trip without the EOC-RPT. The licensee's evaluation of the events

found that a partial load rejection can actuate circuitry that causes turbine control valve motion

in excess of design assumptions and may not always actuate a reactor scram or satisfy the

EOC-RPT control logic.- The licensee found the FSAR analyses enveloped these events,

although large load fluctuations produce pressure excursions that approach those analyzed for

an anticipated transient without scram.

Assessment

Operating experience identified an instance where anticipated transient without scram

mitigation based on EOC-RPT logic failed to operate correctly during a transmission system

fault that produced large electrical load fluctuations. However, the risk associated with this

failure is expected to be very low.

3.8 Effects of Overfrequency on Reactor Integrity

Grid-induced reactor transients can affect reactor vessel integrity. The Westinghouse

evaluation of event 15 in Appendix A found that ugross tilting" or rocking of the reactor internals

(i.e., uplift of the fuel rods due to excess RCP flow) is limiting with respect to allowable reactor

coolant flow. While the licensee was taking one of two available 345 kV power generation

paths for an NPP OOS, a 345 kV relay malfunctioned, tripped the remaining power path, and

tripped the reactor following a load rejection. The equipment OOS also disabled an NPP

electrical protective trip that left the RCPs electrically connected to the main generator, which

was overspeeding from the load rejection. The RCP rated flows increased from 96 percent to

111.8 percent as a result of the increased frequency from the main generator. In analyzing the

effects of the increased RCP flow, Westinghouse found a new RCP flow limit of 115.8 percent

is more limiting than the previous 125 percent limit identified in the licensee's FSAR.

Assessment

Grid conditions which result in over-frequency conditions can have unexpected consequences.

At one plant, over-frequency conditions following a load rejection caused speed-up of the RCPs

which generated forces to within a small margin of those causing uplift of the fuel rods from

excess RCP flow. The over-frequency condition was not properly accounted for by the plant

protective relay control logic.

27
4 ASSESSMENT

Deregulation of the electrical industry has resulted in major structural changes over the past

few years. Whereas before, electric utilities produced the electricity and operated the

distribution system, that is no longer the case. In many states, the electric utilities have split

into separate generating companies, and transmission and distribution companies thereby

increasing the coordination times to operate the grid from the involvement of different

companies. In addition, generating companies have daily open access to the grid and this

changes the grid power flows and voltages so as to change the grid parameters in the NPP

design and grid operating configurations that were established before deregulation. NPPs rely

on an outside entity to maintain safety bus voltage within limits for NPP operation.

The assessment found that major changes related to LOOPs after deregulation compared to

before include the following: (1) the frequency of LOOP events at NPPs has decreased, (2) the

average duration of LOOP events has increased - the percentage of LOOPs longer than

4 hours has increased substantially, (3) where before LOOPs occurred more or less randomly

throughout the year, following deregulation, most LOOP events occurred during the summer

months (May-September), and (4) the probability of a LOOP as a consequence of a reactor trip

has increased substantially during the summer months.

Simplified event trees were developed to assess the impact of grid changes on overall NPI'

risk, and to include the impact of the LOOP as a consequence of reactor trip. The findings.

indicate: (1) the average yearly risk from LOOPs and reactor trips decreased, and (2) a small

number of events over the first five years of deregulated operation indicates that most of the

risk from LOOPs occurs during the summer months. Sensitivity studies indicate that the ri3k

reduction goals from SBO rule implementation have been maintained, except during

summertime operations with the EDG out of service or with the grid degraded.

The assessment re-enforces the need for NPP licensees and NRC to understand the concition

of the grid throughout the year to assure that the risk due to potential grid conditions remains

acceptable. To elaborate:

(1) The NRC does not regulate the grid; however, the performance of offsite power is a

major factor for assessment of plant risk. With respect to maintaining the current levels

of safety, offsite power is especially important when considering EDG maintenance and

outage activities. Consequently, NRC and licensee assessments of risk that suppcrt

EDG maintenance and outage activities should include: (a) assessment of offsite Flower

system reliability, (b) the potential for a consequential LOOP given a reactor trip, arid

(c) the potential increase in the LOOP frequency in the summer (May to September).

Regarding (a) above, the assessment of the power system reliability and risks from plant

activities can be better managed though coordination of EDG tests with transmission

system operating conditions.

(2) Another important aspect of the changes to the electrical grid is the impact on the

electrical analyses of NPP voltage limits and predictions of voltages following a reactor

trip and whether a reactor trip will result in a LOOP. Recent experience shows that

actual grid parameters may be worse than those assumed in previous electrical

analyses due to transmission system loading, equipment out-of-service, lower than

28
expected grid reactive capabilities, and lower grid operating voltage limits and action

levels. NPP design basis electrical analyses used to determine plant voltages should

use electrical parameters based on realistic estimates of the impact of those conditions.

(3) With the structural and operational changes that have occurred in the industry, it is

important to have formal agreements, such as contracts between the NPP and

transmission company, in place to ensure grid operators will maintain adequate reactive

and voltage support. Some regional grid operating entities manage and control

operational and engineering activities in real time to maintain grid availability and

reliability. Since external factors impact the ability of licensees to manage risks and

understand the condition of the grid, some NPP licensees have implemented contractual

agreements with grid operators to provide a mechanism for maintaining secure electrical

power in the deregulated environment. Contractual arrangements should include

specific regulatory requirements or commitments; electrical performance requirements

under normal, transient, and accident conditions; communication protocols; operating

procedures and action limits; maintenance responsibilities; responsibility for station

blackout (SBO) (alternate ac) power supplies not owned by the licensee; and NPP and

grid technical parameters necessary to maintain adequate'electrical supply to the NPP.

Within its proper roles and responsibilities, the NRC should communicate with the

industry about the possible need for formal agreements.

Additional insights from this study include the following:

(1) The California Independent System Operator (CAISO), the Pennsylvania-New JerseyMaryland (PJM) Interconnection, and Callaway experiences provide an opportunity for

the industry and NRC to develop lessons to be learned. As examples, CAISO found it

needed to manage and control regional operational and engineering activities in real

time to maintain adequate reactive and voltage support to NPPs, PJM identified

numerous corrective actions for the root causes of low voltage conditions following a

1999 heat wave, and Callaway modified the plant and its grid operating protocols with

the transmission entity as a result of low voltage conditions from operating in a

deregulated environment.

(2) While the data set is small, the number, types, and duration of LOOPs have changed

since 1997. Recent experience indicates that there are fewer LOOPs. Whereas most

of the 1985-1996 LOOPs were of short duration and plant-centered, most of the recent

LOOPs are longer and had major grid involvement from the reactor trip, severe weather

or lightning that affected the NPP switchyard and transmission lines, or NPP switchyard

equipment failures. Further, based on historical data, power restoration times following

a LOOP were generally less than 4 hours; more recent LOOPs have lasted significantly

longer. Also, recent grid events, although not directly associated with LOOPs, indicate

that grid recovery times are longer. For example, in the Northeast, it took the grid

operator (of 12 NPPs) 10 hours to resolve problems from unexpected behavior of the

grid, despite implementation of planned voltage and load management programs;

investigation found insufficient reactive capacity to quickly restore voltages. In the MidWest, the grid operator needed 12 hours to change regional power flows and restore

voltage to an NPP. Longer restorations for most of the events challenge the

assumptions and capabilities used in assessing plant risk from LOOPs.

29
(3) LOOPs, partial LOOPs, and voltage degradations below the technical specification low

limit following or coincident with a reactor trip may indicate potential electrical

weaknesses in the grid and a need for followup to prevent more serious events.

(4) Realistic assessment of the risk from grid events will need to consider the impact o a

grid event on multiple NPPs. For example, a 1996 transmission system disturbance

resulted in the simultaneous trip of four NPPs.

(5) Experience indicated that transmission system operation or disturbances may cause

sustained or frequent current unbalances that result in damage to electrical equipment.

It is common practice to protect expensive or important non-safety equipment from

current unbalances. Safety equipment should also have the same level of protection.

(6) Grid-induced reactor transients can effect scram capability. Operating experience

identified an instance where anticipated transient without scram mitigation based on

end-of-cycle recirculation pump trip logic failed to operate correctly during a

transmission system fault that produced large electrical load fluctuations.

(7) Grid conditions which result in over-frequency conditions can have unexpected

consequences. At one plant, over-frequency conditions following a load rejection

caused speed-up of the reactor coolant pumps which increased flows that generated

forces to within a small margin of those causing uplift of the fuel rods. The overfrequency condition was not properly accounted for by the plant protective relay control

logic.

(8) The synergistic effects of reduced reactive grid capability on NPPs from hot weather or

multiple reactor power uprates should be evaluated to determine the impact on the

capacity and capability of the grid to maintain adequate NPP voltages.

(9) Attention to non-safety related equipment could improve the response of an NPP to a

grid electrical transient or LOOP. The availability of non-safety related voltage

controlling equipment, such as station power transformer automatic tap changers that

control safety bus voltage levels, is important as these are assumed to be functional in

the analyses of internal voltages and by the grid controlling entity for the range of

external voltages maintained at the NPP. In addition, attention to non-safety relatei

NPP protective setpoints may reduce the chance of a premature NPP trip during a grid

disturbance. For example, experience caused one licensee to lower RCP undervoltage

and underfrequency setpoints to better coordinate with grid relay setpoints. In other

instances, inappropriate NPP main generator voltage regulator and volts per hertz

protective relay setpoints caused unnecessary reactor trips during a grid disturbance.

5 REFERENCES

1. U.S. Code of Federal Regulations, Part 50, uDomestic Licensing of Production and

Utilization Facilities," Appendix A, General Design Criteria for Nuclear Power Plants."

30
2. U.S. Nuclear Regulatory Commission, NUREG-1433, Revision 2, Standard Technical

Specifications, General Electric Plants BWRI4, June 2001 and NUREG-1431,

Revision 2, Standard Technical Specifications, Westinghouse Plants, June 2001.

3. U.S. Nuclear Regulatory Commission, NUREG-1 032, Evaluation of Station Blackout

Accidents at Nuclear Power Plants, June 1988.

4. U.S. Nuclear Regulatory Commission, Regulatory Effectiveness of the Station Blackout

Rule, August 15,2000 (ML003471812).

5. U.S. Nuclear Regulatory Commission, NUREG-5496, Evaluation of Loss of Offsite

Power Events at Nuclear Power Plants: 1980-1996, June 1998.

6. U.S. Nuclear Regulatory Commission, NRC Regulatory Guide 1.182, "Assessing and

Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.

7. Nuclear Energy Institute, NUMARC 93-01, "Nuclear Energy Institute Industry Guideline

For Monitoring The Effectiveness of Maintenance At Nuclear Power Plants, February 22,

2000.

8. U.S. Nuclear Regulatory Commission, Generic Letter 79-36, Adequacy of Station

Electric Distribution System Voltages, August 8, 1979.

9. U.S. Nuclear Regulatory Commission, Strategic Plan, Fiscal Year 2000-Fiscal Year

2005, October 4, 2000.

10. SECY-01 -0044, "Status of Staff Efforts Regarding Possible Effects of Nuclear Industry

Consolidation on NRC Oversight," March 16, 2001.

11. U.S. Nuclear Regulatory Commission, The Effects of Deregulation of the Electric

Power Industry on The Nuclear Plant Offsite Power System: An Evaluation," June 30,

1999 (ML003743741).

12. SECY-99-129, "Effects of Electric Power Industry Deregulation on Electric Grid

Reliability and Reactor Safety," May 1999

13. U.S. Nuclear Regulatory Commission, Notice 98-07, Offsite Power Reliability

Challenges From Industry Deregulation, February 27, 1998.

14. U.S. Nuclear Regulatory Commission, NRC Information Notice 2000-06: Off site Power

Voltage Inadequacies, March 27,2000 (ML003695551).

15. Meeting Notes, Discussion on Grid Voltage Adequacy Issues, May 18, 2000.

(ML003722320)

16. Letter from Ralph E. Beddle, Nuclear Energy Institute, to Samuel J. Collins, Nuclear

Regulatory Commission, "Electrical Grid Voltage Adequacy," June 26, 2000.

(ML0037275470)

31
17. Meeting Notes, Grid Reliability Issues, October 27, 2000 (ML003757737).

18. U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2000-24, Concerns

About Offsite Power Voltage, December 21, 2000 (ML003752181).

19. Meeting Notes, Summary of March 15, 2002 Meeting with NEI on Grid Reliability

Issues," March 15, 2002 (ML020930268).

20. U.S. Code of Federal Regulations, Title 10, Section 205.351, Chapter II, Report of Major

Electric Utility System Emergencies," uReporting Requirements."

21. U.S. Nuclear Regulatory Commission, Regulatory Effectiveness of the Station Blac!(out

Rule, August 15, 2000 (ML003471812).

22. Pennsylvania, New Jersey, Maryland Interconnection, "Results of Heat Wave 1999:

July 1999 Low Voltage Condition Root Cause Analysis," March 21, 2000.

23. Pennsylvania, New Jersey, Maryland Interconnection, " Voltage Criteria and Voltage

Limits Working Group Report," September 11, 2000.

24. U.S. Nuclear Regulatory Commission, Operating Experience Assessment - Energetic

Faults in 4.16 kV to 13.8 kV Switchgear and Bus Ducts That Caused Fires In Nuclear

Power Plants 1986-2001," February 22, 2002 (ML021290358).

32
APPENDICES
APPENDIX A

GRID EVENTS
Appendix A

Grid Events

This section of the appendix provides summaries of grid events that affected nuclear power

plant (NPP) performance from 1994 through 2001. The events were identified and summarized

from licensee event reports (LERs) in the NRC Sequence Coding and Search System.

Appendix A summaries provide the plant name, the source of the information, the date the

event occurred, the reactor power level, and a brief discussion of the event in relation to the grid

and the NPP.

In a few cases, the summaries reference NRC inspection reports, NRC preliminary notification

of occurrence (PNO) reports, and National Electric Reliability Council (NERC) Disturbance

Analyses Working Group (DAWG) reports. The LER, PNO, and DAWG event dates were

cross-referenced to identify the events affecting multiple NPPs in Appendix A. The DAWG

reports helped identify when the event was part of a larger grid disturbance.

Grid events were defined as events initiated from the grid and causing reactor trips or various

forms of loss of offsite power (LOOP), and events initiated by a loss of electric power from any

remaining power supplies as a result of, or coincident with, a reactor trip. For the purposes of

this study, a line of demarcation was drawn between the plant and the grid at the NPP main and

station power transformer high-voltage terminals. The grid was defined to include: (a) the highvoltage switchyard or substation nearest the NPP which is typically under the control of the

transmission organization, (b) the transmission and generation system beyond the switchyard

or substation, and (c) the protective relaying and control circuits of the switchyard and

transmission system which are often located inside the NPP. The boundary between the NPP

and the grid was based on typical organizational responsibility for equipment design,

maintenance, and operational control. In a deregulated environment this boundary is typically

the boundary between the regulated transmission system company and the deregulated

nuclear generating company.

A LOOP was indicated by the start and loading of all emergency diesel generators (EDGs). A

partial LOOP was indicated by the start and loading of one or more, but not all the EDGs.

Momentary LOOPs and partial LOOPs were indicated by the start of the EDGs; however, the

voltage quickly recovered so the EDGs did not load. Partial or momentary LOOPs are

generally not risk significant, however, for the purposes of this assessment they were used to

identify potential NPP sensitivities to a grid- related event.

The grid events were grouped as follows:

* R events are losses of electric power from any remaining power supplies as a result of,

or coincident with, a reactor trip at power. Losses of electric power include any LOOPs,

partial LOOPs, or voltage degradations below the technical specification low limit.

* 5 events are reactor trips where the first event in the sequence of events leading to the

reactor trip was in the switchyard or substation nearest the plant.

A-1
* T events are reactor trips where the first event in the sequence of events leading to the

reactor trip was in the transmission system beyond the switchyard or substation nearest

the plant.

* L events are LOOPs where the first event in the sequence of events leading to the

LOOP was in the switchyard or transmission network. LOOPs at zero power are

indicated by a zero suffix.

* PL events are partial LOOPS where the first event in the sequence of events leading to

the partial LOOP was in the switchyard or transmission network.

* I events are events of interest that provide insights into the plant response in the

switchyard or transmission network event, but did not involve a unit trip, LOOP, or partial

LOOP.

1. S Oyster Creek, LER 219/94-007, "Reactor Scram Due To Personnel Error While

Performing Switchyard Work." On May 31, 1994, while at 100 percent power a

reactor scram occurred due to human error while transmission company personnel

were installing a modification in the switchyard. At the time of this event, Oyster

Creek (OC) was operated by General Public Utility-Nuclear (GPUN) and the

switchyard equipment was maintained by Jersey Central Power and Light (JCF&L).

After notifying the OC control room, JCP&L Relay Department technicians loosened

a wire that caused opening of the generator output circuit breakers while installing a

digital fault recorder. After the event OC planned to establish a new agreement

between GPUN and JCP&L to strengthen the control and review of switchyard

activities.

2.1 Oyster Creek Unit 1, LER 219/94-019, SBO Power Source Unavailable Due To

Inadequate Design of Modification Due To Inadequate Administrative Control." On

October 19,1994, while at 0 percent power, the SBO combustion turbine (SBC)-CT)

failed to start during functional testing. At the time of this event, Oyster Creek (OC)

was operated by General Public Utility-Nuclear (GPUN) and the SBO-CT was under

operational control of Jersey Central Power and Light (JCP&L). Of interest was that

JCP&L modified the SBO-CT in May 1994 by installing a trip for a loss of ac power

and defeated its safety function. After the event, OC planned to establish an

agreement between JCP&L and GPUN that provides for review and testing of ll

SBO-CT modifications.

3. R Oyster Creek Unit 1, LER 219/97-010, "Manual Reactor Scram, ESF Actuation and

Design Deficiencies Noted As A Result of Generator Exciter PM." On August I,

1997, the reactor was manually tripped from 100 percent power causing a low

voltage condition that resulted in the start and loading of the EDGs. The licensee

found that the start-up transformer (SAT) voltage regulators were not set to regulate

consistent with the degraded voltage study assumptions. When the reactor tripped

the regional grid voltage dropped 4.5 percent due to heavy demand and a 500 kV

substation out-of-service. During transfer of in-house loads to the SATs, the voltage

dropped an additional 3 to 6 percent from no-load to full load. As corrective action,

A-2
the SAT voltage regulator setpoint was raised to ensure the required voltage levels

are maintained.

4. S Nine Mile Point Unit 1, LER 220/94-002, Reactor Scram Caused By Main Generator

Trip as a Result of Failed Output Breaker Protective Relay." On April 5,1994, while

at 100 percent power, one of the two generator circuit breakers was opened to

prepare for maintenance on a 345 kV transmission line disconnect switch. At this

time, the other generator circuit breaker tripped unexpectedly due to mis-operation

of a degraded (transmission line) protective relay resulting in a generator trip and a

reactor scram.

5.1 Nine Mile Point 1, LER 220/96-004, "Reactor Scram Caused by Turbine Trip Due to

Feedwater Oscillations." At 1318 EDT on May 20,1996, while at 100 percent power,

a turbine trip and reactor scram occurred as a result of feedwater control valve

oscillations. NERC DAWG Report No. 7,1996 indicates that at 1319 on the same

day the New York Power Pool (NYPP) initiated a 5 percent voltage reduction as a

result of the loss of NMP1 and the controlled shutdown of Indian Point 3 earlier that

day. Of interest was that the NYPP adjusted the grid voltages quickly, (i.e., 1 minute

after NMP1 tripped).

6. S Dresden Unit 2, LER 237/00-004; Reactor Scram Due To Failure To Close Current

Transformer Knife Switches Following Maintenance." On November 30, 2000, while

at 100 percent power, the reactor and several 345 kV circuit breakers tripped when

Bulk Power Operations closed a 345 kV circuit breaker in the switchyard. Prior to

the event, substation construction personnel completed maintenance and test on the

345 kV circuit breaker that was closed without verifying proper restoration of the

equipment.

7. PL Ginna, LER 244/94-005, "Loss of 34.5 kV Offsite Power Circuit 751, Due to Loss of

Power to #2 34.5 kV Bus at Station 204, Causes Automatic Activation of RPS

System (Turbine Runback)." On February 17, 1994, while at 98 percent power,

Rochester Gas and Electric Energy Operations opened a degraded 34.5 kV circuit

breaker at remote Substation #204. A high voltage condition followed and the

Substation #204 circuit breaker that was feeding Ginna 34.5 kV offsite power

Circuit 751 tripped. At this time, EDG "A" was being tested and loaded through

Circuit 751. The circuit breakers to safety buses 14 and 18 tripped on undervoltage,

and EDG "A" isolated and successfully powered safety buses 14 and 18. Power was

restored to safety buses 14 and 18 through Circuit 751 in 23 minutes.

8. PL Ginna, LER 244/94-012,"Loss of 34.5 kV Ofisite Power Circuit 751, Due to External

Cause, Results in Automatic Start of B Emergency Diesel Generator." On

September 29,1994, while at 98 percent power, a tree was accidently knocked into

the 34.5 kV Circuit 751 by a private citizen operating heavy machinery. The event

resulted in a partial LOOP to safety buses 16 and 17 and the start and loading of

one EDG. Power was restored to safety buses 16 and 17 through Circuit 767 in 30

minutes. The loss of power resulted in a loss of program memory to a radiation

monitor.

A-3
9. PL Ginna, LER 244/97-002, "Loss of 34.5 kV Offsite Power Circuit 751, Due to External

Cause, Results in Automatic Start of "B" Emergency Diesel Generator." On July 20,

1997, while at 100 percent power, 34.5 kV Circuit 751 lost power for approximately

12 hours and 15 minutes after a raccoon climbed an offsite utility pole causing i

phase to phase short. B" EDG started and loaded per design.

10. PL Ginna, LER 244/98-005, "Loss of 34.5 kV Offsite Power Circuit 751, Due to Faulted

Cable Splice, Results in Automatic Start of "B" Emergency Diesel Generator." On

November 20, 1998, while at 100 percent power, 34.5 kV Circuit 751 lost powe* after

a cable splice failed. EDG "B" started and loaded to safety buses 16 and 17. Fower

was restored to safety buses 16 and 17 through Circuit 767 in 15 minutes.

11. PL Indian Point Unit 2, LER 247/94-001, "ESF and Emergency Diesel Generator

Actuation." On January 26, 1994, while at 100 percent power, the in-service feeder

from Buchanan 138 kV Substation to P2 faulted resulting in (1) a 60 MW load

reduction on Unit 2 due the loss of 2 circulating water pumps and (2) start and

loading of two of three EDGs. Power was restored in 61 minutes.

12. S Indian Point Unit 2, LER 247/95-016, "Direct Generator Trip and Reactor Trip." On

June 12, 1995, while at 90 percent power, a broken wire and ground in a pilot wire

protective relay circuit in the Buchanan 345 kV substation resulted in generator,

turbine, and reactor trips.

13. T Indian Point 2, LER 247/96-003, "Direct Generator Trip due to Pilot Wire Feeder

Protection." On March 5,1996, while at 100 percent power, generator, turbine and

reactors trips resulted from mis-operation of a pilot wire protective relay following a

fault on a 345 kV transmission line between Buchanan and Sprain Brook

Substations. The pilot wire relay that protects equipment between Indian Point 2

and Buchanan substation had not been modified as it had at other company

locations.

14.1 Indian Point Unit 2, LER 247/96-021, Containment Isolation Valve Closure Due to

Offsite Electrical Disturbance." On October 30,1996, while at 100 percent power a

significant voltage disturbance in the 345 kV transmission system tripped one of two

generator output circuit breakers. The disturbance de-energized a radiation monitor

and caused the closure of safety related steam generator blowdown containment

isolation valves. NERC DAWG Report 26,1996 indicates that the 345 kV

disturbance was due to a faulted offsite 765 kV electrical reactor and resulted in

voltage reductions of 5 to 8 percent through-out New York. Of interest was the

voltage sensitivity of a few NPP components to the grid disturbance.

15. R Indian Point Unit 2, LER 247/97-018, Buchanan's Substation Ringbus Breaker Trip

Caused P2 Turbine Overspeed Trip and Reactor Trip." On July 26, 1997, while at

99.4 percent power, one of two available 345 kV transmission paths for Indian

Point 2 (P2) was taken out of service for repairs. At this time a degraded protective

relay circuit in the Buchanan 345 kV Substation misoperated and tripped the

remaining transmission path for 1P2. This resulted in a loss of load to P2, a turbinegenerator overspeed, a turbine trip, and reactor scram without an immediate

generator trip. When the 345 kV transmission path was taken out of service, the

A-4
Buchanan 345 kV Substation ring bus circuit breakers were placed in a configuration

that disabled a generator protective trip. The main generator remained operational

for approximately 7 seconds until it tripped from an overcurrent condition on the P2

unit auxiliary transformer (UAT).

During the 7 seconds the main generator output remained connected to the UAT,

the turbine overspeed increased the frequency to between 68 and 73 hertz. The bus

transfer from the UAT to the station auxiliary transformer (SAT) did not take place

due to the frequency mismatch between the UAT and the SAT power supplies. In

addition, the increased frequency increased rpm of all electric motors connected to

the UAT, specifically 6.9 kV buses 1 to 4 and the 480 v safety buses 2A and 3A.

The reactor coolant pump (RCP) speed overspeed increased the RCP flow from

96 percent to 111.8 percent for 10 seconds. The licensee reported that

Westinghouse evaluation found that "gross tilting" or rocking of the reactor internals

to be limiting with respect to allowable RCP flow conditions and that a new RCP flow

limit of 115.8 percent is more limiting than the previous 125 percent limit identified in

its Final Safety Analysis Report.

After the UAT tripped, safety bus 3A lost power. EDG 22 started and was available

to feed buses 2A and 3A. The 6.9 kV buses were manually transferred to the startup transformers after the generator tripped, energizing safety buses 2A and 3A.

Motor Driven Auxiliary Feedwater (AFW) Pump 21 was then used to feed Steam

Generators 21 and 22.

16. R Indian Point 2, LER 247/99-015, "Reactor Trip, ESF Actuation, Entry into TS 3.01,

and Notification of an Unusual Event." On August 31, 1999, the turbine and reactor

tripped from 99 percent power following spurious initiation of the RPS during

calibration. About 30 seconds later the generator tripped as designed and the

6.9 kV station buses transferred 3300 amps of load from the Unit Auxiliary

Transformer to the Station Auxiliary Transformer (SAT). A sustained low voltage

condition followed and all EDGs started and loaded. Throughout the event the SAT

tap changer remained in the manual mode due to a defective voltage control relay;

an NRC inspection report found the tap changer had been inoperable for several

months and plant procedures allowed manual operation without compensatory

measures.

EDG 23 (that was feeding bus 6A) tripped on overcurrent 14 seconds after it began

loading due to a low overcurrent relay setpoint. The EDG overcurrent trip was set at

3200 amps not 6000 amps as designed. The setpoint error was not discovered as

there was no requirement for a test to measure the actual trip point. The trip

activated from the 4400 amps surge from multiple overlapping motor starts AFW

Pump 23 starts in 12 seconds and takes 5 seconds to start; the Component Cooling

Water Pump 23 and Service Water Pump 23 start in 11 and 15 seconds,

respectively) following bus transfer.

The risk from this event was due to the loss of the EDG, one motor-driven AFW

pump, one pressure-operated relief (PORV) block valve, and automatic control of

one AFW control valve. Battery Charger 24, which is powered from bus 6A lost

A-5
power and the battery supported DC loads for 7.4 hours. Instrument Bus 24 WS

lost when the voltage on DC bus 24 became too low for Inverter 24 to provide

power. Approximately 75 percent of the safety system annunciators were lost or

more than approximately 5.5 hours. Offsite power was available the entire time but

not available without resetting the generator trip and operations believed resetting

the generator trip to be inadvisable. An NRC Inspection report calculated a CC:DP of

2E-04 assuming no credit for feed and bleed (need both PORVs), loss of AFW

pump was unrecoverable, and low probability of operator success for using the

feedwater system to provide make-up to the steam generators. The NRC ASP

Program determined the conditional core damage frequency was 2.8E-06 based on

new information that showed the feedwater system was available.

Review of P2 voltage 1993 analyses found: (1) that licensee voltage analyses. of a

LOOP, as with reactor trip, credits operation of the plant transformer automatic load

tap change (LTC) and grid operator action to raise voltage at the NPP using the

upstream transformer LTC and (2) that the plant automatic LTC had been inoperable

for 11 months and normal operating practice in such cases is to notify the grid

operator so he can maintain the required voltage until the LTC is repaired. AD the

LTC was stuck on a lower tap, about 3 percent below where it is expected to be

during normal power operation.

17. T Monticello, LER 263/94-003, "Transmission System Electrical Fault Causes Loss of

Circulating Water Pumps Resulting in a Reactor Scram." On April 15, 1994, while at

100 percent power, a 345 kV fault due to a transmission line wave trap (a device

used transmittreceive high frequency signals through the transmission line) failure at

another generating plant switchyard caused the voltage at Monticello 345 kV

substation to drop to 55 percent for 2 to 3 cycles. The momentary decrease in

voltage tripped the synchronous circulating water pump motors and resulted in low

condenser vacuum. The reactor was manually scrammed. The low voltage

condition also tripped the Recirculation Pump Motor-Generators on a low power

factor protective trip, and caused the Emergency Filtration Train system to change

modes due to de-energized 120 volt relays.

18. T Quad Cities Unit 2, LER 265/00-008, "Reactor Trip Due to a Main Generator

Differential Relay Operation." On July 18, 2000, while at 100 percent power a

345 kV transmission line faulted due to a failed insulator about 5 miles from the

NPP. The Unit 2 generator protective relaying circuit mis-operated tripping the

generator, turbine, and reactor. About 10 seconds later, one of the 345 kV circuit

breakers that opened to isolate the fault, automatically reclosed per design causing

the Unit 2 Reserve Auxiliary Transformer (RAT) that normally feeds the safety uses

to trip and transfer its loads to the Unit 1 Auxiliary Transformer. Power was restored

to the RAT in approximately 10 hours. The licensee found the relay mis-operaped as

the expected operation of protective relays under faulted conditions changed over

the years after the plant added and replaced current transformers in the protective

relay circuits.

19. T Oconee Unit 2, LER 270/95-002, "Incorrect Timer Setting Due to a Design

Deficiency Results in a Reactor Trip." On April 14, 1995, while at 100 percent

A-6
power, a 100 kV transmission line fault,-an offsite substation breaker failure, and an

incorrect timer setting on the Oconee main generator loss of excitation relay resulted

in generator, turbine, and reactor trips.

20. T Oconee Unit 2, LER 270/97-002, "Grid Disturbance Results in Reactor Trip Due To

Manufacturing Deficiency." On July 6,1997, while at 100 percent, the main

generator voltage regulator on Unit 2 did not respond to a system grid disturbance

created by the loss of two hydro units 15 miles from Oconee. The Oconee voltage

could not be maintained within acceptable ranges as the main generator voltage

regulator had been mis-calibrated in 1994. The voltage dropped to 80 percent of

nominal, tripping the reactor coolant pumps. The reactor tripped on underpower.

The voltage fluctuation also resulted in the loss of several non-safety electrical loads

in the turbine building and programmable controllers on a control room vertical

board."

21. S Vermont Yankee, LER 271/97-023, A Component Failure in the Main Generator

Protection Circuitry Results in a Reactor Scram." On November 25,1997, while at

85 percent power, a 345 kV phase to phase fault lasting 5 cycles occurred due to

errors made during 345 kV switching to support transmission system maintenance.

The reactor scrammed due the failure of turbine-generator runback controls in

response to the 345 kV fault. The licensee stated that the switchyard equipment

was owned and controlled by the transmission entity and the NPP's received

periodic updates of the status of the switchyard.

22. R Vermont Yankee, LER 271/98-016, "Reactor Scram on High Water Level as a

Result of a Stuck Open Feedwater Level Control Valve Due To A Cap Screw Lodged

Underneath the Valve Disk." On June 9,1998, while at 65 percent power, high

reactor water level resulted in turbine and reactor trips. About 50 minutes later

non-safety related A and B feedwater pumps motors (5500HP) auto-started

simultaneously and caused an overcurrent condition on 4 kV non-safety bus 1 that

tripped the supply circuit breaker to 4 kV non-safety bus 1 and 4 kV safety bus 3.

EDG B started and loaded to safety bus 3.

23.21 Diablo Canyon Unit 1 and 2, LER 275/94-016, "Diesel Generators Started as

Designed Upon De-Energization of Startup Bus Due to Offsite Wildfire." On

August 15, 1994, with Units 1 and 2 at 100 percent power, two nearby transmission

lines tripped due to a wildfire. Morro Bay Unit 3, one of four nearby generators, also

tripped due to the system disturbance. At this time Diablo Canyon made plans for a

two unit LOOP/reactor trip. About 13 hours after the initial fault, two more nearby

230 kV lines and Morro Bay Units 1 and 4 tripped due to the wildfire and all Diablo

Canyon 1 and 2 EDGs started but did not load. Morro Bay Unit 2 was out of service

for maintenance. Of interest was the dual unit aspect of the event.

The transmission and generation losses affected the distribution system voltage. It

was subsequently determined that the early warning sirens were inoperable for

approximately 5 hours due to the power losses.

A-7
24. 2T On December 14,1994, a transmission line fault in Idaho affected 6 nuclear units in

California and Arizona. A Western Systems Coordinating Council (WSCC) Sys.tem

Disturbance Report noted that the event resulted in the loss of 11,300 MW of

generation for various reasons (underfrequency, overfrequency, low voltage),

divided the grid into four islands, and 1.7 million customers lost power for timeE.

lasting a few minutes up to 4 hours. During the event, voltages were as low as

81 percent of rated and noted to exceed equipment maximum rated voltages of

105 percent (typically transformer maximum allowable voltages under loaded

conditions limit maximum allowable system voltages). The frequency was as low

58.5Hz in one island and as high as 61.4 Hz in another island.

The WSCC report identified 35 recommendations to address conditions that were

not fully consistent with grid reliability criteria, relay misoperations, the need for

additional system circuit breakers, improved methods to coordinate grid operat on,

and improved voice back-up communication systems.

Diablo Canyon Unit 1, LER 275/94-020, "Reactor Trip Due to Reactor Coolant Pump

Bus Undervoltage that Resulted from an Electrical System Disturbance." On

December 14, 1994, while Units 1 and 2 were at 100 percent power, a transmission

line fault in Idaho resulted in Unit 1 and 2 reactor trips due to reactor coolant pump

motor bus undervoltage. Some primary 500 kV protective relaying was out of

service for testing. EDGs 1-1 and 2-2 started but did not load as power was

available to their buses. At the time of the trip, EDG 1-3 was paralleled to the grid

for routine surveillance testing and picked up its safety bus load. EDG 1-3 tripped

on overcurrent when attempting to restore offsite power approximately 45 minLtes

into the event. One containment fan cooler unit did not start due to a low speei

timing relay failure. The instrument uninterruptible power supply (UPS)

2-2 experienced a failed ac input due to protective features that trip the UPS during

voltage transients below 30 percent and above 20 percent normal. The UPS was

reset by cycling the ac input circuit breaker. As part of corrective action, the ROP

undervoltage and underfrequency trips were increased to the maximum alloweJ by

the Technical Specifications.

PNO-IV-94062. The grid disturbance also affected WNP-2, Palo Verde 1 & 2, and

San Onfre 2. While at 100 percent power several WNP-2 UPSs tripped off line and

realigned to their alternate power source. Palo Verde Units 1 and 2 were operating

at 98 percent and 100 percent, down-powered 1 percent, and received several UPS

alarms on the Class IE electrical system. San Onfre Unit 2 was at 98 percent power

and lost 40 MWe as a result of one of four turbine governor valves closing.

25. 4T On August 10, 1996, at 1549 a major electrical disturbance resulted from a fault on

an overloaded 500 kV transmission line that sagged into a tree in Oregon. A

Western Systems Coordinating Council (WSCC) System Preliminary Disturbarce

Report (Draft) noted that the event resulted in the loss of 25,455 MW of generation

for various reasons (underfrequency, overfrequency, low voltage), 7.5 million

customers lost power for periods ranging from a few minutes to six hours, and

separated the grid into four islands. The industry report stated the contributing

factors were high Northwest transmission loads due to hot weather throughout the

A-8
- :i , l a | 7

WSCC region, large power transfers from Canada, and equipment out of service

(three 500 kV transmission lines in the Portland area were forced out of service, a

500/230kV transformer was out for a modification, 2000 MW of generation to protect

salmon migration). The report also stated the grid was operating in a condition in

which a single contingency outage would overload parallel transmission lines;

operating studies had not been conducted for this condition so the operators were

unknowingly operating the system in a condition that violated WSCC minimum

reliability criteria.

The WSCC report identified 30 recommendations to address conditions that were

not fully consistent with grid reliability criteria, relay misoperations, the need for

additional system monitoring, operating, and control facilities; improved operating

personnel performance; improved system, operating, restoration planning; and

preventive maintenance. NERC DAWG Report 18,1996, indicates that multiple

transmission line outages over a period of one hour prior to the disturbance,

primarily related to hot temperatures, weakened the system and led to growing

voltage oscillations. The NERC report also indicates that random outages over a

short time pushed the system into an abnormal condition in which it could not

withstand the next contingency.

Diablo Canyon Units 1 & 2 are in the Northern Island where the frequency initially

dipped to 58.54Hz, spiked to 60.7Hz, drooped again to 58.3Hz and returned to

normal in 2.5 hours. The Northern Island lost 11,603 MW of load from manual and

automatic underfrequency load shedding; and 6,246 MW of generation due to low

voltage, out of step protection, and turbine-generator vibration. Diablo Canyon

Unit 1, LER 275/96-012, Reactor Trip on Units 1 and 2 Due to Major Western Grid

Disturbance," states the electrical disturbance resulted a Unit 1 reactor trip due

tripping its reactor coolant pumps (RCPs) on undervoltage and a Unit 2 reactor trip

due to loss of two of four RCPs. Two Unit 2 containment fan cooler units tripped on

thermal overload when they attempted to restart in high speed (improperly aligned).

Palo Verde is in the Southern Island where the frequency initially spiked to 61.3 Hz,

dropped to 58.5 Hz and returned to normal in 70 minutes. The Southern Island lost

15,982 MW of load from manual and automatic underfrequency load shedding; and

13214 MW due to loss of excitation, overcurrent, underfrequency, overfrequency

and line trips. Palo Verde Unit 3, LER 528/96-004, no title, states that Unit 1 and

Unit 3 reactors tripped due to load fluctuations (a substantial 700MW decrease and

significant load demand increase) that caused the steam bypass control system

(SBCS) valves to open and exceed the variable over power trip (VOPT) setpoint

within the core protection calculators (CPC). Unit 2 momentarily spiked to

102 percent power without reaching the (VOPT) setpoint.

Differences in the moderator temperature coefficient (MTC) levels explain why Palo

Verde Units 1 and 3 tripped and Unit 2 did not trip. On Units 1 and 3, the MTC was

more negative and near th6 end of core condition (EOC) on Units 1 and 3 (-34 and -

23.5 pcm per'degree Fahrenheit respectively). On Unit 2 the MTC was less

negative at the beginning of core conditions (-9 pcm per degree Fahrenheit). The

CPC VOPT is-an expected response to the load change as is the opening of the

A-9
SBCVs, excess steam demand, and resulting power increase due to decreasing

temperature with a negative MTC. However, the closer the unit is to the EOC, the

more rapid the power increase and the higher probability of reaching the VOPT

setpoint.

PNO-IV-96042. At 1320 on August 12, 1996, Diablo Canyon reported that 100 of

the 135 offsite early warning sirens had been without power. Power was

subsequently restored to all sirens within 10 miles, and as of the reporting, all but

4 sirens were restored outside the 10 mile area. In addition, the grid disturbance

resulted in frequency oscillations from 58.5 Hz to 61.3 Hz and slight load losses at

San Onfre 1 & 2. WNP-2 also experienced frequency oscillations and remained

operational.

26. 21 Diablo Canyon Units land 2, LER 275/98-013, "Actuations of Engineered Safety

Features, Diesel Generators Started When Startup Power Was Lost Due to an

Inappropriate Relay Setpoint (Personnel Error)." On November 20,1998, while

Units 1 an 2 were at 100 percent power, offsite power was lost while energizing

Startup Transformer (SUT) 1-1 through a new 230 kV circuit switcher 211-1. ll six

Unit 1 and 2 EDGs started but did not load as the emergency buses remained

energized through their respective Auxiliary Transformer. The circuit

switcher 211-1 tripped due to inappropriate setting of the SUT differential relays.

The settings should have been re-evaluated due to changes in the inrush currents

from the installation of the new circuit switcher, recent replacement of SUTs 1-1 and

2-1, and new switchyard capacitor banks. Of interest was the dual unit aspect of the

event.

27. 21 Diablo Canyon Unit 1, LER 275/01-001, "Automatic Emergency Diesel Generator

Start Upon Loss of Startup Power Due to 230 kV Line Arcing in Heavy Smoke From

Escaped Fire Caused By Inadequate Administrative Controls." On April 5, 20C 1,

while Units 1 an 2 were at 100 percent power, a scheduled and controlled brush

burn generated heavy smoke that caused a phase to phase fault on 230 kV

transmission lines that supply offsite power to Diablo Canyon. All Unit 1 and 2 EDGs

started and did not load as the emergency buses remained energized through their

respective Auxiliary Transformer. The 230 kV power was restored in 73 minutes.

Of interest was the dual unit aspect of the event.

28. 21 Peach Bottom Units 2 and 3, LER 277/96-007, "Actuation Due to a Loss of One

Off-Site Electrical Source as a Result of Off-Site Substation Activities." On June 4,

1996, while Unit 2 was at 80 percent power and Unit 3 was at 100 percent power,

the 220 kV 2SU (licensee nomenclature for its transmission line) off-site power

source tripped as a result of a transmission system perturbation caused by remote

switching operation. All station buses transferred to an alternate power source. Of

interest was the dual unit aspect of the event.

29.1 Peach Bottom Unit 2, LER 277/01-001, Loss of Offsite Power Source Results in

Specified System Actuation and Safety System Functional Failure." On June 18,

2001, while Unit 2 and 3 were at 100 percent power, a raccoon caused a phase to

phase short on offsite power supply 343SU-E (licensee nomenclature for its

transmission line). The emergency 4.16 kV buses on Units 2 and 3 transferred to

A-10
their respective offsite power supply. Of interest was that due to a procedure

deficiency, two of four emergency-buses per unit would not have automatically

received power from their respective EDGs in the event of a LOOP.

30.1 Fort Calhoun, LER 285/95-003, uManual Reactor Trips Due to Water Leakage Into

Reactor Coolant Pump Lube Oil." On May 11, 1995, and May 24,1995, the reactor

was manually tripped from 100 percent power and the EDGs started but did not

load. By design reactor trip logic initiates autostart of the EDGs.

31. LO Indian Point 3, LER 286/97-008, "Automatic Actuation of Emergency Diesel

Generators Following a Loss of Offsite Power Due to a Personnel Error that

Inadvertently Grounded the Feed to the Station Auxiliary Transformer." On June 16,

1997, while at 0 percent power, a Consolidated Edison Company substation

operator mistakenly closed the wrong ground switch to support maintenance and

caused a 138 kV phase to ground fault on the Buchanan feeder that was supplying

offsite power to P3. Two out of three EDGs started and loaded. One EDG was out

of service for maintenance. The LOOP lasted 43 minutes.

32. S Indian Point Unit 3, LER 286/00-008, "Automatic Reactor Trip As A Result of Direct

Trip From the Buchanan 345 kV Substation Upon Protective Relay Conductors Low

Insulation Resistance Fault." On June 9, 2000, while at 100 percent power, faulted

protective circuitry wiring between P3, P3 138 kV control house, and the Buchanan

345 kV Substation control house resulted in generator and reactor trips.

33. R Three Mile Island Unit 1, LER 289/97-007, Generator Output Breaker Failure

Resulting In A Loss Of Offsite Power and Reactor Trip." On June 19, 1997, a

switchyard relay technician reported unbalanced current readings on phase B of

generator 230 kV output circuit breakers GB1 -02 (current readings on each phase

were 1020, 420,1080 amps) and GB1-12 (current readings on each phase were

1182, 2100, 1140 amps) and a thermal scan was planned for June 23,1997.

[Phase currents are usually balanced within a few percent of each other.]

On June 21, 1997, at 0956 while at 100 percent power, A and B Main Transformer

top oil high temperature alarm was received and transformer cooling spray was

initiated at 1022 and terminated 1109. At 1145 the generator reactive power was

raised to +220 VARS per load dispatcher request, and lowered to +200 VARS at

1200 per the shift supervisor direction due to main transformer temperature rise. At

1214 230 kV generator circuit breaker GB1-02 phase B faulted to ground and failed

to open. The other generator circuit breaker GB1-12 opened as designed and

resulted in generator and reactor trips. An arc re-strike on Phase B resulted in

failure of GB1-12 and a fault on another 230 kV bus. The faulted 230 kV buses

resulted in the opening of additional 230 kV circuit breakers and a LOOP. Both

EDGS started and loaded. Offsite power was restored in 90 minutes.

The data gathered from the event indicated undervoltage occurred 2 seconds after

the generator and reactor trips. The generator residual voltage continued to feed

one fault for 17.7 seconds.

A-11
Two reactor coolant system, loop A and B, wide range pressure instruments

indicated failed to zero signals to the plant process computer. Although the

instruments were not directly affected by the loss of power, the plant process

computer input from these instruments feeds through the Diverse Scram System

and this system was de-energized by the LOOP.

LER 289/97-008, "Control Rod Trip Insertion Times Exceed TS Section 4.7.1.1

Limits," dated June 21, 1997, reports that, as a result of the LOOP, power was lost

to the control rod drive mechanisms. The licensee evaluation of the scram found

that 8 of 61 control rods exhibited slower than normal scram times and (4 of 61 were

not within Technical Specification limits) due to the hydraulically induced effect from

reduced clearances in the thermal barriers because of deposits on the internal check

valves and between the thermal barrier parts. The licensee determined that th re

would be no adverse affects associated with this condition.

LER 289/97-010, Pilot Operated Relief Valve (PORV) Inoperability Due to Being

Mis-Wired and Failure To Perform Post-Maintenance Test (PMT) Following

Replacement During 11 R Refueling Outage," dated October 12, 1997, reported that

the PORV installed during 11 R refueling outage was not capable of being opened

during the operating cycle prior to refueling outage 12R. Consequently, the PC)RV

was failed during the June 21, 1997, event.

The NRC ASP Program determined the conditional core damage frequency was

9.6E-06.

34.1 Pilgrim, LER 293/97-007, "Safeguards Buses De-Energized and Losses of Offsite

Power During Severe Storm While Shut Down." On April 1,1997, while at 0 percent

power, a LOOP occurred during a severe storm. Severe undervoltage transients

occurred on the 345 kV transmission system that resulted in automatic shutdown of

safety related 480/120v voltage regulating transformers that were installed in 1992.

Of interest was that these transformers contain programmable microprocessor

control units that automatically shutdown the transformer when the voltage drops to

384v (20 percent of nominal), in this case for 6 to 8 cycles.

35. S Salem Unit 2, LER 311/95-004, "Engineered Safety Features Actuation (Reactor

Trip) During Unit 2 Controlled Shutdown Per Technical Specification 3.0.3." On

June 7,1995, Unit 2 began a controlled shutdown from 100 percent power due to

the inoperability of both Residual Heat Removal trains. At 20 percent reactor power,

the station non-safety buses were transferred from auxiliary to start-up power (the

safety buses are always feed from "startup" power). At 14 percent reactor power the

turbine was tripped, and both 500 kV generator output circuit breakers 1-9 and

9-10 opened. However, 500 kV circuit breaker 1-9 breaker failure relay operatad

unexpectedly, and opened two more 500 kV circuit breakers and five 13 kV

breakers. An automatic reactor trip followed due to low flow conditions in two

reactor coolant pumps from the loss of power. The licensee reported that

Westinghouse previously notified users that its SBF-1 breaker failure relay was;

susceptible to premature actuation and recommended actions to prevent

malfunction.

A-12
36. S Arkansas Nuclear One, LER 313/95-009, "Reactor Trip on High Reactor Coolant

System Pressure Which Resulted From Closure Of The Main Turbine Governor And

Intercept Valves Due To The Failure Of A Main Generator Output Circuit Breaker

Contact." On July 15, 1995, while at 100 percent power, a reactor trip occurred

when one of the two main 500 kV generator output circuit breakers was opened for

maintenance. The Electro Hydraulic Control system sensed that the both 500 kV

generator output circuit breakers were open due to a failed auxiliary contact in the

closed 500 kV generator output circuit breaker.

37. 2PLO D.C. Cook Unit 1 & 2, LER 316/00-004,"Partial Loss of Offsite Power Results in Start

of Emergency Diesel Generators." On June 8, 2000, while Units 1 and 2 were at

0 percent power, Transmission Department personnel inadvertently opened the

wrong 34.5 kV switch resulting in a partial loss of power to Unit 1 and 2 Train A

buses. The EDGs on both units started and loaded as expected. It was planned

that the Interface Agreement between D.C. Cook and American Electric Power

(AEP) Western Transmission Region would be revised to require concurrent

verification of switching operations in the switchyard.

38. R Calvert Cliffs Unit 2, LER 318/96-001, "Automatic Plant Trip Due To Partial Loss of

Offsite Power." On February 2,1996, while at 100 percent power, plant personnel

and System Operation and Maintenance Department (SOMD) were troubleshooting

a switchyard circuit breaker with two out of three offsite transmission lines in service.

Less than adequate work control and a relay card failure in a 500 kV circuit breaker

caused three 500 kV switchyard circuit breakers to trip resulting in the concurrent:

(1) loss of power to the Unit 2 reactor coolant pumps (RCPs) and the automatic

reactor trip of Unit 2 on low RCP flow and (2) loss power to one vital bus on Unit 1

and another on Unit 2 and the start and loading of EDGs 12 (Unit 1) and 21 (Unit 2).

During troubleshooting activities a SOMD analyst recommended closing of the

switchyard circuit breaker and no one recognized that this invalidated the original

premise of the plant circuit breaker troubleshooting plan that no breaker would be

operated.

39.1 Diablo Canyon 2, LER 323/97-002, uReactor Trip on Low-Low Steam Generator

Water Level Following the Failure of Main Feedwater Pump 2-1 Due to Mechanical

Problems." On March 29,1997, the reactor tripped from 50 percent power on steam

generator (SG) water level low-low in SG 2-2 due to loss of one main feedwater

pump. Prior to the reactor trip, operators compensated for the partial loss of

feedwater by rapidly reducing the load from 100 percent to 50 percent and starting

all (two motor driven and one steam driven) auxiliary feedwater pumps. EDGs 2-2

and 2-3 started due to the momentary voltage dip on their respective buses during

the bus transfer to start-up power. The EDGs did not load as the voltage recovered

quickly. DG 2-1 did not start due to different loading conditions on the vital bus. By

design, the EDG autostarts if the voltage has not recovered within 1 second.

40.1 Diablo Canyon 2, LER 323/97-003, Manual Reactor Trip on Loss of Normal

Feedwater Due to Unknown Condensate/Feedwater Transient." On July 27, 1997,

the reactor was manually tripped after the loss of both main feedwater pumps.

Operators initiated a load reduction and two motor driven and on a steam driven

auxiliary feedwater pumps started automatically. EDG 2-2 started due to the

A-13
momentary voltage dip. The EDG did not load as the voltage recovered quickly. By

design, the EDG autostarts if the voltage has not recovered in 1 second.

41.1 Diablo Canyon Unit 2, LER 323/98-005, "Manual Reactor Trip Due to Heavy Debris

Loading of the Circulating Water System During a Pacific Ocean Storm." On

December 1, 1998, operators initiated rapid Unit 2 generator load reduction from

100 percent to 50 percent and subsequently tripped the reactor due to heavy debris

loading of the circulating water systems during a Pacific Ocean storm. EDG 2-2

started following bus H transfer to startup power, but did not load as startup pcwer

was available to the 4 kV buses. By design, the EDG autostarts if the voltage as

not recovered in 1 second.

42. Lo, PL Brunswick Unit 2, LER 324/94-008, "Dispatcher Switching Evolution Results in Loss

of Offsite Power to Unit 2. On May 21, 1994, while Unit 2 was at zero power the

dispatcher made an error while executing six actions as part of returning a 23 kV

line to service. The actions were completed in 52 seconds and the time between

actions did not allow for self checking or feedback from the Brunswick control room.

All Unit 1 and 2 EDGs started and the Unit 2 EDGs loaded.

43.L0 Brunswick Unit 1, LER 325/00-001, "Loss of Offsite Power During a Refuel Outage."

On March 3, 2000 while Unit 1 was at zero power and Unit 2 was at 100 percent

power, utility transmission maintenance technicians mispositioned a switch in

protective relay circuitry during switchyard relay trip activities. A LOOP occurred on

Unit 1. The Unit 1 and 2 EDGs started. The Unit 1 EDGs loaded; however, one

EDG failed to. run due to failure of is excitation system transformer.

44. S Sequoyah Unit 1, LER 327/96-006, "A Failed Coupling Capacitor Potential Device

Caused Actuation of the Generator Backup/Transformer Feeder Relay Trippirg the

Turbine and the Reactor." On June 26,1996, while at 100 percent power, a

coupling capacitor potential device in the 500 kV switchyard faulted and caugl-t fire

resulting in generator, turbine, and reactor trips.

45. S Sequoyah Unit 2, LER 328/95-007, "Reactor Trip With Auxiliary Feedwater Start and

Feedwater Isolation as a Result of a Switchyard Power Circuit Breaker Failure." On

December 12, 1995, while at 100 percent power, a 161 kV transmission line circuit

breaker opened to clear a ground fault due to a latent defect in one of its insulators.

The perturbation was sensed by protective circuitry on 2 of 3 and all synchronous

circulating water pump motors (CCPM) on Unit 1 and Unit 2, respectively. Unit 2

reactor was manually tripped due to loss of condenser vacuum due to the losE of the

CCPMs. Security system lost power after transferring to its UPS but its batterl was

"faulty."

46. T Beaver Valley, LER 334/94-005, "Main Transformer Bushing Failure Results in

Electric Grid Disturbance and Dual Unit Reactor Trip." On June 1,1994 while nits 1

and 2 were at 100 percent power, a bushing failure on the Unit I Main Transformer

initiated a voltage disturbance on the grid. Generator and reactor trips followed.

The transformer fault also causes a voltage perturbation on the grid that caused

inadvertent actuation of protective relaying that tripped the 138 kV transmission line

that was supplying Unit 2 System Station Service Transformer (SSST) 2A. The loss

A-14
of SSST 2A resulted in actuation of the two reactor coolant pump underfrequency

protective relays, a Unit 2 reactor trip, and the start and loading of one Unit 2 EDG.

47. I Beaver Valley Unit 1, LER 334/96-008, "Reactor Trip During Solid State Protection

System Turbine Testing." On May 31, 1996, the reactor tripped due to an

inadvertent turbine trip signal generated during RPS Testing. All auxiliary feedwater

pumps (2 motor driven and one steam) started. The B train EDG automatically

started but did not load in response to a momentary undervoltage condition. The

licensee stated that calculations showed the EDG may start as the EDG

undervoltage diesel start trip setpoint is very close to the actual value expected

during a fast bus transfer and reactor coolant pump re-starts.

48. 2T Beaver Valley Units 1 & 2, LER 334/97-005, "Inadvertent Operation of 345 kV

Backup Timer Relay Results in Dual Unit Reactor Trips." On March 19, 1997, while

Units 1 and 2 were at 100 percent power, both units experienced simultaneous

reactor trips following a grid disturbance. A fault on remote 345 kV transmission

line, whose primary protective relaying was out of service, resulted in shedding

various loads through opening of transmission line circuit breakers. Eight circuit

breakers opened in the Beaver Valley Switchyard. Beaver Valley Units 1 and 2

reactors tripped after Unit I and 2 generator 345 kV output breakers opened due to

inadvertent operation of a breaker failure and its backup timer relays on the

#3 345 kV bus in response to the disturbance. An events recorder indicated Unit 1

safety bus voltage dipped for 0.2 seconds and Unit 1 EDG-1 autostarted (voltage dip

duration was above setpoint of 0.198 seconds) and the other safety bus voltage

dipped for 0.166 seconds but EDG-2 did not autostart (voltage dip duration was

below setpoint of 0.194 seconds).

49. S St. Lucie Unit 1, LER 335/94-007, "Automatic Reactor Trip on Loss of Electrical Load

Due To Flashover On 240 kV Switchyard Potential Transformer." On October 26,

1994, while at 100 percent power, a potential transformer failed and caught fire in

the 240 kV switchyard resulting in generator, turbine, and reactor trips. As a result,

Utility Power Delivery replaced its potential transformer and began replacing other

potential transformers in its switchyard maintenance coating program.

50. T North Anna Unit 1, LER 338/96-010, "Automatic Reactor Trip Due to Failure of a

Generator Negative Phase Sequence Relay." On October 24, 1996, while at

100 percent power, a fault occurred on a 230 kV transmission line in North Carolina

and produced a negative phase sequence current of 1 percent at North Anna. The

line fault cleared; however, Unit 1 reactor tripped due to the negative phase currents

from the fault and the 4.6 percent downward calibration drift of its main generator

negative phase sequence relay that was set for approximately 6 percent.

51. S North Anna Unit 1, LER 338/00-004, "Automatic Reactor Trip Due to Malfunction of

Generator Circuit Breaker." On May 7, 2000, while 100 percent, a suspected ground

in one of two 500 IN-generator circuit breakers resulted in generator, turbine, and

reactor trips.

52. S Fermi 2, LER 341/98-001, "Automatic Reactor Scram Due to Main Turbine Trip." On

February 1, 1998, while at 96 percent power, a Nuclear Power Plant Operator

A-15
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

actuated a test switch in the 345 kV relay house for a 345 kV transmission line that

tripped the transmission line circuit breaker, both 345 kV generator output circLit

breakers, and the reactor. The test exposed degraded conditions that existed on

two 345 kV transmission line relays that activated the circuit breaker trips.

Maintenance of protective relaying equipment in the 345 kV switchyards is

performed by corporate Equipment Performance and Predictive Maintenance

personnel under a Fermi work request.

53. 2T Limerick Units 1 & 2, LER 352/95-002, "Dual Unit SCRAM Due to an Offsite Electrical

Transmission Disturbance." On February 21, 1995, while Units 1 & 2 were at

100 percent power, 220 kV transmission line 220-61 to Limerick tripped following a

fault. A circuit breaker at an offsite substation failed, causing a voltage spike that

faulted and failed a lightning arrester. Several other transmission lines tripped as a

result of the fault. Transmission line 220-61 automatically isolated in 2 seconds and

returned to service in 4 seconds but not before Unit 1 and 2 main transformer relays

initiated Unit 1 and 2 generator and reactor trips. The primary and secondary

ground fault detection relays failed to properly trip at the offsite substation befc re the

Limerick units tripped. About 0.5 seconds after 220-61 was restored,

220 kV transmission line 220-60 tripped due to ground fault current at another offsite

substation. The safety bus voltage dropped from 4320v to 4020 v which was riot

enough to start the EDGs. One Unit 2 non-safety 13 kV bus failed to transfer due

circuit breaker failure.

54. T Limerick Unit 2, LER 353/96-004, uReactor SCRAM Resulting From a Main

Generator Lockout Due to the Actuation of a Volts/Hertz Relay Caused by an

Inadequate Design Change Package." At 1033 on May 5, 1996, while at

100 percent power, inappropriate actuation of a volts/hertz relay due to a low

setpoint (made in 1988) resulted in generator, turbine, and reactor trips. NERC

DAWG Report 6, 1996, indicates that at 1009, the Pennsylvania, New Jersey, and

Maryland (PJM) grid started experiencing grid instabilities due a fault in Delaware

that tripped several transmission lines and transformers. The industry report

indicates the incident occurred during modification work at a substation in Delaware

and tripped 15 high voltage circuit breakers and 290,000 customers lost electric

service. Just after 1009 and again at 1030 the load dispatcher requested Limerick

Unit 2 to pick up additional reactive load (and raise the generator voltage, and the

volts/Hertz) to help stabilize the grid.

55. S Limerick Unit 2, LER 353/99-006-01, Generator Lockout and Scram Due To F-ailure

of B Phase Main Transformer Surge Arrestor." On December 31, 1999, while at

100 percent power load dispatchers were removing a 500 kV capacitor bank from

service when a 500 KV generator output circuit breaker phase B grading capacitor

failed. The capacitor failure resulted in a voltage transient that caused a failure of

the B-phase main transformer 500 kV lightning arrester which was sensed by ground

fault protective relaying that resulted in a generator and reactor trip. The

undervoltage from the ground fault caused the Drywell Chiller, Reactor Building

Enclosure HVAC system, and Turbine Building Enclosure HVAC system to trip.

A-16
56.1 LaSalle Unit 1, LER 373/94-011, "Unit 1 Scram Due to a Feedwater Signal Spike."

On July 8,1994, while at 58 percent power the reactor tripped due to a feedwater

transient. Of interest was the that EDG B," which was running to the grid for a

scheduled surveillance test, assumed an abnormal amount of current as a result of

the grid disturbance caused by the loss of the Unit 1 generator. The licensee

estimated that the EDG current exceeded 600 amps for 5 minutes and did not reach

its overcurrent trip; no damage was found during inspection and tests. [The EDG is

rated for approximately 450 amps so this was a 133 percent overload.]

57. S LaSalle Unit 1, LER 373/01-001, "Reactor Scram Due To Electrical Fault on

Transformer Yard 345 kV Line C Phase." On January 31, 2001, while at

100 percent power, a dirty support insulator between the Unit 1 main power

transformer and the 345 kV switchyard flashed over causing generator and reactor

trips. The electrical perturbation caused the loss of the Unit 2 2A heater drain pump

and a unit load reduction.

58. T Waterford Unit 3, LER 382/95-002, "Reactor Trip and Non-Safety Related

Switchgear Fire." On June 10, 1995, while at 100 percent power a failed 230 kV

lightning arrester at the Waterford Substation, (Waterford Unit #2 transformer)

caused the Waterford Unit 3 Main Transformer protective relays to operate and trip

the generator and reactor. A circuit breaker failure resulted in a non-safety related

6.9 kV switchgear fire that lasted approximately one hour. EDG "A" started and

loaded as a result of the loss of power to one safety bus. The NRC ASP Program

determined the conditional core damage frequency was 9.1 E-05.

59. S Susquehanna Unit 2, LER 388/95-005, "Reactor Scram Following Turbine Trip on

Load Reject." On April 15, 1995, while at 100 percent power, one 500 kV motor

operated disconnect switch was opened to support switchyard bus maintenance. An

incorrectly configured cam switch in the 500 kV motor operated disconnect switch

activated a protective relay causing a generator and reactor trip. The voltage

transient from the restart of the B Reactor Recirculation Pump resulted in several

unexpected containment isolation valve isolations and de-energized two instrument

ac power panels.

60. R Harris Unit 1, LER 400/96-008, "Reactor Trip Due to the Failure of a Switchyard

Breaker Disconnect Switch." On April 25, 1996, while at 100 percent power and one

of two generator output circuit breakers in service, a manual 230 kV disconnect

switch for the in-service generator output circuit breaker failed resulting in the

opening of the other generator circuit breaker. Generator and reactor trips followed.

Undervoltage relay contact bounced closed momentarily following the shock from

opening and closing bus circuit breakers during bus transfer. The false

undervoltage signal resulted in the loss of several non-safety motors and the B train

safety bus. The B EDG started and loaded.

61. PL Nine Mile Point Unit 2, LER 410/98-006, "Engineered Safety Features Actuations

Due to Partial Loss of Offsite Power." On March 28, 1998, while at 92 percent

power, a partial LOOP lasting approximately 195 minutes occurred following the

failure of a Scriba 345 kV switchyard circuit breaker that de-energized the

A-17
345/115 kV transformer that supplies one of two 115kv sources of offsite power to

Unit 2. Division I and IlIl EDGs started and loaded. The transmission entity had

responded to a "345 kV Breaker Trouble" alarm received by the grid control operator

and classified the alarm as not requiring notifications to NMP2.

62. R Nine Mile 2, LER 410/99-010, "Unit 2 Reactor Trip due to a Feedwater Master

Controller Failure." On June 24,1999, while at 100 percent power the reactor

tripped due to the failure of the feedwater master controller. The 13.8 kV buse.s fast

transferred to offsite power and a 115kV line circuit breaker tripped unexpectec y.

Division I and Ill load electrical power and their EDGs started and loaded. The

115 kV line tripped because a primary protective relay for one of the 345 kV main

generator output circuit breakers failed, initiating a backup protective scheme that

tripped the 345/115 kV feeder that was supplying offsite power to Unit 2.

63. S Grand Gulf, LER 416/95-010, "Reactor Scram Due To Turbine/Generator Trip." On

July 30, 1995, while at 100 percent power, a current transformer in one of the

500 kV generator output circuit breakers failed causing generator, turbine, and

reactor trips.

64. R Grand Gulf, LER 416/00-005, "Automatic Scram Due to Offsite 500 kV Circuit

Breaker Failure." On September 15, 2000, while at 100 percent power, a ground

fault and 500 kV circuit breaker failure at an offsite switchyard that directly feecs the

Grand Gulf 500 kV Switchyard resulted in generator load fluctuations, fast closure of

the turbine control valves (TCV), and a reactor trip. One EDG started and loaded

due to low grid voltage. The end of cycle reactor recirculating pump (EOC-RPT) trip

did not operate. LER 416/00-006, Unanalyzed Condition-Turbine Control Valves

May Move in Excess of Design Assumptions," found that a main generator partial

load rejection can actuate circuitry that causes TCV motion in excess of design

assumptions and may not always actuate a reactor scram/EOC-RPT downshift.

(EOC-RPT logic was not satisfied.)

65. T Grand Gulf, LER 41 6/01-003, "Automatic Scram Due to Offsite 500 kV Switchyard

Problem and EOC-RPT Pump Failure." On August 7, 2001, while at 100 percent

power, a 500 kV disconnect switch failure at a remote switchyard that feeds the

Grand Gulf switchyard resulted in generator load transient, turbine trip, and scram.

The EOC-RPT did not occur.

66. S Vogtle Unit 2, LER 425/94-001, uAutomatic Reactor Trip Due to Turbine Trip

Resulting From Trip Of Switchyard Breakers." On January 7, 1994, while at

100 percent power, a loose wire connection in a 500 kV switchyard protective circuit

for a 500 kV electrical reactor tripped one of two 500 kV generator output circuit

breakers. Two additional 500 kV circuit breakers tripped, including the remaining

Unit 2 500 kV generator output circuit breaker, due to low air pressure indicatic ns

that activated breaker failure protective relaying. Generator, turbine, and reactor

trips followed.

67. S Seabrook Unit 1, LER 443/98-014, "Reactor Trip Due To Pole Disagreement oi

345 kV Breaker." On December 22, 1998, while at 1 00 percent power, a pole

A-18
disagreement switch (a switch that monitors whether all three poles of a circuit

breaker operate together) in one of two 345 kV generator output circuit breakers

malfunctioned when it was opened to support transmission line maintenance. The

switch malfunction activated backup protective relays that opened three more 345

kV circuit breakers, including the remaining generator output circuit breaker.

Generator, turbine, and reactor trips followed. All but one bus, non-safety 4 kV bus,

transferred to offsite power. One Startup Feedwater Pump failed to start due to the

loss of power, and the electric and steam driven Emergency Auxiliary Feedwater

Pumps automatically started. During the event the voltage transient caused some

safety loads (Control Room Makeup Fan, Spent Fuel Pool Cooling Pump, Train-A

Switchgear Area Supply and Return Fans, and three Containment particulate

Radiation Monitor isolation valves) and non-safety loads (Loose Parts Monitoring) to

trip and not restart when power was restored. The license reported that this was the

second event where this switch malfunctioned however, the first event was not

required to be reported as it did not cause a reactor trip.

68. S Comanche Peak Unit 1, LER 445/97-009, "Slow Opening of the Unit 1 East Bus

Supply Resulted in Turbine Trip and Subsequent Reactor Trip." On October 27,

1997, while at 100 percent power one of the two 345 kV generator outputs circuit

breakers was slow to open during test, activating backup protective relaying that

resulted in generator, turbine, and reactor trips. The licensee also noted that the

work instructions were insufficient in that the backup protective relaying should have

been defeated for test.

69. L Bryon Unit 1, LER 454/98-017, "Line 0621 Trip and Subsequently, Loss of Unit 1

SATs Causing Loss of Offsite Power. On August 4, 1998, while at 100 percent

power, a 345 kV transmission line faulted and tripped two 345 kV circuit breakers at

Bryon and two at the remote end of the transmission line. Lightning was believed to

be the most likely cause of the fault and it had no effect on the NPP. Of interest was

that during power restoration, a LOOP occurred while at 100 percent power when a

345 kV circuit breaker supplying off site power to the NPP opened upon reclosure of

one of the two Bryon 345 kV circuit breakers due to failure a 345 kV transmission

line relay failure to reset, a NPP 345 kV switchyard alarm response procedure

inadequacy, and improper 345 kV circuit breaker synchronization timing. Both

EDGs started and loaded. The load dispatcher reclosed the remote circuit breakers

shortly after the loop occurred. However, the power restoration activities took

8 hours for coordination with the Nuclear Analysis Operational Department,

walkdowns, resetting relays, and visual inspection.

70. S Bryon Unit 2, LER 455/00-001, "Automatic Reactor Trip System Actuation Due to

Off-site Power Line Fault and Failed Air Circuit Breaker. Load Rejection Contact."

On January 13, 2000, while at 100 percent power, a fault resulted after a static line

on an offsite transmission tower associated with Unit 1 fell on one phase of a

transmission line associated with Unit 2. Protective relays isolated the fault opening

two Bryon 345 kV switchyard circuit breakers including one of the Bryon 2 345 kV

generator output circuit breakers. A failed control contact in the other Bryon 345 kV

generator output circuit breaker resulted in generator, turbine, and reactor trips.

A-19
71. S River Bend Station, LER 458/99-014, "Automatic Reactor Scram Due to

Inappropriate Work Activities in the Plant Substation." On October 29, 1999, While

at 100 percent power, a utility technician who was authorized to install a

communications microwave panel in the 230 kV Fancy Pont Substation, mistakenly

tested and activated protective relay circuits for the main generator 230 kV outout

circuit breakers resulting in generator, turbine, and reactor trips.

72. S Clinton, LER 461/96-004, "Inadequate Job Preparation for a Preventative

Maintenance Task on a Switchyard Breaker Causes Main Steam Isolation Valve

Closure and Reactor Scram." On April 9, 1996 while at 100 percent power,

protective relaying activated while utility personnel were maintaining one of the

345 kV circuit breakers that supplies offsite power through the reserve auxiliar'

transformer (RAT) to the safety and non-safety related buses when the unit is on

line. The safety buses transferred to an alternate supply in 2.5 seconds. The

non-safety buses lost power causing the turbine building main steam line high

temperature instruments to lose power, initiate nuclear steam protection system

logic that closed the main steam isolation values, and scram the reactor. The

severe transients on the normal power supply caused the circuit breaker for the rod

control and information system core map display to trip on an overcurrent condition

caused by the voltage decay. The reactor operator observed that some of the rods

did not indicate full insertion, initiated a manual scram, and Alternate Rod Insejtion

after some rods still indicated they had not inserted. It was determined that all rods

did scram and that the rod insert indications were anomalous due to an unknown

cause.

73. LO Clinton Power Station, LER 461/99-002, "Offsite Fault on In-service Offsite Electrical

Supply Line Causes Loss of Offsite Power to Safety Related-Electrical Buses.' On

January 6, 1999, while at zero power and one of two transformers that provide

offsite power was out-of-service for scheduled maintenance, the 138kV offsite power

feed to the in-service transformer faulted. A guy wire for an offsite power pole pulled

out of the ground, causing the pole to lean and fault. All three EDGs started and

loaded. The EDGs ran for approximately 10 hours until the safety buses were

transferred to alternate offsite power.

74. R Callaway, LER 483/99-003, "Manual Reactor Trip Due To Heater Drain System Pipe

Rupture Caused by Flow Accelerated Corrosion," and LER 483/99-005, "Operating

Conditions Exceeding Previously Analyzed Values Results in Inoperability of Bath

Offsite Power Sources." On August 11, 1999, at 0907 the reactor was manually

tripped from 100.78 percent power due to a feedwater drain line pipe rupture

(LER 483/99-003). On August 12, 1999, while at zero power, the switchyard voltage

supplied from the grid decreased below the minimum operability level established in

station procedures for 12 hours. The voltage drop resulted from near peak levels of

electric system loading and the transport of large amounts of power on the grid near

Callaway. The grid conditions were due to high temperatures. Licensing

correspondence (ML01 0990214) notes that the licensee stated that the deregulated

wholesale power market contributes to conditions where higher grid power flovs are

likely to occur as in this case.

A-20
The licensing correspondence also indicated that the plant was subsequently

modified to replace the existing transformers that normally supply power to the

safety buses from the 345 kV transmission network with new transformers that

include automatic tap changers. Due to changes in the nature of the transmission

system in the vicinity of Callaway, a wider range of grid voltages were expected in

the future. The new transformers combined with the previously installed 6 MVAR

capacitor banks will assure acceptable voltages are provided to the safety buses. In

addition, the licensee advised that the transmission system operator, AmerenUE

Energy Supply Operations (ESO) monitors and models the grid voltage, including

the Callaway switchyard voltage. In addition to seasonal grid load flow analysis,

ESO performs real time analysis under conditions being experienced and postulated

credible contingencies such as the loss of Callaway.

75. T Callaway Unit 1, LER 483/00-002, "Automatic Reactor Trip Initiated By Reactor

Coolant Pump Trip Caused By Motor Current Imbalance Due To External

Transmission System Disturbance." On February 13, 2000, while at 100 percent

power, a fault occurred in a neighboring electric cooperative's transmission line. The

fault did not clear due to neighboring utility protective relay weaknesses, and for the

next eight minutes, multiple subsequent faults were introduced onto the system.

Approximately one minute into the event the B reactor coolant pump (RCP) tripped

on current imbalance causing a low flow condition that tripped the reactor.

Subsequent to the reactor trip all RCPs and main condenser circulating water pump

motors tripped on motor current imbalance. NRC Inspection Report 50-483/00-01

notes that breaker protection for a 161 kV transmission line in southeast Missouri did

not operate causing significant voltage fluctuations on the Callaway switchyard

buses.

76. T South Texas Unit 1, LER 498/95-013, 'Turbine Trip and Reactor Trip Due to Main

Transformer Lockout." On December 18, 1995, while Unit 1 was at 100 percent

power, a transmission line fault with a grounded plant current transformer protective

circuit wiring caused backup protective relaying to incorrectly trip the main

transformers.- Generator, turbine and reactor trips followed. The train A EDG

automatically started and loaded. A pinched wire caused the grounded condition.

77. PL South Texas Unit 2, LER 499/99-003, "Engineered Safety Feature Actuation and

Entry Into Technical Specification 3.0.3 Following a Partial Loss of Offsite Power,

-and Failure to Verify ESF Power Availability per Technical Specification

Requirements." On March 12,-1999, while at 100 percent power, a partial LOOP

occurred after a 345 kV circuit breaker faulted. EDGs "B" and "C" started. EDG C"

loaded and EDG B" did not load as its output circuit breaker did not close due to a

failed to cell switch.

78. S South Texas Unit 2, LER 499/01-002; "Manual ReactorTrip as a Result of

Switchyard Breaker Failure." On March 1, 2001, while at 95 percent power, the plant

was realigning the 345 kV switchyard circuit breakers to support maintenance.

Unknown to the switchyard and operating crews, one pole of a 345 kV circuit

breaker stuck open after it was closed creating a phase imbalance that tripped

Circulating Water Pump 21 on phase balance overcurrent. The imbalance also

caused a main generator negative phase sequence alarm, high voltage alarms on

A-21
Standby Bus 2F and Auxiliary Bus 2H, and the trip of Circulating Water Pumps 22

and 24. A manual reactor trip was initiated.

79.1 Palo Verde Unit 1, LER 528/95-001, "Entry Into Technical Specification 3.0.3 Due To

Transient Grid Voltage." On February 15, 1995, while at 100 percent power Control

Room personnel were notified by the Emergency Control Center (ECC) that the Palo

Verde switchyard voltage had dropped below the administratively imposed limit of

525 kV for a short time (lowest reading 518 kV). The voltage was restored to ormal

level of 528 kV by a 100 MVAR increase on Unit 1. Of interest was that (1) ECC

personnel had not anticipated the severity of Palo Verde switchyard voltage drop to

518 kV during performance of switching activities: lowering VARS and removing a

transmission line from service, and the (2) the influence of the Palo 1 on the

switchyard voltage.

80.1 Palo Verde Unit 1, LER 528/95-003, "Entry Into Technical Specification 3.0.3 Due To

Transient Grid Voltage," and NERC disturbance report. On July 29, 1995, while at

100 percent power Control Room personnel were notified by the Energy Control

Center (ECC) that the Palo Verde switchyard voltage had dropped below the

administratively imposed limit of 524 kV for a short time (lowest reading 523.6 kV.

NERC DAWG Report No. 13,1995, indicated that the low voltage condition was due

to a fault that resulted in the loss of 206 MVAR of capacitor banks and several

generating units that were providing voltage support. The voltage at Palo Verde

decreased from 529 kV to 523.6 kV, increased to 537.7 kV, and then stabilized at

532.8 kV after ECC requested the MVARs be adjusted to assist in returning the

voltage to normal. Of interest was the influence of the Palo Verde 1 on the

switchyard voltage.

The internal review of this report resulted in the additional events of interest that for

the purposes of better emphasizing some of the points in this report.

81. I DC Cook Units 1 and 2, LER 315/99-022-01, Electrical Bus Degraded Voltage

Could Be Too Low For Safety Related Loads," June 23, 1999. Licensee electrical

analyses found the degraded voltage setpoints may be too low; the licensee sat the

relays so as to prevent spurious ESF actuation due to short voltage dips. The

licensee committed to make several modifications to reduce transformer loading

including the addition of a switchyard circuit breaker, one voltage regulating

transformer per train, and the replace of a few motor cables. The licensee also

planned to establish a working agreement between the American Electric Power

System Operations and the NPP so as to improve the minimum voltage during

sustained degraded voltage conditions.

82.1 DC Cook Units 1, LER 315/99-028, "ESF Actuation and Start of Emergency Diesel

Generator 1CD During Transformer Maintenance," December 16, 1999. With the

reactor a 0 power, inadvertent actuation of a protective relays started and loaded

one EDG. Of interest was that the licensee stated the cause of this event was

inadequate ownership interface between the NPP Maintenance Department and

American Electric Power (AEP) Division (transmission and distribution) personnel.

The LER also stated that there was an opportunity to resolve the lack of interface in

A-22
---- - ---

that the corrective actions were similar to this event but insufficient to prevent

recurrence.

83.1 Diablo Canyon 1 & 2, LER 275/95-007, '230 kV System May Not Be Able To Meet

Its Design Requirements For All Conditions Due To Personnel Error," August 8,

1995. The 230 kV system may not be able to meet its design requirements for all

system loading conditions. Studies indicated that during peak loading, all

transmission lines and Morro Bay Power Plants 3 & 4 need to be in service to meet

Diablo Canyon plants' voltage requirements. The LER states that "An assessment

of past 230kV operability found that, 47 times in the last five years, the 230 KV

system should have been declared inoperable due to degraded voltages." A

subsequent Diablo Canyon 1 & 2 LER 275/96-005, Potential For Flashing in

Containment Fan Cooler Units," July 31, 1996, states that a review of past

configuration of the offsite power supplies found that it was degraded for

approximately 130 hours per year since i 990.

A-23
Table A-1 Types and Number of Grid Events 1994-2001

(The numbers in the table correspond to the event numbers in Appendix A)

Type of event Number of reactor events

94 95 96 97 98 99 00 01 T

R 38 3 22 16 10

60 15 62 64

33 74

S 1 12 44 21 52 55 6 57 25

4 35 72 68 67 71 32 78

49 36 51

66 45 70

59

63

76

T 17 19 13 20 18 65 21

24 53 25 48 75

24 53 25 48

46 58 25

25

50

54

LOOP full at power 69 1

0 power 42 31 73 43 4

Partial LOOP 7 9 10 77 37 9

8 61 37

1 1

Total 12 111I 11 I10 16 7 10 3 7

Events are listed more than once indicating that the event affected more than one NPP

A-24
Table A-2 Event Summary

Table A-2 was prepared from the Appendix A, Grid Events. An explanation of the column

headings are as follows:

Column 1 - "No.," is the Table event number.

Column 2- "LER No.," is the Licensee Event Report (LER) number.

Column 3 - "Event Group," lists the event grouping codes as explained in Appendix A. In case

of loss of offsite power (LOOP) or partial LOOP, the recovery time was also noted.

Column 4 - "EDG Status," provides the response of the EDG to include the number of

emergency diesel generator (EDGs) that started, loaded, reloaded (if it was running to the grid

at the time of the event), or failed to run (FTR).

Column 5- "Degraded Grid," provides information about degradation of the grid that

contributed to the event as follows:

* "Fault." An "X" in this column indicates if equipment under control of the

transmission entity faulted.

* Elect" (Electrical). An "X" in this column indicates a weakness in the electrical

capability of the grid (or grid and NPP combined) to support the NPP offsite voltage.

* "HE" (Human Error). An "X" in this column indicates human error by personnel

that work for the transmission entity.

* "ADM" (Administrative Control). An "X" in this column indicates a lack of control of

administrative of the transmission entity's activities

* "EQPI (Equipment). This column lists equipment under control of the transmission

entity that failed or mis-operated (mis-op).

* "EOOS" (Equipment Out Of Service). An "X" in this column indicates that

equipment or facilities under control of the transmission entity were out of service at

the time of the event.

Column 6 - "Degraded Plant" indicates degraded nuclear plant equipment that contributed to

the event.

Column 7- "Observations" provides general observations and notes.

A-25
The following abbreviations were used in addition to those in the main text:

CB circuit breaker

CC coupling capacitor

CT current transformer

CW circulating water

HP horsepower

RRP reactor recirculation pump

SAT startup auxiliary transformer

TR transformer

T-line transmission line

A-26
Table A-2 Event Summary

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

1 219/94-007 S X X - New agreement between NPP and

transmission entity to strengthen control

-_______ ___________and review of switchyard activities.

2 219/94-019 l - Transmission entity modification

defeated safety function of SBO power

supply; inoperable 4 to 5 months.

- Agreement between NPP and

transmission company to strengthen

review of activities affected SBO power

supply.

- Event demonstrates when SBO power

. supply controlled by transmission entity

important to have agreement to provide

for review of Important SBO power

supply activities including post

modification and periodic tests to ensure

operability of SBO power supply.

3 219/97-010 R All EDGs- X X SAT voltage - Licensee found that when the plant

loaded regulator not tripped the regional grid voltage dropped

set 4.5% from heavy demand, EOOS, and

consistent loss of station output. Additional 3-6%

with design voltage drop from load transfer.

analysis - EOOS includes a 500 kV substation.

4 220/94-002 S Relay X - EOOS Includes one of two generator

CB.

5 220/96-004 I - Grid operator initiated 5% voltage

reduction quickly; one minute after from

loss of NMP1.

- EOOS includes P3.

A-27
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM ECP EOOS

6 237/00-004 S X X - Need to ensure proper verification

practices when returning equipment to

service.

7 244/94-005 PL EDG X 34.5 kV - Testing the EDG to the grid at time of

23 min reloaded Cs disturbance; reload successfully.

8 244/94.012 PL EDG X X 34.5 kV - Radiation monitor program memory

30 min loaded T-line lost upon loss of voltage.

9 244/97-002 PL EDG X 34.5 kV - Raccoon climbed a utility pole and

12 hr loaded T-line shorted two T-line phases.

10 244/98-005 PL one EDG X 34.5 kV

15 min loaded cable

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _s p lic e _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

11 247/94-001 PL 2/3 X 138 kV

61 min EDGs feed

loaded

12 247/95-016 S X relay

circuit

13 247/96-003 T X relay mis- - Pilot wire relay had not been modified

op at this location.

14 247/96-021 I X 765 kV - Remote 765 kV fault de-energized

electric radiation monitor.

reactor

A-28
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

15 247/97-018 R one EDG X X relay X EOOS Overfrequency increased RCP speed.

started mis-op disabled - Westinghouse found 'gross tilting" of

generator reactor internals to be limiting with

protective trip respect to allowable RCP flow and new

RCP flow Is more limiting than 125%

FSAR ilmitspeed approached gross

tilting.

- EOOS from T-llne and substation

outages reduced left one of two available

power generation paths unavailable.

- Overfrequency effects on running

______ _______ __________ safety m otors.

16 247/99-015 R EDGS X Degraded -Analysis assumed automatic tap

loaded; protective changer was operable

one EDG relay and TR -ASP 2.8E-06(ilcensee found 2E-04)

FTR tap changer

17 263/94-003 T X 345 kV - Synchronous motor/motor generator

wave trap sensitivity to momentary low voltage

(55% for 2-3 cycles fault).

- Emergency filtration 120v relays de-

________ ______ energized.

18 265/00-008 T - X 345 kV Changeout of - After fault Initially Isolated and reactor

T-llne CTs over tripped, 345 kV circuit breaker automatic

years reclosed Into fault resulting In momentary

changed LOOP and load transfer to Unit 1.

operation of

relays In

response to a

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .__ _ __ _ _ _ _ _ g rid fa u lt

A-29
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

19 270/95-002 T X 100 kV Generator

T-line and protective

CB relay setpoint

in error

20 270/97.002 T X Main - Operability of main generator voltage

generator regulator important to NPP voltage

voltage support and to prevent cascading (NPP

regulator did tripped following loss of two hydro units).

not respond - Loss of programmable controllers.

to loss of two

hydro units

21 271/97-023 S X X X Turbine

runback

controls did

not work

correctly

22 271/98-016 R one EDG X - Electric system could not support

loaded simultaneous start two 5500 horsepower

feedwater pumps motors which tripped

on bus overcurrent minutes after unit trip.

23 275/94-016 21 all EDGs X X X - Plant assessed unfavorable grid

start conditions and prepared for a dual unit

trip and LOOP.

- EOOS includes loss of several nearby

transmission lines and generators

several hours before the event.

- Many offsite sirens lost for 4 hours.

A-30
Table A-2 Event Summary (Cont.)

No. LER No. Event EDO Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

24 275/94-020 2T EDO X T-line in - 2 NPPs tripped, 4 others NPPs

reloaded Idaho affected.

- EDG 1-3 running to grid for test at time

of disturbance, successfully picked-up

safety load but tripped 45 minutes into

event.

- UPS sensitivity :Diablo Canyon and

WNP2 UPS trips; Palo Verde UPS

alarms.

- Effects of high(1 18%) voltage on safety

equipment.

- RCP undervoltage and underfrequency

trips Increased to maximum allowed by

Technical Specirication.

25 275/96-012 4T X X X - Soaring temperatures wilted

528/96-004 transmission lines.

- EOOS Includes 3 500 kV T-lines in

Oregon, a 500/230 kV transformer, and

2000 MW of generation that weakened

the grid.

- Grid operated In a unanalyzed

condition that violated grid reliability

criteria would overload parallel

transmission lines.

- MTC level Influences the NPP

response to grid disturbance.

26 275/98-013 21 all EDGs X plant relay - Relay setpoint changes due to

started misoperated increased inrush current from new 230

kV circuit switcher, SAT replacement,

and new switchyard capacitor banks.

A-31 
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

27 275/01-001 21 all EDGs X 230 kV -Wildfire affecting grid and NPP a

started T-Iine repetitive event.

- Transmission restored in 73 min.

28 277/96-007 21 X X - Momentary LOOP due to remote

switching.

- Safety buses transferred from

degraded offsite power supply to an

alternate power supply.

29 277/01-001 i power X T-line - Raccoon climbed utility pole and

transfer shorted two phases.

to other - Safety buses transferred from

source degraded offsite power supply to an

alternate power supply.

- Procedure deficiency left 2/4 EDGs per

unit inoperable for a LOOP for 3 hours.

30 285/95-003 I EDGs X - Reactor trip logic autostarts EDGs.

started

31 286/97-008 LO 1 EDG X X 138 kV

43 min loaded,1 feed

EDG

started

but FTR,

1 EDOG in

32 286/00-008 S X control - Faulted control cabling between P3,

cable and 138 kV and 345 kV control houses.

A-32
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

33 289/97-007 R all EDGs X X X 230 kV - Slow to take corrective action; planned

loaded CB to operated 4 days with 60-80% current

unbalance.

- Effect of unbalanced current on safety

related motors.

34 293/97-007 1 -Voltage regulating transformer

microprocessors sensitive to grid voltage!

transients.

35 311/95-004 S X X relay X - Manufacturers bulletin specified

corrective action, if implemented, would - -... ---.. .. .. ... -.. have prevented protective relay mis-.

operation.

36 313/95-009 S *500 kV X - EOOS Includes 1 of 2 generator CBs in

CB control the switchyard.

37 316/00-004 2PLO Unit 1& 2 X - Transmission company switching error.

Train A - Cook/AEP Interface agreement

EDGs planned.

loaded

38 318/96-001 R one EDG X X X - Voltage drops on loss of unit with

loaded EOOS.

on each - EOOS includes 1 of 3 offsite T-lines.

unit

39 323/97-002 I 2/3 X - Momentary voltage drop due to bus

EDGs transfer from auxiliary to startup power.

start - EDO autostarts if voltage recovery

more than 1 second.

A-33
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

40 323/97-003 l 2/3 X - Momentary voltage drop due to bus

EDGs transfer from auxiliary to startup power.

started - EDG autostarts if voltage recovery

more than 1 second.

41 323/98-005 I 1/3 X - Momentary voltage drop due to bus

EDGs transfer from auxiliary to startup power.

started - EDG autostarts if voltage recovery

more than 1 second.

42 324/94-008 LO Unit 2 X - Load dispatcher switching error.

EDGs - Momentary LOOP.

loaded.

Unit 1

EDGs

started

43 325/00-001 LO Unit 1 X X EDG - EDG common mode failure.

EDGs excitation - Momentary LOOP.

loaded, system

one EDG inoperable for

FTR, unknown

Unit 2 duration

EDG

started

44 327/96-006 S X 500 kV - Switchyard fire.

cc

45 328/95-007 S X 161 kV - Synchronous motor sensitivity on both

CB units.

- Security system LOOP.

A-34
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EQP EOOS

46 334/94-005 T one EDG relay Unit 1 Main - Transmission line protective relay

loaded mis-op TR high misoperation during voltage perturbation

voltage following Unit 1 trip, tripped Unit 2 on

bushing RCP underfrequency and caused a

failed PLOOP.

47 334/960-08 I one X - Momentary voltage dip on bus transfer

EDG and RCP restarts,

started

48 334/970-05 2T one EDG 345 kV X - Short safety bus undervoltage trip time

started T-line; of approximately 0.194 seconds explains

relay trip. . -- - mIs-op - EOOS Includes remote T-line relaying.

49 335/94-007 S X 240 kV - Switchyard fire.

PT

50 338/96-010 T X 230 kV Generator

T-line relay

mis-oporatio

n

51 338/00-004 S X 500 kV

CB

52 341/98-001 S 2 relays - Degraded transmission line protective

relays exposed during a test.

53 352/95-002 2TX 220 kV

T-line

A-35
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status .Plant

Fault Elect HE ADM EOP EOOS

54 353/96-004 T X X X V/Hz relay - Modification work at remote facility trips

mis-op several transmission lines and

_ ______________ ________ transformer resulting in grid instability.

55 353/99- S X 500 kV - 500 kV circuit breaker grading

006-01 CB capacitor failure caused a voltage spike

that failed transformer lightning arrester.

56 373/94-011 _ - Unit tripped while EDG being tested.

EDG tried to pickup grid and assumed

abnormal current level.

57 373/01-001 S X X 345 kV - Electrical perturbation from Unit 1 trip

line tripped Unit 2 heater drain and caused a

Unit 2 load reduction.

58 382/95-002 T one EDG TR circuit - ASP = 9.1 E-05

loaded breaker FTO - Waterford 2 23.0kV fault sensed at

on load Waterford 3.

transfer - One hour plant fire.

59 388/95-005 S X cam SW - Restart of reactor recirculation pump

in 500 kV motor caused an unexpected voltage

CB transient that tripped some plant

equipment.

60 400/96-008 R ono EDG X 230 kV X relay contact - EOOS Includes one of two generator

started SW bounce on CBs.

load transfer

61 410/98-006 PL 2/3 X 345 kV

195 EDGs CB

min loaded

A-36
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EOP EOOS

62 410/99-010 R 2/3 relay - Protective relay failure.

EDGs

loaded

63 416/95-010 S X 500 kV

CB CT

64 416/00-005 R one EDG X X 500 kV - Partial load rejection did not actuate

416/00-006 loaded CB reactor scram or end of cycle reactor

______ ,______ ________ .______ recirculation pump trip as expected.

65 416/01-003 T X 500 kV - Partial load rejection did not actuate

..r .. .. . . .. . _ . . . . .. = . SW . EOCiRPT.

66 42594-001 S 500 X

kVCB

67 443/98.014 S X 345 kV - Voltage drop from bus transfer and

CB start of 2 auxiliary feedwater pump

motors.

- Voltage transient caused 7 safety and

some non-safety motors tripped and did,...

not restart.

68 445/97-009 S X 500 kV

CB

69 454/98-017 L EDGs relay - Circuit breaker reclosed during power

8 loaded restoration.

hours - Reactor stayed at power

70 455/00-001 S X 345 kV - Static line fell on live line.

CB

A-37
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status Plant

Fault Elect HE ADM EQP EOOS

71 458/99-014 S X X

72 461/96-004 S X X - Voltage transient caused overcurrent

condition that tripped rod control and

information system map display.

73 461/99-002 LO EDGs 138 kV X - Offsito power supply pole guy wire

10 loaded T-4ine pulled out, leaned and faulted.

hours

74 483/99-003 R X - Related to deregulation-large amounts

483/99-005 of power being transported across the

country.

- Peak transmission loading.

- Grid operation changed such that wider

range of grid voltage expected at NPP.

75 483/00-002 T X 161 kV -Transmission line fault persisted for 8

T-line minutes due to neighboring utility

protective relay weakness.

- RCP and CW pump motors tripped on

negative phase sequence currents in

contrast to safety motors do not trip on

these currents.

76 498/95-013 S one EDG X relay Grounded

loaded protective

._______ relay wiring

77 499/99-003 PL EDG C x 345 kV

loaded, CB

EDG B _ _ _ _ _ _ _ _ __ __ F R

A-38
Table A-2 Event Summary (Cont.)

No. LER No. Event EDG Degraded Grid Degraded Observations

Group Status - _ _Plant

Fault Elect HE ADM EOP EOOS

78 499/01-002 S X 345 kV - CW tripped on current imbalance.

.______ _CB - high voltage alarm on safety bus.

79 528/95-001 I - Grid operating entity had not

anticipated severity of NPP voltage drop .____.____.__ from switching activities

80 528/95-003 I - Influence of NPP on offsite voltage.

TOTALS -39 19 15 14 50 11 15

A-39
Table A-3 Event Causal Factors

(The numbers in the table correspond to the event numbers in Appendix A)

Event Group Degraded Grid Degraded Plant

Fault Elect HFE ADM EQP EOOS

R 33, 60, 64 3,15,16, 22, 38 15, 33,38 15, 33, 60, 62, 3,15, 60 3,15,16, 60

38, 64,74 64

S 12, 21, 32, 44, 57,59,66,67 1, 6, 21, 35, 1, 6,21, 35, 4,12,32,35, 4, 35, 36, 66 21, 76

45, 49, 51, 55, 71, 72,76 68, 71,72 36, 44,45, 49,

57, 63, 70, 78 51, 52, 55, 57,

59, 63, 66, 67,

68, 69, 70, 76,

78

T 3,17,18,19, 20,25 54 54 13,17,18,19, 25,48,65,75 18,19, 20, 21,46,

24, 25, 50, 53, 24, 46,48, 50, 50, 54, 58

54, 65, 75 53, 53, 58, 65,

75

L L _ 69

LO 31,73 31,42,43, 43 31,73 73 43

PL 7, 8, 9,10,11, 8,37 7, 8, 9,10,11,

61,77 61,77

A-40
Table A-4 Summary of Event Group Causal Factors

Event Degraded Grid Degraded Plant

Group Fault Electrical Human Administrative Equipment Equipment Out of

Error Control Failure Service

R 3 7 1 3 5 3 4

S 12 4 7 7 21 4 2

T 11 2 1 1 13 4 8

L L 1 0 0 0 1 0 0

| LO 2 3 1 2 1 1

PL 7 0 2 0 7 0 0

TOTALS 36 13 14 12 49 12 15

137 16

A-41
APPENDIX B

RISK ANALYSIS
Appendix B

Risk Analysis

This appendix contains the background, methods, and results of risk analyses that were used

for assessing average industry core damage frequency (CDF) from a station blackout (SBO)

before (1985-1996) and after (1997-2001) deregulation using simplified event trees. Several

after deregulation cases were investigated. The analyses required consideration of all losses of

offsite power (LOOPs) which were collected along with other operating data in Appendix C,

"LOOP and Scram Data 1985-2001."

Section B.1 provides a summary of the dominant characteristics of an SBO accident sequence,

Section B.2 develops simplified event trees, Section B.3 summarizes the method used to

calculate the CDF, and Section B.4 summarizes results.

B.1 Summary of the Dominant Characteristic of an SBO Accident Sequence

The NPP offsite power system is the "preferred source" of ac electric power, often referred to

as the grid. The safety function of the offsite power system is to provide power to ac safety

loads required to shut down the nuclear power plant (NPP). Onsite ac emergency power

supplies, usually emergency diesel generators (EDGs), automatically provide power to the

safety buses following a LOOP. These systems provide power for various safety functions,

including reactor core decay heat removal and other support systems required to preserve the

integrity of the reactor core and containment following a reactor trip.

A station blackout (SBO) is defined in Secti6n 50.2 as the "complete loss of electric power to

the essential and nonessential electric switchgear buses in an NPP (i.e., a LOOP concurrent

with a turbine trip and unavailability of the emergency ac power system)." The loss of all ac

power to reactor core decay heat removal and other support systems can result in core damage

within a few hours as follows: (1) core cooling failures, or loss of reactor core cooling integrity

(RCP seal failure) in 1 to 2 hours or (2) support system failures (e.g., batteries, compressed air,

HVAC) or design limitations (e.g., high suppression pool temperatures), typically for SBO

durations lasting more than four hours.

The principle parts of SBO accident sequence are: (1) the initiating LOOP-the frequency of a

LOOP, (2) the loss of onsite power-the unreliability of the onsite ac emergency power supplies

including common cause failures, (3) recovery-the likelihood that ac power will not be restored

before the core is damaged, and (4) core'damage probability-the event sequences that result

in core damage from the failure to recover ac power and consequently, the failure of decay heat

removal or support systems necessary to safely shutdown the reactor. Core cooling failures, or

loss of reactor core cooling integrity can occur in 1 to 2 hours.

B.2 Explanation of SBO Event Trees and Data

The contributors t the CDF from an SBO are: (1) reactor trip induced LOOPs (LOOPs-as a

consequence of a reactor trip, (i.e., some of the R events in Appendix A) and (2) grid (including

S and T LOOPs in Appendix A), weather, or'plant related LOOP induced reactor trip. The risk

contribution from LOOPs that do not result in a reactor trip (non-initiating) was considered

negligible; this data was collected in Appendix C for information only.

B-1
Simplified event trees were developed to represent the two principal contributors to the CDF

from an SBO. Figures B-1, "Reactor Trip-Consequential LOOP Event Tree," and B-2, "LOOP

Event Tree," show the event trees of interest. Figure B-1 represents a reactor trip induced

LOOP and Figure B-2 represents a LOOP induced reactor trip. The event trees end with n

outcome in terms of "OK meaning recovery without core damage and "CD" meaning some core

damage can be expected.

The data used in event trees are shown in Table B-1 and Appendix C. All of the data in

Table B-1 and Appendix C were from actual operating experience with the exception that the

critical reactor years for the summer months that were estimated as indicated in Table B-l.

Plant specific data could provide different results.

The following is a discussion of each element of the event tree.

(1) The initiators

In Figure B-1, the event is a LOOP as a consequence of a reactor trip which was

modeled in two steps. Figure B-1 shows this event is initiated the number of reactor

trips per critical reactor year (Rx-Trip/(RY)," and followed by "Consequential LOO '," the

probability of a LOOP given a reactor trip or P(LOOP/RT). Table B-1 shows the "reactor

trips/critical reactor year" and P(LOOP/RT) data.

In Figure B-2, the event is a LOOP that subsequently progresses to a reactor trip. In

Figure B-2, the event is initiated by the total number of grid (S and T events), weal her,

and plant LOOPs per critical reactor year, LOOP/RY." Table B-1 shows the

"LOOPs/RY" data.

(2) EDG unreliablity

Figures B-1 and B-2 show the events progress from a LOOP to UEDG' to reflect whether

the onsite emergency power supplies (EDGs), started and loaded, or failed to start and

load. The system failure rate for UEDG' was based on a two train EDG system and

calculated from the square of the individual EDG rates (P) plus the product of the

common mode (a) and EDG train failure rates (P squared +aP). A two train system is

typical of the NPP onsite power system; of 103 operating reactors, approximately

75 percent have 2 or less EDGs per reactor unit. So changes to the grid parameters

could be detected more easily, the same EDG data was used in the before and afler

analyses. Sensitivity analyses considered recent improvements in EDG unreliability

from 0.0033 to 0.0027 that reduced the risk by approximately 19 percent. All data used

was based on actual demand performance data published by the NRC as shown in

Table B-1. Table B-1 shows the "EDG failure rate for a two train system" data.

In some cases the EDG is unavailable for testing times up to 24 hours or out-of-service

(OOS) for allowed outage times (AOTs) up to 14 days. During the AOTs, the EDG

being serviced is often in some state of disassembly and unavailable so the two train

system is dependent on a single EDG to start and run for the full duration of the event.

B-2
Rx Trip-1RY Consequential

LOOP

EDG LOOP>4 hrs Sequence

CCDP

Core Damage - 1/RY

OK

CD

OK

CD

OK

CD

OK

CD

.

Figure B-1 Reactor Trip - Consequential LOOP Event Tree

B-3
LOOP -1RY EDG LOOP 4hrs Sequence CCDP Core Damage - RY

_ _ _ _ _ _ _ _ O K

CD

|__ _ _ _ _ _ _ _ OK

CD

f________ OK

CD

Figure B-2 LOOP Event Tree

B-4
Table B-1 Operating Data From LOOPS At Power Before and After Deregulation

Risk factor Measurement All Year Summer Months Only

(Reference) ' May 1 - September 30

Before 1985-1996 After 1997-2001 Before After

Reactor trips 3161 441 1350 201

Reactor trip (Appendix C, Table C-6)

frequency_ Critical reactor years (RY) (Appendix C, Table C-6) 940 442 392 184

Reactor trips/critical reactor years (RY) 3161/940 = 3.4 441/442 =1.0 1350/392 = 3.4 201/184 =1.1

LOOP Initiating LOOPs

frequency -Consequential (Appendix C, Tables C-1 and C-2) 7 2 2 2

-LOOP (Appendix C, Tables C-1, C-3, C-4, C-5) 47 6 24 5

P(LOOP/RT) 7/3161 = 0.002 21441 =0.0045 2/1350 - 0.0015 2/201 - 0.01

LOOPs/RY 54/940 = 0.057 8/442 = 0.018 26/392 = 0.066 7/184 = 0.038

EDG reliability EDG failure rate for a two train system .0033 (Reference B.1 and B.2) 0.0027 calculated In SAPPHIRE

& redundancy using 1997-2002 EPIX EDG data

._______________ _______________ (R ef B .3)

Recovery time LOOP events exceeding 4 hours recovery time

-Consequential LOOP ,0 1 0 1

-LOOP 7 4 7 4

Percent LOOPs > 4 hours 13 (7/54) 63 (5/8) 27(7/26) 71 (5/7)

LOOP > 4 hours (number/RY) 0.0074 (7/940) 0.011 (5/442) 0.018 (78/392) 0.0271 (5/184)

Plant capability Average CCDP (Reference B.2) LOOP at power 1.8E-04

Note 1: May to September critical RY assumed to be 5/12 of total critical hours

References:

5.1 INEL-95/0035, "Emergency Diesel Generator Power System Reliability 1987-1993," February 1996.

B.2 NUREG/CR-5497, Common-Cause Failure Parameter Estimations," 1997.

5.3 Nuclear Regulatory Commission, Accident Sequence Precursor (ASP) Database.

B-5
(3) Recovery

Figures B-1 and B-2 show the events progress from "EDG" to "LOOP > 4hrs" to r lect

the percentage of LOOP events where it took more than four hours to recover. This

activity represents NPP and grid operators ability to restore ac power before exceeding

the SBO coping time.

The actual time power was restored was used in the analysis. The time that power

could have been restored by determining it was available and assuming it was reliable,

was also considered. These times are shown in Appendix C, Table C-1. As the data

indicates, this reduces the percentage of LOOPs more than 4 hours from 63 percent to

50 percent. This lowers the risk approximately 21 percent and will not change the order

of magnitude of the risks in Figure B-1.

The actual time power was restored could be considered overly conservative

considering that the operators may have restored power sooner under SBO conditions.

During the LOOP the NPP may have found it more prudent to stay on the EDGs fcr a

time to pursue more urgent tasks such as stabilizing plant systems. On then other

hand, the time power could have been made available may be optimistic as it relie; on

the assumption that offsite power was also reliable (would have worked). Recovery

from an SBO event, like a LOOP, will be specific to the event and circumstances and

there is likely to be a broad spectrum of responses. During an SBO, it is imperative that

the NPP establishes that offsite power is both truly available and reliable, and

expeditiously obtain these assurances. Like the LOOP experience, during an SBC

event, urgent operating tasks are also likely (e.g., maintaining the reactor water

inventory via connection of alternate water supplies or minimizing battery load).

Event 69 provides additional insights into how offsite power is actually restored. In this

case, if 8 hours and under, actual conditions would most likely have been done sooner.

In event 69, lightning caused a 345kV transmission line fault that opened two 345kV

circuit breakers at the NPP and two at the remote end of the transmission line, but had

no effect on the NPP. The event progressed to a LOOP at 100 percent power when a

345 kV circuit breaker supplying offsite power to the NPP opened upon reclosure of one

of the two NPP 345 kV circuit breakers due to failure a 345 kV transmission line relay

failure to reset, an inadequate NPP 345 kV switchyard alarm response procedure, and

improper 345 kV circuit breaker synchronization timing. At this point in the event both

EDGs started and loaded. The load dispatcher reclosed the remote circuit breakers

shortly after the LOOP occurred. However, the power restoration activities actually took

8 hours for coordination with the Nuclear Analysis Operational Department, walkdowns,

resetting relays, and visual inspection.

(4) Sequence conditional core damage probability (CCDP)

"Sequence CCDP" represents the likelihood of recovering or not recovering, ac powNer

for decay heat removal and other support systems necessary to safely shutdown

reactor. The CCDPs were obtained from the NRC ASP database by averaging the

CCDPs from 1980 to the present for all LOOPs at power (1.8E-04). In some case the

CCDP for some LOOP was less than E-06 and not in the ASP database; in these cases

a CCDP of zero was assigned for LOOP in determining the average. The CCDP

B-6
reflects actual demand performance and reflects the performance of the EDGs,

availability and reliability of alternate ac power supplies and cross-ties, use of

compensatory measures, operator performance, and fully credits overall NPP safety and

non-safety system redundancy and performance. However, the CCDPs typically credit

shorter recovery times than experienced so as to recognize that the NPP may have

restored power sooner under SBO conditions.

The CCDPs for sequences involving the failure of both EDGs was assumed to be an

approximately an order of magnitude higher (2.OE-03) than that for failure of the EDGs

with recovery (1.8E-4). Failure to recover in 4 hours was assumed to be approximately

another order of magnitude higher (2.OE-02).

B.3 Method

A baseline average industry CDF from an SBO before deregulation was calculated as the sum

of the CDFs leading to core damage in Figure B-1 and Figure B-2. The average industry CDF

from an SBO for the after deregulation cases were calculated using the sum of the CDFs

leading to core damage from Figure B-1 and Figure B-2 event trees. The data showed a need

to analyze the risks in the summers (May to September); all of the LOOPs since 1997 occurred

in the summer (May to September) in contrast to 23 of 54 LOOPs in the summers of

1985-1996.

The after deregulation cases were: (1) all LOOP data 1997-2001, (2) the summer months

(May-September), and three summer sensitivities cases based on actual experience (3) the

EDG out of service (OOS) for 14 days with a higher likelihood that grid will degrade,

(4) increasing in the amount of time that the grid is degraded, and (5) the EDG OOS for

14 days while the grid is

degraded. In each of the five

cases, the risks after deregulation * Risk Profile

were subtracted from the risks X

before deregulation to obtain a >Before and Afer Deregulation

"delta CDF" and the results o ^ .OOE0

displayed in Table B-2 and Figure o - yE,. CCDP 

B-3. u 14dayOOS

B.4 Results atC) . .CD , \crLIE46

The results of the Appendix B Ca 1.00E-05 - -- = __

assessment of the risk are E

summarized in Table B-2, M IIE-06

"Changes In Risk After 2

Deregulation," and Figure B-3, 0

"Risk Profile. Table B-2 shows ' 1.OOE-07

the results in terms of a "delta Jan Mar May Jul Sep Nov Jan

CDF" that was obtained by, 2 -Before -After -Summer

subtracting the CDF BEFORE' LU'

deregulation from the CDF for the DG/Ave -- 30Day EDGANC

particular case being analyzed.

Figure B-3, shows the CDF/RY Figure B-3 - Risk Profile

B-7
"Before" deregulation and the CDF/RY for the particular case being analyzed. The before

deregulation cases establish baselines to evaluate changes after deregulation. The average

risk reduction delta CDF' from SBO implementation was estimated to be 3.2E-05/RY (Rel. 1).

In Table B-2, a negative "delta CDF' indicates decreased risk since deregulation and the risk

reduction goals from SBO rule implementation have been maintained; and a positive "delta

CDP' indicates an increased risk since deregulation and that a portion of the risk reduction from

SBO rule implementation has been offset. Table B-2 also summarizes the change in the "delta

CDF' in terms of key data (the number of reactor trips per RY; the number of LOOPs/RY; the

P(LOOP/RT), and the LOOPs more than 4 hours as a percentage and as a number per FLY).

Table B-2 Changes in Risk After Deregulation

Observation Baseline Change

-Delta CDIIRY

BEFORE Risk reduction from SBO rule 3.2E-05/RY 0

deregulation -Reactor trips/RY = 3.4

1985-1996 -LOOPs/RY = 0.05

-Probability (LOOP/reactor trip) = 0.002

-Percent LOOPs >4hours =17%

-(LOOPs > 4hours)/RY = 0.0074

AFTER Risk reduction from SBO rule implementation maintained. -0.9E-05

deregulation CDF decreased below baseline due to offsetting changes:

1997-2001 -Reactor trips/RY =1.0

-LOOPs/RY = 0.014

-Probability(LOOP/reactor trip) = 0.0045

-Percent of LOOPs > 4 hours = 67%

-(LOOPs > 4 hours)/RY = 0.011 

SUMMER Risk reduction from SBO rule implementation maintained. -0.5E-03

After deregulation CDF decreased below baseline due to offsetting changes:

1997-2001 -Reactor trips/RY = 1.1

-LOOPs/RY = 0.021

-P(LOOP/reactor trip) = 0.01

-Percent LOOPs > 4 hours = 67%

-(LOOPs > 4 hours)/RY = 0.027

SUMMER Risk reduction from SBO rule implementation partially or fully offset:

SENSITIVIlY -EDG out-of-service for 14 days with a 0.01 chance of a degraded grid 0.8E-05

1997-2001 -Increase time grid degraded to 30 days (based on experience) 1.1E-0;5

-EDG out-of-service for 14 days with the grid degraded 7.7E-0

Appendix B, Table B-1 shows the key summer data for 1985-1996. Typical assessments of the

risks from an SBO use yearly averages to calculate risk and do not consider that the key

parameters affecting risk are different in the summer. Also, those assessments do not account

for long outage times on EDGs or for potential degraded grid conditions as measured by

P(LOOP/RT), both in the summer. This assessment noted that seven of the eight LOOPs

(87 percent) involving a reactor trip since 1997 occurred in the summer - May to Septemberin contrast to 23 of 54 (44 percent) LOOPs in the summers of 1985-1996. Prior to

deregulation, there was only a small difference in the likelihood of a LOOP between the

summer and the rest of the year. Thus the base case does not make a difference between the

summer and the year round.

B-8
In general, comparison data before and after deregulation shows significant changes in the key

data related to summer time LOOPs: the frequency of LOOP events at NPPs has decreased,

the average duration of LOOP events has increased, and P(LOOP/RT) has increased. The net

effect of these changes is that the risk reduction goals from SBO rule implementation'have

been maintained, except during summer time operations with EDG OOS or with the grid

degraded. The discussion below provides a detailed comparison.

Table B-2 indicates a negative delta CDF AFTER" deregulation indicating that

deregulation has not eroded the risk reduction from SBO rule implementation.

Comparison of the key factors in Table B-2 before and after deregulation help to explain

the decrease in the risk (i.e., the decreases in the number of reactor trips/RY and

number of LOOPs/RY have more than offset the increases in percentage of LOOPs

' more than 4 hours and probability of a LOOP given a reactor trip). P(LOOP/RT) is

0.0045 (as compared to 0.002 before deregulation) and corresponds to the grid being in

this condition approximately 40 hours per year. Figure B-3'shows the CDFIRY "After"

deregulation (1997-2001) have decreased below the risk "Before."

Table B-2 indicates that the "delta CDF" during the "SUMMER" is negative indicating

that deregulation has not eroded the risk reduction from SBO rule implementation.

Comparison of the key factors in Table B-2 before and after deregulation help to explain

the decrease in the risk (i.e., when averaged over the summer months [5/12's of the

each year from 1997-2001]) the decreases in the number of reactor trips/RY and

number of LOOPs/RY have more than offset the increases in the percentage of LOOPs

more than 4 hours and the probability of a LOOP given a reactor trip. P(LOOP/RT) is

0.01 and corresponds to the grid being in this condition approximately 88 hours per

year, all during the summer months (Appendix B, Table B-1 shows P(LOOP/RT) was

0.0015 during the summers of 1985.9.1996). Figure B-3 shows the CDF/RY for the

"Summer" after deregulation peaks from May to September, 1997-2001, slightly below

that "Before" deregulation. The peak reflects that 1997-2001 'the summer data has

been averaged over 5/12ths of the year rather than the entire year.

SUMMER SENSITIVITY studies performed to gauge the potential changes by averaging

the data over the summer for plant operations assuming (1) an EDG out of service

(OOS) for 14 days with a likelihood that the grid will be in degraded condition based on

operating experience, (2) increasing the amount of time that the grid is degraded to 30

days, and (3) an EDG taken OOS for 14 days with the grid degraded. TS approved

EDG OOS times typically range from 3 to .14 days. Operating experience shows that

the grid is degraded approximately 88 hours per year, (i.e. P[LOOP/RT]=0.01). Thirty

days was assumed to gauge the change in the risk during those times that a reactor trip

will result in a LOOP; specific analyses of the grid conditions being experienced would

provide the actual time a reactor trip may cause a LOOP.

Table B-2 delta CDFs indicates that in each of these three cases, the risk is positive,

indicating that the risk reduction from SBO rule implementation may be partially or fully

offset. In each of these cases, this risk increase may not be explicitly evaluated unless

the assessment considers (a) a consequential LOOP i.e. the results of electrical

analyses to determine whether a reactor trip will cause a LOOP and other LOOPs

separately (b) summer time operation and (c) actual demand performance under LOOP

B-9
conditions. Figure B-3 indicates that in each of the three cases, the risks are

represented as point estimates over portions of the summer months. The discussion

follows:

(1) The first sensitivity study estimated a change in risk as a result of having one of two

EDG OOS with a 0.01 chance that the grid is degraded, i.e. P(LOOP/RT=0.01).

Table B-2 indicates the "delta CDF" is slightly positive indicating the risk reduction from

SBO implementation has been partially offset. Figure B-3 shows this as a 14 day point

estimate in the risk as "DG/Ave" that is just above the risk "Before" deregulation. Figure

B-3 also shows the corresponding CCDP of 1.1 E-06 that was obtained by multiplying

14/365 and the CDF/RY for this case. As stated above plant specific analyses may yield

different results.

(2) The second sensitivity study evaluated the risk from an increase in the time that a

LOOP would have resulted from a reactor trip to approximately 30 days. Table B-2

indicates the "delta CDF" is positive indicating the risk reduction from SBO

implementation has been partially offset thus indicating that understanding the

percentage of the time a reactor trip can potentially cause a LOOP can be important.

Figure B-3 shows CDF/RY for this case as "30 day" that is above the risk Before"

deregulation.

(3) The worst case sensitivity study increases the risk above the Before" deregulation

values by assuming one EDG is unavailable for 14 days with the reactor at power and

the grid is degraded, (i.e., P[LOOP/RT]) is 1.0. As previously discussed, TS typicelly

allow one EDG to be unavailable for allowed outage times (AOTs) of up to 72 houis,

and in some cases with compensatory measures, up to 14 days. Table B-2 indica:es

the "delta CDF" is positive and indicates the risk reduction obtained from SBO rule

implementation has been fully offset. Figure B-3 shows this as a point estimate,

"EDG/WC," that is above the values before deregulation. Figure B-3 also shows the

corresponding CCDP of 3.OE-05 that was obtained by multiplying the 14/365 and the

CDF/RY for this case.

(4) Appendix B evaluated changes to the risks in Figure B-3 from: (a) recent

improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by

approximately 19 percent; (b) potentially shorter LOOP recovery times from

consideration of NRC data that assumes offsite power was available sooner than the

actual restoration time so as to reduce the risk by approximately 25 percent; (c) multiple

reactor trips (see Section 3.3.3.) that increase the risk by approximately 200-400

percent.

The NRC does not regulate the grid; however, the performance of offsite power is a major

factor for assessment of risk. As previously discussed the licensees are expected to assess

and manage the increase in the risk that may result from maintenance and outage activities;

NPPs should understand the condition of the grid before scheduling EDG, maintenance o,

AOTs.

B-10
APPENDIX C

LOOP AND SCRAM DATA FROM 1985-2001
Appendix C

LOOP and Scram Data From 1985-2001

The data in the tables below was obtained as follows:

The 1985-1996 LOOP data were obtained from NUREG/CR-5496, Evaluation of Loss of

Offsite Power Events at Nuclear Power Plants: 1980-1996," June 1998) and summarized in

Table C-2 through C-4.

The CCDP data was obtained from the NRC ASP database and summarized in Table C-1

through C-5.

The scram data in Table C-6 to include the number of reactor trips and number of critical hours

for 1985-1986 were obtained from NUREG-1272, "Report to the U.S. Nuclear Regulatory

Commission on Analysis and Evaluation of Operational Data-1 986," 1987. The same scram

data for 1987-2001 and summer were obtained from the NRC performance indicator data

maintained by INEL and SCSS.

Table C-1 LOOPs While At Power 1997-2001

LOOP LER Plant Event Recovery Time In Minutes CCDP Cause

Category Date

Actual - Assumed

Availability

NRC EPRI

Consequential 219/97-010 Oyster 08/01/97 90 E 90 4040 <E-06 heavy demand, 500 kV emergency OOS,

LOOP (as a Creek 1 transmission company 34.5 kV voltage

result of a regulator inoperable

reactor trip 247/99-015 Indian 08/31/99 612 444 720 2.8E-06 plant LTC Inoperable 11 months and planned

Point 2 grid operator response ineffective

LOOPs (with 275100-004 Diablo 05/15/00 1980 480 2014 <E-06 wildfire under 230 kV transmission lines

reactor trip) Canyon I .

265/01001 Quad Cities 08102/01 154 214 15 - lightning hit 345 kV line, :noise,' and

.__________ _________ switchyard relay

346/98-006 Davis 06/24/98 1560 1359 1383 5.4E-04 tornado hit 345 kV switchyard

Besse

443101-001 Seabrook 03/05/01 2236 43 0 - 345 kV switchyard bushing flashovers from

snow

456/98-003 Braidwood 09106198 688 528 528 <E-06 wind blew plant cable Into plant

transformer/lightning strike to transmission - ~~~line

289/97-007 Three Mile 06/19/97 90 90 90 9.6E-06 230 kV switchyard circuit breaker failure

IslandI

Non-Initiating 266/98-002 Point 01/08/98 600 - - <E-06 plant equipment failures

LOOPs (no Beach 1 . . . .

reactor trip) 454/98-017 Byron 1 08/04198 - 501 - . _ <E-06 errored plant recovery from lighting strike

I________ ____ ___ __ _______ ____ _ ________ I________ ______tripped 345 kV transm ission lines

Table C-1 developed from the review of LERs as found in SCSS.

'Lcensee estimate on the order of 2E-04.

C-1
Table C-2 Consequential LOOPS 1985-1996

LER No. Plant Event Date Recovery Time CCiP

in Minutes

237/90-002 Dresden 2 01/16/90 45E 3.4E.06

247/85-016 Indian Point 2 12112/85 20 5.8E-05

261/86-005 Robinson 01/28/86 100 3.OE-04

301/89-002 Point Beach 2 03/29/89 90 2.5E-04

311/86-007 Salem 2 08/26/86 1 E <E-06

395/89-012 Summer 07/11/89 130 1.5E.04

455/87-019 Bryon 2 01/16/90 1E 1.5ETable C-3 Grid-Related or Initiated LOOPs While At Power 1985-1996

LER No. Plant(s) Event Description Recovery Time CC:DP

Date in Minutes

219/92-005 Oyster Creek 05/18/89 Transmission line fault due to 6 7.1 -05

offsite fire

249/89-001 Dresden 03/25/89 Switchyard circuit breaker fault 45E 1.3E-05

251/85-011 Turkey Point 4 05/17/85 Multiple intense brush fires 125 3.8!-05

shorted out three transmission

lines almost simultaneously

271/91-009 Vermont Yankee 04/23/91 Switchyard human error during 277 2.9:--04

battery restoration and

communication delays between

plant and transmission entity

317/87-012 Calvert Cliffs 1 &2 07/23/87 Faults on a transmission line 118 4.81-04

from tree contact 118 4.8E- 04

327/92-027 Sequoyah 1 12131/92 Grid configuration heavily 95 1.8'_-04

Sequoyah 2 contributed to dual unit trip 95 11.8'--04

334/93-013 Beaver Valley 1 10/12193 Switchyard human error (HE) 15 5.5-05

Beaver Valley 2 caused dual unit trip 15 5.51-05

369/91-001 McGuire 02111/91 Switchyard human error while 40 2.61--04

testing circuit breaker

395/89-012 Summer 01/11/89 Grid instability 130 1.51-04

456/88-022 Braidwood 10/16/88 Transmission line potential 95 1.81--04

transformer failed at a remote

location

C-2
Table C-4 Plant Related LOOPs While At Power 1985-1996

LER Number Plant Event Date Recovery Time CCDP

In Minutes

029/91-000 Yankee-Rowe 06/15/91 24 6.1 E-04

206/85-017 San Onofre 1 11/21/85 4 9.4E-04

219/89-015 Oyster Creek 05/18/89 1 <E-06

237/85-034 Dresden 2 08/16/85 5 4.OE-05

255/87-024 Palisades 07/14/87 388 . 4.3E-04

261/92-017 Robinson 2 08/24/92 454 - 2.1 E-04

270/92-004 Oconee 2 10i19/92 57 2.1 E-04

293/93-022 Pilgrim 09/10/93 10 <E-06

301/89-002 Point Beach 2 03/29189 90E 2.5E-04

302/92-001 Crystal River 3 03127/92 20E 1.7E-05

304/91-002 Zion 2 03/21/91 60 2.1 E-04

309/88-006 Maine Yankee 08/13/88 14 1.2E-04

315/91-004 Cook 1 05/12/91 1E <E-06

323/88-008 Diablo Canyon 2 - 07/17/88 38 4.1 E-05

324/89-009 Brunswick 2 06/17/89 90E 3.6E-05

325/86-024 Brunswick 1 09/13/86 - 1 E <E-06

336/88-011 Millstone 2 10/25/88 19 <E-06

370/93-008-2 McGuire 12/27/93 96 9.3E-05

373/93-015 LaSalle 1 09/14/93 15E 1.3E-04

409/85-019 La Crosse 10/22/85 60 2.05E-05

412/87-036 Beaver Valley 2 11/17/87 4 1.7E-05

414/96-001 Catawba 2 02/06/96 330 2.1 E-03

443/91-008 Seabrook 06/27/91 20 4.4E-05

458/86-002 River Bend 01/01/86 46 7E-05

528/85-058 Palo Verde 1 10/03/85 25 3.4E-05

528/85-076 Palo Verde 2 10/07/85 13 3.4E-05

C-3
Table C-5 Weather Related LOOPS While At Power 1985-1996

LER Number Plant(s) Event Date Recovery Time in CCDP

Minutes

245/85-018 Millstone 1 09/27/85 21 E 3.5E-0!5

Millstone 2 09/27/85 330E 3.5E-0!5

250/92-000 Turkey Point 3 08/24/92 7950 1.6E-04

Turkey Point 4 08/24/92 7908 1.6E-04

282/96-012 Prairie Island 1 06/29/86 296 5.3E-05

Prairie Island 2 06/29/86 296 5.3E-05

293/91-024 Pilgrim 10/30/91 120 1.2E-04

293/93-004 Pilgrim 03/13/93 1 E 4.6E-0'S

Table C-6 Non-initiating LOOPs While At Power 1985-1996

LER Number Plant Event Date Recovery Time CCDP

In Minutes

220/90-023 Nine Mile Point 1 11/12/90 335 <E-06

220/93-007 Nine Mile Point 1 08/31/93 1 E <E-06

244/88-006 Ginna 07/16/88 65 <E-06

266/85-004 Point Beach 1 07/25/85 45E <E-06

311/94-007 Salem 2 04/11/94 385 <E-06

457/96-001 Braidwood 2 01/18/96 113 <E-06

529/89-001 Palo Verde 2 01/03/89 1138 4.9E05

C-4
Table C-7 Annual Scrams and Critical Reactor Years 1985-2001

Year Scrams Critical Reactor Years Scrams: May 1 to September 30

1985 552 59.44 210

1986 469 65.29 218

1987 404 70.24 177

1988 274 75.76 121

1989 244 76.04 96

1990 232 80.66 105

1991 196 83.94 87

1992 195 83.61 84

1993 162 82.90 59

1994 142 85.80 60

1995 154 88.84 75

1996 137 87.09 58

1997 84 79.93 32

1998 80 84.39 36

1999 95 90.73 54

2000 92 92.92 41

2001 90 93.96 38

Totals:

1985-1996 3161 792 1350

1997-2001 441 280 201

C-5
APPENDIX D

RESOLUTION OF COMMENTS
Appendix D

Resolution of Comments

A May 16, 2003, memorandum, Operating Experience Assessment- Effects of Grid Events on

Nuclear Power Plant Performance," was sent to several external stakeholders from

Farouk Eltawila, Director, Division of Systems Analysis and Regulatory Effectiveness, Office of

Nuclear Regulatory Research (Adams Package ML031360115). Identical letters were also

made publically available. The purpose of the May 16, 2003, memorandum was to obtain

comments regarding (1) the reasonableness of the approach used to assess grid reliability,

(2) the appropriateness of the conclusions, (3) and the need for additional sources of data that

could be used in the assessment. Letters with comments were received from Westinghouse,

the Nuclear Energy Institute (NEI), and the North American Electric Reliability Council (NERC).

Additionally, several internal comments were also received.

Each organization that provided comments is listed below, in order of the date received,

followed by a restatement of their comments verbatim and the resolution of each comment.

Italics were used to identify report text and bold italics to note revisions to the report.

Conforming changes were made throughout the report. Editorial comments were made but not

explicitly shown in the comment resolution.

D-1
D.1 Westinghouse Comment Resolution

Comments were received from Steven E. Farkas, Westinghouse, to William S. Raughley, NRC,

in a June 18, 2003, e-mail (ML033000272). We mailed suggested editorial comments in a

separate marked-up copy. The Westinghouse comments were numbered, restated verbatim,

followed by the resolution of each comment. Italics were used to identify report text and bold

italics to note revisions to the report. Conforming changes were made throughout the report.

Westinghouse also provided editorial comments that are not shown.

1. Comment, Page 2

now: The NPP offsite power system is the "preferred source' of ac electric power, often referred

to as the grid.

suggest: The word "preferred" is not accurate. Some plants are set up to draw their own

power when available, e.g., Waterford 3 SUTs vs. UATs and fast-transfer back to SUTs pon

trip.

Resolution: Revised to state: "The NPP offsite power system is the 'preferred source'

of ac electric power for all conditions, including accident or postaccident, and is

often referred to as the grid."

2. Comment, Page 3

now: The capacity and capability of the offsite power system are ensured through analyses

(discussed in Section 2.4).

suggest: The capacity and capability of the offsite power system are ensured through analyses

(discussed in Section 2.2).

Resolution: Revised to reflect the proper reference. In addition the sentence was

revised to state: "Grid operating entities typically perform analyses to determine

the requirements and limits that are used in the operation of the system to ensure

adequate levels of power, voltage, and frequency following a disturbance."

3. Comment, Page 3

now: ... electrical power to the essential and nonessential electric switchgear buses in an

NPP ...

suggest: ... electric power to the essential and nonessential switchgear in a NPP ... (switc-gear

is the equipment connected to the bus bars).

Resolution: No change required as the bus bars are an integral part of the switchgear.

D-2
4. Comment, Page 9

now: ... The grid design and operating configurations were established before the electric power

industry was deregulated to ensure the correct voltages on the grid and at NPPs.

suggest: ... The assumptions about both grid design and operating configurations that ensure

correct voltages on both the grid and at NPPs typically date from before the electric power

industry was deregulated.

Resolution: Revised as suggested.

5. Comment, Page 10

now: ... A follow up meeting was held on October 27, 2000 (Ref. 15) to discuss suggest: [The

sentence talks about meetings but does not refer to any conclusions or actions as a result of

them.]

Resolution: The text was revised: A followup meeting was held on October27, 2000

(Ref. 1) to discuss the status of NRC and industry grid reliability activities including the

Electric Power Research Institute (EPRI) Power Delivery Initiative for developing tools to

enhance grid reliability. The meeting resulted in actions to prepare for an industry

workshop, Grid Reliability Workshop" that took place in April, 2001.

6. Comment, Page 13

now: definitions for L, PL and I refer to "in the grid" whereas event T refers to "in the

transmission system"

suggest: [using the term "the grid' consistently]

Resolution: Revised to use "NPP switchyard and transmission network" rather

than grid in the 1, PL, and I definitions.

7. Comment, Page 14-15:

now: The "delta CDF" was obtained by subtracting the risk "BEFORE" deregulation from the

risks after deregulation. A negative delta CDF indicates the risks have decreased since

deregulation. A positive delta CDFs may offset the risk reduction obtained from SBO rule

implementation. Specifically a delta CDF of more than 0.6E-05/RY (the difference between the

risk reduction outcome and expectation from SBO rule implementation) and a delta CDF of

more than 3.2E-05/RY (the outcome from SBO rule implementation) partially and completely

offsets the risk reduction from SBO rule implementation, respectively.

suggest: [I've done PRAs for a while now and I'rn not even sure I know what the above

paragraph means. Here's my try.] The "delta-CDF" comes from subtracting the risk "BEFORE"

deregulation from the risks "AFTER" deregulation. A negative delta-CDF means risks have

gone down since deregulation. SBO rule implementation itself has caused delta-CDF to be

negative. A positive delta-CDF offsets both the benefits expected from SBO rule

implementation (0.6E-05/RY), and the actual risk reduction achieved with SBO rule

implementation (3.2E-05/RY).

,D-3
Resolution: 'The "delta CDF was obtained by subtracting the CDF "BEFORE"

deregulation from the CDF after deregulation. A negative delta-CDF means risk has

decreased since deregulation. SBO rule implementation itself resulted in a risk

reduction of 3.2E-05IRYprior to deregulation. Any positive delta CDFs since then

offsets the actual risk reduction obtained from SBO rule implementation."

8. Comment, Page 16

now: ... as a spike in the risk as "EDG/Avg" that is just above the risk before deregulaticn [no

period]

suggest: ... as a spike in the risk as "DG/Avg" that is just above the risk before deregulation.

[DG/Avg is the label used on Figure 1]

Resolution: Revised as suggested.

9. Comment, Page 18

now: ... group, which was dominated by grid and plant electrical weaknesses (see Section

3.3.2).

suggest: ... group, which was dominated by grid and plant electrical equipment weaknesses

(see Section 3.3.1)

Resolution: Revised as suggested.

10. Comment, Page 18

now: ... shows changes in the percent of LOOPs more than four hours and median recovery

times

suggest: ... shows changes in the percent of LOOPs lasting more than four hours and median

recovery times.

Resolution: Revised as suggested

11. Comment, Page 21

now: (3) Eight of the 10 R events took place in June, July, and August. Seven of the 1 0 events

were in the Northeast suggest: [the sentence does not consider the relative density of NPPs in

the Northeast. We need a good number for grid reliability" that, for the most part is not

dependent on the presence of a nuclear plant. For example, a power interruption to a large

fossil plant looks just like a LOOP at a nuclear plant in the process of estimating grid reliability.

We can assume that a grid disturbance that trips off any large electric generator should e

counted when trying to predict the frequency of LOOPs in a deregulated market.]

Resolution: Revised to state: "Eight of the 10 R events took place in June, July, and

August. Seven of the 10 events were in the Northeast (Maryland, New York, Neiv

Jersey, Pennsylvania, and Vermont where there are a total of 20 NPPs)."

D-4
12. Comment, Page 34 A

now: 10. U.S. Nuclear Regulatory Commission, The Effects of Deregulation ...

suggest: 10. U.S. Nuclear Regulatory Commission, SECY 99-129, "The Effects of

Deregulation

Resolution: The references were revised to include both SECY-99-129 and the paper.

13. Comment Appendix A, Item 38

now: type R

suggest: type S [work was in the switchyard providing power to RCPs]

Resolution: No change required. Observation is correct however that the event meets

the definition of an R event as the opening of 500kv circuit breakers resulted in a reactor

trip and a partial LOOP on 2 NPPs at one site. Had there not been a partial LOOP the

event would have been an S event. -

14. Comment Appendix A, Item 60

now: type R

suggest: type S [generator at issue is the one for the plant]

Resolution: No change required. Observation is correct however that the event meets

the definition of an R event as the opening of a 230kV circuit breaker disconnect switch

resulted in a reactor trip and a partial LOOP. Had there not been a partial LOOP the

event would hav6 been an S event.

15. Comment Appendix A, Item 76

now: type T

suggest: type S [transformer protective circuit wiring is at the plant, not remote]

Resolution: Revised as suggested.

16. Comment Appendix A, Item 79 and 80

now: Item 79 refers to 525kV for 2.5 minutes as an administrative limit. Item 80 refers to a

524kV for 10 seconds administrative limit.

suggest: revisit why these two administrative limits are different for the same plant, PVNGS-1

- 25Febl 999 vs. 29Jul1 999

Resolution: Both were reworded to state "the voltage dropped below the

administrative limits for a short time." Palo Verde administrative limits vary as they

are predetermined based on a formula that reflects their operating status.

D-5
17. Comment Appendix A Item 83

now: no type given

suggest: type I [eye]

Resolution: Revised as suggested.

18. Comment, Table Al and Table Cl

now: no apparent relationship between the events cited in Appendix A (and

summarized on Table Al) with the counts shown on Table Cl

suggest: [using the knowledge from Appendix A to calculate initiating event

frequencies in Appendix C]

Resolution: No change required. Table Al is a summary of the grid events that

affected NPP performance from 1994-2001 as defined in Appendix A and the

assessment, and contains LOOPs where the grid played a major role but not other types

of LOOPs. Table C-1 is a summary of all of the LOOPs since 1997, of which four are in

Appendix A. The other LOOPs in table C-1 are weather related LOOPs and one plant

LOOP.

19. Cost Comment Page ix

now: ... should include: (a) assessment of offsite power system reliability ...

suggest: [this is a notoriously complex calculation that requires real time

data from the grid operator]

Resolution: No change required. "The report states: Regarding (a) above, the

assessment of the power system reliability and risks from plant activities can be better

managed though coordination of EDG tests and outages with transmission system

operating conditions."

Regarding the data the executive summary states: "Recent experience shows that

actual grid parameters may be worse than those assumed in electrical analyses due to

transmission system loading, equipment out-of-service, lower than expected grid

reactive capabilities, and lower grid operating voltage limits and action levels. NP!'

design basis electrical analyses used to determine plant voltages should use electrical

parameters based on realistic estimates of the impact of those conditions."

20. Comment

Westinghouse provided several editorial suggestions that are not shown. In a telephone

conversation with W. Raughley, it was agreed that it would suffice that Westinghouse woLId

send a marked-up copy rather than take the time to write them out.

Resolution: With minor exceptions the report was revised to reflect the editorial suggestions.

D-6
D.2 Nuclear Energy Institute Comment Resolution

The comments below were provided in a letter (ML032060007) dated July 23, 2003, from

Alexander Marion, Nuclear Energy Institute, Director, Engineering Nuclear Generation Division

to Farouk Eltawila, Nuclear Regulatory Commission (NRC), Director-Division of System

Analysis and Regulatory Effectiveness, Office of Nuclear Regulatory Research. The NEI letter

paragraphs were numbered, restated verbatim, followed by the resolution of each comment.

Italics were used to identify report text and bold italics to note revisions to the report.

Conforming changes were made throughout the report.

1. Comment

We appreciate the opportunity to review and comment on the subject report. It appears the

principle objectives of the NRC assessment of losses of offsite power (LOOP) are twofold:

1. to determine the extent to which nuclear power plant (NPP) trips are causing

losses of offsite power (LOOP) and conversely, the extent to which LOOP are

causing plant trips; and

2. to determine the extent to which deregulation in the electric power industry is

impacting plant trips and LOOP.

Resolution: The principal objectives stated in Section 1, "Introduction," were clarified

as follows: "The Nuclear Regulatory Commission (NRC) Office of Nuclear Regulatory

Research (RES) completed the work described in this report to identify and provide an

assessment of grid events and LOOPs at NPPs before deregulation (1985-1996) and

after deregulation (1997-2001). The objectives of the work were to use accumulated

operating experience from various sources to identify and assess (1) the numbers,

types, and causes of these events, (2) potential risk-significant issues (3) potential

challenges to the effectiveness of the NRC regulations, and (4) lessons learned. This

assessment is intended to identify changes to grid performance relative to NPPs which

could impact safety. The assessment also provides simplified numerical measures to

characterize grid performance before and after deregulation - in particular, those related

to loss of offsite power (LOOP). The information gathered provides a perfornance

baseline to gauge changes in grid operation by operating in a deregulated

environment."

2. Comment

The assessment focused on two distinct periods of time: before deregulation

(1985-1996) and after deregulation (1997-2001). Although we recognize the merits of

periodically conducting such assessments of transmission grid performance and

associated impacts on nuclear power plant performance, it is imperative that such

assessments apply recognized methodologies and statistically valid bases especially

when making conclusions. The conclusions in the report offer no direct insights on the

impact of deregulation on LOOP or nuclear power plant performance. No data is

provided to identify which events included in the study occurred at plants, switchyards or

transmission grids that were subject to deregulation. Not all power generation and

D-7
transmission systems were deregulated in 1997 and clearly not all of these systems are

subject to deregulation today. Furthermore, not all electric utilities have decentralized in

divesting transmission services. Any conclusion regarding the impact of deregulation

cannot be substantiated without this important information.

Resolution: See resolution of comments 3 and 4 regarding the methodologies and

statistically valid bases.

Since the mid-1 996 all states and NPPs, regardless of their restructuring status, have

been exposed to revised power flows from open generator access to the transmission

system, (i.e., the grid has a direct impact on NPP even though some power generation

and transmission systems are not subject to restructuring today). Consequently, all of

the data since 1997 is in a deregulated environment and the final data analyses provide

direct insights in terms of changes in grid performance and NPP risk from operation in a

deregulated environment.

Operating experience supports that a NPP in a state that has not deregulated can be

affected by deregulation. As an example, in event 74 of the report the NPP was in a

state that had not restructured (the NPP is in Missouri and the DOE Web site mentioned

in the report indicates Missouri has not deregulated) however, the licensee found that

their failure to properly consider the impacts of deregulation (i.e., heavy grid loading

coupled with the loss of voltage support from the NPP generator) resulted in lower than

expected NPP safety bus voltage. As corrective action, the NPP made major

modifications and formalized its relationship with the grid operator even though it wias in

a state that had not restructured.

Section 2.4 of the report discusses deregulation in terms of: (1) formation of wholesale

generators by restructuring of the utility into separate transmission and generating

companies and (2) open access transmission. The report indicates that the utilities

divested their generating assets, not their transmission services as stated in the

comment. The report states that about 50 percent of the states have restructured, 50

percent either have not restructured or have no plans to restructure, and referenced a

Web site that provides the status and history of state deregulation initiatives. Accc rding

to the referenced Web site, 9 of the 10 LOOPs since 1997 are in states that have

deregulated, and one is in a state California that has deregulation on hold. Section 2.4

was revised to better summarize these effects as follows:

"In 1992, the National Energy Policy Act (NEPA) encouraged competition in the electric

power industry. NEPA requires, in part, open generator access to the transmission

system and statutory reforms to encourage the formation of wholesale generators. The

electric industry began deregulating after the April, 1996 issuance of FERC Order 688,

"Promoting Wholesale Competition Through Open Access Non-discriminatory

Transmission Services by Public Utilities, Recovery of Stranded Costs by Public Ulifities

and Transmitting Utilities,' which requires that utility and nonutility generators have open

access to the electric power transmission system."

"Prior to deregulation of the electrical system, NRC licensees were both electrical

generators and transmission system operators. With economic deregulation, NRC

D-8
licensees no longer control the transmission system - typically, generation and

transmission are separate corporations. Wholesale generators resulted mostly from

State legislation that remove the generators from the regulated rate base so as to

allow them to compete for the sale of power in an open market. Utilities also

divested the generating assets; typically the switchyard remained part of the

transmission company. As a result of these changes there are more entities involved

in grid recovery that must be coordinated following any disturbance. A detailed state-bystate status is available on a Department of Energy (DOE) Web site and shows about

50 percent of the state utility regulatory commissions have orplan to deregulate, and 50

percent have no plans to deregulate or have put deregulation on hold."

"Initial licensing of NPPs included analyses of electrical system performance with certain

contingencies to assure reliable offsite power. Open access transmission generally

results in changes to the grid design and operation that could challenge operating

limits and grid reliability. The power market results in power transactions and

transmission of electricity over longer distances. Predicting the voltages and

current paths requires analyses of the conditions being experienced and these analyses

may no longer be valid. Grid operating entities and NPPs not involved in the power

transaction may see their operation affected by unexpected power flows. Regardless

of their restructuring status or participation in the power market, all states and

NPPs are exposed to design and operating challenges from the revised power

flows due to open transmission line access."

Comment

The report acknowledges a deviation from past studies in the' methodology for

characterizing grid events. The methodology combines plant-centered events and

switchyard events into the grid event category even though the initiating element was

not at the grid. For example, in many of the events treated in this manner, plant

electrical equipment is considered part of the transmission'grid rather than the plant. As

an example, refer to event numbers 16, 21, 22, 36, 51, 55, 60, and 62. Similarly, other

events whose cause was attributed to a malfunction in the plant switchyard are

categorized as grid events. We believe that such characterization of events will skew

the results and lead to incorrect conclusions. We believe that an event should not be

considered as grid initiated, if the initiating device, system, etc. would not exist if the

plant did not exist.

Resolution: For the purposes of our assessment of grid performance, the grid as

well as the plant, play major roles as evidenced in several events. Up to now, the focus

has been on the plant aspects of these events; this study investigates grid aspects of

these events. Section 3.0 explains the potential grid and risk aspects of LOOPs as a

result of a reactor trip. In addition, Appendix A defines the grid to start at the main and

station power transformer high voltage terminals and divides the grid into "S" -

switchyard events and T' - transmission system events, noting that this is the typical

boundary line between the NPP and the transmission entity.

The S and T events are reactor trips, not LOOPs, where the first sequence of events

leading to the trip was either in the switchyard or transmission system respectively;

D-9
subsequent sequence in the event involved the plant. The S (such as events 21, ,;6, 51,

and 55) and T events, and R events that were partial LOOPs (such as 22, 60, 62 ) were

not used in the data or risk analyses so the results are not skewed. Many of the events

noted in the comment involve the high voltage generator output circuit breakers in the

NPP switchyard. In practice, the transmission entity owns, tests, maintains, and assures

the operability of the equipment and the NPP only has a switch in the control room to

open and close the circuit breaker after coordinating with the load dispatcher.

The industry's proposed definition would eliminate many of the R, S, and T events in

Appendix A. Multiple perspectives, whether they be plant and grid, should encourage

the industry to take actions to prevent recurrence so as to minimize their impact on the

NPPs and risk to the public. At the current rate of these events and reactor trips, this

action could eliminate approximately 50 reactor trips, substantially reduce the overall

risk. A reactor trip challenges the plant and safety systems. Reducing the number of

trips will result in overall safety benefits. Section 3.2.2 was revised to state:

"The Table 1 R, S, and T events show approximately 50 grid initiated or related

reactor trips. Actions to prevent recurrence appear to be justified as there are

risk benefits from a reduction In the number of trips.

Section 3.1 was revised to explain methodology in the text (as already explained in

Appendix A) and further acknowledge other views as indicated below. After the

paragraph that starts with "To be consistent with... "the following was added.

"For the purposes of this study a line of demarcation was drawn between the

plant and the grid at the NPP main and station power transformer high-voltage

terminals. The grid was defined to Include: (a) the high- voltage switchyard or

substation nearest the NPP which is typically under the control of the

transmission organization, (b) the transmission and generation system beyond

the switchyard or substation, and (c) the protective relaying and control circuits

of the switchyard and transmission system which are often located inside ths

NPP. The boundary between the NPP and the grid was based on typical

organizational responsibility for equipment design, maintenance, and operational

control. In a deregulated environment this boundary Is typically the boundary

between the regulated transmission system company and the deregulated nuclear

generating company.

After the paragraph that starts with "R events are losses ....... "the following was added.

The S and T events described in Appendix A are reactor trips having major

switchyard or transmission network involvement, and were not used in the risk

analyses since they did not result in a LOOP. Past NRC studies typically velved

S and T as plant centered events due to the major role the plant played in the

event, e.g., turbine trips.

Lastly, Event 16, a LOOP as a consequence of a reactor trip, was the only event of the

ones mentioned that was used in the risk and data analyses. Event 16 was an R event

and the Appendix A event description will be revised to describe the grid problem. Also

D-1 0
Section 3.2.1 of the report will be revised to use the information from Event 16 (and

Event 3) to demonstrate that the probability of a LOOP given a reactor trip may, on an

individual plant bases, be more than we've estimated in the risk analyses. The Event 16

information includes:- (1) that licensee voltage analyses of a LOOP, as with reactor trip,

credits operation of the plant transformer automatic load tap change (LTC) and grid

operator action to raise voltage at the NPP using the upstream transformer LTC and

(2) that the plant automatic LTC had been inoperable for 11 months and normal

operating practice in such cases is to notify the grid operator so he can maintain the

required voltage until the LTC is repaired. Also the LTC was stuck on a lower tap, about

3 percent below where it is expected to be during normal power operation. This would

essentially raise the minimum required 138kV offsite power supply voltage from

98.5 percent to approximately 101.5 percent. As the 138kV would most likely be

operated below 101.5 percent a considerable percentage of the time, the probability of a

LOOP given a reactor trip was most likely quite high (approaching 1.0), a considerable

portion of the 11 months that the LTC was inoperable. Had the grid operator known

about the inoperable LTC, he could have compensated by keeping the voltage around

101.5 percent.

4. Comment

Of particular concern is the treatment of emergency diesel generator (EDG) starts and

load runs. The report treats the EDG actuation as a LOOP and that LOOP duration is

predicated on how long the EDG operated rather than how long offsite power was

unavailable. The Electric Power Research Institute (EPRI) conducts annual

assessments of losses of offsite power.' A recent update included all events through

2002. We believe this would be a useful reference for NRC consideration. In preparing

its annual loss offsite power update, EPRI determines how long offsite power is truly

unavailable for each loss of offsite power event. In many events, backup offsite power

is available but is not needed and not used. For example, at most plants, following the

loss of offsite power to the safeguard buses, it is the plant management's decision to

power these buses from the EDGs, even though a totally acceptable option would be to

transfer to an available altermate offsite source. If powering these buses from the EDGs

is the selected first choice, it is often possible to transfer the safety buses quickly from

normal or backup offsite power if necessary. However, plant management frequently

finds it more prudent to stay on the EDGs for a time and pursue more urgent tasks such

as stabilizing plant systems. -

Resolution: The short recovery times using NRC and EPRI data were shown in

Appendix C and the report was revised as'stated in-the resolution to NEI comment 7.

The NRC data is used when' predeterrhined criteria were satisfied. We reviewed and

referenced the EPRI 2001' report and the EPRI 2002 report that is a supplement to the

2001 report, in our study as'suggested. In addition, we compared the NRC and EPRI

LOOP durations for-events from 1990--2001 lasting longer than one hour (events

highlighted in ERPI report, Table'2-7) involving a reactor trip. The comparison found 6

events where' the NRC estimated longer durations than ERPI, four events where the

EPRI durations were'longer than the NRC, and six events where the NRC and EPRI

durations were the same. Essentially, the NRC and EPRI'data had little impact as

shown in the table below.

-D-11
Percentage of LOOPs trip>4 hours

All year Summer

Before After Before After

LOOPs with a NRC -original 17 66 29 66

reactor trip EPRI data based 15 50 29 57

on power

availability

Appendix B was revised to state

The actual time power was restored was used in the analysis. The time that

power could have been restored by determining it was available and assuming it

was reliable, was also considered. These times are shown in Appendix C,

Table C-1. As the data indicates this reduces the percentage of LOOPs more than

four hours from 66 percent to 50 percent and as indicated at the end of App.andix

B lowers the risk approximately 25 percent and will not change the order of

magnitude of the risks in Figure B1.

The actual time power was restored could be considered overly conservative

considering that the operators may have restored power sooner under SBO

conditions. During the LOOP the NPP may have found it more prudent to stay on

the EDGs for a time to pursue more urgent tasks such as stabilizing plant

systems. On then other hand, the time power could have been made available

may be optimistic as it relies on the assumption that offsite power was also

reliable (would have worked).

Recovery from SBO event, like a LOOP, will be specific to the event and

circumstances and there likely to be a broad spectrum of responses. Like the

LOOP experience, during an SBO urgent operating tasks are also likely

(e.g., maintaining the reactor water inventory via connection of alternate water

supplies or minimizing battery load). During an SBO it is imperative that the NPP

establish that offsite power both truly available and reliable, and expeditiou.;ly

obtain these assurances.

Event 69 provides additional insights into how offsite power is actually restored.

In this case it took 8 hours and under actual conditions would most likely have

been done sooner. In event 69, lightning caused a 345kV transmission line fault

that opened tvo 345kV circuit breakers at the NPP and two at the remote end of

the transmission line, but had no effect on the NPP. The event progressed to a

LOOP at 100 percent power when a 345 kV circuit breaker supplying offsite power

to the NPP opened upon reclosure of one of the two NPP 345 kV circuit breakers

due to failure a 345 kV transmission line relay failure to reset, an inadequate NPP

345 kV switchyard alarm response procedure, and improper 345 kV circuit breaker

synchronization timing. At this point in the event both EDGs started and loaded.

D-12
The load dispatcher reclosed the remote circuit breakers shortly after the LOOP

occurred. However, the power restoration activities actually took 8 hours for

coordination with the Nuclear Analysis OperationalDppartment, walkdowns,

resetting relays, and visual inspection.

5. Comment

The report indicates that the number of LOOP events is decreasing, but the median

duration is increasing. Although this statement is true, it can be misleading as well.

There have only been 4 long LOOP events since the beginning of 1998. Two

weather-related events occurred in 1998, one lasted 8:28 hours and one lasted 23:03

hours. There was a non-weather related LOOP in 1999 that lasted 12:00 hours and a

non-weather related LOOP in 2000 which lasted 33:34 hours. What has changed is the

frequency of plant-centered short duration LOOP, such that the total LOOP frequency

for a 5-year moving average has decreased from 0.056 LOOP per generating unit year

in 1993 to 0.0014 LOOP per generating unit year in 2002. This decrease is explained

by the fact that during the years 1998-2002 there have been only 7 losses of all offsite

power: 5 of these lasted longer than 4 hours, and 4 longer than 8 hours. The more

robust grids and switchyards reduced the incidents of minor, short duration LOOPS.

What remains are the LOOP events associated with weather and major equipment

failures.

The fact remains that the number of short, plant centered LOOPs has gone down

substantially, not that the number-of longer duration LOOP has increased. Obviously if

the frequency of short duration LOOP decreases, the median LOOP duration increases.

This report should include a more comprehensive discussion of such statistics.

Resolution: The report concludes that the LOOP/reactor year has been decreasing so

our observations regarding LOOP frequency are fundamentally the same as the

industry. The report concludes:

"The assessment found that major changes related to LOOPs after deregulation

compared to before include the following: (1) the frequency of LOOP events at NPPs

has decreased,..."

The report simply does not say that the number of LOOP events is decreasing, but the

median duration is increasing;" this is NEI's statement. The discussion of the median

was limited to comparisons of the' medians in this study to those in previous NRC

studies which used the medians as th6 recovery time measure.

The reports conclusion was revised to address'NEI's observation that the number of

short, plant centered LOOPs has gone down substantially asfollows.'

"While the data set is small, the number, types, and duration of LOOPs have

changed since 1997. Recent experience indicates that there are fewer LOOPs.

Whereas most of the 1985-1996 LOOPs were of short duration and plantcentered, the most of the recent LOOPs are longer and had major grid

involvement from the reactor trip, severe weather or lightning that affected the

D-13
NPP switchyard and transmission lines, or NPP switchyard equipment failures.

Further, based on historical data, power restoration times following a LOOP were

generally less than 4 hours; more recent LOOPs have lasted significantly longer. Also,

recent grid events, although not directly associated with LOOPs, indicate that grid

recovery times may be longer....."

Also the supporting discussion of the LOOP duration will be revised to state:

"While the data set is small, the nature of the numbers, duration, and types of the

LOOPs have changed since 1997. Table 2 above the number of LOOPs has

decreased from .05/RYin 1985-1996 to 0.014/RYafter 1997. Based on historical

data, power restoration times following a LOOP were generally less than 4 ours.

Table 2 shows the percent of LOOPs lasting more than four hours has increased

from 15 percent (six weather related and one was plant centered) in 1985-1996 to

67 percent after 1997. The 1985-1996 data is dominated by short plant centered

LOOPs (median 20 minutes) whereas now there is a general absence of the short

duration plant centered LOOPs and longer duration LOOPs involving the gild now

dominate the frequency. Nine of the ten LOOPs since 1997 involved the grid or

severe weather that affected grid and included: two severe weather events

affecting the NPP switchyard, three events Involving lightning strikes to the

transmission lines, one wildfire involving schedule burning of brush under

transmission lines, one event due to a 230kV switchyard circuit breaker failure,

one event involving heavy power system demand and transmission company

equipment out of service, and one involving the lack of communication between

the NPP and the grid operator."

"Further analyses of the data in Appendix C found the median LOOP recovery

time increased from 60 minutes before 1997 to approximately 688 minutes vfter

1997. As anotherperspective, Appendix C, Table C-1 shows NRC data that

assumed offsite power was available before it was actually connected to one

safety bus; this data shows 50 percent of the eight LOOPs involving a reactor trip

lasted more than four hours and the median LOOP recovery time was estimated

to be 326 minutes."

6. Comment

We are also concerned with the treatment of the probability of a LOOP as a

consequence of a reactor trip. The report contains a number of generalized conclusions

that are based upon questionable statistical techniques; for example, it states that the

probability of a LOOP given a trip has increased by a factor of 5 (from 0.002 to 0.')1).

The actual analysis in the report suggests that the overall probability has increased from

0.002 to 0.0045, a factor of 2.250. However, this is based upon 2 post-deregulatiDn

events. Statistically, it is not appropriate to draw conclusions from such a small sample

size. According to the event descriptions, one of the two events was actually an

operational problem that does not appear to be related to deregulation or grid

conditions. Thus, with only one event, the probability is essentially unchanged (0.002 to

0.0023). The factor of 5 appears to be based upon an unspecified culling of the cata

that is restricted to summer operations. This undermines the validity of the statistics.

D-14
Resolution: The treatment of the probability-of a LOOP as a consequence of a reactor

trip is reasonable arid technically sound. Our methods have detected changes that

potentially impact NPP operability and are masked by normal PRA methodology.

Our conclusions reflect that licensees should understand the condition of the grid to

properly assess the risk. Electrical engineering analyses can establish whether a unit

trip does or does not cause a LOOP. It is normal practice to consider that these

analyses consider realistic contingencies such as equipment failure or human error.

Use of proven plant specific electrical analyses to understand the risk appears to be

both pragmatically, technically, and economically superior to debates over individual

statistical preferences and interpretation of results.

To elaborate about the reasonableness of our methods, most PRA models have

screened out LOOPs as a consequence of a reactor trip due to their low frequency; it is

appropriate to periodically validate this assumption. In addition, the assessment shows

the probability of a LOOP as a consequence of a reactor trip has increased from 0.002

before deregulation to 0.0045 after deregulation when all of the data is considered, and

from 0.002 before deregulation to 0.01 after deregulation if the 1997-2001 summer data

is considered. Observing major changes in the data and risk due to summer operation,

May-September, and concluding that simple steps need to be taken to avoid the risks,

is a responsible departure from normal PRA methodology that is in the best interest of

the public rather than unspecified culling of the data. Inclusion of Event 16 in the risk

assessment is appropriate as it was a LOOP that occurred in the time period being

considered; whether it was grid related or no makes not difference (As mentioned

previously the report was revised to detail the grid aspects of Event 16.)

As shown below the sample size provides an adequate statistical basis as follows:

(1 ) The 2001 reversion of the EPRI report referenced in Comment 4 indicates five years

of data is enough; the EPRI report states 'Table 2-4 shows the loss of off-site power

experience for the most recent 5 years (1997-2001). The experience during an interval

such as the past 5 years is especially meaningful." The EPRI report goes on to note

that in the past (before 2001) a 3 year interval was used.

(2) NUREG-1 475, Applying Statistics," Table 21-3 indicates that the 2 post-deregulation

LOOPs 1997-2001 as a consequence of a 201 reactor trips meet a 95/95 statistical

criterion. NUREG-1475 indicates that this is very high quality data and validates the

EPRI observation that the 5 years of data is especially meaningful.

(3) Other ways used to assess the data include Bayes analysis using a Jeff erys

noninformative prior that indicates the mean is 0.0124 with a lower bound of .00286 and

an upper bound of 0.0273. In addition, classical statistical analysis with a 90 percent

D-15
confidence interval and maximum likelihood estimate would indicate that the mean is

0.00995 with a lower bound of .00177 and an upper bound of 0.0310.

Statistically, it appears that regardless of the statistical method 0.01 a valid result. Also

0.01 is in the lower part of the boundary interval, consequently the risks in Figure 1 may

be low.

7. Comment

Lastly, we believe these concerns must be addressed in order for this report to provide

useful and valid information relative to the impact of grid events attributed to

deregulation. There are a number of assumptions and concluding statements mad in

the report that are derived from the methods for which we have expressed concerns as

noted above.

Resolution 7: The concerns have been addresses as stated above. Notwithstanding

that the assessment benefitted from revisions as a result of the industry's comments,

our data analyses, risk evaluation, and the report conclusions are essentially the same.

Regardless of the statistical analysis there are lessons learned that can benefit the

industry. Table 2 summarizes the risk discussion and indicates that in the summer the

risk reductions obtained from SBO rule implementation have been offset by these

statistics. The report also evaluates these statistics in the context of not achieving the

regulatory expectations.

Section 3.2.1 was revised to summarized the changes in the risk from the NEI

comments and those already stated in the report prior to the comment as follows:

"Appendix B evaluated changes to the risks in Figure 1 from: (a) recent

improvements in EDG unreliability from 0.0033 to 0.0027 that reduced the risk by

approximately 19 percent; (b) potentially shorter LOOP recovery times from

consideration of NRC data that assumes offsite power was available sooner than

the actual restoration time so as to reduce the risk by approximately 25 percent;

(c) multiple reactor trips (see Section 3.3.3.) that increase the risk by

approximately 200-400 percent; and (d) as stated in Appendix B, potentially low

CCDPs assumed in the recovery following the loss of all EDGs, and loss of ill

EDGs and failure to recover in four hours, that could increase the risk by a factor

of more than 200 percent. Collectively these factors indicate the risks in Figure 1

could be low."

8. Comment

We would be pleased to meet with NRC staff to discuss this report in further detail. In

addition, we request that the staff consider a collaborative effort with industry to ccnduct

an improved assessment on the relationship between deregulation, grid events and

nuclear power plant safety. I will contact you to schedule a meeting.

Resolution 8: No revision required.

D-16
D.3 North American Electric Reliability Council Comment Resolution

The comments below were provided in a letter (ML032060020) dated July 23, 2003, from

David R. Nevius, Senior Vice President, North American Electric Reliability Council (NERC), to

Farouk Eltawila, Director, Division of Systems Analysis and Regulatory Effectiveness, Office of

Nuclear Regulatory Research. The NERC letter paragraphs were numbered, restated

verbatim, followed by the resolution of each comment. Italics were used to identify report text

and bold italics to note revisions to the report. Conforming changes were made throughout the

report. NERC also provided editorial comments that are not shown.

1. Comment

Thank you for giving the North American Electric Reliability Council (NERC) the

opportunity to review and provide comments on your report, "Operating Experience

Assessment - Effects of Grid Events on Nuclear Power Plant Performance," April 29,

2003.

Resolution: No response required.

2. Comment

To answer directly the questions posed in your May 16, 2003, letter, NERC believes that

the approach taken in the report is reasonable and that the conclusions reached are

appropriate. As far as additional sources of "data" are concerned, we think the best

source of useful information on grid performance relative to NPPs continues to be faceto-face discussions with and among grid operators, NPP licensees, and industry groups

such as NERC.

Resolution: The Foreword identifies possible uses of the report.

3. Comment

NERC is pleased to see that the Commission recognizes in its report the important

interdependencies between the operation of the grid and the safe and reliable operation

of NPPs. It is essential that the Commission continue to work with licensees, grid

operators, and industry organizations, including NERC, to improve this understanding

and to facilitate more joint analyses of actual and potential grid operating conditions on

NPPs and vice versa. This is especially true in the area of grid voltage support and the

impact of voltage degradations on NPPs. in some cases, grid operators may not be

fully aware of the more restrictive bus voltage limits at NPPs, the condition of the grid

before the NPP takes its EDGs out of service for maintenance, or the pre-trip voltages

necessary for safe shutdown of the NPPs. These were evident from the discussion in

the report. In addition, the 1999 events in PJM, which are described on page 26 of your

report indicate that the Commission is well aware of the Transmission Control

Agreements in place between the California Independent System Operator and nuclear

licensees in that area. A key area for the Commission to explore is whether comparable

agreements are in place in other parts of the country between grid operators and NPPs,

D-17
and if grid operators are aware of the more restrictive grid voltage limits that NPPs

require.

Resolution: The Foreword identifies possible uses of the report.

4. Comment

Another point in your report that deserves mention is the identified loss of 4,340 MVAR

of generator reactive capability that accompanied the 1,200 MW increase in electr c

output. In some cases, this loss of reactive capability could have a significant effec.t on

the ability of the grid operator to maintain adequate voltages on the grid. An increase in

real power output at NPPs is certainly desirable, but not if it comes at the expense of

increased risk of inadequate grid voltages. Some further investigation of this issue

seems warranted by licensees and their respective grid operators.

Resolution: The Foreword identifies possible uses of the report.

5. Comment

There is no doubt that the interconnected grids, and the generators connected to them,

which serve North America are being operated and used somewhat differently today

than when the electricity industry was vertically integrated. However, there is no reason

this change in industry structure should adversely affect either the reliability of the grid

or the safe and reliable operation of NPPs. The events that were cited and analyzed in

your report provide a wealth of information and "lessons learned" that should be taken

seriously and acted upon by the Commission, licensees, and grid operators, both

individually and collectively.

Resolution: The Foreword of the report will acknowledge this comment.

6. Comment

Please let me know if you have any questions about these comments, or if NERC can

assist the Commission in any way in pursuing the "lessons learned" identified in your

report.

Resolution: No change required.

7. Comment

I have already spoken with Bill Raughley of your staff regarding several minor technical

comments on the report, which I have not repeated here.

Resolution: The report was revised as NERC suggested.

D-18
D.4 Other Comments

The internal comments below were provided informally on July 31, 2003, from the Division of

Risk and Reliability Assessm6fit o W.S. Raughley. :

1. Comment

Grid reliability conclusions do not appear to be supported by data. The observed

events/failures cited in the report are site related failures (switchyard or switchgear

failures) and not grid/network-related failures. Our data does not show any grid-related

loss of offsite power events during the 1997-2001 period.

Resolution: The conclusions are fully supported by data. The classification of events

is different than the past as explained in Section 3.1 of the report. Also see the

response to NEI Comment 3.

2. Comment

The risk analysis in the report should take into account more than just the frequency of

LOSP events. Factors such as EDG reliabilities (which has improved substantially over

the last 10 years) should be taken into account. We also believe that the risk analysis

should be peer reviewed.

Resolution: The risk assessment already takes into the primary SBO risk factors to

include EDG reliability, as clearly explained in Appendix B pages B-1 though B-9. The

concept was to measure the grid so we kept the EDG reliability constant and used a

two-train EDG system failure rate of 0.0033 based on 1987-1993 EDG data. DRAA

advised that the corresponding value is 0.0027 based on 1997-2002 data.

Consideration of the 1997-2001 data made only a very small difference in the EDG

reliability-see the resolution to NEI Comment 7.

The risk analyses was peer reviewed by DRAA in December 2002. At that time the

major comment was that the CCDPs assumed for recovery from a LOOP with all EDGs

failed and after failure to recovery in four hours was low; the comment was noted in our

Appendix B.

3. Comment

We agree that data shows that the average duration for LOSP events to be longer

during the 1997-2001 period. However, the durations for some events appear to be

overstated in the report.

Resolution: See resolution to NEI comment 4. DRAA LOOP recovery data was also

added to Appendix C, Table C-1. In addition DRRA and DSARE reconciled our LOOP

data in June 2003. In the end, this made only a small difference in the risk.

D-19
4. Comment

Comparison of LOSP events data between the before and after deregulation time

periods may not be straight forward because of the number of events involved and the

differences in the grouping of events.

Resolution: These risks were assessed in Section 3.2 by comparing the risks from all

LOOP events before and after deregulation on an equal basis using Appendix B, "Event

Trees," and actual operating data which were gathered in Appendix C, "LOOP and

Scram Data, 1985-2001." See resolution to NEI comment 6 and 7.

D-20
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER

(2489) (Assigned by NRC. Add Vol.. Supp., Rev., NRCM 1102, B DATA SHEET and Addendum Numbers, if any.)

3201,3202 BIBLIOGflIXRPHIC AA HE

(See instnuctions on the reverse)

2. TITLE AND SUBTITLE NUREG-1784

Operating Experience Assessment -

Effects of Grid Events on Nuclear Power Plant Performance 3._ DATEREPORTPUBLISHED

MONTH YEAR

12 2003

4. FIN OR GRANT NUMBER

5. AUTHOR(S) 6. TYPE OF REPORT

W.S. Raughley, G. F. Lanik

7. PERIOD COVERED (Inclusive Dates)

1985 --- 2001

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (ftNRC. provide Diision. OfficeorRegion, U.S. NuclearRegulatoryCommission. andmailingeddress:Ifcontractor. provide name and mailing address.)

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington. D.C. 20555-0001

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (IfNRC. type 'Sarne as above;M contractor. provide NRC Division. Oflice orRegion. U.S. NuclearRegulatoryComnission.

and mailing address)

Same as above

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 words orless)

Deregulation of the electrical industry has resulted In major changes to the structure of the industry over the past few years.

Whereas before, electric utilities produced the electricity and operated the transmission and distribution system, that is no longer

the case. In many states, the electric utilities have split Into separate generating companies, and transmission and distribution

companies. Most nuclear power plant (NPP) operators no longer have control of the transmission and distribution system

operations. NPPs rely on outside entities to maintain adequate reactive and voltage support for NPP operation. An assessment

was completed by the Office of Nuclear Regulatory Research (RES) to identify changes to grid performance relative to NPPs

which could impact safety. The assessment also provides some numerical measures to characterize grid performance before

and after deregulation - - in particular, those related to loss of offsite power (LOOP).

The information gathered provides a baseline of grid performance to gauge the impact of deregulation and changes in grid

operation. (This work was completed prior to the August 14, 2003, blackout that affected several states and Canada.) The

period 1985-1996 was considered before deregulation' and 1997-2001 after deregulation.' The assessment found that major

changes related to LOOPs after deregulation compared to before include the following: (1) the frequency of LOOP events at

NPPs has decreased; (2) the average duration of LOOP events has increased; (3) where before LOOPs occurred more or less

randomly throughout the year for 1997-2001* most LOOP events occurred during the summer; and (4) the probability of a

LOOP as a consequence of a reactor trip has Increased.

The assessment re-enforces the need for NPP licensees and NRC to understand the condition of the grid throughout the year to

assure that the risk due to potential grid conditions remains acceptable.

12. KEY WORDS/DESCRIPTORS (List words orphrases that winassist researchers In locating the report.) 13. AVAILAB1LITY STATEMENT

unlimited nuclear power plant 1 unliit

loss of offsite power 14.SECURITYCtASSIFICATION

grid (This Page)

station blackout unclassified

emergency diesel generator rThis Report)

unclassified

15. NUMBER OF PAGES

16. PRICE

NRC FORM 335 (2-89)
Federal Recycling Program
NUREG-1784 OPERATING EXPERIENCE ASSESSMENT - EFFECTS OF GRID DECEM*IBER 2003

EVENTS ON NUCLEAR POVER PLANT PERFORMANCE

2s

UNITED STATES

NUCLEAR REGULATORY COMMISSION

OFFC-InAL nBU InESz nSm

OFFICIAL BUSINESS