All; I just came across this on c.s.y2k. My question is, is it true that up to 20% of the generation capacity of the US will go offline if the grid fails ?

From c.s.y2k: Statement of Paul Gunter, Director Reactor Watchdog Project Nuclear Information and Resource Service, Washington, DC "Nuclear Y2K Symposium" March 8, 1999 Cannon House Office Building

Nuclear Power Stations and Emergency Diesel Generators

The reliability of offsite power is critical to nuclear safety.

The steady availability of offsite power is essential to prevent nuclear hazards in the daily operation of this technology.

If offsite power is lost, Emergency Diesel Generators onsite at nuclear power stations are necessary to provide back up power to operate important components of the reactor and storage areas.

Offsite power is referred to as the "preferred power system" at nuclear power stations, providing electricity to numerous safety and non-safety related systems including the reactor coolant system recirculation pumps, the main feedwater system and power conversion system.

The steady supply of offsite power is considered so important that components for utilizing electricity from the grid to the nuclear power stations are designed to minimize to the chance of failure during station operation.

These features include:

1.two or more incoming power supplies from the grid; 2.one or more switchyards to allow routing and distribution of power within the station; 3.one or more transformers to allow the reduction of voltage to levels needed for safety and non-safety systems within the station; 4.distribution systems from the transformers to the switchgear buses.

The Y2K issue now raises a broad range of uncertainty for electrical power grid reliability with the potential for brief imperceptible interruptions of local or regional power transmission systems or a catastrophic failure of the grid system of unknown duration.

In the event of a grid failure and loss of offsite power, nuclear power stations attached to disrupted grid systems will scram, or automatically shutdown with the rapid insertion of control rods and cease production of electricity. Nuclear power stations are neither designed nor capable of "black start" or the ability to operate independent of available offsite Alternating Current (AC) electricity.

Normally, nuclear power stations slowly coast down from 100% levels with the gradual insertion of control rods. However, the rapid insertion of the control rods is comparable to slamming on the brakes of a speeding car it is a sudden activity and according to one former NRC Commissioner "a violent maneuver" potentially challenging station safety systems leading to component malfunctions.

Once scrammed, a nuclear power station must address the tremendous amount of heat generated by the atomic reaction within the fuel core. With the loss of offsite power a substantial number of systems normally used to cool the reactor are lost and unavailable.

Emergency AC power must be generated onsite to maintain reactor core stability and fuel cladding integrity through the removal of this "residual heat" via a system of circulating coolant pumps and motor operated components. Additional safety-related monitoring and control systems require electrical power stored and generated on-site. Emergency Diesel Generators (EDG) are designed to provide back-up AC electrical power and charge onsite auxiliary batteries necessary for the duration of any grid instability or failure.

When loss of offsite power is coupled with the loss of onsite emergency power, reactor cooling and heat removal must be accomplished through a limited set of systems and manual operations. The Nuclear Regulatory Commission has recognized the combination of loss of offsite power coupled with the failure of the onsite emergency backup power to be the largest postulated contributor to reactor accidents resulting in fuel damage.

This condition, known as "station blackout," was the subject of a 1979 task action plan and Unresolved Safety Issue (A-44) identified in July 1980. The NRC report "Evaluation of Station Blackout Accidents at Nuclear Power Plants," (NUREG-1032, June 1988) states that Station Blackout results in the unavailability of the high-pressure injection system, the containment spray system, the inside and outside containment spray recirculation systems and motor driven auxiliary feedwater pumps. In addition, normal station heating ventilation and air conditioning (HVAC) would become unavailable. Equipment needed to operate during a station blackout and that required for recovery from a station blackout event would have to operate in environmental conditions (temperature, pressure, humidity) that could occur as a result of the blackout. Failures of necessary equipment due to these environmental conditions could lead to a loss of core cooling and heat removal or a "station blackout induced loss of coolant accident."

A station blackout of long duration (in excess of two hours) leads to auxiliary battery depletion for AC conversion and subsequent loss of vital instrumentation and control features. The uncovering of the reactor core and its associated hazards can occur within a range 3 to 10 hours beyond the time of battery depletion without restoration of AC power in Pressurized Water Reactors and Boiling Water Reactors, respectively.

One NRC report "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants" (NUREG-1150) states that with the combination of grid failure, battery failure and EDG failure "core damage begins in approximately one hour as the result of coolant boiloff" or uncovering the core for some reactors. Core damage can be expected to proceed to a core melt if effective and timely measures to restore AC power and core cooling are not taken or available.

Much uncertainty and numerous scenarios exist regarding containment performance and failure following a core melt accident. Reactors with smaller containment structures such as designs by Babcock & Wilcox, Westinghouse Ice Condensers, and General Electric MARK I Boiling Water Reactors are of greater concern with regard to the potential for early failure. Basemat melt through, steam pressure spikes, hydrogen burns, direct containment heating, and overpressurization of containment with noncondensable gas and steam are possible scenarios for breach of containment and the catastrophic release of radiation to the environment.

Accident scenarios for times from the start of a fuel melt to containment failure range between 2 hours to more than 24 hours.

These station blackout studies assumed the electrical grid to be a stable and reliable system.

NRC studies consider a long duration blackout event in excess of two hours to be a dominant factor influencing the likelihood of core damage or a core melt accident.

We believe that a long term or reoccurring grid failure as a result of Y2K vulnerabilities has not been sufficiently studied. Therefore, the need for a thorough re-examination of the station blackout rule and nuclear accident probability figures still looms large.

Emergency Diesel Powered Generators and Their Reliability

The safety significance of redundant and operable onsite emergency power cannot be disputed.

The NRC and industry touts a 95% reliability factor for successful emergency start-up and electrical loading of safety equipment. In the event of widespread grid disruptions, even this official figure allows a 5% margin for EDG failure. However, a NIRS review of EDG reliability as evidenced through NRC Daily Event Reports continues to indicate that the margin of failure maybe larger.

In December, 1998 NIRS filed three petitions for rulemaking to the NRC regarding Y2K. The NIRS petition relevant to emergency diesel generator operability has an attached Appendix A providing a compilation of US NRC Daily Event Reports and Licensee Event Reports for every month of 1997 and 1998. These reports indicate a wide range of new and recurring problems potentially affecting emergency diesel generator operability.

A short list of recent examples include:

1.a fuel oil delivery to New Jerseys Hope Creek nuclear power station contaminated with lubrication oil resulted in a clean up and refill operation in excess of the stations Allowable Outage Time of 72 hours (LER-98-004-00, 06-22-98);

2.a Discrepancy Report filed under an Independent corrective Action Verification Program per NRC Confirmatory Order at Connecticuts Millstone 2 nuclear power station involving the possibility of a water intrusion/contamination as the result of corrosion of the nonsafety-related underground diesel oil storage tank resulting in the common failure of multiple emergency diesel generators (DR-0312, 10-15-98); 3.both of River Bend nuclear power stations diesel generators may not have been able to perform their required safety function from 1985 to 1990 prior to design modifications on the equipments pneumatic control systems (DER /Event #34738, 09-04-98);

4.all three of New Yorks Indian Point Unit 3 emergency diesel generators were declared inoperable due to multiple circuit breaker problems resulting in the cold shutdown of the reactor (DER/Event #33447, 12-23-97);

5.a high level emergency (ALERT) was declared at Detroit Edisons Fermi Unit 2 when a fire broke out in the emergency diesel generator control panel causing the operator to shut down the diesel generator and exit the building (DER/Event #34889, 10-8-98).

Since January, 1999, NIRS continues to monitor Daily Event Reports for diesel generator problems and continues to evidence a range of potential operability issues including vendor reports on inoperable equipment, diesel generators found to be outside of technical specifications, and equipment component degradation. We expect to see continued problems with design and hardware failures, operation and maintenance errors and failures related to support systems.

A NIRS review of NRC documents indicates that industry reporting of diesel generator start-up reliability may not be as accurate as perceived by NRC.

It is our concern that some number of nuclear utilities may not be accurately reporting reliable restart data for their emergency diesel generators.

NIRS is aware that on at least one occasion a nuclear utility falsified data relative to the reliability of its emergency diesel generators. This is documented by U.S. Nuclear Regulatory Commission memorandum dated December 20, 1993 to Stewart Ebneter, Region II Administrator from Ben Hayes, U.S. NRC Office of Investigations entitled "Vogtle Electric Generating Plant (VEGP): Alleged False Statements Regarding Test Results On Emergency diesel Generators (Case No. 2-90-020R).

On March 20, 1990 Vogtle Unit 1 declared a Site Area Emergency due to a loss of offsite power when a truck hit a tower in the switchyard and the concurrent loss of available onsite emergency diesel generator capability when the one operable diesel generator tripped after starting. As a result the unit went into station blackout and an associated heat up of Reactor Coolant System before the emergency diesel generator was successfully started and restored emergency power. As a result, Georgia Power Company (GPC) was required to demonstrate successful startup of their emergency diesel generators before restart of their power reactors.

The NRC report documents deliberate violations by Georgia Power Company of federal regulation and license conditions in falsification of material statements made to NRC by senior company officials regarding the reliability of the emergency diesel generators.

The Office of Investigation (OI) substantiated that on April 19, 1990, the general manager deliberately presented incomplete and inaccurate information to NRC regarding testing of the Unit 1 diesel generators conducted subsequent to the site emergency. The OI substantiated that the Vice President of Nuclear Operations deliberately and repeatedly presented misleading, incomplete, and inaccurate statements of diesel test results with at a minimum careless disregard. The OI investigation concluded "there was evidence of a closed, deceptive, adversarial attitude toward NRC on the part of GPC senior management."

This particular investigation was unique in that the alleger provided NRC with tape recordings of internal telephone conversations of various levels of Georgia Power Company; from employees within the power station up to the Senior Vice President of Nuclear Operations. The OI report states that the tape recordings show "evidence of closed deceptive adversarial attitude toward NRC on the part of GPC senior management." The alleger was fired from Georgia Power and subsequently was granted relief through a settlement agreed upon by both the NRC and the utility.

It should be of concern to the federal agency that conclusive evidence indicating an "closed deceptive adversarial attitude toward NRC" on the part of utility senior management may not be unique to Georgia Power Company. In fact, "a deceptive adversarial attitude toward NRC" could exist within other nuclear utilities and potentially impact the high reliability data pertaining to emergency diesel generator start-ups and failures.

Finally, other actions taken on the part of electric to avoid Y2K disruptions can impact emergency onsite power reliability in terms of duration of reliance on emergency power at a nuclear power station.

At least one known utility and potentially others plan to separate their various power pools from regional and national grid systems to avoid widespread power outages come Y2K rollover dates. This preventive action may constitute an added burden on emergency onsite power generators should grid failures occur.

The New London Day reported on January 5, 1999 in an article entitled "Millstone Official Says Y2K Problems Wont Have Any Effect On Nuclear Station" comments made by Northeast Utilities corporate management. It was reported that NU had undertaken plans to restrict the flow of electricity at the various grid interconnects to the New England Power Pool to prevent a "cascading grid failure."

It is our concern that in the event of a grid failure within a power pool system that is "islanding" its electricity or in a neighboring power pool, a significant delay or potential failure to transfer power can result without open interconnections providing power to the blackout area. This can be further compounded by Y2K telecommunication problems between utilities systems necessary to initiate and monitor power transfers normally available through automated systems. Such delays to restoring AC to nuclear power stations represent a concern to public health and safety.

Consequently, NIRS has submitted its petition for rulemaking requesting that NRC require that all EDGs to be determined operable with a 60-day supply of fuel oil onsite.

We have also requested that NRC provide a top-level emergency classification to all power systems and components providing coolant to the large inventories of thermally hot irradiated fuel in storage ponds at each of the reactors. The petition would require that additional emergency AC power generators be installed at each reactor site to provide a broader margin of reliability for the protection of the public health and safety.

***

-- Anonymous, March 23, 1999

Answers

Bruce, you asked if it's true that up to 20% of the generation capacity of the US will go offline if the grid fails. There are three major Interconnections, or grids, in the U.S. -- the Eastern Interconnection, the Western Interconnection, and the Ercot Interconnection (Texas area). This is simplistic, but if a grid fails, it is because utilities in that grid have already tripped offline and are not generating electricity. If a grid, or Interconnection fails, then we're already without a lot of generation capacity until such time as power could be restored.

I'm assuming you're focusing on nuclear generation when you mentioned the 20%. It is true that approximately 20% of the total electrical generation in the U.S. is supplied by nuclear power. This is an overall statistic, however, and the actual generating mix varies substantially in different areas of the country. For instance some places have next to no reliance on nuclear generation, and others get a much higher percentage of their power from nuclear plants.

The NRC is monitoring nuclear plants' Y2K project status with the stated intent of *possibly* closing down any plants which they are convinced cannot demonstrate Y2K readiness in the timeline they have set forth. There has been online debate about this. Some feel that since there has been no evidence thus far that nuclear safety systems (shutdown capability) are affected by the Year 2000 date problem, that they should be allowed to operate through the rollover and thus keep their generating capacity available to the grid. (The premise is if a Year 2000 problem did occur, either in the plant or on the grid, that the plant could be still be shut down safely.)

The other side of the argument is that shutting down all of the nuclear plants prior to the millennial rollover would be safer, and then they could be brought online afterward in a controlled start up. Since there is a generating margin (surplus of electricity versus demand) of usually 15-20% on the grids during low periods of demand (which applies to the winter holiday season) and part of the NERC contingency plans is to have even more generating capacity online at the rollover, then it has been argued that we can do without the nuclear generation, at least for awhile.

The NRC appears to be dealing with this issue on a case by case basis, however, rather than deciding on an all or nothing approach. NIRS, which is a private nuclear "watchdog" organization, has expressed many varying concerns about nuclear plant safety over the years. Their previous petitions to the NRC, as well as this new one, will go through the prescribed channels and we should know before too long what the NRC decisions are.

What is not stated in the NIRS post is that part of the Year 2000 contingency plans for nuclear plants is the testing of their generators and backup systems. Nor is it stated that non-nuclear utilities do have "black start" capabilities to recover from a trip caused by a grid instability and offsite power to nukes could be restored that way, also. (I'm assuming here that not all utilities will have individual Y2K problems, which I think the data thus far bears out.) Personally, I do believe that the NRC is taking potential Y2K problems seriously and that safety is uppermost in their minds, also. Whether their efforts are enough to satisfy everyone's concerns will likely always be debated. Certainly public pressure in the direction of safety can't hurt at all. In addition to the audits recently done on a representative sample of nuclear plants, the NRC has also just decided to conduct limited scope audits of every nuclear facility, to better determine what their individual Y2K status is. To read about this, see the recent posting (3/23) by Rick, "New NRC Y2K information".

So *if* the nuclear plants were all shutdown before 2000, then yes, we would lose about 20% of our overall electric generation. If any of them trip offline because of a disturbance in the grid they are a part of, there has already been a loss of generation elsewhere.

-- Anonymous, March 24, 1999

Hi, Bonnie;

Thanks for responding. The amount of information that you and Rick have made available is very helpful in assessing the possible futures that we face w.r.t. the electrical supply.

Aside from the considerations of safety, which everyone seems to be focussed on, and the bias inherent in the referenced NIRS document, the systems view of this says that the nuke plants are not going to be helping to hold the grid up in the event of problems.

I would have thought that the plant would be designed so that its own power would be available to run the plant, with onsite diesel and offsite supply as backups, sized and engineered to provide black start capability. The way I read it, if there is any interruption of grid supply (longer than some short time), then the plant scrams, trips, and the substantial capacity of the plant is lost, and is not available to efforts to bring the grid back up. That's what prompted my comment about losing 20%. I work w/ a former Navy nav/electronics tech who served on nuclear submarines. He's doubtful that the plants are designed this way. It sounds like you are confirming that they will trip if offsite power goes down. Is that the case?

Thanks, again, very much for all the work you have put into all this. Bruce

-- Anonymous, March 24, 1999

NIST has a 20MW research reactor; that's tiny for a power reactor, very big for research. At any rate, it was constructed like a little power reactor. When we lose offsite power (happens routinely during the summer; one good electric storm will make local power blip), we do scram. Yes, I suppose it's a "violent" event as opposed to powering down slowly, but a better analogy than "slamming on brakes" would be "blowing halogen on a campfire." That's more "violent" than taking out the logs one by one, carefully cooling them and burying them neatly in sand; but it's not like braking a car.

As for nukes and the grid -- if they can't get power *from* the grid, then they can't deliver power *to* the grid. Even if they are otherwise operational, what choice would they have but to shut down? I'm no engineer, but I will be surprised if the nukes stay up next year, NRC or no.

On another note, yes it is possible to be too concerned with safety. Imagine if the Health Department required restaurants to operate like bio-research labs, where every surface had to be totally sterile and workers had to wear Level 4 protective gear (to protect the food from themselves, not the other way around). Why not? Any bacterium is potentially hazardous, isn't it? Best to make the contamination level As Low As Reasonably Achievable, isn't it? No, it's not cost effective; but how can you put a "cost" on human suffering or, potentially, the loss of a human life?

Just my own thoughts for which my employers are in no way accountable.

-- Anonymous, March 24, 1999

Bruce, here's Criterion 23 of the NRC 10CFR Part 50, Appendix A:

"Criterion 23 -- Protection system failure modes. The protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are experienced."

This can be found at:

http://www.nrc.gov/NRC/CFR/PART050/part050-appa.html

So I'd have to say that yes, nuclear plants are required to be designed to "fail into a safe state" if there is a loss of offsite power. At least that's how I read that Criterion, but after navigating through NRC documents and regulations I always feel like I've left part of my brain capacity behind in the confusion! I'm reminded of military regs - mind boggling, makes me groan even thinking about them. This is the best I could do for substantiation of what you wanted to know. Hope it helps. Going to go have a cup of tea and get all the acronyms out of my thoughts. Maybe I'll watch the Kosovo bombing news and get myself really depressed...*wry smile*. On second thought, to heck with the TV and the news, going to find a good, happy, book!

-- Anonymous, March 24, 1999

Thanks, Bonnie;

know what you mean abt the news. Enjoy yr book. I'll try to get a PE over on y2000timebomb to comment here, but it sounds like they're supposed to go off if there's trouble. (it's not a bug, it's a feature) Later, Bruce

-- Anonymous, March 24, 1999

I am not aware of any design criteria requiring a reactor trip on a loss of offsite power, and it is possible for the plants generators to continue to provide power to the plant in this event for the plant designs I am familiar with. A loss of offsite power is quite a challenge however, since the generator has lost a very significant load and the turbine must run back to a much lower power level, and often things go wrong during this transient, leading to a reactor trip. The historical data I have seen (and actual events I have witnessed) indicates that sometimes the plant stays up, but many times a reactor trip occurs due to secondary causes resulting to the trip (Turbine trip, which initiates a reactor trip, high turbine impulse pressure, improperly designed electrical systems, etc).

EDGs are not sized for black start, they are sized for the emergency loads only (LOCA protection and core integrity systems such as core cooling, contaiment spray, etc.)

Blackstart plants have other onsite power sources.

Regards, FactFinder

-- Anonymous, March 25, 1999

FF,

It's been awhile since I had to read through 10CFR50, app. A (GDC)for job related purposes, and I don't have the time to do so tonight, so I can't comment intelligently about any such trip/scram regulatory requirements. Keep in mind that, like everything else in 10CFR50, every page in the code has another 10,000 pages of interpretation behind it ;-) (this is a bit of ex-nuclear humor, but not too far off from reality...)

However, laws of physics apply. If there is a loss of offsite power at any plant that has a turbine/generator combination turning, fossil fueled or nuke, the plant will trip on load reject unless the plant has 100% steam bypass capabilities. Very, very few plants have this capability (only one nuke that I'm aware of). At the last plant I was at, load reject logic was activated as soon as load increased beyond 20% rated power.

And you are correct that NO nuke EDG's are used for "black start". Using EDG's for other than intended purposes is one of those little things that the NRC tends to get very upset about. A few years back, there was actually one nuke that was routinely, and on the sly, using it's EDG's as peaking units until the commission found out about it. They paid more than a few $$ in fines, IIRC.

-- Anonymous, March 25, 1999

Rick, Good feedback, your physics looks good from here. I believe that you are right on target in identifying that the ability of a plant to withstand 100% load rejection is the issue in whether a plant can continue to operate following a loss of offsite power. This is a pretty tough subject for me, since I know the details of the power systems and load rejection capabilities of only a couple of plants. You state that very few plants have this capability, so I learned something here. For nukes, I know from reading the daily reports over the years that it is very common for plants to trip after a loss of offsite power due to the resulting transient, very often due to the inability to handle the load rejection. However, I was at a nuke that withstood a loss of offsite power (100% load rejection) not too many years ago, and do know that others have withstood load rejections on LOOP events but I cant remember what power levels they were at (and dont have the time to search for the reports right now).

As far as reactor trip logic goes, I have seen the trip logic for lots of plants. I am confident that there is no GDC requiring a reactor trip on a LOOP, and the plants I have seen have no automatic reactor trip. Thats not to say that there isnt some design out there that does have an automatic reactor trip on a LOOP, but obviously its not a GDC requirement and I do not believe it is common (if existent at all). Tables listing the reactor trip logic inputs can be found in the Standardized Technical Specification documents for the various reactor designs, available at the www.nrc.gov web site. Also if anyone researches this, you should check the engineered safeguards section, since there may be a design that trips the reactor on a LOOP via a safeguards signal.

Putting technicalities aside, I believe that we both would agree that the end result of a LOOP is not pretty  plants often trip offline following this event. For nukes, a LOOP is a significant challenge, since the reactor/turbine generator may trip, leaving only the EDGs (or in some cases other emergency power sources) to protect the core. I have stated in a previous post here that EDGs arent the most reliable power sources on the planet (fortunately there is redundancy). Every time a nuke looses power to the vital buses and the EDGs must be relied upon, I get just a tad nervous, since there is a slight risk that the redundant EDGs will fail (I will not discuss common mode failures here, but I think you know how much this type failure can significantly increase the risks). If anyone wants to plug some numbers, a reliable EDG might start successfully 99% of the time (some are lower). A typical site has two EDGs per unit, and if both are 99% reliable, the odds are 1/10000 that both would fail to start on a single event (I have never been comfortable with this reliability, but when you plug in the fact that the initiating event such as a LOOP is also small, the overall risks of core damage is correspondingly smaller than the typical figures above). An EDG problem might be quickly fixed, but immediately following a reactor trip, the core melt time is not very long if there is no power for cooling. This is why no one likes to see a LOOP.

If you have 50 nuclear units trip offline due to a LOOP, the risk that one of them may loose all their EDGs results in a cumulative risk 50 times higher than a single event on one unit. So, if Y2K caused lots of LOOPs, there is a significant increase in the risk that one of the units may experience core damage due to loss of both EDGs. From what we now know about Y2K problems (with almost all nukes 100% complete in their assessments), there is not a significant risk of multiple LOOP events at nukes. Additionally, contingency plans may require operation at reduced power levels, better enabling plants to withstand LOOPs ( I do not know if all nukes are doing this).

Rick, as you know, my experience in nuke y2k projects has given me a very optimistic view of the ability of the plants and grid to do just fine in y2k, but I have always been concerned about EDG reliability, regardless of the year. Since LOOPs occur on occasion and EDG systems do not have a high enough reliability, this will concern me way beyond Y2K, unless there is a regulatory required change. To this I say wake up NRC, NEI, and EPRI - the core melt frequency figures are way too optimistic here  plug in some REAL EDG reliability and LOOP event numbers, then do a cumulative risk assessments for all the units out there. A significant improvement in reliability is needed here, and this will be gained only by costly modifications to add additional emergency power sources  this wont happen in todays business environment unless you drive it.

And finally, the story about the plant using EDGs as peaking units was hilarious! Sheesh, they must really have been hurting for power with the small 2-6 MW that an EDG puts out:)

Regards, FactFinder

-- Anonymous, March 26, 1999