ML25183A282

TLR-RES-DE-2025-05 - Possible Vulnerabilities to the On-site Electrical Distribution System When Transitioning, Operating, and Recovering from Nuclear Power Plant Island Mode Operation

ML25183A282
Person / Time
Issue date:	07/18/2025
From:	Darrell Murdock NRC/RES/DE
To:
Darrell Murdock 4151591
Shared Package
ML25183A280	List: ML25183A282
References
TLR-RES-DE-2025-05
Download: ML25183A282 (25)

Text

TECHNICAL LETTER REPORT TLR-RES-DE-2025-05 Possible Vulnerabilities to the On-site Electrical Distribution System when Transitioning, Operating, and Recovering from Nuclear Power Plant Island Mode Operation July 2025 Division of Engineering Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 D. Murdock U.S. Nuclear Regulatory Commission

1 This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.

2 DISCLAIMER This report does not contain or imply legally binding requirements. Nor does this report establish or modify any regulatory guidance or positions of the U.S. Nuclear Regulatory Commission and is not binding on the Commission.

3 Page left intentionally blank

4 CONTENTS ACKNOWLEDGMENTS........................................................................................................................5 1.

INTRODUCTION........................................................................................................7 2.

BACKGROUND.........................................................................................................9 2.1 Behavior of units designed for IMO.................................................................................10 2.2 Summary of benefits associated with IMO......................................................................11 2.3 Summary of drawbacks associated with IMO..................................................................12 3.

FORSMARK UNIT 1 EVENT AND THE ROLE OF IMO..........................................12 4.

OPERATING EXPERIENCE OF THE KOREAN OPR-1000 DURING IMO............14 4.1 Objectives and acceptance criteria for a successful IMO................................................14 4.1.1 Acceptance criteria objectives:................................................................................14 4.1.2 Acceptance Criteria for a successful IMO:...............................................................15 4.2 System design for IMO....................................................................................................16 5.

IMO OPERATING EXPERIENCE IN THE CHECH REPUBLIC..............................19 6.

CONCLUSION.........................................................................................................22 REFERENCES...............................................................................................................23

5 ACKNOWLEDGMENTS The author would like to acknowledge the efforts and commitment of all contributors to the research. The author would also like to thank Sheila Ray, Sergiu Basturescu, and Christopher Cook from the United States Nuclear Regulatory Commission for their support and review of the report. In addition, the author would like to thank the Electric Power Research Institute (EPRI),

and the Czech Republic Power Generation Company (EZ) for their input to the report.

6 EXECUTIVE

SUMMARY

Island Mode Operation (IMO)1 is the capability of nuclear power plants (NPPs) to operate completely isolated from the electrical transmission grid while supplying AC power to the plants auxiliary loads (house loads), without triggering a reactor trip.

The Forsmark Unit 1 event is one of the events that highlights possible vulnerabilities an NPP with IMO capability could be subject to when transitioning to IMO. During the Forsmark event, the plant attempted to transition into IMO, but the plant was unsuccessful due to a short circuit in the switchyard and a delay of the protection device to actuate, which caused the effects of the short circuit to propagate to the NPPs on-site electrical distribution system.

In addition, during the Forsmark Unit 1 event, the protection relays for under-frequency on the Class 1E busbars operated slower than the designed response time and allowed the frequency to drop below the acceptable range, to where it prevented a fast transfer of plant safety related loads to the alternate (70kV) off-site power supply. Thus, disadvantages associated with IMO include the need for more complex protection schemes to limit the effects of transients, higher voltage and frequency transients during a load rejection, and higher investment cost.

Benefits associated with IMO include an additional line of defense in the form of an immediate source of power to station auxiliaries, the capability to return to full power supporting the grid in a shorter period of time (compared to a reactor trip) and the ability to continue supplying power to all auxiliary loads when off-site power (the grid) is lost.

In order to mitigate against disadvantages associated with IMO, the on-site electrical distribution system should be evaluated for the worst cases of voltage and frequency transients that take place during the transition to IMO to protect sensitive equipment on the distribution system against severe electrical transients or a failure of protection equipment that could increase the severity of disturbances that may take place on the grid or on the on-site distribution system.

1 Note: The term grid island mode is the formation of an island in the transmission system (separated from the grid) containing both power sources and loads. Conversely, in unit island mode or unit house load operation, the unit is disconnected from the grid and supplies power only to its own house loads (auxiliaries).

7

1. INTRODUCTION The off-site electric power supply, delivered via the electrical transmission grid and NPP switchyard, is the most reliable electric power source for safe operation and accident mitigation in NPPs. It is also the preferred source of power for normal and emergency NPP shutdown. If the loss of the off-site electric power system is concurrent with a main turbine trip and unavailability of the on-site emergency ac power system, a total loss of ac power occurs, resulting in a station blackout (SBO) condition, which is one of the significant contributors to reactor core damage frequency.

An important factor that could increase the availability of off-site electric power (avoiding a full load rejection) is the electrical transmission grid protection system. The electrical transmission grid protection system is designed to isolate or clear electrical faults as rapidly as possible to prevent the propagation of electrical disturbances to the NPPs on-site electrical distribution system and becoming a wide-reaching system transient that challenges system stability and affects large portions of the transmission grid. Severe system transients can potentially lead to a trip of the reactor, loss-of-off-site power, and/or the NPP transitioning to IMO.

Criterion 17, "Electric Power Systems," of Appendix A, "General Design Criteria for Nuclear Power Plants," to 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities,"

includes a requirement that an on-site electric power system and an off-site electric power system be provided to permit functioning of structures, systems, and components important to safety.

An on-site electric power system and an off-site electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that: (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences; and, (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

Electric power from the transmission network to the on-site electric distribution system shall be supplied by two physically independent circuits. Each of these circuits shall be designed to be available in sufficient time following a loss of all on-site alternating current power supplies and the other off-site electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.

Criterion 17, in part, requires that electric power from the transmission network to the on-site electric distribution system be supplied by two physically independent circuits. Loss of off-site power events (full load rejection) impose the most challenging conditions for NPPs. Upon a loss of off-site loads (e.g., the electrical transmission grid), an IMO capable NPP must consider the following factors:

The reactor, turbine, steam dumps, condenser and generator controllers must be able to handle the initial transient (full load rejection) and the subsequent post transient phenomena without causing a reactor scram.

8 If initial power maneuvering is to be accomplished by turbine bypass and atmospheric dump valves, where steam is diverted from the turbine and rejected directly to the condenser, until the core power level is reduced, or another approach.

Depending on the projected return to service of the electrical transmission grid, the reactor may remain on hot-standby or the required amount of power level to power the house loads.

The operating auxiliary loads, specifically any large motors (e.g., reactor coolant or recirculation pumps, circulating water pumps, feed-water pumps, condensate pumps, etc.), will have to withstand the voltage and frequency transients.

A fast bus transfer to IMO must take place when the electrical transmission grid is lost if the NPP auxiliaries are normally supplied directly from the off-site power source.

Reactor stability and noble gas concerns may induce additional electrical transients in the on-site power system due to extended reactor low power operation.

Possible concerns associated with IMO are centered around the reactors ability to instantaneously reduce power from full power to the power required to feed the auxiliary loads, and the amount of excess power that could flow into the on-site electrical distribution system (after the loss of load) while the reactor is coming down in power.

Ideally, there should be a clear understanding of the capability of the on-site electrical distribution systems of NPPs with IMO capability to dissipate the excess power generated by the reactor and the time limit the on-site electrical distribution system can withstand the flow of excess power to protect sensitive electrical equipment.

For small modular and advanced reactor designs, there may be a need to establish measures to evaluate whether the on-site electrical distribution systems are robust enough to dissipate the initial flow of excess power, and the amount of time the on-site electrical distribution system may be able to cope with the flow of excess electrical power before sensitive electrical equipment is compromised. As more applicants begin to cite, and potentially credit, IMO in their designs, it is important that the Nuclear Regulatory Commission (NRC) establishes a baseline of information and knowledge that can eventually be used to support the development of guidance and acceptance criteria in support of licensing reviews.

9

2. BACKGROUND During the transition to IMO the plant could undergo several challenges. The abrupt load reduction during a transition to IMO puts stress on several of the NPP systems. The main concern in achieving IMO is in the management of excess power from the reactor, not absorbed by the turbine-generator, which must be dumped as steam to the main condenser. Therefore, to successfully achieve IMO, adequately sized main condenser and /or atmospheric steam dump valves in Pressurized Water Reactors (PWRs), are required NPP design features. In certain cases, during IMO the generator busbar voltage and frequency will initially increase as the load drops-of (disconnecting from the electrical grid). This will tend to increase the speed of motors and pumps which could affect the fluid dynamics and the related core heat transfer and core reactivity effects.

Margins in process variables and design of components must be sufficient to cope with the electrical and fluid system excursions. This is particularly the case in the PWR where the increase in Reactor Coolant Pump speeds could lead to an increase in reactivity and thermal output.

In Boiling Water Reactor (BWRs), it could cause a potential risk of instability when the reactor coolant flow is rapidly reduced because of Reactor Coolant Pump runback. To cope with the transient, the reactor and turbine control systems must function properly and be well synchronized.

The following main control systems play a critical role in BWRs and PWRs successfully disconnecting from the electrical grid and transitioning to IMO:

reactor pressure controller (BWR) reactor level controller (BWR) pressurizer level control (PWR) steam generator level controller (PWR) turbine speed governor turbine pre-heater and drain tank level controllers main generator voltage regulator reactor power regulation steam bypass feed-water flow control The electrical transient that is generated when transitioning to IMO puts added strain on the systems of electrically driven components. This includes reactor safety system components which might be in service during normal operation such as component cooling water pumps and PWR charging pumps. There is an additional possibility of a further electrical transient if an ongoing transition to IMO must be aborted due to electrical or process system failures.

It is important to point out that the process components dependency on electric system variations must be understood so that the overall process behavior during electrical system

10 transients or faults can be modelled and managed. Power uprates and modernizations of equipment could give rise to an increased risk from the loss of original design margins and introduction of new failure modes.

Electrical system performance may also change when modernized electrical equipment employs components that significantly differ from the originally installed components such as solid-state power converters and software-based processor controllers. Because of this change in technology, the specified functionality needs to be extended beyond what was listed for the original components. This applies both to areas of functionality which were inherent with previous-generation technology and therefore not explicitly specified in the original design basis and new areas of functionality which inherently come with modern technology.

2.1 Behavior of units designed for IMO The transition to IMO begins when the unit breaker gets a trip signal or signals to open, provided there is no fault signal from within the power plant. Often the reason for the unit breaker to open is a short circuit somewhere in the off-site substation or in the nearby grid which cannot be cleared or is not properly cleared by the line protection.

When transitioning into IMO, typically the unit breaker is tripped by an under-impedance or over-current relay. In cases where the under-voltage remains beyond the anticipated breaker failure protection clearing time (typically 250 ms), an under-voltage protection initiates unit breaker opening and subsequent transition to IMO. Hence the generator busbar voltage might already be far below the normal operating range when the transition starts. Subsequently, the generator excitation may be giving full excitation current before the unit breaker opens.

The turbine-generator speed might also be affected as the load from the grid changes faster than the turbine governor can follow. Assuming an initial grid short circuit, the load of the generator decreases as the voltage on the grid is lowered substantially and the generator current is not increased to the same extent.

Consequently, the turbine-generator starts to accelerate as the mismatch in power over time is taken up as increased rotating energy in the turbine-generator rotors. However, a major part of this mismatch in power occurs after the transition to IMO has started, rather than before the transition, as the off-site network is completely disconnected when the unit breaker opens.

When the unit breaker opens, the voltage on the generator and auxiliary busbars is governed only by the generator excitation, without any influence from the grid. In most cases, the plant is set to produce reactive as well as active (real) power in normal operation. Therefore, the generator exciter is very likely to be set to produce much higher excitation current than is required in IMO, even without considering the demand for more excitation due to a possible initiating grid short circuit.

During these conditions, the generator voltage regulator function is challenged to quickly reduce the generator voltage by reducing the excitation current. In this regard, the principal design of

11 the high-power part of the exciter plays a major part in what can be achieved. In a rotating exciter, the excitation current is driven from a rotating AC winding and diode bridge piloted from a stationary thyristor bridge. This thyristor bridge is in normal operation (voltage control) powered from an auxiliary rotating winding. This is not the optimal arrangement from a dynamic point of view as the arrangement lacks the ability to quickly reduce the excitation current, as no negative voltage can be applied.

Nonetheless, when the excitation current is fed via brushes from a stationary thyristor bridge-based exciter, a negative voltage can normally be applied. This type of excitation system has a more direct coupling to the generator voltage as the excitation transformer often is fed off the generator busbar. In the case of an initial extremely low generator voltage (due to a grid fault) this leads to the driving voltage for the excitation current being automatically reduced.

Assuming a transition to IMO from normal operation, but without any grid fault, (i.e. load shedding), the frequency typically ramps up to a maximum of 3%-4% over-speed in about one second and then decays (which could be in an oscillatory mode with under, and over-shoots) over many seconds. The voltage on the generator and non-Class 1E auxiliary busbars typically ramps up 15-20% over one period and then slowly decays, initially generating an increase in the auxiliary transformer currents. Similar excursions can be seen on the Class 1E auxiliary busbars that could also affect the DC busbar voltages.

A high voltage transient is generated and passed down into the auxiliary system at the time when the unit breaker opens. This is also the case when the transition to IMO is not successful.

If proper measures are not taken in the design and setting of protection equipment, mainly relay protection, the voltage transients on the generator busbar can reach a range of 150%,

depending on the specific voltage regulator design and the field excitation control system.

Redundant protection and carefully designed schemes of backup protection features are strongly recommended to prevent damage to sensitive protection and control systems.

If a transition to IMO fails, the whole auxiliary supply is fast transferred to the alternative off-site power supply. If the fast transfer is successful, the reactor may remain in operation, with steam dumping into the steam condenser. If the fast transfer to the alternative off-site power supply fails, the respective Class 1E busbar is isolated from the non-Class 1E busbar, Emergency Diesel Generator (EDG) starts on low voltage, loads are shed, the EDGs connected, followed by the load-sequencer reconnecting the Class 1E loads.

2.2 Summary of benefits associated with IMO An NPP designed for runback power to IMO, following a unit breaker opening, in general:

has one additional line of defense (an immediate source of power to station auxiliaries) has the capability to return to full power supporting the grid without delay has instantaneous power to all auxiliaries when off-site power is lost.

An NPP without IMO capability in general:

12 needs a slightly simpler design of control and protection systems is less likely to be subjected to power system transients due to failures has lower investment costs due to different requirements on the generator breaker and larger condenser 2.3 Summary of drawbacks associated with IMO An NPP with IMO capability in general:

needs a more complex design for control and protection systems is more likely to fail and thus generate power system transients has higher investment costs.

An NPP without IMO capability in general:

trips for any significant grid disturbance relies more on the availability of fast transfer capabilities has a 2-3-day delay to restart due to reactor limitations and regulatory requirements

3. FORSMARK UNIT 1 EVENT AND THE ROLE OF IMO Forsmark Unit 1 Event Forsmark Unit 1 is a 1000 MWe BWR plant of ASEA Atom design and with twin turbines, in Osthammar, Sweden, commissioned in 1980. Its principal safety design is four trains redundancy of 50% capacity Emergency Core Cooling Systems. At the time of the July 25th, 2006, event, Unit 1 was operating in normal full power mode. Unit 2 connects to the same switchyard as Unit 1 and was down for maintenance. Unit 3 connects to a separate switch yard.

The event was initiated by a short circuit in the 400 kV switchyard outside the plant. The short circuit was caused by a maintenance error in the 400 kV switch yard. Following the short circuit an electrical transient was fed back through the main transformers to all four divisions of the Class 1E Emergency Power Supply (EPS) [divisions A, B, C and D]. Each of the four divisions of the Class 1E EPS contains an uninterruptable power supply system.

To the normal plant control systems, the event initially appeared as a 50% load rejection. The reactor power was reduced by partial scram and the plant attempted IMO, but only for a short period. The protection for under-frequency on the Class 1E busbars operated slower than the designed response time and allowed the frequency to drop below the acceptable range to a level that prevented fast transfer of plant safety related loads to the alternate (70kV) off-site supply.

The transient resulted in a failure of the uninterruptable power supply (UPS) systems in the divisions A and B. Only by chance, the UPS systems of the divisions C and D were not affected due to minor random variations in protective settings. The UPS system supplies low voltage AC systems without any interruption. During normal operation, the batteries in each UPS system are charged from the normal AC system via rectifiers. In the event of loss of power supply, the

13 batteries supply the safety equipment powered from the system with low voltage AC via inverters. Both the rectifiers and the inverters incorporate various internal component protection features.

Figure 1. Scheme of the power supply of Forsmark Unit 1 At the time the short circuit took place at the switchyard, the generator busbar voltage dropped initially and was followed by an overshoot after tripping of the unit breakers. The over-voltage transient was largely driven by the generator excitation controller trying to compensate for the previous voltage drop. The transient was transmitted back into the station. The protective settings on the uninterruptible power supply units supplying battery backed-up power to the AC 220V busbars were not properly coordinated with the battery chargers for protecting against a voltage surge transient. Two (A and B) of the four redundant UPS units tripped and left the underlying AC loads without power.

Figure 2. Phase to phase generator busbar voltage recording during the Forsmark event

14 The diesel generators started, but one function necessary for proper connection of diesel power to the busbar was dependent on control power from the UPS unit. Thus, train A and B diesel generators ran but did not connect and left the safety systems in these trains without power.

Train C and D safety buses operated as intended. The plant was, at this stage, left with two out of the four trains inoperable.

The plants Engineered Safety Features Actuation logic operates on 2 out of 4 coincidence logic. As transmitters were left without power in train A and B, several signals in these trains failed to zero-output values and the Engineered Safety Features logic conditions were initiated, leading to trip of the protection channels.

The operators quickly realized this was an unusual event. The information available to them in the main control room was substantially reduced due to the power disturbances. However, the operators handled the event in accordance with the emergency procedures. Approximately 22 minutes into the event, the operators detected that the non-safety busbars were powered. They closed the breakers to the Diesel Generator (DG) backed busbars in train A and B and restored power to the remaining safety functions. The pressure in the reactor vessel had blown down to a level allowing the low-pressure injection system to inject. When power to A and B was reconnected and all water injection capacity was available again, the vessel inventory was quickly restored.

4. OPERATING EXPERIENCE OF THE KOREAN OPR-1000 DURING IMO Table 1 below showcase the success rate of the Korean OPR-1000 over the last decade (2009 through 2018) when transitioning IMO. The total number of IMO events are eight, excluding those involving startup tests. Of these eight cases, seven were designated successful IMOs events and one was classified as a failure. The failure probability of IMO of the OPR-1000 plants is approximately 0.125.

Table 1. Experiences of IMO in the OPR-1000 plants from 2009 -2018 (note: Symbols under the Unit column heading represent redacted plant names) 4.1 Objectives and acceptance criteria for a successful IMO 4.1.1 Acceptance criteria objectives:

The acceptance criteria objectives aim to demonstrate that the Nuclear Steam Supply System (NSSS) can accommodate the load rejection at 100% power without initiating a Reactor Protection System (RPS) signal or an Engineered Safety Features Actuation

15 System (ESFAS) signal, and without opening any primary or secondary safety valves and tripping the turbine.

Assess the performances of the Reactor pressure controller (BWR), Reactor level controller(BWR), NSSS, Turbine speed governor, Turbine Pre-heater and drain tank level controllers, main generator voltage regulator, Steam Bypass Control System (SBCS), Feed-Water Control System, Reactor Regulating Control System (RRS),

Pressurizer Pressure Control System, Pressurizer Level Control System (PLCD),

Reactor Power Cutback System (RPCS) and Turbine Control System (TCS) following full load rejection to IMO from 100% power.

4.1.2 Acceptance Criteria for a successful IMO:

The RPS does not initiate a reactor trip The ESFAS is not actuated The primary and/or secondary safety valves do not open Atmospheric Dump Valves do not actuate The RPCS drops the selected control elements assembly (specific control rods) into the CORE The 100% power load rejection is successful without tripping the turbine and generator.

The Korean OPR-1000 plants are connected to two electrically separated sections of the grid system. One section is connected to the main transformer to transmit the power produced by the generator to the grid system during normal operations, while the other is connected to the standby auxiliary transformer (SAT) to serve as a standby electrical power source. During normal operation, the generator supplies power to the off-site grid system through the main transformer and to house loads through the unit auxiliary transformer (UAT).

Figure 3. On-site Electrical Power System for OPR-1000 plants during normal operation ([GCB]

Generator circuit braker, [UAT] Unit Auxiliary Transformer, [MTR] Main Transformer, [PCB] Power

16 Circuit Breaker, [BKR] Breaker, [SAT] Standby Auxiliary Transformer, [EDG] Emergency Diesel Generator, [AAC DG] Alternative AC Diesel Generator).

When a grid disturbance takes place, the NPP cannot supply power to the off-site grid system because of the automatic opening of power circuit breakers (PCBs) in the power transmission lines. However, IMO enables the generator to continuously supply power to house loads through the generator circuit breaker (GCB) and the UAT.

Figure 4. On-site Electrical power system for OPR-1000 plants during IMO operation 4.2 System design for IMO After opening the PCBs in the power transmission lines, IMO is automatically initiated. On the primary side of the NPP, the RPCS generates a signal for dropping selected control rods to decrease reactor power. The RRS also creates a control rod insertion signal according to the primary and secondary power differences. The digital rod control system moves the control rods by receiving signals from the RPCS and the RRS. On the secondary side, the TCS rapidly decreases the turbine power. The SBCS balances the output between the primary and secondary sides.

17 Figure 5. Simplified schematic of the interrelated control systems for IMO in OPR-1000 plants During normal operations, the primary and secondary powers of the NPP are balanced at the rated level. On the primary side, the selected control rod drop by the RPCS can reduce power by approximately 25%. The RRS and other primary side systems can reduce by an additional 20%. Therefore, the total primary side power can be instantaneously decreased by 45%.

Thus, if all the control systems operate successfully, the primary and secondary side power will equilibrate at 55% of the rated power after the initiation of IMO. On the secondary side, the SBCS can cover up to 50% of the full power level, and the turbine runback and setback can decrease 95% of the rated turbine power. The generator supplies 5% of the rated power for house loads.

18 Figure 6. Simplified schematic of the interrelated control systems for IMO in OPR-1000 plants Figure 7. OPR-1000 estimated reactor power decrease during IMO Immediately after the initiation of IMO, the operator begins to perform an abnormal procedure for loss of loads. If IMO is successful, neither the reactor nor the turbine-generator will be tripped, and no other procedure is required. If IMO does not proceed as designed, due to any issue, the reactor and turbine will be tripped automatically. The main objectives of the abnormal procedure are to verify that the automatic control systems are operating as designed after the initiation of IMO by monitoring the information in the main control room, and to maintain reactor power.

In the core, the concentration level of xenon increases due to the instantaneous power reduction associated with the initiation of IMO, and the reactor power automatically decreases over time. The abnormal procedure states that the reactor power should be kept above 18%, at which point, the control mode of the steam generator water level must be manually adjusted. If the reactor power decreases to below 18%, IMO cannot be maintained.

Immediately after IMO initiation, the period during which the reactor power falls from 55% to 18% of full power is the window given to the operator to implement the abnormal procedure for IMO. Based on the operational experience, the decrease rate of the reactor power is estimated to be 0.6% of full power per minute in the early stages of IMO.

If the reactor power decreases linearly, the time it takes to reduce the reactor power by 37% is approximately 60 min. Note that according to the operational experience, IMO can last for several hours without manual control. This shows that, unlike some NPPs with the IMO

19 capability, which require operator actions for IMO within a minute, the time for actions to maintain IMO in OPR-1000 plants is long enough to avoid human failure events associated with the operator actions.

5. IMO OPERATING EXPERIENCE IN THE CHECH REPUBLIC In the Czech Republic, the Czech Republic Power Generation Company (EZ) owns 6 NPP units at two sites, Temelin and Dukovany. EZ is currently performing studies on the impact of IMO on design basis, safety aspects and operation modes, design and safety analyses, safety reports and configuration management.

Description of the Dukovany and Temelin NPPS:

Dukovany:

Temelin Startup 1985 - 1987 2000 Type (all are PWRs):

VVER 440 VVER 1000 Number of units:

4 2

Installed power (after Power Uprate):

4 x 510 MWe 2 x 1125 MWe Number of turbine-sets per unit 2

1 The NPP units are connected to an interconnected European grid (ENTSO-E) with nominal parameters of power output of 400 kV @ 50 Hz. The NPPs were designed to meet the requirements of the Atomic law and other Czech Republic (CZ) regulations and Energetic law and Czech Republic Grid code.

Design of our NPPs considers the following grid events:

Various types and location of short circuits Deviation (+/-) of frequency and voltage values on the transmission grid Deviations (decrease) of power generation on the transmission grid Sudden decrease in load Response of the NPPs to specific disturbances or events depends on the type and location of the disturbance or the event:

If there is a fault (short circuit) in the unit power outlet (generator transformer, unit power outlet line 400 kV), both the GCB and the unit 400kV circuit breaker (UCB) trip, auxiliaries are automatically transferred to standby grid source (110 kV).

If there is a fault (short circuit) upstream of the unit power outlet line (typically at busbars of 400kV switchyard that performs interface with the 400kV Grid), UCB is tripped by switchyard protection system. Information about UCB opening is quickly transferred to the TCS and turbine High Pressure and Low-Pressure steam valves are quickly closed and thus turbine runbacks to IMO.

20 If the grid operates in the abnormal grid island mode (some part of the grid with one or both of our NPPs is separated from the rest of interconnected grid), the power and frequency control of turbine-sets is switched over to the proportional speed control. The unit can be disconnected from the island grid upon two events/conditions:

o Frequency in the island grid exceeds the frequency variation settings of the unit frequency protection (settings are derived from design safety limits), UCB is tripped and turbine-set runbacks to IMO. Information about UCB opening is quickly transferred to the TCS to speed up steam valves closing.

o If there is an electrical fault near the island grid that results in the trip of one or more of the high voltage circuit breakers that isolate the unit from the island grid, the UCB remains connected. Because the UCB remains connected in this situation, there is no command communicated to the TCS to speed up steam valves closing, even if the turbine load can be very small and comparable with IMO.

Below are a set of three questions from the NRC staff along with responses from counterparts in the Czech Republic that were transmitted through EPRI:

A. What was the magnitude of the electrical system transient and any over-voltage and over-frequency conditions that came because of disconnecting from the grid?

Turbine-set load rejection to IMO:

We conduct shutdown test regularly. We simulate the transition from 100 % power to IMO. Transients upon exams are always computer simulated first and only after then tested.

Dukovany:

The load rejection represents a reduction in power from approximately 500 MWe to 30 MWe. For example, during a transition to IMO in 2012, the maximum voltage was 15.61 kV at the generator side (nominal voltage is 15,1 kV) and 52.3 Hz (nominal is 50 Hz).

This transition process to IMO did not trigger protections, the plant successfully transitioned to IMO.

Temelin:

In 2017, a load rejection test from 55% of the reactor nominal power to IMO was performed. The load rejection constituted a change in power from approximately 550 MWe to 50 MWe. During the transition to IMO, the maximum frequency observed was 50.8 Hz (nominal is 50 Hz). The transition process to IMO did not trigger the protections system, and the transition to IMO was successful.

Experience from April 2006 event in Czech transmission grid:

21 There was a short circuit fault at the 400kV busbars in one of the substations (Sokolnice switchyard) near the Dukovany NPP. Because the protection at the substations busbar where the fault took place failed, the fault resulted in the tripping of 8 (400 kV) transmission lines in the Sokolnice - Dukovany area, which caused a grid island (island grid with the NPP at Dukovany disconnected from the rest of transmission grid). The NPPs responded as follows:

Dukovany was closer to the fault. All four units were transferred to IMO. During IMO, there was a gradual frequency increase. Frequency reached a maximum of 52.8 Hz. The operation of the main processes and control systems were in accordance with the NPPs design. Transfer to the island was successful and all units stayed connected to the island.

Temelin was further away from the fault. One reactor unit was in planned shutdown. The second unit was in operation and stayed connected to the 400kV transmission grid.

Nonetheless, the unit was unnecessarily switched to island control mode of control due to genset voltage and frequency swings.

B. What was the impact of the over-voltage and over-frequency conditions on sensitive electrical equipment?

The NPP design divides all electrical equipment into 3 groups:

Group I: Safety important items requiring non-interruptible (immediate and long term) and high-quality power supply in all NPP modes.

Group II: Safety related equipment that can tolerate power supply interruption given by safety conditions. Power supply quality corresponds to the standard grid and International Electrotechnical Commission (IEC) standard generator sets.

Group III: Items non-important to safety that tolerate power supply interruption depending on performed nuclear and machinery processes. Power supply quality corresponds to the standard grid and IEC standard generator sets.

Sensitive devices (such as Instrumentation and Controls (I&C) equipment and electrical protections) are classified as Group I equipment and are fed by category I electrical systems. These electrical systems are normally supplied by normal auxiliary transformers or standby auxiliary transformers from the preferred sources (the grid and/or main generator). In case of the occurrence of a voltage or frequency deviation outside the design limits, an automatic transition to uninterrupted power supply from an emergency source (battery backup) is ensured. When voltage and frequency return to acceptable limits, an automatic transition back to normal auxiliary transformers or standby auxiliary transformers is performed. These automatic transitions are provided by UPS systems.

22 As far as over-voltage disturbances that can affect safety systems and sensitive equipment (Forsmark 1 event), additional over-voltage protection devices were installed on the rectifiers 220V DC (on safety and safety related systems). This additional protection ensures that over-voltage wave (very low frequency interference caused by a failure of main generator exciter or by a fault in the grid) cannot penetrate through the rectifiers to the 220V DC vital buses. Thus, over-voltage conditions cannot affect the uninterruptible power supply (batteries, inverters) and sensitive electrical and I&C equipment.

C. What was the rate of success of the plant achieving IMO?

The island mode operation (unit connected to an island on the transmission grid) and IMO (unit disconnected from the transmission grid and only feed auxiliary loads) were implemented from the beginning in the design of the Czechs NPPs. These operation modes are also required by Czech Transmission System Operator (EPS) in the Grid Code. Tests are carried out regularly to verify this capability.

As it stands, EZ is not able to provide historical data regarding rate of success. Our design basis rank IMO among anticipated operation occurrences.

6. CONCLUSION Operating experience in Korea and in the Czech Republic highlight benefits associated with IMO, such as an additional line of defense in the form of an immediate source of power to station auxiliaries, the capability to return to full power supporting the grid in a shorter period of time (compared to a reactor trip) and the ability to instantaneously provide power to all auxiliary loads when off-site power (the grid) is lost.

However, the event that took place at Forsmark Unit 1 brings to light potential disadvantages that could jeopardize the stability of NPPs. Disadvantages associated with IMO include the need for more complex protection schemes to limit the effects of transient, higher voltages and frequency transients during a load rejection, and a higher investment cost.

Therefore, any site considering implementing IMO should consider evaluating the on-site electrical distribution system for the worst cases of voltage and frequency transients that could take place during the transition to IMO. This evaluation should analyze the protection of sensitive equipment connected to the on-site distribution system against severe electrical transients or a failure of protection equipment that increases the severity of disturbances that may take place on the off-site grid or on the on-site distribution system.

Lastly, the author did not identify any significant operator-reported events or operating experience that discussed substantial risk to the on-site distribution system once the plant successfully achieved IMO. Additionally, the author did not identify any operator-reported events or operating experience that discussed challenges to the on-site distribution system associated with the plant recovering from IMO and subsequently returning to full power operation.

23 REFERENCES 1.

Nuclear Energy Agency Committee on the Safety of Nuclear Installations (NEA/CSNI),

Defense in Depth of Electrical Systems and Grid Interaction, Paris, France.

2.

Nuclear Energy Agency Committee on the Safety of Nuclear Installations (NEA/CSNI),

Probabilistic Safety Assessment Insights Relating to the Loss of Electrical Sources, Paris, France.

3.

Hak Kyu Lim and Jong-Hoon Park, KEPCO International Nuclear Graduate School, Effects of house load operation on PSA based on operational experience in Korea, Ulsan, South Korea.

4.

Korea Hydro & Nuclear Power Co, Ltd, Shin-Kori Units 1 and 2, Abnormal Procedures, Loss of Loads, South Korea.

5.

Michal Vondrak, International OE on Island Mode Operation (House Load Operation),

Dukovany, Czech Republic.

6.

U.S. Nuclear Regulatory Commission, Research Assistance Request [NRR-2024-005],

Assessment of Possible On-site Electrical Power System Vulnerabilities Associated with NPP Island Mode Operation, Washington, DC.

ML25183A280; ML25183A282 OFFICE NRR/DORL/LPL2-2 RES/DE/ICEEB RES/DE NAME DMurdock CCook CAraguas DATE Jul 8, 2025 Jul 15, 2025 Jul 18, 2025