Analysis of Loss of Offsite Power Events at China’s Nuclear Power Plants

Abstract

The function of the electric power system of nuclear power plants (NPPs) is to provide safe and reliable electricity for the equipment both in normal operation and accident conditions, and to provide emergency power for nuclear safety-related systems to maintain the safety of NPPs. Station blackout (SBO) occurs when loss of offsite power (LOOP) happens concurrently with unavailability of the onsite emergency alternating current (ac) power. LOOP is a precursor of SBO which rarely occurs but contributes significantly to reactor core damage frequency (CDF). Collecting and analyzing all LOOP events in NPPs of China from 1993 to 2017, this paper summarizes the common features of the LOOP events, and identifies the weaknesses and lessons learned from these events. Conclusions and experience feedback suggestions are put forward for improving the reliability of the offsite power supply of NPPs in China.

1. Introduction of the Electric Power System

The function of electric power system in a NPP is to provide safe and reliable electricity for the equipment in normal operation or accident conditions, and to provide emergency power for nuclear safety-related systems and equipment to maintain the safety of NPPs. The electrical power system contains the onsite and offsite power system at NPPs. NPP’s offsite power in China comes from two sources, the main grid and auxiliary grid, and the onsite ac power is supplied by the emergency diesel generators (EDGs). A typical configuration diagram of the electric power system for a dual unit is shown in Figure 1.

In normal operating conditions, the NPP electric power system sends the power generated by the main generator to the transmission grid through the main transformer and delivers the power to equipment through the step-down transformer.

The main transformer connects the generator to the main switchyard and then to the grid. The unit bus supplies power to all auxiliary equipment through the plant transformer at normal operating conditions. The unit bus is powered by a generator when the plant is in normal operation and by the main grid through the transformer when the generator is unavailable. If the bus power or the plant transformer is unavailable, the auxiliary power from the auxiliary grid would supply power to the nuclear safety related system via the auxiliary transformer. In cases both the main and the auxiliary grid fail, that is, a loss of offsite power (LOOP), the emergency diesel generators (EDGs) become the power source for the safety-related systems.

The offsite power from the grid is considered as a reliable power source for safe operation and accident recovery, and is also preferred as a power source for emergency shutdown of a NPP. LOOP, concurring with loss of the onsite emergency ac power, is referred to as a “station blackout” (SBO). SBO rarely occurs, it is regarded as a significant contributor to core damage frequency (CDF), accounting for as much as 74% in some plants [1].

NPPs are designed to respond to LOOP events by switching to onsite power, however, LOOP is still considered as a precursor to the SBO. An increase in frequency and duration of LOOP events will lead to the growth of core damage risk.

2. Statistics of LOOP Related Events in China’s NPPs

A total of 11 LOOP events in China’s NPPs were collected from 1993 to the end of 2017 in the National Nuclear Safety Administration Experience Feedback System [2] (

Table 1. Loss of offsite power (LOOP) events in China’s nuclear power plants (NPPs) from 1993 to 2017 [2].

No.	Event Date	Title
1	1993-7-17	Loss of all offsite power supply and unavailability of channel A EDG at Daya bay NPP
2	1999-5-12	Loss of all AC power supply at Qinshan NPP due to transmission line (2001M) trip on low frequency
3	2000-12-22	Failure of transfer from the main transformer to the auxiliary of 6.6 KV Switchboard (LGB) in shutdown condition of unit 2 at Daya Bay NPP
4	2002-12-07	Loss of two offsite power supply on Unit 2, Lingao NPP
5	2002-12-25	Reactor trip at Qinshan Phase III NPP (CANDU reactor) due to loss of offsite power supply
6	2003-5-15	Loss of level 4 power supply of Unit 1 at Qinshan Phase III Nuclear Power Plant
7	2004-4-26	Loss of Level 4 power supply due to trip of standby transformer (SST1) causes Unit 1 trip at Qinshan Phase III Nuclear Power Plant
8	2010-5-07	Loss of all offsite power supply on Unit 2, Daya bay NPP caused by Pinghe transmission line trip
9	2010-7-18	Breaker fault trip on transmission line 2P59 causing loss all offsite power supply at Qinshan NPP
10	2011-3-06	Loss of offsite power supply on Unit 1 (VVER reactor), Tianwan NPP caused by activation of distance protection on Heyun 4911 transmission line
11	2015-2-7	Trip of H0LGR211JA breaker resulted in the existence of more than 5 second group I0 exceeding 1 h of unit 2 at Hongyanhe NPP

). Figure 2 shows the numbers of LOOP Events per year at NPPs of China during 1993 to 2017.

The event frequency per reactor year is calculated by the following formula:

$$f{\left(n\right)}_{frequencyperreactoryear}=\frac{E_n}{N_n}$$

$$f{\left(n\right)}_{averagefrequencyperreactoryear}=\frac{{\sum }_{i=1993}^n{E}_i}{{\sum }_{i=1993}^n{N}_i}$$

where Ei/En means the amount of LOOP event that happened in the year (i/n), where Ni/Nn means the amount of NPPs in the year (i/n).

Figure 3, the average occurrence frequency of LOOP events per unit per year, illustrates a decreasing trend. By the end of 2017, the average frequency of LOOP events was 0.0385/reactor year.

3. Analysis of LOOP Events

Statistical analysis regarding the status of reactors at the time of the events, activities carried out during the events, causes of the events, and response of the electric power system following events, are described respectively as follows.

3.1. The Status of Reactors at the Time of the Event

Reactors were in power operation and shutdown or refueling when 11 LOOP events occurred. Two events occurred during power operation, accounting for 18%, and nine events occurred in the shutdown or refueling stage, accounting for 82%. Figure 4 shows the proportion of reactors’ status at the time of the events.

At the shutdown or refueling stage, with unavailability of the turbine, the NPP is powered by the offsite main or auxiliary grid. The duration of the shutdown or refueling stage is short in time compared with the operational cycle of the NPP. However, during the shutdown or refueling stage, a lot of activities such as commissioning, maintenance, and testing are carried out on the electric power system and its protecting system (for example, EDGs, one train of the two offsite grid, and so on) by many staff from licensee, grid, and contractors or subcontractors, who worked on the site simultaneously, thus bringing in potential adverse effects on power supply reliability, as 82% of the total events revealed were during the shutdown or refueling stage.

During the operational cycle, the unit of the plant works in a steady state most of the time. The electric power system sends power from the generator to the grid and to the plant equipment through the step-down transformer, while the auxiliary grid and auxiliary transformer work in standby mode. The plant electric power system works stably with few actions for related equipment. Two LOOP events occurred in the operational cycle, during which the thermal power of NPP reactors was the highest, making it demanding for reliability of the safety system. A LOOP event in operational cycle will pose high potential risk to the reactor.

3.2. Plant Activities at the Time of the Event

This section analyzes plant activities in which the staff were involved at the time of the event occurred or discovered.

Three out of the 11 events were involved in commissioning activities, accounting for 27% of the total number of events that are LOOP events, see No. 1, 2, 9 in Table 1. Two events were involved in activities of electrical equipment initiation, accounting for 18% of the total number of events that are LOOP events, see No. 3 and 4 in Table 1. One event was involved in maintenance activities, accounting for 9% of the total number of events, see event No. 5 in Table 1.

The total number of LOOP events related to commissioning, initiation of equipment or maintenance was six, five of which happened during the shutdown or refueling stage, these activities pose a high risk to the reliability of the offsite power sources.

Figure 5 shows the proportions of the plant activities at the time of the events.

3.3. Causes for the Events

Causes for these 11 events can be divided into four categories: electric transmission grid fault, equipment failures, procedure LTA (less than adequate), and human error. Event statistics in terms of causes is shown in Figure 6.

3.3.1. Equipment Failure

Four events, No. 3, 6, 7, and 10 in Table 1, were due to electrical equipment failure, accounting for 37% of the total LOOPs.

On 12 December 2000, during the switchover of LGB from the main transformer to the auxiliary transformer during the shutdown of Unit 2 of Daya Bay NPP, 2LGB101 and 2LGC101 abnormal trips occurred due to a fault of 2LBJ001BT battery. 2LGC201 was not automatically closed and led to a power switchover failure.

On 12 May 2003, the damp of the 11.6 KV common enclosure bus on the low-voltage side resulted in a zero-sequence differential protection, and the standby transformer (SST) of Unit 1 at Qinshan Phase III NPP (CANDU reactor) quit operation. The unit was in operation mode with no standby external power supply. At 7:45 on 15 May 2003, a low impedance protection signal of the generator was falsely triggered, and switch 52GT of the main transformer tripped, unit one lost two external power supplies, A and B buses of level 4 power were de-energized.

On 26 April 2004, because of the maintenance of the high-voltage plant transformer (UST1) in Qinshan Phase III NPP, unit 1 was powered by a standby transformer (SST1). The unit was in operation mode with a single-line external power supply. At 7:00 on the same day, when the SST1 low-voltage was started up, damp on a 11.6 KV common enclosure bus on the low-voltage side caused a zero-sequence overcurrent differential protection, and led to switch SST11-5122-CB001 trip. The unit lost two external power supplies, A and B buses of level 4 power were de-energized.

On 6 March 2011, because the main transformer of Unit 1 of the Tianwan NPP (VVER reactor) was in maintenance, the unit was powered by a No. 1 transformer. At 11:57, unit 1 started a remote protection action on the Heyun4911 electrical transmission line disconnecting Heyun4911, the 220 kV bus was de-energized, then Unit 1 lost the offsite power. The cause of the event was an internal discharge of the 220 kV Gas Insulated Substation connected to the switch side of the 220 kV cable.

The above four LOOP events due to electrical equipment failure are respectively related to the generator protection system, low voltage side 11.6 KV common enclosure bus, gas insulated substation, and battery. It is suggested that licensees strengthen the routine monitoring of equipment during operation, optimize routine testing/maintenance procedures, so as to discover hidden dangers and defects in equipment, and take preventive measures as soon as possible, therefore maintaining nuclear power plants in a safe condition.

3.3.2. Grid Fault

There are two events caused by grid fault: (1) In Unit 2 of Daya bay NPP, failure of the Pinghe electrical transmission line, due to lightning strike of A and C phase of the N14 tower, led to loss of all offsite power supply. The current induced by the lightning strike exceeded the lightning resistance level of the circuit design, resulting in insulation breakdown of A and C phases. The occurrence of a two-phase grounding terminal fault caused the transmission line trip; (2) the trip of H0LGR211JA breaker resulted in the existence of more than 5 second group I0 (which means unavailability of specified safety-related equipment) exceeding 1 h of unit 2 at Hongyanhe NPP. In this event, a forest fire occurred 5 km to the northeast of unit 2. Plenty of smoke and dust caused the Wahong electrical transmission line trip, and the plant lost its auxiliary grid.

Events caused by grid fault account for 18% of the total 11 events. The offsite power supply of nuclear power plants in China is provided by the State Grid Corporation of China and the China Southern Power Grid, considering the huge span of the grid and the massive equipments in the grid, the licensee should stay vigilant to the vulnerability of the grid to various severe weather conditions.

According to the 2015 national electricity reliability index issued by the China Electricity Council, the reliability indices of China’s power grid with 220 kV and above, in the category of power transmission and transformation facilities with a voltage of 13 kV in 2015, keep rising. The availability coefficients of the three major facilities (transformers, circuit breakers, and overhead lines) increased by 0.254, 0.126, and 0.443, respectively, compared with the previous five years, equivalent to an average increase of 22.25 h, 11.00 h, and 38.82 h, respectively, in availability hours per year, which means three to five percent higher than those in North America [3].

Statistical analysis illustrates that equipment’s quality, weather factors, and natural disasters are the dominating factors affecting the reliability of the electric transmission power grid.

3.3.3. Procedure LTA

Two out of a total of 11 (18%) LOOP events were due to procedure LTA, they are (1) loss of offsite AC power due to low-frequency trip of the transmission line (2001M) at Qinshan NPP; and (2) loss of two offsite power supply at Lingao Unit 2 NPP.

Causes for the event that occurred at Qinshan NPP are: (1) Lack of necessary safety precautions on the work instruction sheet of “Reactor Protection System Terminal Tightening and Clamp Cleaning” triggered the “#1 and #2 main pump bus low frequency shutdown alarm signal, which was neglected by the operators; (2) On the applying form for the “generator water break protection test”, it only required sending the power to the generator-transformer protection circuit, ignoring the possible consequences for this operation; (3) In the operating procedures “Main Transformer Group Operating Procedures of #1 Generator”, the steps the operator should follow from cold standby to maintenance state, and the steps the generator-transformer group exit relay platen switches on/off to address the different state of the generator-transformer, were not there.

In the LOOP event at Lingao Unit 2 NPP, the plant was powered by the 2GEV main transformer at the beginning, and automatically switched to 9LGR auxiliary power supply after the loss of main power, as the main coolant pump was powered by the main transformer and tripped, the operator decided to use auxiliary power through the 2LGB and 2LGA bus to start up the 2RCP003PO main coolant pump. As the LGB bus line was not designed to bear such conditions and due to poor cable installation for pump load, this decision led to a fire alarm where the 2LGB001TB bus is located, and technical gutters corridor cable arc smoke. Then the operator tripped the auxiliary power supply manually. The reason for the event is that there were no instructions in the design documents to “Restrict to initiation of RCP002/003PO under auxiliary power supply from auxiliary transformer conditions”.

These two events indicate that the licensee should perform comprehensive risk analysis while making procedures of equipment installation, commissioning and testing, to address the procedure defects due to lack of operating experience, thus avoiding LOOP arising from equipment failure.

3.3.4. Human Error

There are three events caused by human error, accounting for 27% of the total 11 events.

At Daya Bay NPP, a “methane gas protection signal” mistakenly activated by a jumper error led to breaker trip and then LOOP while implementing commissioning procedures. The cause of this event was that the staff did not properly prepare the commissioning procedures.

At Qinshan Phase III NPP, generator low frequency protection activated due to lack of isolation and led to LOOP when staff repaired the generator backup protection device. Before the event, a component of backup protection device failed and caused action of generator differential protection, and then the generator outlet switch tripped. However, generator low frequency protection action did not initiate the fast switchover from the 220 KV to 500 KV power supply as designed. As a result, unit 1 lost the power supply, and the reactor shut down due to low flow rate of the reactor coolant system.

During the outage of Qinshan NPP, when conducting the bus protection transmission test, a trip of the 2P59 external power line circuit breaker was caused by accidentally touching the trip switch during the wiring process. The cause of the event was a lack of isolation measures at the time of bus differential protection. The maintenance staff was not fully aware of the high risks due to insufficient indications in the working procedures and unclear operation guidance.

To sum up the above human error cases, severe consequences might occur due to insufficient knowledge and skills and the failure to follow behavioral expectations, for example, Stop Think Action and Review (STAR), in the commissioning, maintenance, and operation of nuclear power plants. Therefore, it is necessary for the licensees of NPPs to improve the staff’s awareness about safety and risk, to encourage the staff follow code of conduct, so as to prevent similar events from occurring.

3.4. Response of Power System

As described above, NPPs in China have their power supplied from two external sources: the main grid and the auxiliary grid. In the 11 LOOP events, when one external power source lost, the other failed to provide offsite power for reactors for various reasons.

Among them, six switch failure events were caused by unavailability or maintenance of the standby power source. Five switch failure events were caused by human error, equipment failure, design defects or procedure LTA during state transition. Two failed due to power off in LBJ (125 V DC power supply) switchgear; one failed due to failure to switch to main cooling chiller power, resulting in overheat trip of the main transformer; and one was due to the design fault, as the low frequency protection of the generator did not activate the power switchover device outside the plant and failed to switch. The last one was caused by use of improper bus line as the procedure did not restrict this action.

In addition, regarding to successful startup of onsite emergency ac power supply (EDG) after the loss of offsite power event, two onsite EDGs startup succeeded in five out of 11 events and one EDG succeeded in six out of 11 events. So, by the end of 2017, the NPPs in China had not yet undergone a SBO scenario.

4. Conclusions

A reliable offsite power supply is an important guarantee for reliable ac power in nuclear power plants. Based on the analysis of LOOP events at China’s operating nuclear power plants and experience feedback from the USA [4] and IAEA [5], the conclusions are as follows:

(1)

From 1993 to 2017, there were 11 events involving loss of offsite power in China. The average frequency of the event shows a decreasing trend. As of the end of 2017, the average frequency of LOOP event in China is 0.0385/reactor year.

(2)

As nine out 11 events occurred during commissioning, equipment initiation and equipment maintenance activities in the nuclear power plant, which indicates most LOOP events happened during reactor shutdown or refueling. It is recommended that licensees strengthen the management of off-site power during shutdown and refueling, and formulate emergency plans during high-risk operations such as maintenance, commissioning, and testing.

(3)

The causes for LOOP events include electric transmission grid fault, equipment failure, procedure LTA, and human error, among which equipment failure takes the highest proportion, then human error. It is recommended that licensees focus on the reliability of power supply equipment in the plant, strengthen equipment condition monitoring, and take preventive maintenance measures to reduce the frequency of LOOP events.

(4)

The external power grid might be disabled by equipment faults, weather factors, and natural disasters. It is suggested that licensees establish a disaster warning system, arrange operation and testing plans reasonably, and make emergency preparations.

(5)

Causes for fail to switch to standby power include grid maintenance, equipment failure, design defect, human error, and procedure LTA. The reliability of the standby external power grid should be improved from the aspects of maintenance planning, equipment reliability, procedures, and personnel performance.

(6)

In the 11 LOOP incidents, there were five events that two EDGs succeeded startup, one EDG succeeded startup in other six events. No SBO event occurred.

(7)

After the Fukushima nuclear accident, the licensees in China have taken waterproofing measures in the emergency power room, installed waterproof baffles, and mobile power in order to withstand the extreme external natural conditions and reduce the potential SBO risks for NPPs both in operation and under construction, according to the requirements of “General Technical Requirements for NPP Improvement Operations after the Fukushima Nuclear Accident” issued by National Nuclear Safety Administration.

The analysis in this article would provide a valuable input for licensees aiming to construct a nuclear power plant to enhance the reliability of the offsite power system and lower the overall cost through taking into account the causes of LOOP event, especially at the beginning stage of designing a NPP. Furthermore, for licensees of NPPs in operation, preventive actions could be taken in light of the causes to prevent LOOP event occurring, thus reducing the potential risk to the nuclear safety, protecting the staff, the public, and the environment.