Evaluation of Station Blackout Accidents at Nuclear Power Plants – US NRC 1988


South Australian main transmission tower, one of a number destroyed by wind in 2016, causing a state wide blackout.

“”Station Blackout,” which is the complete loss of alternating current (AC) electrical power in a nuclear power plant, has been designated as Unresolved Safety Issue A-44. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on AC power, the consequences of a station blackout could be severe. This report documents the findings of technical studies performed as part of the program to resolve this issue. The important factors analyzed include: the frequency of loss of offsite power; the probability that emergency or onsite AC power supplies would be unavailable; the
capability and reliability of decay heat removal systems independent of AC
power; and the likelihood that offsite power would be restored before systems that cannot operate for extended periods without AC power fail, thus resulting in core damage. This report also addresses effects of different designs, locations, and operational features on the estimated frequency of core damage resulting from station blackout events.

“The results show the following important characteristics of station blackout
(1) The variability of estimated station blackout likelihood is potentially
large, ranging from approximately 10-^5 to 10-^3 per reactor-year. A
“typical” estimated frequency is on the order of 10-^4 per reactor-year.
(2) The capability to restore offsite power in a timely manner (less than 8
hours) can have a significant effect on accident consequences.

(3) The redundancy of onsite AC power systems and the reliability of individual
power supplies have a large influence on the likelihood of station
blackout events.
(4) The capability of the decay heat removal system to cope with long duration
blackouts (greater than 2 hours) can be a dominant factor influencing the
likelihood of core damage or core melt for the accident sequence.

(5) The estimated frequency of station blackout events that result in core
damage or core melt can range from approximately 10-^ to greater than
10-^4 per reactor-year. A “typical” core damage frequency estimate is on
the order of 10-^5 per reactor-year.

“The losses of offsite power can be categorized as those resulting from
(1) plant-centered faults, (2) utility grid blackouts, and (3) failures of
offsite power sources induced by severe weather. The industry average frequency
of total losses of offsite power was determined to be about 0.1 per
site/year, and the median restoration time was about one-half hour.

South Australian main transmission tower, one of a number destroyed by wind in 2016, causing a state wide blackout.

“(1) the design of preferred power distribution system, particularly the number
and independence of offsite power circuits from the point where they
enter the site up to the safety buses
(2) operations that can compromise redundancy or independence of multiple offsitepower sources, including human error
(3) the reliability and security of the power grid, and the ability to restore
power to a nuclear plant site with a grid blackout
(4) the hazard from, and susceptibility to, severe weather conditions that can
cause loss of offsite power for extended periods

“On the basis of reviews of design, operation, and location factors, the staff
determined that the expected core melt frequency from station blackout could be
maintained around 10-^5 per reactor-year or lower for all plants. To reach this
level of core melt frequency, a plant would have to be able to cope with station
blackouts on the order of 2 to 4 and perhaps 8 hours long and have emergency
diesel generator reliabilities of 0.95 per demand or better, with relatively
low susceptibility to common cause failures

The concern about station blackout is based on accumulated operating experience
regarding the reliability of AC power supplies. A number of operating plants
have experienced a total loss of offsite electrical power, and more such occurrences are expected. During these loss-of-offsite-power events, onsite emergency

AC power sources were available to supply the power needed by vital safety
equipment. However, in some instances one of the redundant emergency power
supplies was unavailable, and in a few cases there was a complete loss of AC
power. (During these events AC power was restored in a short time without any
serious consequences.) In addition, there have been numerous instances at
operating plants in which emergency diesel generators failed to start and run
during surveillance tests.

For one of two plants evaluated, the Reactor Safety Study (NUREG-75/014) showed
that station blackout could be an important contributor to the total risk from
nuclear power plant accidents. Although this total risk was found to be small,
the relative importance of the station blackout event was established. This
finding, with the accumulated data on diesel generator failures, increased the
concern about station blackout.

Although total loss of offsite power is relatively infrequent at nuclear power
plants, it has happened a number of times and a data base of information has
been compiled (Wyckoff, May 1986; NUREG/CR-3992). Historically, a loss of offsite
power occurs about once per 10 site-years. The typical duration of these
events is on the order of one-half hour. However, at some power plants the
frequency of offsite power loss has been substantially greater than the average,
and at other plants the duration of offsite power outages has greatly exceeded
the norm. Table 3.1 provides a summary of the data on total-loss-of-offsitepower
events through 1985.
Because design characteristics, operational features, and the location of
nuclear power plants within different grids and meteorological areas can have
a significant effect on the likelihood and duration of loss-of-offsite-power
events, it was necessary to analyze the generic data in more detail. The data have been categorized into plant-centered events and area- or weather-related
events. Plant-centered events are those in which the design and operational
characteristics of the plant itself play a role in the likelihood of the loss
of offsite power. Area- or weather-related events include those on which the
reliability of the grid or external influences on the grid have an effect on
the likelihood and duration of the loss of offsite power. The data show that
plant-centered events account for the majority of the loss-of-offsite-power
events. The area- or weather-related events, although of lesser frequency,
typically account for the longer duration outages with storms being the major
factor. Figure 3.2 provides a plot of the frequency and duration of loss-of offsite-powerevents resulting from plant-centered faults, grid blackout, and
severe weather based on past experience at nuclear plant sites.

Station blackout is a serious concern because it has a large effect on the availability
of systems for removing decay heat. In both PWRs and BWRs, a substantial
number of systems normally used to cool the reactor are lost when AC power is not
available. A loss of offsite power will usually result in the unavailability of
the power conversion system and, in particular, an inability to operate the main
feedwater system. Power to reactor coolant system recirculation pumps will also
be lost, requiring that natural circulation be used for cooling to shutdown conditions.
When the loss of offsite power is compounded by a loss of the emergency
AC power supplies, reactor core cooling and decay heat removal must be
accomplished by a limited set of systems that are steam driven, passive, or have
other dedicated (or alternate) sources of power. Unless special provisions are
made, the plant will have to be maintained in a “hot” mode (hot shutdown or
possibly hot standby) until AC power is restored. Table 6.1 lists which functions
and systems for PWRs and BWRs would be lost and which would remain available
during a station blackout event. Decay heat can be removed successfully,
using the AC-independent systems identified, for a limited time, depending on
functional capabilities, capacities, and procedural adequacy.

“…the frequency and duration probabilities
of offsite power failures, emergency AC power configuration, and reliability
of the diesels are the most important factors in limiting the likelihood of
core damage. These results also show that the likelihood of significant core
damage may exist at some plants if the capability to cope with station blackout
of modest durations (2 to 8 hours) does not exist. Moreover, the results
show that the demand reliability of AC-independent decay heat removal systems
is important, but it is not the most dominant factor in limiting the likelihood
of core damage for station blackout.

end quotes, source: US NRC, 1988 as given above.