Annals of Nuclear Energy 35 (2008) 2332–2337

Contents lists available at ScienceDirect

Annals of Nuclear Energy

journal homepage: www.elsevier .com/ locate/anucene

Estimation of station blackout frequency for Indian fast breeder test reactor

M. Ramakrishnan a,*, A. John Arul a, S. Usha b, C. Senthil Kumar c

a Reactor Physics Division, IGCAR, Kalpakkam, Tamil Nadu 603 102, Indiab Technical Services Division, IGCAR, Kalpakkam 603 102, Indiac AERB Safety Research Institute, Kalpakkam 603 102, India

a r t i c l e i n f o a b s t r a c t

Article history:Received 15 February 2008Received in revised form 30 July 2008Accepted 1 August 2008Available online 16 September 2008

0306-4549/$ - see front matter � 2008 Elsevier Ltd. Adoi:10.1016/j.anucene.2008.08.001

Abbreviations: AC, alternating current; ASBT, auto sBC, bus coupler; CCF, common cause failures; DCS, DCDGBHW, DG breaker hardware; DGBHWM, DG breakefactor; FBTR, fast breeder test reactor; H, human opeCentre for Atomic Research; INCB, incoming breakersMAPS, Madras Atomic Power Station; SBO, station blacutset evaluation; UVR, under voltage relay.

* Corresponding author.E-mail address: mramki@igcar.gov.in (M. Ramakri

This paper presents the comparison of station blackout (SBO) frequency computed with approximatetime averaged expressions for diesel generator unavailability and time dependent cutset evaluationmethod. It is found that the frequency of SBO is under predicted by a factor of �2 by approximate timeaveraged expressions for SBO durations of 8 h and 16 h. The time dependent cutset evaluation method isapplied for offsite power feeder outage management by treating the change in SBO frequency when oneof the feeders is taken out for maintenance for ‘n’ days, as the risk measure.

� 2008 Elsevier Ltd. All rights reserved.

1. Introduction

Station black out (SBO) is one of the initiating events for poten-tial accidents at nuclear power plants. In this context it is necessaryto study the SBO frequency time correlation. SBO is defined as thetotal loss of AC electrical power to the essential and non-essentialelectrical buses in a nuclear power plant (Baranowsky, 1988). SBOoccurs when onsite emergency AC power systems are unavailableduring a loss of off-site power event. Fast Breeder Test Reactor(FBTR) is a loop type, 40 MWt experimental reactor located at Ind-ira Gandhi Centre for Atomic Research, Kalpakkam, India. In FBTRclass IV power buses are supplied by offsite power through 2 inde-pendent feeders and class III buses get supply from class IV busesand two 100% emergency diesel generator (DG) sets. For FBTR,SBO is defined as the loss of power in two or more of the four classIII bus sections. The broad conditions under which SBO occurs atFBTR are: (i) 2 out of 2 DGs fail (2/2:F) after loss of off-site power.(ii) Fault in two or more bus sections. Although less likely, the sec-ond condition directly leads to blackout irrespective of availabilityof resources.

The estimation of SBO frequency proceeds in three steps. (1)Loss of off-site power (LOSP) frequency time correlation. (2) Gener-ation of cutsets for on-site emergency AC power supply system. (3)SBO frequency time correlation by combing results from steps 1 to

ll rights reserved.

tartup and bus transfer logic;supply; DG, diesel generator;r hardware manual; EF, errorration; IGCAR, Indira Gandhi; LOSP, loss of offsite power;ckout; TDCE, time dependent

shnan).

2. Based on the observed data available at FBTR, step 1 is carriedout by fitting the LOSP data with the help of a power law, whichhas been arrived at after a detailed study of loss of offsite powerphenomena in various plant sites (John Arul et al., 2003; Marimu-thu et al., 2000). Step 2 is carried out by Fault Tree method usingRISK SPECTRUM software. Step 3 is carried out by time dependentcutset evaluation (TDCE) method (Baranowsky,1988; IAEA-TEC-DOC-593, 1991; Battle and Campbell, 1983).

2. Description of off-site and onsite emergency powerdistribution scheme at FBTR

The major factors contributing to the loss of off-site power are:(i) Failures in the grid, (ii) failures in the feeder, and (iii) trans-former failures. The schematic of off-site power distribution atFBTR is shown in Fig. 1. From the schematic diagram it is clear thatthe failure of one feeder or transformer does not lead to LOSP be-cause of redundancy.

Emergency power is provided by two DGs. Each DG unit sup-plies an independent bus, which is in two sections. Each of thesebus sections is normally fed by an independent transformer fromoffsite power supply. When offsite power supply fails, both theDG units start automatically and feed both the buses. Provision ex-ists to connect any one of the DGs to both the emergency buses.

3. LOSP frequency time correlation

For FBTR which has two redundant feeders and transformers,the time independent frequency of loss of offsite power is 4.7/y.The objective is to estimate the frequency of LOSP events, whoseduration is greater than or equal to a specified value. The frequencyof LOSP (kLOSP (t P T)) due to grid failure exceeding specified

Grid Supply

33kV IGCAR Feeder-2

33kV IGCAR Feeder-1

33kV / 6.6 kV FBTR Transformer-1 (TMtb 001)

MA

PS 2

30 k

V B

us

33kV / 6.6 kV FBTR Transformer-2 (TMtb 002)

To the loads of FBTR & SGTF, ITG

To the loads of FBTR

ON

NC33kV bus

6.6kV bus

Fig. 1. Off-site power distribution system at FBTR.

10-1 100 101 10210-2

10-1

100

101

Freq

uenc

y (/y

r)

Duration (hr)

Grid data Fit - (t) = 0 /(1+t)c

0 = 4.4, c = 1.234+0.08 Λ

λλ

Fig. 2. Loss of offsite power frequency as a function of power loss duration.

Table 1Calculated reliability parameters for DG

Sl. no. Parameter DG-1 DG-2

1 Fail to start probability 1.7e�03/de 5.0e�03/de2 Fail to run rate 3.2e�03/h 3.2e�03/h3 Unavailability 9.1e�02 7.7e�02

M. Ramakrishnan et al. / Annals of Nuclear Energy 35 (2008) 2332–2337 2333

duration as derived from FBTR data, is shown in Fig. 2 as points.Detailed analysis of offsite power failure data (Marimuthu et al.,2000) has shown that the frequency non-recovery time correlationis characterized by a power law (John Arul et al., 2003). The follow-ing equation is fitted to the data:

kgridðt P TÞ ¼ k0=ð1þ TÞc; ð1Þ

where k0 = 4.4 and c = 1.235. The power law fit for the LOSP data re-corded at FBTR is shown in Fig. 2.

The LOSP frequency at FBTR class IV bus level is obtained byadding the respective feeder and transformer failure rates withexponential non-recovery times as follows.

With only one feeder-transformer,

kð1ÞLOSPðt P TÞ ¼ kgridðt P TÞ þ kF � expð�T=TFRÞ þ kT � expð�T=TTRÞð2Þ

When both feeders and transformers are available,

kð2ÞLOSPðt P TÞ ¼ kgridðt P TÞ þ 2 � ½kF � expð�T=TFRÞþ kT � expð�T=TTRÞ� � ½UF þ UT� ð3Þ

where kF, kT – failure rates of feeder and transformer, respectively.UF, UT – unavailabilites of feeder and transformer. TFR, TTR – meantime to repair of feeder and transformer.

4. Evaluation of on-site emergency power system unavailability

In this study, the DGs and their configuration, auxiliaries andsupport systems, all important breakers and startup and bus trans-fer relay logics have been considered. The reliability of the emer-gency power supply system is evaluated using fault tree method.Immediate cause approach is followed as far as practicable. The

fault tree is developed using RISK SPECTRUM software. Compo-nents for which data from FBTR is not available, data from litera-ture is used (IAEA-TECDOC-478, 1988; IAEA-TECDOC-636, 1992).The generated cutsets are evaluated by TDCE method as describedin the next section. The reliability parameters calculated for DGfrom FBTR data are given in Table 1. The reliability block diagramfor on-site emergency power system is shown in Fig. 3. The abbre-viations for components in Fig. 3 are described in abbreviations list.

5. Station blackout frequency time correlation

The frequency of station blackout events exceeding a specifiedduration (kSBO(T)) is obtained by combining the model for the fre-quency of LOSP (kLOP(T)) with the unavailability of DG over theduration of interest (UDG(T)), i.e.,

kSBOðt P TÞ ¼ kLOSPðTÞ � UDGðTÞ ð4Þ

where kLOSP (T) is given by Eq. (3),

UDGðTÞ ¼ UDG � e�2T=Tr;

and Tr, the mean time taken to repair a DG, is taken as 8 h. Theparameter UDG is evaluated with fault tree method.

However, Eq. (4) is only an approximate time averaged expres-sion. There are several methods available to calculate the SBO fre-quency like fault tree method, time dependent cutset evaluationmethod and Markov method (IAEA-TECDOC-593,1991; Senthil Ku-mar et al., 2005) treating the time dependence more realistically.Here the time dependent cutset evaluation method is applied asfollows. In the time dependent cutset evaluation method forobtaining SBO frequency duration correlation, the cutsets gener-ated by fault tree method for DG unavailability are assigned timedependence based on the event combinations and then multipliedwith LOSP frequency correlation function and integrated. The de-tails of the method are explained below.

From the analysis of cutsets generated from fault tree analysis itis observed that cutsets of order greater than three are not contrib-uting significantly to the onsite emergency power system unavail-ability. So, cutsets which are of order up to three only have beenconsidered further for time dependent cutset evaluation. The cut-sets generated are in general in one of the following eventcombinations.

Case 1: The systems/components appearing in the cutset areunavailable at the instant of occurrence of LOSP. The integrationrule for this case is a simple multiplication as given below:

DG1

DG2

INCB DGBHW

H

H

ASBT2

ASBT1 INCB DCS1

DCS2

277A

117 B

287 A

BC

197 A

DGBHWM

DGBHWM

H

H

187A

217 B

100 B 100 A

DGBHW INCB INCB BC 200 B 200 A

UVR1

UVR2

177 A 127 B

267 A 227 B

Fig. 3. Reliability block diagram for onsite emergency power supply.

2334 M. Ramakrishnan et al. / Annals of Nuclear Energy 35 (2008) 2332–2337

kSBOðt P TÞ ¼ kLOSPðTÞ � U1 � e�l1T � U2 � e�l2T � U3 � e�l3T ; ð5Þ

where U1, U2, U3 are unavailabilities and l1, l2, l3 are respective re-pair rates.

Case 2: Two systems/components appearing in the cutset areunavailable at the instant of occurrence of LOSP and the third sys-tem/component is available at the instant of LOSP occurrence andsubsequently fails during the LOSP interval. This form is best illus-trated with the help of Fig. 4.

The SBO frequency contribution from this event combination is

kSBOðt P TÞ ¼Z 1

0kLOSPðT þ t1Þ � U1 � e�l1ðTþt1Þ � U2 � e�l2ðTþt1Þ

� ð1� PftsÞ:kre�kr t1 � e�lT dt1 ð6Þ

At t = 0, LOSP occurs. One of the DGs and one of the componentsare unavailable at t = 0. The other DG started successfully but failed

Time

1

0 t1 t=0

T

recovery

Fig. 4. State diagram for UUR case.

at time t1. For this condition to persist for a duration of T or morethe following conditions are to be satisfied.

(a) LOSP does not recover for a duration of t1 + T(kLOSP(T + t1)).(b) One of the DGs and the other component which are unavail-

able at t = 0, do not recover for a duration t1 + T(U1 � e�l1ðTþt1Þ � U2 � e�l2ðTþt1Þ).

(c) The DG which has started successfully and subsequentlyfailed at t1 does not recover for a duration T. (ð1� PftsÞ�kre�krt1 � e�lT ).

If the above conditions are satisfied then we can say that theSBO has occurred for a duration of T or more.

Case 3: A system/component appearing in the cutset is unavail-able at the instant of LOSP occurrence and the other two systems/components which are available at the instant of LOSP occurrence,subsequently failed at different instants during the LOSP interval.

This condition is illustrated with the help of Fig. 5.The SBO frequency contribution from this event combination is

kSBOðt P TÞ ¼Z 1

0

Z 1

t1

kLOSPðT þ t2Þ � U1 � e�l1ðTþt2Þ

� fð1� PftsÞ:kr1 e�kr1 t1 dt1g � e�l2ðTþðt2�t1ÞÞ

� ð1� PftsÞ � kr2 � e�kr2 t2 � e�l3T dt2 ð7Þ

At t = 0 LOSP occurs and one of the components is unavailable.Both the DGs started successfully on demand and one of the DGsfailed at time t1 and the other DG failed at time t2 (t2 > t1). For thiscondition to persist for a duration of T or more, the following con-ditions are to be satisfied.

(a) LOSP does not recover for a duration t2 + T (kLOSPðT þ t2Þ).(b) The component which is unavailable at t = 0, does not

recover for a duration t2 þ TðU1 � e�l1ðTþt2ÞÞ.

Time

t1 t=0

T

recovery

t2

1

0

Fig. 5. State diagram for URR case.

SBO Frequency Vs Duration

1.00E-05

1.00E-04

1.00E-03

1.00E-02

1.00E-01

1.00E+00

0 2 4 6 8 10 12 14 16 18 20Duration (hr)

SBO

Fre

quen

cy (/

yr) Double feeder-TDCE

Double feeder-Time Averaged

Fig. 6. Comparison of SBO frequency by TDCE and time averaged expressions.

Table 3CCF values used in sensitivity study

Sl.no.

Event ID Independentfailure rate/unavailability

Common cause failure rate/unavailability

b = 5% b = 10% b = 20%

1 Auto startup and bustransfer logiccommon cause failure

7.36E�04 3.68E�05 7.36E�05 1.47E�04

2 Station battery bankcommon cause failure

9.2E�05 4.60E�06 9.2E�06 1.84E�05

3 Buses hardwarecommon cause failure

8.0E�08 4.00E�09 8.0E�09 1.60E�08

4 DG fail to runcommon cause failure

3.2E�03 1.60E�04 3.2E�04 6.40E�04

5 DG fail to startcommon cause failure

4.17E�03 2.09E�04 4.17E�04 8.34E�04

1.00E-05

1.00E-04

1.00E-03

1.00E-02

1.00E-01

1.00E+00

0 2 4 6 8 10 12 14 16 18 20

Duration (hr)

SBO

Fre

q (/y

r)

Double Feeder beta=10%Double feeder beta=20%

Fig. 7. Station blackout frequency vs. the duration for different beta values.

M. Ramakrishnan et al. / Annals of Nuclear Energy 35 (2008) 2332–2337 2335

(c) The DG which has failed at t2 does not recover for a durationT. (ð1� PftsÞ � kr2 � e�kr2t2 � e�l3T ).

(d) The DG which has failed at t1 does not recover for a duration(t2 � t1 + T). (ð1� PftsÞ � kr1 � e�kr1t1 � e�l2ðTþðt2�t1ÞÞ).

Case 4: SBO is initiated by common cause failure of redundantcomponents or failure of common elements/components in thedistribution system. In this case the frequency of SBO of durationT or more is,

kSBOðt >¼ TÞ ¼ fsysðTÞ ð8Þ

where fsys (T) is the system failure frequency-time duration correla-tion function. The significant, maximum cutset order encounteredin this problem is three and minimum order is one. The expressionsfor the second and first order cutsets are obtained from the aboveexpressions applicable for third order cutset by setting the irrele-vant unavailability equal to 1 and repair rate equal to 0. The totalSBO frequency is the sum of contributions from the four majortypes of event combinations defined above. For FBTR, events of type4 could occur, for instance, due to failures in 415V bus sections.

Table 2SBO frequency if one of the feeders is unavailable for an additional 14 days in a year

SBOduration(h)

kSBO frequency (/y)

Single feedersystem (kSF)

Double feedersystem (kDF)

Double feeder – one feeder unavailabledays additional period/year (TDCE)

2 1.9E�2 6.1E�3 6.72E�34 1.1E�2 3.1E�3 3.41E�38 3.6E�3 9.3E�4 1.05E�316 4.6E�4 1.1E�4 1.21E�4

Since 415V bus section failure rates are very low of the order of1e�8/h, events of type 4 have not been considered.

6. Analysis of SBO results

A program in C++ was developed to carry out the time depen-dent cutset evaluation method by Simpson’s 1/3 rule. This programtakes the cutsets generated from fault tree and data for basicevents as input and generates the results as SBO frequency vs.duration. The SBO frequency calculated by time averaged expres-sions are 5.42e�4/ry for SBO duration of 8 h and 4.81e�5/ry forSBO duration of 16 h. By this TDCE method the SBO frequency is9.26e�4/ry for SBO duration of 8 h and 1.05e�4/ry for SBO dura-tion of 16 h. The comparison of SBO frequency between TDCEmethod and approximate time averaged expressions are shownin Fig. 6. From Fig. 6 it is clear that the time averaged expressionunder predicts the SBO frequency by a factor of �2 for SBO dura-tion of 8 h and 16 h.

The SBO frequency for FBTR, if one of the feeders is taken out formaintenance for an additional period of ‘n’ days in a year is ob-tained by increasing the feeder’s maintenance unavailability by

for 14 Fractional increase(kSF/kDF � 1)/365

Double feeder – one feeder unavailable for 14days additional period/year (extrapolation)

5.8E�03 6.6E�037.0E�03 3.4E�037.9E�03 1.0E�038.7E�03 1.2E�04

31%

26%

21%

7%

5%

5%3% 1%1% CL3-DGA-FR-RCCF

CL3-DGA-FR-DG02 CL3-DGA-UM-DG01CL3-DGA-FR-DG01 CL3-DGA-UM-DG02CL3-DGA-FR-DG01 CL3-DGA-FR-DG02CL3-DGA-FS-DG02 CL3-DGA-UM-DG01CL3-DGA-FS-SCCF

CL3-DGA-FS-DG01 CL3-DGA-UM-DG02CL3-DGA-FR-DG01 CL3-DGA-FS-DG02CL3-DGA-FR-DG02 CL3-DGA-FS-DG01

Fig. 8. Pie chart of onsite emergency power sub-system contributions.

2336 M. Ramakrishnan et al. / Annals of Nuclear Energy 35 (2008) 2332–2337

an additional period of ‘n’ days. If one of the feeders is taken out formaintenance for an additional period of 14 days in a year, the SBOfrequency increases by 10% for 4 h duration and by 13% for 8 hduration. The ratio (r = kSF/kDF) of single feeder blackout frequencyto double feeder blackout frequency is about 3.1 (for 2 h) to 4.2 (for16 h duration). The results are given in Table 2. The extrapolatedSBO frequency for one feeder non-availability for n-additionaldays/year is k0DF (n) = kDF (1 + (r � 1)/365 � n). From Table 2 it isclear that the extrapolation technique and TDCE technique predictsthe SBO results closely for ‘n’ days of additional outage in a year.

7. Uncertainty and sensitivity analysis

Sensitivity analysis: The SBO frequency has been computed byvarying CCF factor for important components. The componentsfor which b factor variation is studied are shown in Table 3.Increasing beta value increases the SBO frequency without chang-ing the shape of the curve. The results are shown in Fig. 7.

Uncertainty analysis: Uncertainty analysis of SBO frequency isdone by Monte Carlo Method. All basic event data are sampledusing lognormal distribution constructed from available medianfailure rate (x0) and error factor (EF). Box-Muller method (Boxand Muller, 1958) is used for generating log-normal samples. Thefollowing equations are used:

U1 ¼ sqrtð�2lnðr1ÞÞ� sinð2pr2Þ ð9ÞU2 ¼ sqrtð�2lnðr1ÞÞ� cosð2pr2Þ ð10Þk1 ¼ x0 expðsU1Þ; k2 ¼ x0 expðsU2Þ ð11Þ

In these equations, k1 and k2 are the simulated values of twoindependent log normal variables with parameters (s, x0), ands = ln (EF)/1.645, and r1 and r2 are uniformly distributed randomnumbers. The uncertainty analysis indicates that the results inthe magnitude of SBO could be uncertain by a factor of 3.

8. Discussion of the results

The frequency of offsite power loss is 4.7 ± 0.3/y. The onsiteemergency power system unavailability calculated by Fault Treemethod is 8.1E�3. It is dominated by the second order cutset withrun failure of a DG as one event and the unavailability of anotherdue to breakdown or preventive maintenance as the other event.

The percentage contribution due to this is (26 + 21 = 47%) and isfollowed by CCF of DG to run (31%) as shown in Fig. 8.

The increase in SBO frequency, if one of the feeders is taken outfor maintenance for 14 days over the parallel operation of twofeeders case, is about 10% for SBO duration of 2 h and 16 h. Thesimple time averaged method under predicts the SBO frequencyby a factor of �2 for SBO duration of 8 h and 16 h. The contributionto SBO frequency from explicit common elements such as bus sec-tion failures is negligible.

9. Conclusion

The frequency of loss of offsite power (LOSP) at FBTR is found tobe 4.7/y. Onsite data on the LOSP and failure data on feeders andtransformers at FBTR are used to arrive at the frequency of LOSPas a function of down time. The non-recovery probability of offsitepower failure with time is represented by a power law. The cutsetsand unavailability of onsite emergency power supply are evaluatedwith the Fault Tree method. The cutsets were transformed to timedependent form, and integrated with LOSP frequency duration cor-relation to get the SBO frequency duration correlation at FBTR.These results are compared with the results arrived at by usingsimple time averaged expressions. The increase in SBO frequencyfor one feeder outage of ‘n’ days was also analyzed. The sensitivitywith respect to common cause failure parameter (b) is also ana-lyzed. The time dependent cutset method is found to be accuratecompared with the time average method for making decisions onallowed outage time of equipment where errors of factor 2 aresignificant.

Acknowledgements

The authors are thankful to Director IGCAR, Director REG, Direc-tor ROMG for their guidance and active support. The authorsacknowledge the support and motivation received from AssociateDirector (Operation & Maintenance, ROMG) and Head, RPD.

References

Baranowsky, P.W., 1988. Evaluation of Station Blackout Accidents at Nuclear PowerPlants, NUREG-1032.

Battle, R.E., Campbell, D.J., 1983. Reliability of Emergency AC Power Systems atNuclear Power Plants, NUREG/CR-2989, ORNL/TM-8545. ORNL, USA.

Box, G.E.P., Muller, M.E., 1958. Annals of mathematical statistics 29, 610.

M. Ramakrishnan et al. / Annals of Nuclear Energy 35 (2008) 2332–2337 2337

IAEA-TECDOC-478, 1988. Component Reliability Data for use in Probabilistic SafetyAnalysis, IAEA, Vienna.

IAEA-TECDOC-593, 1991. Case Study on the Use of PSA Methods: Station BlackoutRisk at Millstone Unit 3, IAEA, Vienna.

IAEA-TECDOC-636, 1992. Manual on Reliability Data Collection for Research ReactorPSAs, IAEA, Vienna.

John Arul, A., Senthil Kumar, C., Marimuthu, S., Om Pal Singh, 2003. The power lawcharacter of offsite power failures. Annals of Nuclear Energy 30, 1401–1408.

Marimuthu, S., Theivarajan, N., Senthil Kumar, C., 2000. Statistics of Off-Site PowerFailure at Kalpakkam, REV-A, PFBR/01160/DN/1000.

Senthil Kumar, C., John Arul, A., Om Pal Singh, 2005. New Methodologies for StationBlackout Studies in Nuclear Power Plants, ICRESH05, Mumbai.