The Method of Calculating the Frequency of the Initiating Event in a Dual-Unit Site with the Example of LOOP Events

Abstract

In a nuclear power plant, the consequences of a multi-unit event occurring concurrently are more serious than those of a single-unit event. The first step in the probabilistic safety analysis of multi-units is to analyze the initiating events and calculate the frequency of initiating events for simultaneous events of multiple units. The difficulty in using the fault tree model is that the known data are all frequency data from a single unit and cannot be logically multiplied. In this paper, taking a dual unit as an example, we used the formula to convert the probability of failure of the second unit within 72 h and then build a fault tree model. After analyzing the results of the dual unit, the most frequent cut set was the common cause of failure of the main transformer and of the switching failure of the main and auxiliary external power. The final calculation of the frequency of simultaneous loss of off-site power events for the dual units within 72 h was 3.22 × 10⁻⁴/year. After comparing with the single-unit results, it was found that the common cause failure of each unit’s independent equipment was the main reason for the occurrence of a loss of off-site power. Shared equipment in a single unit was ranked low in all the cut sets (such as the stability of the external grid for the main and auxiliary power systems) but was ranked high in multiple units. The calculation results of the frequency of initiating events of double units were two orders of magnitude lower than those of a single unit. However, the consequences of simultaneous events of multiple units were higher than those of single reactors. Therefore, attention should be paid to the risk of a simultaneous loss of off-site power event of multiple units.

1. Introduction

Nuclear power plant sites usually involve multiple reactors at one site, and the multiple unit probabilistic safety assessment (MUPSA) technique can better assess the site risk [1]. South Korea, Canada, and Japan have built six or more units in their nuclear power plants (NPP) [2], and as of April 2020, 88.9% of owner plants in operation worldwide are multi-unit sites [3].

To ensure the safety of the operation of each unit within a nuclear power plant, the vast majority of systems and safety facilities within the units are independent of each other. However, there are still varying degrees of direct or indirect dependencies within sites, and the study of the MUPSA technique needs to consider the relevance of multiple units [4,5,6]. The MUPSA technique needs to address a risk assessment in the event of simultaneous accidents at multiple reactors. The assessment first requires an analysis of the initiating event, and preliminary studies on the classification and identification methods of multi-reactor initiating events have been conducted at home and abroad [7]. The frequency of loss of off-site power (LOOP) events is strongly influenced by plant site conditions and affects multiple units, requiring a separate analysis for the plant [8].

Within the same plant, the types of units may not be the same, which also brings more complexity to the study of the multi-unit problem [9]. In each construction phase, nuclear power plants typically construct two units of the same type. Therefore, it is reasonable and feasible to prioritize the probabilistic safety analysis of two units of the same type. In this paper, we explored the safety analysis method for co-located equipment in a dual-reactor plant site, using a fault tree model for the frequency of initiating events as an example of LOOP events.

2. Multi-Unit Plant Site Initiating Activity Analysis

The current MUPSA technique is based on the probabilistic safety assessment of a single unit (SUPSA). The initiating event is the starting point of the event sequence in the probabilistic safety evaluation and is a crucial basis for the PSA study at a plant site. In SUPSA analysis, the frequency of initiating events can usually be determined by referring to generic data or data based on plant operating experience or expert judgment. While some initiating events can be quantified using a fault tree model, these initiating events, which usually support system failure, are highly correlated with a plant’s design characteristics [10].

According to the classification of multi-reactor site initiating events, multiple units may have the same initiating event or different initiating events during the same period. The former involves beyond-design basis accidents (BDBAs) that usually affect the entire site, such as an earthquake, loss of off-site power, etc., or a problem with equipment or personnel shared by both units. The latter is usually an independent event between two units, which has a much lower probability of occurrence than the former case. This paper was based on the assumption that the same initiating event occurs in multiple units simultaneously. A study on the calculation method of the frequency of initiating events was conducted.

When analyzing simultaneous events of multi-units in a nuclear power plant, it is overly conservative to assume that all units will experience events at the same time, and this assumption is not consistent with actual plant conditions. The experience of the Fukushima accident shows that multiple units may all experience events for a period, ultimately resulting in a severe radiological release [11]. The analysis of multi-unit sites should be more accurate with the actual situation at the site. In this paper, “simultaneous” is defined as when an accident occurs first in one unit and, during the mitigation phase, the same event occurs in another unit. This period is defined as the mission time, T, for an event at multiple units.

Usually, the basic event frequency for a single unit is given as the frequency of the event per year. In the case of a dual unit, the first unit with an event still uses the original single-unit data. After establishing the mission time, the input data of the second unit is converted to the probability of the basic event occurring during the mission time, T, according to Equation (1):

$$\mathrm{P}=\mathrm{f} \left(\frac{1}{\mathrm{year}}\right)\times \frac{\mathrm{T} \left(\mathrm{h}\right)}{8760 \left(\frac{\mathrm{h}}{\mathrm{year}}\right)}$$

(1)

where P is the probability that the unit is damaged in T, and f is the original frequency of the unit. After conversion, the frequency of simultaneous initiating events can be calculated by a fault tree. The specific application will be described in detail in Section 3.2.

3. Case Study of LOOP Event in Dual Unit at the Same Time

3.1. Loss of Off-Site Power Event

A LOOP event is defined as the loss of both the primary and secondary external grids. The reference unit type in this paper was VVER-1000 MW, which is the Tianwan nuclear power plant in Jiangsu, China. The source of the basic event parameters involved in the model (

Table 1. List of key data.

BASIC EVENT	FREQUENCY (/YEAR)	PROBABILITY
Main transformer operation failure of unit A	2.18 × 10−1
Common-cause failure of main transformer	2.42 × 10−2
Plant transformer operation failure of unit A	5.25 × 10−3
Common-cause failure of plant transformer	5.83 × 10−4
Common-cause failure of main and auxiliary external Power switching		5.56 × 10−3
Main and auxiliary external power switching failure of unit A		5.56 × 10−2
Weather reasons	2.39 × 10−5
The stability of the main and auxiliary external power grid fails	6.77 × 10−5

) was NUREG/CR-6928. However, weather-related and external grid stability parameters are strongly influenced by the geographical characteristics of the site, and these data were re-evaluated. In general, the loss of the main external grid will cause a nuclear unit to switch to the plant load operation mode [12]. However, the feedback from the actual operating experience is that the probability of success in the plant load mode is low and is not considered for conservative assumptions. LOOP events include damage to the external grid by the external grid facilities themselves or by other disasters. The nuclear power plant in this study has two units, A and B. Unit A and B share the following equipment: the main external grid, auxiliary external grid, auxiliary transformer, and other equipment for each unit. The nuclear power plant transmission system transmits the power generated by the generators to the grid through the main transformer and to the plant power equipment through the plant transformer. The main transformer connects the generators to the main switching station and through the main switching station to the grid. During normal operation of the NPP, the generator outlet of the unit is connected to the 500 kV system and supplied through two high-voltage plant transformers. A standby power of 220 kV is used as backup power for the working bus.

If the turbine unit fails to shut down, the result is that no external power will be supplied to the generator. The power supply source of the plant working bus is either the 500 kV system or the 220 kV auxiliary backup power system. When the 500 kV system fails or the No. 1 generator–transformer unit (including the No. 1 generator, No. 1 main transformer, and two high-voltage plant transformers, A/B) fails and trips, it automatically switches to the 220 kV standby power. If both the main and auxiliary power sources are lost, the LOOP event occurs, after which the emergency diesel generators provide power to nuclear safety-related systems. If the emergency diesel generator also fails, the nuclear plant enters an SBO (station black-out) event [12,13].

The situations that lead to a LOOP event of two units at the same time can be divided into two categories. One is when two units independently have a LOOP event at the same time due to the failure of their respective equipment. The other is that the LOOP event occurs in both units simultaneously due to the failure of common equipment or meteorological reasons. The fault tree model should cover the above two situations completely.

3.2. Simultaneous LOOP Event Model for Dual Units

In the actual operation of nuclear power plants, some scholars have proposed that nuclear power plants should have a corresponding power supply support system [14]. They can ensure that the NPP will not experience an unacceptably large release of radioactive material within 72 h during the LOOP event and that onsite emergency AC power is supplied. Therefore, we assumed that the mission time of the LOOP event is 72 h for both units of the plant, and we made the following assumptions [14,15]:

• A LOOP event occurs first at unit A.
• Assuming the scenario that the event also occurs in unit B within 72 h after the LOOP occurs in unit A, the mission time is 72 h for the simultaneous event in units A and B.

The model is divided into three main parts, as shown in Figure 1. The first part is the two events that create a risk for all units in the site, i.e., the loss of the main and auxiliary networks due to meteorological reasons and main and auxiliary network stability disruption events. Once the two events occur, all units throughout the site will experience the LOOP event. The second part is the simultaneous failure of two units exactly at the time of the mission. The third part is the common cause of failure (CCF) that causes them to experience a LOOP event.

The codes in Figure 1, Figure 2 and Figure 3 refer to the following: LGB, LGC, LGJ, and LGR are the numbers of the different plant buses. AUX refers to the auxiliary external grid, MAIN refers to the main external grid, and GIC refers to the contact line. Other numbers, e.g., LGR102TAN and P0201, are specific equipment numbers. IE refers to the initiating event, and FWA refers to the failure mode as an operational failure

The data in the first part directly follows the frequencies of the single unit. In the second part of the model, the existing single-unit basic event data need to be processed. For the independent equipment in units A and B, the data of unit A uses the original single-unit data, and the basic event frequencies of unit B are converted according to Equation (1) (converting the annual failure frequency to the failure probability within 72 h):

$$\mathrm{P}=\mathrm{f} \left(\frac{1}{\mathrm{year}}\right)\times \frac{72 \left(\mathrm{h}\right)}{8760 \left(\frac{\mathrm{h}}{\mathrm{year}}\right)}$$

where P is the probability of damage to the equipment of unit B within 72 h, and f is the frequency of damage to this equipment originally per year. The fault tree of the LOOP event in unit A within 72 h is shown in Figure 2. The main transformer in the main external power supply, the main external network wiring, the interconnection between the main transformer and the switching station, and the plant transformer are all independent for units A and B. The input parameters of unit B need to be processed according to Equation (1). The two units share a common set of auxiliary grid power supplies, so the same fault tree is used for the auxiliary external power failure of units A and B in the model. However, the event of main and auxiliary external grid switching failure is not totally independent for units A and B, and it needs to be considered separately. The fault tree of unit A in the second part has the same structure as that of unit B, but the data of unit A still keep the data of a single unit. The part of the auxiliary external grid shared by units A and B is shown in Figure 3.

The third part is failure due to a common cause. In a LOOP event, the equipment involved in a CCF is the transformers, including the CCF of the two main transformers or the CCF of the two plant transformers. The failure of these two devices can lead to the failure of the main external grid. When the main external grid fails and the auxiliary grid also fails to supply power, a LOOP event occurs in both units.

The key data used to build the model are shown in Table 1 [16]:

4. Results Analysis

4.1. Frequency of LOOP Occurring Simultaneously in Dual Units

Table 2. Minimum cut set for simultaneous LOOP event of two units.

CUT SET	TWO UNITS LOOP SIMULTANEOUSLY (/YEAR)	PERCENTAGE	EVENT 1	EVENT 2	EVENT 3
1	1.35 × 10−4	41.79%	Common-cause failure of main transformer	External power switch failure of unit A and B (CCF)
2	6.77 × 10−5	21.03%	The stability of the main and auxiliary external power grid fails
3	6.06 × 10−5	18.82%	Common-cause failure of main transformer	Failure of external power switch of unit A	Failure of external power switch of unit B
4	2.39 × 10−5	7.42%	Weather reasons
5	1.65 × 10−5	5.12%	Common-cause failure of main transformer	Auxiliary transformer common-cause failure
6	7.17 × 10−6	2.23%	Common-cause failure of main transformer	The 220 kv main wiring is faulty
7	3.24 × 10−6	1.01%	Common-cause failure of Factory transformer	External power switch failure of unit A and B (common cause)

gives the main minimum set of cuts for the simultaneous occurrence of LOOP events in both units. The failure of the main transformer in units A and B, as well as the failure of the main and auxiliary external power switching (auxiliary grid failure), are the primary causes of the LOOP events.

The auxiliary grid switching failure of the two units was specifically divided into two scenarios, one scenario being the common-cause failure of both (cut set 1), and the other being the separate switching failure (cut set 3), with a total frequency of 1.95 × 10⁻⁴/year, accounting for 60.52% of all events. In addition, the total percentage of LOOP events caused by main external grid stability and weather was 28.45%, with a total frequency of 9.16 × 10⁻⁵/year. In the following top-ranked cut sets, auxiliary transformer common cause failures and main wiring faults were also the main reasons for the lack of auxiliary grid calls.

The analysis of the calculation results showed that the causes of LOOP events occurring simultaneously in dual units were mainly the CCF of equipment and the failure of shared equipment. However, the frequency of LOOP events caused by the independent failure of equipment in both units was low. The frequency of CCF of the main transformer was significantly higher than others, and if the number of units continues to increase, the frequency of common-cause failure of dual units will increase. Shared equipment failure led to LOOP events mainly due to disruption of the stability of the main and auxiliary external power grid fails and weather reasons. The auxiliary external grid is a critical shared system, and the key factor of its failure was switching failure of the main and auxiliary external power. The auxiliary external grid is a very critical shared system, and the most critical factor for its failure was the CCF of switching of the main and auxiliary external power sources; this event also occurred more frequently in both units independently.

4.2. Comparison Analysis with Single Unit LOOP Frequency Results

From the single-unit cut-set results in

Table 3. Minimum cut set for LOOP occurrence in a single unit.

CUT SET	SINGLE UNITS LOOP (/YEAR)	PERCENTAGE	EVENT 1	EVENT 2
1	1.35 × 10−2	78.89%	Failure of main transformers	Main and auxiliary external power switching failure
2	1.97 × 10−3	11.57%	GIC linkage failure between main substation and switchyard	Main and auxiliary external power switching failure
3	1.11 × 10−3	6.52%	Main external grid main wiring operation failure	Main and auxiliary external power switching failure
4	3.24 × 10−4	1.9%	Failure of plant transformers	Main and auxiliary external power switching failure
5	7.19 × 10−5	0.42%	Failure of main transformers	220 kV main wiring fault
6	6.77 × 10−5	0.4%	The stability of the main and auxiliary external power grid fails
7	2.39 × 10−5	0.14%	Weather reasons

, the operation failure of the main transformer was the main factor causing a LOOP event to occur in a single unit, and the switching failure of the main and auxiliary external power was still the main factor causing an auxiliary external grid failure. Comparing the results of LOOP events occurring simultaneously in dual units, as the number of units increased, the problem of common-cause failure became the main factor leading to simultaneous accidents in multiple units.

There are different consequences between an accident in a single unit and multiple units. The maximum possible release of radioactive material from an accident at two units is twice that of a single unit. If the same dose of radioactive material is released twice, the impact on the total risk may increase exponentially. With more units, the failure frequency of some shared equipment does not decrease with the growth in the number of units, and the consequences of an accident will be more severe. These causes can then lead to worse consequences. In addition, these factors are ranked later in the single unit and are not analyzed as the main cause. For example, main and auxiliary external grid stability failure (cut set 6) may not be analyzed as an important cause in a single unit, but it should be considered in a multi-unit site to enhance its stability to ensure plant safety.

Although the frequency of minimum cut sets in dual-unit accidents decreased, the corresponding accident consequences increased, and more attention must be paid to the implications of these events.

According to the calculation (

Table 4. Comparison of the frequency of LOOP event initiation events for different scenarios.

Event Type	Number of Units	Frequency (/Year)
Single-unit plant site LOOP	1	1.71 × 10−2
LOOP occurs simultaneously in A and B units	2	3.22 × 10−4

), the frequency of LOOP events at a single-unit site was 1.71 × 10⁻²/year, while the frequency of a LOOP event occurring simultaneously in a dual-unit site was 3.22 × 10⁻⁴/year. The frequency of a LOOP event occurring simultaneously in a dual-unit site was about 1.9% of the frequency in a single unit. This indicates that the simultaneous occurrence of a LOOP event in dual-unit units cannot be ignored, and the consequences should be further analyzed and studied.

5. Conclusions

A difficult problem in calculating the frequency of LOOP events at multi-unit sites was that the existing parameters of units A and B were all frequency-type and could not be directly calculated by logical multiplication in the fault tree. In this paper, the simultaneous LOOP event of two units was defined as a LOOP event occurring first in unit A and a LOOP occurring in unit B during the following 72 h. The basic event frequencies of unit B, except for the shared facilities, were converted by the formula to derive the probability of a LOOP event in unit B within 72 h. The simultaneous LOOP events for both units was successfully expressed in one fault tree by the model. The multi-unit LOOP events included three scenarios: simultaneous independent occurrence of both units, failure of shared equipment, and common-cause failure.

Compared with a single-unit site, the frequency of simultaneous LOOP events in a dual-unit site was about 1.9% of that of the single unit. Although the frequency of accidents was reduced, the consequences of simultaneous LOOP events in twin reactors are more serious. Therefore, the risk of simultaneous LOOP events in dual units deserves further study and analysis. The analysis of dual units showed that the common-cause failure of the main transformer and the switching failure of the main and auxiliary external power occurred most frequently. It is recommended to optimize the reliability of the main transformer and improve the stability of the main and auxiliary external power switching equipment at multi-unit sites to improve the safety of the sites. At the same time, the weather and the stability of the main and auxiliary external power grid are greatly affected by the characteristics of the plant site. These factors should be considered for separate assessments of different sites.

This paper is the beginning of the study of LOOP events at multi-unit sites, and the methodology used in this paper to calculate the frequency of initiating events can be extended to other events. The core damage frequency for multiple units will be calculated by combining human factors and CCF analysis