Offsite Power (Grid) Reliability

Transcription

1 Offsite Power (Grid) Reliability SECY Evaluation BLUE text is from the SECY The loss of all alternating current (AC) power at nuclear power plants involves the simultaneous loss of offsite power (LOOP), turbine trip, and the loss of the onsite emergency power supplies (typically EDGs). This situation is called a station blackout (SBO). Risk analyses of nuclear power plants indicate that the loss of all AC power can be a significant contributor to the core damage frequency. Although nuclear power plants are designed to cope with a LOOP event by using onsite power supplies, LOOPs are considered to be precursors to SBO. In particular, a potentially significant increase in NPP risk may occur if equipment required to prevent and mitigate station blackout is unavailable when the grid is degraded. LOOP events can also have numerous unpredictable initiators such as natural events, potential adversaries, human error, or design problems. Pursuant to 10 CFR 50.63, Loss of all alternating current power, the NRC requires that each NPP licensed to operate be able to withstand an SBO for a specified duration and recover from the SBO. The likelihood of LOOP and SBO should be considered in the maintenance risk assessment, whether quantitatively or qualitatively. If the grid reliability evaluation indicates that degraded grid reliability conditions may exist during maintenance activities, the licensee should consider rescheduling any grid-risk-sensitive maintenance activities (i.e., activities that tend to increase the likelihood of a plant trip, increase LOOP frequency, or reduce the capability to cope with a LOOP or SBO). A turbine trips is only a consequence of LOOP for most plants (depending on how the switchyard is arranged). Repeating an exaggeration made as early as the issuance of Regulatory Guide (see first paragraph under ʻDiscussionʼ and later on page 2 of 19 in Attachment 1) serves no purpose. A LOOP does not automatically result in SBO, which is implied by the text above. An increase in the frequency or duration of LOOPs increases the risk of core damage. Recent NRC studies have found that since 1997, LOOP events have occurred more frequently during the summer (May through October) than before 1997, that the probability of a LOOP event due to a reactor trip has also increased during the summer months, and the durations of LOOP events have generally increased. The staff is concerned about extended maintenance activities scheduled for equipment required to prevent and mitigate station blackout during these months, especially in areas of the country that experience a high level of grid stress. The evidence is clear. There are many LOOP events and turbine trip (loss-of-load) in the database but no recent events (~10 years) that have resulted in SBO. Note that there are nominally two busses (corresponding to the two safety-trains), each with their own connection to the grid via a station transformer. That means that it would take two fast transfer failures to

2 create a complete dual-safety train LOOP event. LOOP to a particular safety bus is in fact a significant and high frequency initiator compared to other initiators. But, SBO frequency is only hypothetical, derived from combining the dual-safety-train LOOP frequency estimate with a model of the on-site AC system. Note that LOOP frequency itself is a combination of plantcentered, weather-related, and grid-centered frequency estimates. As polices and procedures improve at the NPPs, the number of plant-centered LOOP events has fallen over time, while the exogenous grid and weather events remain near their historical levels. That makes grid and weather LOOPs relatively more important, not necessarily more frequent as implied by SECY LOOP duration is a strong function of the type of LOOP (i.e., plant-centered, weather-related, grid-centered). The simple methods apparently used to infer that LOOP durations are increasing gloss over the removal of relatively short LOOP durations arising from plant-centered LOOPs no longer as prominent in the data as they were when Regulatory Guide was issued. A communication interface with the plantʼs TSO, together with training and other local means to maintain NPP operator awareness of changes in the plant switchyard and offsite power grid, is important to enable the licensee to determine the effects of these changes on the operability of the offsite power system. grid reliability evaluations should be performed as part of the maintenance risk assessment required by 10 CFR (or in any reassessment.) To perform meaningful and comprehensive grid reliability evaluations (or reevaluations as appropriate), it is essential that the NPP communicate with the TSO before, and periodically for the duration of, grid-risk-sensitive maintenance activities. The communication between the NPP and its TSO should enable the NPP operator to obtain up-to-date information on existing and projected grid reliability for use in maintaining a current and valid maintenance risk assessment and in managing possibly changing risk. Accordingly, licensees should perform grid reliability evaluations as part of the maintenance risk assessment required by 10 CFR before performing grid-risk-sensitive maintenance activities (such as surveillances, post-maintenance testing, and preventive and corrective maintenance). Such activities are those which could increase risk under existing or imminent degraded grid reliability conditions, including (1) conditions that could increase the likelihood of a plant trip, (2) conditions that could increase the likelihood of LOOP or SBO, and (3) conditions impacting the plantʼs ability to cope with a LOOP or SBO, such as out-of-service risk-significant equipment (e.g., an EDG, a battery, a steam-driven pump, an alternate AC power source, etc.). The awareness of offsite power grid parameters may cause the NPP to defer certain maintenance tasks, particularly on the EPS. Many of the maintenance tasks are done in compliance with the license, particularly surveillance requirements. The licensees should propose a blanket relief request from regulatory penalty for deferring maintenance when grid conditions make it prudent to do so.

3 The communication with the TSO should include whether a loss of the NPPʼs electrical output could impact the local grid, as do two of the three types of grid-risk-sensitive maintenance (activities that increase the likelihood of (1) a plant trip and (2) a LOOP). It is important that the NPP operator know when the transmission system near the NPP cannot sustain a reasonable level of contingencies. The TSO has particular control objectives for the power grid. Remain within normal ratings and voltage ranges for all lines in service Remain within emergency limits for outages of elements (contingency analysis) Maintain frequency within specified ranges Minimize frequency deviations Maintain synchronous stability Maintain voltages within specified ranges Maintain reactive power balance Maintain parameters at interfaces to adjacent power grid networks Standard industrial practice for contingency analysis (for example, in New England ISO E. Litvinov, Power system and LMP fundamentals, ISO New England Inc, Holyoke, MA, Available: Lap.pdf ) proceeds in following steps (so called simultaneous feasibility test ): (1) calculate base full AC power flow (or state estimation in real-time); (2) check all limiting elements for violations; (3) screen all the contingencies this is a process of simulating each contingency from the given set one by one by DC power flow-based analysis; (4) check each for potential violations, and (5) run all suspicious contingencies through the full AC power flow analysis. One of the main concerns in the operation of a power system is its security. Security of a power system (under this topic power system means generation and transmission systems) is its ability to withstand some unexpected, but probable disturbances (contingencies) without violating the operating constraints in the remaining system. Typical examples for contingencies are bus bar faults, load and generator losses, transmission line trips, etc. It is vital to know to what extent a power system is secure or reasonably safe to operate. This information is obtained by assessing the security of the power system under probable contingencies. This process is known as security assessment (security analysis) and can be classified into two groups; namely, static security assessment (SSA) and dynamic security assessment (DSA). Real-time or on-line security assessment is the analysis performed on a power system to determine the security level of a power system on a real-time basis. After the real-time security assessment on a power system, if it was found that the power system is insecure towards a particular contingency, an appropriate preventative actions can be taken to make the system

4 secure. Security analysis has been implemented through a number of software packages in modern energy management systems. The frequency of running the security assessment software on a power system depends entirely on the operational sophistication of the particular utility. The typical frequency is hourly. In the absence of maintenance scheduling decisions, a degraded power grid would most likely become more so if the plant were to make any change in its output (especially in terms of MVARs supplied by the main generator). When the TSO needs this MVAR support, the communication between the TSO and the plant become quite active. It is unclear that the public would benefit from routine communications rather than specific communication needed to avoid degraded power grid conditions. Because grid conditions change throughout the day, thoughtless requirements for TSO communications with the NPP would distract the NPP operators from their primary safety mission. Frequent unimportant messages from the TSO are likely to cause the NPP operators to discount the significance of any particular message whereas currently, the TSO would only contact the NPP in extraordinary circumstances that the NPP operators should pay attention to. It was not always clear from the data collected in accordance with TI 2515/156 whether the TSO would notify the NPP of inadequate transmission system contingency voltages or inadequate voltages required for the NPP SSC operability. The transmission network (grid) is the source of power to the offsite power system. The final paragraph of GDC 17 requires, in part, provisions to minimize the probability of the loss of power from the transmission network given a loss of the power generated by the nuclear power unit(s). The loss of the power generated by the nuclear power unit (trip) is an anticipated operational occurrence. The offsite power circuits must therefore be designed to be available following a trip of the unit(s) to permit the functioning of SSCs necessary to respond to the event. Generally, operating criteria that are in place to prevent transient stability and voltage stability problems are developed off-line and the resulting operating criteria are put into operating procedures. Contingency analysis that only considers thermal branch/transformer limits can be performed on-line. The implicit NERC assumption, followed by all reliability council regions, is that all contingencies are equal. But there are different kinds of contingencies. A contingency event can result in a voltage event (a voltage declines below a safe level), a stability event (the electric system enters into an unstable oscillation), or a thermal event (transmission lines, or other circuit elements such as transformers, heat to an unsafe temperature). [T]his assumption [that all contingencies are equal] is not correct. A voltage or stability event can happen at any moment following a contingency event. For example, in 1996, it took only 27 seconds after a voltage contingency in Portland, OR for the blackout on the West Coast to travel as far as El Paso, TX. Voltage and stability events are deterministic and uncontrollable, and must be avoided at all times, even at high costs.

5 On the other hand, thermal events are probabilistic. A thermal event - an unsafe temperature of a transmission line or a substation component - occurs only if the line current is high at the same time when cooling conditions are poor and if the condition persists for long enough for the conductor and/or other circuit elements to heat to a critical temperature. This heating, depending on the size and characteristics of the line, takes approximately minutes. Thus, not surprisingly, most assumed thermal overload events do not happen in reality. The contingency voltage is an estimate based on a hypothetical, not an actual condition of the power grid. Aside from contractual assurances, the NPP has no leverage over the day-to-day operation of the power grid. Nowhere in the 10CFR does it specify that the power grid must support the NPP under one or more hypothetical contingencies except for a trip of the NPP itself. If the critical contingency were the NPP trip, then clearly the least favorable action would be to exacerbate the situation by beginning to reduce the power produced by the NPP. Inadequate NPP contingency post-trip switchyard voltages will result in TS inoperability of the NPP offsite power system due to actuation of NPP degraded voltage protection circuits during certain events that result in an NPP trip. The RTCA programs in use by the TSOs, together with properly implemented NPP/TSO communication protocols and training, can keep NPP operators better informed about conditions affecting the NPP offsite power system. However, the RTCA programs are not always available to the TSO. This was the case during the period leading up to the August 14, 2003, blackout; and events have shown that the data used in the programs sometimes do not represent actual conditions and capabilities. These shortcomings have been offset to some degree by notification of RTCA unavailability to NPP operators. The NPP operators then perform operability determinations to assess post-trip switchyard voltages following inadvertent NPP trips. for the duration of grid-risk-sensitive maintenance activities (i.e., activities that could increase risk under degraded grid reliability conditions). Unavailability of plant-controlled equipment such as voltage regulators, transformer auto tap changers, and generator automatic voltage regulation can contribute to the more frequent occurrence of inadequate NPP post-trip voltages. Some licensees communicate routinely with their TSOs once per shift to determine grid conditions, while others rely solely on the TSOs to inform them of deteriorating grid conditions and do not inquire about grid conditions before performing grid-risk-sensitive maintenance activities. Some licensees do not consider the NPP post-trip switchyard voltages in their evaluations, and some do not coordinate grid-risk-sensitive maintenance with their TSOs. The licensees should propose a surveillance requirement that amounts to a preventive maintenance task on equipment such as voltage regulators, transformer auto tap changers, and generator automatic voltage regulation. The surveillance requirement should be a MODE change restriction requiring completion prior to commencing power production (typically the transition from MODE 2 to MODE 1).

6 Preestablished agreements between NPP and TSOs that identify local power sources and transmission paths that could be made available to resupply NPPs following a LOOP event and NPP operator training help to minimize the durations of LOOP events, especially unpredictable LOOP events. Section 2 of RG provides guidance on the procedures necessary to restore offsite power, including losses following grid under voltage and collapse. Section 2 states: Procedures should include the actions necessary to restore offsite power and use nearby power sources when offsite power is unavailable. These procedures are a necessary element in minimizing LOOP durations following a LOOP or SBO event. Section 55.59(c)(3)(i) requires operator requalification programs to include on-the-job training on a number of control manipulations and plant evolutions if they are applicable to the plant design; the loss of electrical power (or degraded power sources) is but one of the evolutions to be performed annually by each operator. Moreover, section 55.59(c)(3)(iv) requires each licensed operator and senior operator to review the contents of all abnormal and emergency procedures on a regularly scheduled basis. It is possible to negotiate an agreement with the TSOs to identify local power sources and transmission paths that could be made available to re-energize the NPP switchyard busses following LOOP. However, such an agreement cannot be compelled without federal legislation. It is doubtful that the intent of the GL was to impugn NPP operator training in general, or in terms of the electrical system in particular. The point of NPP operator training being able to in some way shorten LOOP durations is specious. With the NPP off-line (as in most LOOP events), the NPP operators are in a poor position to offer assistance to the TSO in attempting to re-energize the NPP switchyard busses. The NPP licensees may agree with the TSO to provide electrical maintenance craft (on a contingency basis to the TSO) who would then perform tasks in the NPP switchyard requiring human actions. Training money would be most effectively spent on the NPP electrical maintenance craft rather than on the NPP operators. The trip of an NPP can affect the grid so as to result in a LOOP. Foremost among such effects is a reduction in the plantʼs switchyard voltage as a result of the loss of the reactive power supply to the grid from the NPPʼs generator. If the voltage is low enough, the plantʼs degraded voltage protection could actuate and separate the plant safety buses from offsite power. Less likely results of the trip of a nuclear plant are grid instability, potential grid collapse, and subsequent LOOP due to the loss of the real and/or reactive power support supplied to the grid from the plantʼs generator. This statement is hypothetically true, but unlikely. The reasons LOOP occur at a particular site can be hypothetically related to the physical position of the plant on the grid, the number of circuits to the plant, the number of nearby MVAR providers, and the distance to industrial (inductive) loads. In a shutdown condition, the house load at nuclear plant is on the order of 20MWe. As the house load is relatively small, the nearby grid is usually able to flawlessly

7 accommodate a sudden load shed by the nuclear power plant main generator. Because the house load is relatively small, the likelihood is quite small that the power grid at-large is unable to support house loads (and thus making a LOOP a rare condition). The use of the term RTCA throughout the GL oversimplifies the set of tools TSOs used to evaluate power grid conditions in real-time. 1 Network Topology Processor Computes the correct status of the network connectivity as a front-end to the State Estimator to reduce mismatches and improve robustness. 2 State Estimator (SE) Provides a reliable real time ac power flow model and system snapshot computed at least every 2 minutes with mismatches less than 10 MVA. Used for RTCA and other Reliability based and Market based applications. 3 Real Time Contingency Analysis (RTCA) Contingency analysis computed at least every 5 minutes for all internal facilities typically 100 kv and above and for all facilities external to the foot-print that have the potential for adverse impact within the internal system 4 Critical Facility Loading Assessment Assesses the post contingency loading of critical facilities using telemetry data and Line Outage Distribution Factors (LODF) at least every 5 seconds with LODFs updated on status change. This is a fall back should the state estimator fail to solve. 5 Dynamic Security Assessment (DSA) Voltage stability Transient stability Small signal stability Near real time determination of system operating limits based on transient and voltage stability assessment using a snap-shot of the real-time system. Also derivation of minimum voltages at key buses & minimum dynamic reactive reserves required in local areas.

8 6 Real Time Thermal Capability Assessment Real time evaluation of line ampacity, cable ampacity and transformer capability based on measured ambient conditions and pre-load or dynamic field measurements 7 Real Time Short Circuit Level Assessment Real time evaluation of 3 ph and L-G short circuit levels of buses 100 kv and above based on prevailing generation & transmission conditions. This determines the need for operating actions such as split bus operation and conditions when the buses can be operated solid. If there is some overriding need to perform grid-risk-sensitive maintenance activities under existing or imminent conditions of degraded grid reliability, the licensee should consider alternate equipment protection measures and compensatory actions to manage the risk. Offsite power availability is one example given of an emergent condition that could change the conditions of a previously performed risk assessment. Licensees should reassess the plant risk in view of an emergent condition that affects an existing maintenance risk assessment, except as discussed below, and should take a worsening grid condition into account when doing so. However, as discussed in the Statements of Consideration for 10 CFR 50.65(a)(4) and also in the associated industry guidance (revised Section 11 of NUMARC 93-01), this reassessment of the risk should not interfere with or delay measures to place and maintain the plant in a safe condition, in general, or in response to or preparation for the worsening grid conditions. Note also that as discussed in the Statements of Consideration for 10 CFR 50.65(a)(4) and also in the associated industry guidance (revised Section 11 of NUMARC 93-01, Revision 3), if the emergent condition (including degrading grid reliability) is corrected (or ceases to exist) before the risk reassessment is completed, the reassessment need not be completed. In the event the contingency analysis results in an under voltage prediction, and an INOPERABLE condition results, the GL proposes no remedy. Clearly, one of the least feasible options would be to deny the TSO the power and MVAR generating capacity of the NPP in this delicate period. As it is a computer program based on relatively real-time inputs, the contingency analysis can fluctuate between adequate voltage and inadequate voltage. In fact, the state estimator (on which the RTCA relies) of the key TSO on August 14, 2003, was not in its routine automatic mode for several hours in the early afternoon because inconsistent data was keeping it from arriving at a reasonable solution. It is unreasonable to maneuver the output of the NPP directly as a function of the predictions of a contingency analysis. As corrective maintenance of the most critical nature is allowed while on-line for up to 72 hours on many SSCs, it is unreasonable for the NPP to change its state in short order based on only the results of a contingency analysis.

9 It is unlikely that a low-voltage condition would occur for more than a few hours as the power grid load changes over the course of a day. Note that the wide spread outage of August 14, 2003 was preceded by an hourʼs worth of erratic indications followed by the key fault which propagated through the system in a matter of seconds. Presuming the TSOs involved had the time to call the various NPPs (during the hour or so the TSO worked to stabilize the situation), knowledge of the degrading condition would have little practical benefit to the NPP operators. The most practical action the NPP operators could have taken on August 14, 2003, would have been to do what they in fact did, i.e., keep the generator running at a steady state while the TSOs selectively shed load from the power grid. In summary, the NPP operator should know and stay informed of the general condition of the NPP offsite power system and be adequately trained to assess and manage risk under the Maintenance Rule before performing and for the duration of grid-risk-sensitive maintenance activities (i.e., activities that could increase risk under degraded grid reliability conditions). Unavailability of plant-controlled equipment such as voltage regulators, transformer auto tap changers, and generator automatic voltage regulation can contribute to the more frequent occurrence of inadequate NPP post-trip voltages. Some licensees communicate routinely with their TSOs once per shift to determine grid conditions, while others rely solely on the TSOs to inform them of deteriorating grid conditions and do not inquire about grid conditions before performing grid-risk-sensitive maintenance activities. Some licensees do not consider the NPP post-trip switchyard voltages in their evaluations, and some do not coordinate grid-risk-sensitive maintenance with their TSOs. The licensees should propose a surveillance requirement that amounts to a preventive maintenance task on equipment such as voltage regulators, transformer auto tap changers, and generator automatic voltage regulation. The surveillance requirement should be a MODE change restriction requiring completion prior to commencing power production (typically the transition from MODE 2 to MODE 1). Preestablished agreements between NPP and TSOs that identify local power sources and transmission paths that could be made available to resupply NPPs following a LOOP event and NPP operator training help to minimize the durations of LOOP events, especially unpredictable LOOP events. Section 2 of RG provides guidance on the procedures necessary to restore offsite power, including losses following grid undervoltage and collapse. Section 2 states: Procedures should include the actions necessary to restore offsite power and use nearby power sources when offsite power is unavailable. These procedures are a necessary element in minimizing LOOP durations following a LOOP or SBO event. Section 55.59(c)(3)(i) requires operator requalification programs to include on-the-job training on a number of control manipulations and plant evolutions if they are applicable to the plant design;

10 the loss of electrical power (or degraded power sources) is but one of the evolutions to be performed annually by each operator. Moreover, section 55.59(c)(3)(iv) requires each licensed operator and senior operator to review the contents of all abnormal and emergency procedures on a regularly scheduled basis. It is possible to negotiate an agreement with the TSOs to identify local power sources and transmission paths that could be made available to re-energize the NPP switchyard busses following LOOP. However, such an agreement cannot be compelled without federal legislation. It is doubtful that the intent of the GL was to impugn NPP operator training in general, or in terms of the electrical system in particular. The point of NPP operator training being able to in some way shorten LOOP durations is specious. With the NPP off-line (as in most LOOP events), the NPP operators are in a poor position to offer assistance to the TSO in attempting to re-energize the NPP switchyard busses. The NPP licensees may agree with the TSO to provide electrical maintenance craft (on a contingency basis to the TSO) who would then perform tasks in the NPP switchyard requiring human actions. Training money would be most effectively spent on the NPP electrical maintenance craft rather than on the NPP operators. The trip of an NPP can affect the grid so as to result in a LOOP. Foremost among such effects is a reduction in the plantʼs switchyard voltage as a result of the loss of the reactive power supply to the grid from the NPPʼs generator. If the voltage is low enough, the plantʼs degraded voltage protection could actuate and separate the plant safety buses from offsite power. Less likely results of the trip of a nuclear plant are grid instability, potential grid collapse, and subsequent LOOP due to the loss of the real and/or reactive power support supplied to the grid from the plantʼs generator. This statement is hypothetically true, but unlikely. The reasons LOOP occur at a particular site can be hypothetically related to the physical position of the plant on the grid, the number of circuits to the plant, the number of nearby MVAR providers, and the distance to industrial (inductive) loads. In a shutdown condition, the house load at nuclear plant is on the order of 20MWe. As the house load is relatively small, the nearby grid is usually able to flawlessly accommodate a sudden load shed by the nuclear power plant main generator. Because the house load is relatively small, the likelihood is quite small that the power grid at-large is unable to support house loads (and thus making a LOOP a rare condition). Nuclear power plants generate electricity as well as consume part of it for in-house electric loads. In a four reactor coolant pump (RCPs) PWR, ~20MWe is needed to run those pumps. The circulating water pumps are typically just as large and just as numerous. The 1000MWe class of nuclear plants almost exclusively uses 4160-volt pumps for tasks like component cooling water and service water. Some of the plants have electric-motor-driven (MD) main feedwater pumps. All together, a nuclear power plant operating at rated power could itself consume on the order of 50MWe. That load is colloquially referred to as the house load. As it is evident from this discussion, after a nuclear plant trips many of its large normally operating pumps no longer are needed. An off-line plant uses one or two reactor coolant pumps, maybe one circulating water pump for shutdown cooling (i.e., residual heat removal). Component cooling water and service water demands typically increase during shutdowns, so those loads

11 remain. In a shutdown condition, the house load at nuclear plant is on the order of 20MWe. Thus, the small number of LOOP events should be of no surprise. For economic reasons, many NPPs provide their own house loads when on-line. That is, the generator step-up transformer connects to unit auxiliary transformers and those are connected to the various buses. At these plants, when the generator trips off-line, the electrical system is set to transfer electric load from the unit auxiliary transformer to the startup transformer, which is the interface to the plant switchyard and the grid at-large. This introduces a means of plantcentered LOOP that does not exist at every NPP. The plant-centered LOOP frequency is mainly a measure of the reliability of this fast transfer feature. The load needs to move to the startup transformer within a few AC-cycles (e.g., three is typical). Relaying protects electrical equipment from being connected to two sources of power at the same time, but takes a nonzero amount of time to react. If the fast transfer were successful, then those relays will not act. Note that there are nominally two busses (corresponding to the two safety-trains), each with their own connection to the grid via a station transformer. That means that it would take two fast transfer failures to create a complete dual-safety train LOOP event. Nuclear power plants generate electricity as well as consume part of it for in-house electric loads. In a four reactor coolant pump (RCPs) PWR, ~20MWe is needed to run those pumps. The circulating water pumps are typically just as large and just as numerous. The 1000MWe class of nuclear plants almost exclusively uses 4160-volt pumps for tasks like component cooling water and service water. Some of the plants have electric-motor-driven (MD) main feedwater pumps. All together, a nuclear power plant operating at rated power could itself consume on the order of 50MWe. That load is colloquially referred to as the house load. As it is evident from this discussion, after a nuclear plant trips many of its large normally operating pumps no longer are needed. An off-line plant uses one or two reactor coolant pumps, maybe one circulating water pump for shutdown cooling (i.e., residual heat removal). Component cooling water and service water demands typically increase during shutdowns, so those loads remain. In a shutdown condition, the house load at nuclear plant is on the order of 20MWe. Thus, the small number of LOOP events should be of no surprise. For economic reasons, many NPPs provide their own house loads when on-line. That is, the generator step-up transformer connects to unit auxiliary transformers and those are connected to the various buses. At these plants, when the generator trips off-line, the electrical system is set to transfer electric load from the unit auxiliary transformer to the startup transformer, which is the interface to the plant switchyard and the grid at-large. This introduces a means of plantcentered LOOP that does not exist at every NPP. The plant-centered LOOP frequency is mainly a measure of the reliability of this fast transfer feature. The load needs to move to the startup transformer within a few AC-cycles (e.g., three is typical). Relaying protects electrical equipment from being connected to two sources of power at the same time, but takes a nonzero amount of time to react. If the fast transfer were successful, then those relays will not act. Note that there are nominally two busses (corresponding to the two safety-trains), each with their own connection to the grid via a station transformer. That means that it would take two fast transfer failures to create a complete dual-safety train LOOP event.