A widespread power outage in Florida occurred just after 1 PM Eastern today affecting several millions of Florida customers. Two of Florida's five nuclear reactors were shutdown as a result of the outage. Here is a statement from the Nuclear Regulatory Commission:
At approximately 1:09 p.m. today, Turkey Point's two nuclear reactors (units 3 and 4) automatically shut down from 100% power in response to an "undervoltage" caused when two power distribution lines between Miami and Daytona went down following an equipment malfunction in a substation near Miami. The automatic trip of the reactors is a safety measure to protect plant equipment from abnormal power line voltages. The reactors are likely to be shut down for 12 to 24 hours, as part of a regular re-start protocol, with offsite power sources remaining available. Emergency diesel generators were not necessary.Here is the Nuclear Energy Institute's statement on the outage:
As the result of a disturbance in off-site power that led to an electricity outage throughout much of Florida, the two reactors at the Turkey Point power station in south Florida safely shut down earlier today. They were among several power plants, including fossil-fired power plants, that shut down today. The Nuclear Energy Institute’s executive vice president, Marvin Fertel, made the following remarks about nuclear power plant operations and design relative to this event.
“Nuclear power plants are designed to shut down safely in response to electrical grid disturbances. They have been required to do so on many occasions over the years, most notably during the August 2003 blackout that afflicted the Northeast and Midwest regions of the United States.
“As required by the Nuclear Regulatory Commission, nuclear power plants have on-site emergency backup power supplies available that enable them to be maintained in a safe condition if sufficient off-site power is not available. Backup power typically is provided by diesel generators, and more than sufficient fuel supplies for the generators are present on-site as well.
“Once the electricity grid is functioning and ready to be re-energized, power plant operators will follow precise procedures designed to ensure the safe restart of the Turkey Point power station’s two reactors to return electricity to the distribution grid. The start-up process typically takes approximately five hours if the power plant is in a ‘stand-by’ rather than a ‘shutdown’ mode. Start-up times for affected nuclear plants will vary depending on circumstances at each facility.
“Nuclear power plants’ electronic security systems also have independent back-up power to keep them functioning. Beyond that, nuclear power plants are protected by a paramilitary security force of highly trained, well-armed officers. Power plants also are protected by a combination of robust structural plant designs and redundant physical barriers.
“Specific questions concerning this power outage are properly addressed to the energy companies operating in Florida.”
Comments
I'd like to see a real engineer provide a real explanation of why the plants scrammed out, as opposed to the typical fluff piece above. My personal suspicion is that, as is common in the U.S. nuc generation industry, the plants that shut down are so transient-intolerant that an unplanned loss of steam load causes a transient primary overpressure beyond the plant's response capability. (A sudden steam load decrease caused by generator shutdowns necessitated by grid conditions removes the principal means of removing heat energy from the primary circuit. Reactor power does not immediately decrease to match the reduced rate of heat removal from the primary circuit, leading to greater heat content in the primary circuit. Water expands when heated, raising primary pressure. Adequately-designed plants [e.g. U.S. Navy propulsion plants] have sufficient pressurizer, surge line, and pressurizer spray capacity to mitigate pressure excursions caused by the design downpower transient.) The design-on-a-dime U.S. nuc power industry and its toothless NRC watchdog don't think this is important, leaving a protective shutdown and relief valve lifts as mitigation measures. Students of history will note that a similar loss-of-steam-load casualty caused the Three Mile Island accident, although the initiating cause was not 'legitimate' as appears to be case here, and it took a determined team of incompetents almost a day and a half after the initiating minor screwup to implement an elaborate casualty chain in melting a third of a perfectly good reactor core.
(For history buffs, at TMI, sloppy maintenance upon the condensate system caused a protective shutdown of the pumps injecting steam-cycle feedwater into the steam generators. Typical of the U.S. civilian nuc industry, the minimal-volume steam generators will boil dry within single-digit seconds of a loss of feed, creating a loss-of-steam-load condition. An immediate shutdown is needed to protect the plant from primary overpressure caused by loss of steam load. [So far so good, except for the customers' lights...] The transient-intolerant plant then lifts a pressurizer steam relief to protect itself. [So far, so good, if you buy that inadequate pressurizer capacity is an acceptable design and venting the primary is an acceptable response to a foreseeable 'normal abnormal' condition.] Due to maintenance standards sickening to a Navy nuc, the relief valve was leaking heavily before the lift in the accident chain. That caused the downstream piping to be continuously hot, and caused the associated alarm to sound continuously (it being one of a few hundred continuously locked-in alarms at this plant). Because of this human factor, the fact that the plant was not a leaktight design and thus required constant management of primary water inventory [and the operators were habitually mindless in performing this function], the operators and several layers of supervisors lacked the ability to use even the most most basic knowledge of the thermodynamic properties of water, and a save-the-company's-expensive-coolant-pumps -first attitude, the dream team did nothing about a primary leak [and in fact for a while aggravated it by draining coolant] for a day and a half. Fuel element assemblies are tough, but a day and half of ineptitude found their limits. BTW, this entire fiasco was a public safety non-event [beyond the self-evident fact that nobody in the whole system - owner or regulator - was minding the safety store], but you'd never have known that from the press.)
I hope the above is useful to the curious citizens who are not versed in nuclear technology, and I hope leads to pressure upon the nuc industry and its regulators to depart from the current path of marginally-designed Rube Goldberg plants under a regulatory regime that is more enabling than regulating.
The author of this screed, who prefers to remain anonymous, is hardly a shiver-in-a-cold-cave greenie. I have five years of Navy nuclear experience, and qualified as a Nuclear Engineer Officer in 1992. Thankfully, I don't do it any more, but what I learned is burned in deep - I probably will be able to diagram an S5W primary circuit to my dying day, and my last nightmare will probably be of engineering drills on the good ship USS Tautog. I've done nuclear power right, and am disgusted by American industry's and government's fifty-year inability to get it right.
Without an external load, the plants trip because that removes one level of safety system support. There is nothing in the functional design of the plants that requires them to shut down. It's just conservative decision making. A navy reactor would probably take the corresonding action if it had the kind of backup safety systems that a commercial reactor has.
Why the inability to generate power that cannot be used is evidence that nuclear plants "can't cut it" escapes me.
For the month of December 2007 the fleet average net capacity factor was only 96.1 percent. Nuclear generation in the month of December was only 71.7 billion kilowatt-hours. Nuclear generation in 2007 was only 807 billion kilowatt-hours (bkWh). The civilian nuclear fleet average capacity factor in 2007 was only 91.8%.
Maybe we should just shut the whole civilian nuclear industry down and let the Navy fleet backfeed from shorepower into the grid. I'm sure you'd valiantly keep your coolant pumps operating if the grid frequency and voltage suddenly drops due to some disturbance originating a hundred miles from your control room. Your coolant pumps could handle plenty of undervoltage while you let them reduce core flow, right?
I guess those pitiful generation totals and capacity factors could be improved if the civilian nuclear industry used plate fuel and ran on weapons grade enrichments of uranium like the Navy does. You know those "shiver-in-a-cold-cave greenies" would love that.
BTW, not all civilian nuclear plants use once-through steam generators with little or no collapsed water level. Most use recirculating U-tube steam generators with lots of inventory, and are designed to handle a 50% load reject.
Don't get me wrong, I certainly appreciate the Navy and thank you for your service to our country, but civilians don't go demanding you decommission the fleet every time you bump into something or when some nutjob blows a whole in the side of a destroyer while docked.
Sure, the outage was inconvenient. It was not initiated by the nuclear plants. It was a substation transformer problem. Those things can and do happen. It would be nice to have more redundancy in the system so the when equipment outages occur you limit the impact, but that isn't always possible, no matter how robust your system is designed. I think the overall record of grid reliability in this country is pretty good. We have a major outage every 10 or 15 years and while those are a pain, we at least avoid expensive and potentially hazardous damage to the plant equipment by playing it cautious and shutting things down safely, and thus allowing quick restart.
Traffic lights? Shoot, those go out all the time, from storms, bulbs burning out, etc. Society manages to deal with that. You know the rule? When you come to an intersection with the traffic lights out, treat it as a four-way stop. That's what I do. I have never had a safety issue with this.
Access to the Internet? My ISP goes down occasionally, usually for reasons unrelated to grid power. The result? I mumble and grumble a bit, but life goes on. No one gets hurt. No one dies.
Stock trading? Well, gee, I think our economy can manage well enough if a few dozen stock trading offices lose power temporarily. I don't think anyone's safety or even fortunes will be seriously threatened.
Food safety? Sure, if your food spoils there are ways to deal with it. You throw it out. Use the old reliable sniff test to see if you've got a problem. My Mom always told me not to drink spoiled milk. Not a bad adage to live by.
Life support? Most hospitals I've been in have emergency backup power. Same with most home-based equipment. Managing an outage of several hours is not impossible on that account.
There will likely be an investigation of the root cause of this outage and if malevolent actions are discovered then those should be further investigated and prosecuted. If faulty maintenance is involved then that should be addressed. If it was simply equipment failure that occurs from time to time then all you can do it fix the problem and maybe make your case to the ratepayers, regulating board, and intervenors to build more redundancy into your system. Good luck on the latter.
We had an ice storm last year that caused a power outage to some areas that lasted days. How responsible is it for companies to allow their systems to be vulnerable to something as common as an ice storm? Why, those should be outlawed, and company officers who allow their systems to experience such outages should be called to task.
/sarc
Stick to the navy nuc plants because you obviously have NO CLUE how commercial plants operate. If you have ever read an UFSAR of a commercial nuclear plant, you would know that loss of load is a transient that is analyzed and protected against. If you actually knew something, then you would also know that by law, U.S. nuclear plants are required to maintain a negative MTC (Moderator Temperature Coefficient). Since you probably don't know what it means, I'll dumb it down for you. When temperature goes up in the primary side, that adds negative reactivity to the core thus shutting itself down. So this whole talk about how the primary side would just overpressurize itself and a disaster would happen is nonsense.
I don't know where you get your info from, but the plant i work at has a "sufficient pressurizer, surge line, and pressurizer spray capacity to mitigate pressure excursions caused by the design downpower transient" as apparently you think they should. We have 2 main feedwater pumps that feed into the steam generators and also 3 seperate trains of auxiliary feed water. You think that's enough redundancy to protect the loss of feed into the generators.
So by now I'm sure you're saying that TMI is different, and yet, what really ended up happening when the primary side was leaking. The safety injection came on AS IT SHOULD and the plant did what it was supposed to. It wasn't until operator shut down SI that part of the core became exposed.
If anything, you should be putting the blame on training of operators and NOT on the design of the plants because they are functioning just as we intended them to.
The funny thing about this is every thing you brought up happended in 1979. You think we might have gotten a little better at what we do since then. Write back when you have something intelligent to say.
The grid was disrupted due to at least two and possibly more pieces of equipment faulted (shorts for those non-EE's). The first device to fault is believed to be a isolating switch that took out two transmission lines.
The voltage at the plant bus dropped to near zero. ANY plant, regardless of type, trips at that point because the auxiliaries lose power. (A hint for someone who has never worked in the civilian power world: auxiliaries are powered by the grid, not a separate generator bus).
Who will be the investigative body? The South East Region Reliability Corporation (SERC).
They will investigate and report exactly what happened. The report will appear here:
http://www.serc.org
Matthew B
That is, it is entirely possible to design our nuclear power plants from tripping when the downstream power transmission lines go dead. Some US plants have the capacity already, called "net load rejection." I know Diablo Canyon is one.
If Turkey Point or St. Lucie had this feature, the benefit to the public would be to keep the reactors critical and the generators spinning at rated voltage and frequency. They could be reduced in power so to just handle the internal plant ("hotel") loads. Coming back on line when the transmission problem was resolved would take only minutes and not 12 to 24 hours.
I would have expected the new NERC rules on system reliability to almost require this of new nukes. The sticking point is, in a deregulated grid, who is to pay for the extra $50 to $60 million it would cost.
Joe Somsel
The AP1000 and ESBWR are designed to survive a loss of offsite power without a trip. Rather than trip the generator, they are designed to trip all interconnecting lines and feed the house loads through the substation and from the generator.
I don't know if the system reliability engineers are aware of this design "feature" yet. It is considered very undesirable to trip intertie lines on degraded voltage or frequency.
Matthew B.
You are incorrect in saying that no current plant can operate with a loss of offsite power.
Diablo Canyon 1 and 2 were designed with this feature and have successful do so in testing albeit not 100% of the time!
Lungmen 1 and 2 in Taiwan also were designed with this capability although they are still in construction.
I do believe other US and foreign plants share this feature although it is a definite minority of the population.
Florida Power & Light issued a preliminary report saying that a field engineer was to blame for Tuesday's failure, which affected more than 584,000 customers, or the equivalent of more than 1 million people.
The engineer was investigating a malfunctioning switch at one of the power company's substations in west Miami when he disabled two levels of protection for the system, officials said.
While he was making measurements of the switch, a circuit shorted, making a loud noise and smoke that was reported as a fire. Normally, the protection system would have contained the consequences of the short circuit, but because both levels of protection had been removed, the problem cascaded to other parts of the system.
In total, 26 of the company's 435 transmission lines and 38 of its 600 substations were affected. Two nuclear reactors and a natural gas unit at Turkey Point south of Miami shut down protectively. Two other FPL plants were also affected.
"We don't know, still, why that particular employee took it upon himself to disable both sets of relays," FPL president Armando Olivera told reporters.
The employee, who had "significant tenure," has been put on paid leave during an investigation, Olivera said. It would have been appropriate for the employee to disable one, but not two, levels of protection while making measurements, he said.
A full investigation could take months, Olivera said.
Low and behold, the grid is operated by humans. It appears that in this case, negligence by the technician was the cause... but any person with access to the controls can easily do far more damage.
What kind of safeguards to you expect? Engineers and operators do have to be able to control the system.
Proves that there needs to be greater safeguards installed to protect Americans from those who would seek to sabotage our nuclear power facilities this way.
HUH? Proves how. This was a non-issue for the nuclear power plants, other than it made the press because some of the affected plants were OMG NUCLEAR!!!
Internal to the plants there are considerable safeguards against both negligence and malfeasance by employees. And given the absence of *ANY* event in over 40 years of commercial nuclear, I don't think this dog hunts.
-Matthew B