In the AGRs, the main factor which it is believed could impede the free entry of control rods into the core is distortion of the top dome (gas baffle). The articulation of control rods has been included to ca­ter for limited non-linearity of the control rod path. Checks are carried out from time to time to ensure that the rods can move freely; on some AGRs these checks are assisted by some of the coarse rods having fewer articulation joints (Hinkley Point B) or no arti­culation (Dungeness B), these rods are called ‘sensor rods’.

The secondary shutdown system in the AGRs is a nitrogen gas injection system. Nitrogen is a good absorber of neutrons, for example, it has been esti­mated that filling the Hinkley Point В reactor with nitrogen at a pressure approaching normal operating pressure would have a reactivity worth in excess of -20 Niles, twice the worth of the control rods. Nitro­gen at adequate pressure is capable of maintaining the reactor shut down for any reactivity state of the reactor core.

At Hinkley Point В and Dungeness В the nitrogen injection is initiated at the discretion of the operating staff. Plant abnormalities such as sensor rods jam­ming or failure of several control rods to fully enter the core on reactor trip will indicate the need for nitrogen injection. At Hartlepool and Heysham 1 the nitrogen injection may also be initiated automatically by tripping of the secondary shutdown (SSD) guard lines, the two tripping parameters being rate-of-change of top dome differential pressure (TDDP) and chan­nel gas outlet temperature (CGOT). The CGOT trip covers top dome failures which are insufficient to trip on TDDP. Tripping of the SSD guard lines also trips the main guard lines, thus releasing the control rods into the core. In all AGRs the displaced CO: rnav be vented through the blowdown system to ensure that the reactor gas pressure does not rise sufficient­ly high to lift the safety valves; at Hartlepool and Hevsham /, however, it has been calculated that the nitrogen injection will not cause the reactor gas pres­sure to exceed safety valve lift pressure if CO: is not vented off.

In the maenox reactors with steel pressure vessels, the main factor which it is believed could impede the free entry of control rods into the core is distortion of above-core components by the gas forces arising from failure of a top gas duct. Boron ball shutdown devices (BBSD) have been provided in these reactors to cover such an event. This is not normally known as a secondary shutdown system, probably because that name had already been taken b the secondary shutdown rods! (which were provided for a quite dif­ferent purpose). However BBSDs are included in this section because the reason for their existence is logi­cally related to the AGR SSD system.

A BBSD consists of a hopper filled with small boron steel balls and a release mechanism which will allow the balls to fall under gravity into a thimble in the reactor core when the rate of fall of reactor gas pressure exceeds a given value. There are typically 20 BBSDs in each reactor. The balls are recover­able. The boron balls are of sufficient worth to ensure that the reactor can be adequately shut down, their reactivity worth is typically about — 1 Nile. BBSDs are not normally claimed as first or second line pro­tection against particular faults, but it is usual to demonstrate their effectiveness by starting the reactor shutdown for biennial overhaul with the release of one or two BBSDs.

Tertiary shutdown systems

In AGRs the secondary shutdown system, nitrogen injection, is regarded as temporary. In the event of a more permanent shutdown being required, and if it is not possible to insert sufficient control rods into the core to aehieve this, the tertiary shutdown (TSD) system is used.

At Dungeness В and Hinkley Point В the TSD system is to fill the reactor internals with water. Clearly this is irreversible. The TSD pipework is not complete; at Dungeness В short closing lengths are provided to make the final connections on the day, at Hinkley Point В much of the pipework is tem­porary and must be installed to enable the operation to be carried out. The reactor will be cooled to about 50°C prior to filling to ensure that the fuel does not overheat between the cessation of normal cooling and the completion of filling, and to minimise the water flashing to steam on the hot components and displac­ing the neutron-absorbing nitrogen. Once commenced the filling must be completed because normal cooling cannot be restored.

At Hartlepool and Heysham / the TSD system is to fill a number of specially designated core chan­nels with boron-impregnated glass beads. The beads are blown in under CO: pressure. The beads should be recoverable, but it cannot be guaranteed that suf­ficient will be removed to take the reactor to power again. Unlike Hinkley Point В and Dungeness В the TSD plant is complete, so it could be in operation within a few hours of a possible need being identi­fied. Therefore if there is reason to believe that the control rod and SSD system together cannot maintain the reactor subcritical, the TSD system could be op­erated before the xenon has decayed.

In magnox reactors the ultimate shutdown system is boron dust injection, although it is not normally referred to as tertiary shutdown. A portable hopper and pump can be connected to the gas circuit near a blower inlet. Two powders, one a sticking agent and the other containing neutron-absorbing boron, will be mixed and pumped into the gas circuit. The blower will be running in order to distribute the mixture into the core. The boron dust, aided by the sticking agent, adheres to the hot surfaces within the reactor core and its reactivity worth ensures permanent shutdown.

Clearly the irreversible shutdown systems described above are under strict administrative control, requiring the authority of the Station Manager to proceed.

General gas composition The operational require­ments are summarised in Table 3.8 which indicates the concentrations of various components of the cool­ant gas.

Moisture in primary coolant In AGRs this is sig­nificant for safety since: [36]

• If not corrected, a high moisture level may lead to corrosion in the cooler part of the primary circuit.

In the case of Heysham 2, two systems are provided:

(a) Bulk moisture system

Reactor gas is bled from the bottom of the boiler annulus in quadrants A and C to two mirror dew­point instruments. These operate at a gas pressure of approximately 1.5 bar, but the pressure is not controlled. The output of these instruments is a dewpoint signal over the range — 50°C to + 40°C, and a pressure signal from an internal pressure transmitter.

Each dewpoint instrument has a dedicated mi­croprocessor. These convert the dewpoint tempera­ture signal into moisture weight parts per million concentration, using the pressure signal to give automatic compensation for the operating pres­sure. There is a 4-20 mA signal from each micro­

processor which is linear with concentration for the range 0-400 wpm.

The microprocessors also give a 4-20 mA signal which is linear with dewpoint over the range -30°c to + 40°C.

The moisture concentration and dewpoint signals are fed to the data processing system to appear on data displays (including trends with time) and alarms, the dewpoint indication being used when shut down and depressurised. Alarms are generated within the data processing system for ‘moisture level high’, ‘moisture level very high’, ‘high rate of increase of moisture level’, and ‘extra high rate of increase of moisture level’.

The moisture concentration signals are also fed via alarm amplifiers to give a grouped direct-wire facia alarm ‘moisture level very high’.

The system is not affected by oil ingress since this will plate out before reaching the instrument.

(b) Boiler leak detection system

The boiler leak detection system gives a means of identifying which quadrant has a leaking boiler in the event of an increase in moisture concentration. Reactor gas is sampled from each of eight loops which take gas from each circulator discharge back to its inlet. There are four moisture-sensitive cry­stal oscillator moisture detectors. Each detector monitors the difference in moisture concentration between two diametrically opposed points by al­ternate sampling using solenoid valves (about 30 seconds per sample):

• Detector 1 monitors gas bled from loops around circulators A1 and Cl.

• Detector 2 monitors gas bled from loops around circulators A2 and C2.

• Detector 3 monitors gas bled from loops around circulators B1 and Dl.

• Detector 4 monitors gas bled from loops around circulators B2 and D2.

Each detector is connected to its own dedicated microprocessor. While detector 1 is sampling loop Al, the datum is taken as the last reading from loop Cl, and vice versa. The output from each of the microprocessors, normally 4-20 mA for ±50 wpm, is decoded within the data processing system by means of a signal indicating which loop of the two is currently being sampled to give a non-oscillating moisture difference between the two loops.

Alarm relays raise alarms on the data processing system in the event of a difference of 50 wpm.

Oil in primary coolant This indicates whether or

not the oil leakage from the circulator motor com­partments is excessive. If this is so and the reactor is operated with a high oil concentration in the pri­mary coolant, this could lead to heavy carbonaceous deposits on the fuel pins, with a significant reduction in the heat transfer coefficient and corresponding increases in pin temperatures.

In the case of Heysham 2, the oil in the primary coolant detection system is intended to delect increases in the oil concentration in the CO; primary coolant and in this event to identify which circulator is the source. Gas is sampled from the discharge from each circulator via pipework leading out through the in­strument penetration in each quadrant to an instru­ment rack at the +3,9 m level.

There are four gas analysis systems, one per quad­rant. Each contains a photo-ionising detector cell consisting of an ultra violet lamp producing ionis­ing photons. A potential difference is applied to elec­trodes within the cell and the current carried by the ions produced by the photons is proportional to con­centration. The detector operates within an oven at 240°C and sample lines are trace heated to prevent condensation. The detector operates at a pressure of 0.8 bar.

The analysis system is differential to compensate for the effects of background organics produced from methane which is injected into the primary coolant to inhibit graphite core corrosion. The systems each contain a rotating valve and cooling coils so that the detector can give outputs for the following for comparison:

1 Circulator I gas uncooled.

2 Circulator 1 gas cooled (i. e., condensables removed).

3 Circulator 2 gas uncooied.

4 Circulator 2 gas cooled.

5 ‘Span’, i. e., reference concentration of propylene in CC>2-

6 ‘Zero’, i. e., pure CO2.

The output signal from each detector is fed to a de­dicated microprocessor. These provide 4-20 mA sig­nals for circulator 1 oil concentration (0 to 1 ppm) and circulator 2 oil concentration. The repeatability is ±0.003 ppm. The microprocessor also performs the sequence control of the rotating valve, on a settable time basis from 1 to 64 minutes per sample.

In the event of these measurements not coming up to expectations, oil ingress will be measured by hydrogen balance and discrete propene measurements at each gas circulator outlet as at existing AGRs.

4.11 Fuels

4.11.1 Introduction

The following sections, which deal with nuclear fuel, are concerned almost entirely with those commercial reactor systems which are currently operating, or are in the course of design and construction in the UK. This gives a natural division between the indigenous gas cooled systems (magnox and the commercial ad­vanced gas cooled reactor CAGR) and the USA devel­oped pressurised water reactor (PWR) which evolved from the small reactors originally designed for opera­tion in nuclear submarines.

Harris and Duckworth (1982) [1] have shown how the British magnox reactors grew from the weapons programme and how the choice of natural uranium fuel was dictated largely by circumstances, rather than a systematic search for the best solution to an engi­neering problem. Nonetheless, natural uranium metal has been found to be a highly satisfactory nuclear fuel with several advantages over other types. It is the densest form of uranium and, with a graphite mod­erator, can be used without enrichment. It is readily available in a fairly pure form and it has a high co­efficient of thermal conductivity. This last factor is important since a major problem with metallic ura­nium is that it cannot be operated at temperatures much above 660°C; the high thermal conductivity al­lows this constraint to be met fairly easily whilst still producing gas outlet temperatures which allow rea­sonable turbine thermal efficiency. Provided that there is a sufficient concentration of fissile atoms to achieve criticality, the thermal conductivity of the fuel is pro­bably the most important factor in deciding the fuel shape. This is because the thermal conductivity has a direct bearing upon the temperatures which, as al­ready observed for uranium metal, generally sets the operating limits for the fuel.

In the case of uranium dioxide, the coefficient of thermal conductivity is low (between 4 and 17 times lower than for pure uranium) so that, although the allowable operating temperature for the oxide is much higher (melting temperature 2800°C) than for the metal, the fuel diameter has to be considerably smaller (approximately halved) in order that it can be ade­quately cooled. This separation of the fuel to allow cooling, together with the lower density of the oxide, usually dictates the need for enrichment of the U-235 (in the CAGR the use of stainless steel clad makes this essential). The balance of the fuel comprises the fertile isotope U-238 which can be converted by neu­tron capture and beta decay to (fissionable) Pu 239.

By the use of enriched fuel, smaller pins and more efficient cooling, the rate of heat generation per unit mass of fuel, or rating has been progressively in­creased: magnox reactors and CAGRs have peak ele­ment ratings of about 5 and 20 MW/t respectively; in PWR the maximum fuel rod rating is about 60 MW/t. The increase in rating between magnox and CAGR is largely attributable to the higher fuel tem­peratures possible with oxide fuel. The difference be­tween CAGR and PWR is mainly the result of the increased effectiveness of pressurised water cooling (compared to gas cooling) which allows these ratings to be reached whilst maintaining the fuel at accept­able temperatures.

In this section frequent reference will be made to the fuel burn-up. This can be expressed in three ways (e. g,, see Olander, 1976 [2]); firstly, the fission density, or the total number of fissions/unit volume; secondly, as a fractional burn-up, or the total number of fissions divided by the initial number of heavy metal (not necessarily fissile) atoms; or, thirdly, as the thermal energy released by one tonne of heavy metal atoms (noting that 210 MeV/fission is equivalent to 0.95 MWd/g fissioned) — this is the measure adopted here. For conversion purposes, 1% fractional heavy metal burn-up is equal to 8.6 GWd/t. It is important to remember that the fuel rating, and hence the burn — up, will vary from point to point in the reactor. Thus in CAGRs, for example, the peak stringer burn — up will be less than the peak element burn-up, which will be less than the peak pin burn-up and the peak point burn-up.

In general, the lifetime of the fuel will be deter­mined by its endurance which we may loosely define as the maximum burn-up attainable by the fuel be­fore significant numbers of failures begin to occur; this is the main subject of this section. In addition to this, however, there is also a limit on the maximum achievable burn-up which is dictated by the reactor physics; this is the point at which the reactor runs out of reactivity. In a reactor using enriched fuel the burn-up limit can be increased, at least in theory, by increasing the fuel enrichment, although in some cases it may also be necessary to use burnable poisons to maintain a more uniform reactivity throughout the life of the fuel. In reactors which are fuelled with natural uranium, however, this option is unavailable and in the magnox reactors, where the endurance limit has been steadily increased over the years, the reacti­vity limit is now being approached.

High purity water is used in nuclear systems as a primary reactor coolant (pressurised water reactor), for steam raising in a secondary circuit (advanced gas cooled reactor), or fulfilling both roles (boiling water reactor). This section deals with the applications where the water passes through the core but does not con­stitute the steam raising circuit. It is specific therefore to the PWR, where the reactor coolant is high tem­perature water held in a single phase at a pressure above its saturation vapour pressure, for the purposes of neutron moderation and heat transfer.

Typical reactor coolant conditions for steady state full power operation of a 1200 MW(e) PWR are shown in Table 1.17, and the main thermodynamic and physical properties of water at 155 x 105 N/m2 (155 bar) taken from Grigull et at (1984) [25] over the tem­perature range of interest are summarised in Table 1.18. On exit from the reactor there is, in principle, an approximately 20°C margin to boiling and the system therefore is single phase, although in some de­signs it is expected that a degree of boiling will occur at the top of the fuel elements. Maintenance of sys­tem pressure and adjustment of the coolant inven­tory are achieved by the pressuriser (Section 9.2.1 of this chapter) which contains coolant under SVP con­ditions of 155 x 105 N/m2 and 344.8°C in an atmos­phere of hydrogen.

It should be noted that the 240 m3 coolant in a typical PWR undergoes a significant specific volume change over the temperature range of 25°C at atmos­pheric pressure (1 x 105 N/m2) to 30O°C at operating pressure (155 x 105 N/m2), as can be seen from the specific volume data in Table 1.18.

1.4.1 Pressure circuit — primary circuit

Function

The function of the reactor pressure circuit is to contain the coolant gas which transfers the core­generated heat to the boilers. An increase in gas pressure increases the rate of heat removal from the core and decreases the circulator power. As successive magnox stations were developed, gas pressures were increased.

At the stations with steel pressure vessels, the de­sign limited the gas pressure which could be used for a given size of core and hence reactor output. This was the primary incentive for adopting the pre-stressed concrete pressure vessel at Oldbury and Wylfa (Table 2.1).

Standards and design

Safety considerations require that the components of the primary coolant circuit have the highest integrity. When the first stations were designed, it was generally agreed that the existing standards for the design, con­struction, inspection and testing of these components were not adequate. Supplementary requirements to the existing standards were agreed with the Independ­ent Inspecting Authority and specified for primary coolant circuit components. These supplementary re­quirements were mainly concerned with the detailed analysis of the design and the quality of the fabrica­tion and inspection of the reactor components. They now form part of the relevant British Standards.

The Nuclear Installation Inspectorate (Nil), has a condition in the Station Site Licence which requires the CEGB to appoint an Independent Inspecting Authority.

Steel pressure vessel — reactor pressure circuit layout The reactor pressure vessel containing the core is con­nected to the boilers by ducts. Typical arrangements of the pressure circuits are shown in Fig 2.8, the number of boilers per reactor varying from station to station.

The location of the boilers relative to the reactor is governed by a number of considerations which include:

• The need for adequate shielding between the core and the gas circuit components.

• Gas distribution to and from the core.

• Economics (capital cost and gas circuit pressure drop).

• The requirement to have a good natural circulation round the gas circuits. This influences the relative heights of the boilers and the core.

Each gas circuit consists of inlet and outlet ducts connecting the reactor to the boilers; gas valves to isolate the reactor from the boilers; bellows units to cater for component thermal expansion; a gas circu­lator to circulate the coolant gas round the circuit and a bypass circuit which connects the outlet of the gas circulator to the boiler, i. e., bypassing the reactor.

Boron trifluoride type

The boron trifluoride (BF3) proportional counter de­tects neutrons by the n-a boron-10 reaction and con­sists essentially of a fine wire concentric with, and insulated from, a thin copper or aluminium tube to form a vessel filled with BF3, as shown in Fig 2.47.

The electrons produced in the primary ionised tracks are attracted to the central anode wire and, with a sufficiently high positive potential (1.5 to 2 kV), sec­ondary ionising collisions occur and the final collected charge is thus amplified by a gas multiplication pro­cess. The BF3~gas is free from electron capturing impurities and the counter body is thoroughly out — gassed to prevent subsequent contamination of the gas and deterioration of the counting characteristics. Good vacuum characteristics are obtain. J by using oxygen-free copper and fluxless brazing techniques for all joints.

Modern counters also use aluminium extensively and this gives a better performance than copper, par­ticularly for life in high neutron fluxes.

For a 12EB40 counter filled with enriched boron triflouride to 400 mm Hg, the slow neutron sensi­tivity is about 3.5 counts/s/n/cm2/s. This type of counter will work satisfactorily in a у flux of about 2 Gy/h and the maximum counting rate possible is about 5 x 104 counts/s because of pulse length. Proportional counters are about 100 times more sen­sitive to slow neutrons than fission counters of simi­lar size, but unfortunately their 7 sensitivity is also considerably greater and it is not possible to discri­minate between 7 and neutron pulses of similar amplitude.

With a gas multiplication factor of 40, the life of a BF3 counter is about 1010 counts at below 100°C whilst above 150°C counters deteriorate rapidly. Counters are not operated in neutron fluxes above about 2 x 107n/cm2/s to avoid difficulty in discri­minating between neutron pulses due to space charge effects.

The BFi proportional counter is used extensively in the thermal columns of magnox stations with arrangements for withdrawal during power raise and insertion during the shutdown phase, as discussed in Chapter 3.

Fission type

By the use of the fission process, detectors can be made that operate at higher temperatures and neu­tron fluxes than the BF3 type without suffering from

pulse pile up.

A typical uranium-235 fission counter consists of a stainless-steel container with cathode liner concen­tric with, and insulated from, the cylindrical anode. A thin layer of fissionable material is deposited on

the electrode surface.

The fission counter detects neutrons by the U-235-n reaction; the resulting fission fragments cause ionisa­tion of the filling gas. The coating of uranium is limited to about 1 mg/cm2 to limit energy lost by fission fragments emerging from the coating. The neutron-induced fission pulses, relative to the 7 pulses in this type of counter, are much larger than in the proportional counter; they are also much shorter in duration, and these two effects enable the fission counter to operate satisfactorily in 7 fluxes up to 103 Gy/h. The sensitivity of the P7 counter, shown in Fig 2.48, is in the range 0.01 to 0.1 counts/s/n/cm2/s with rates up to 2 x 105 pulses/s with 10% counting losses.

The operating potential required is between 200 and 400 V. Since inert gases are used for filling and there_is no gas multiplication, fission counters are less sensitive to impurities and may be operated at temperatures of up to 550°C and with containment. up to 40 bar The life of the counter is 1019 nvt and it will operate in a neutron flux of about 1011/ cm2/s before j3/pulse ‘pile-up’ becomes serious, thus limiting the use of the detector at low powers after

irradiation. The burn-up at 10n n/cm-/s is 0.2ro per annum. Further details of fission counters type P7 are given in Table 2.5.

Another chamber, P8, is available specially devel­oped for Campbell channels, described in Section 5.2.12 of this chapter.

Control and protection

The use of common equipment for reactor control and protection is not generally permitted, because a common-mode fault on control equipment could re­sult in a reactor fault coincident with loss of one trip group.

Safety interlocks

For some protection applications, an interlock to pre­vent the occurrence of an unsafe reactor condition may be preferable to a trip group. In such a case the ‘safety interlock’ must be designed to a similar stand­ard to the equivalent trip group; with similar redun­dancy, diversity and reliability requirements.

Operator action

The safety trip system is designed to provide protection entirely independently of operator action. No reliance is placed on operator resetting of trip levels on modern stations, auto reset trip amplifiers being used where necessary. The operator can initiate a trip at any time, however, as a high integrity manual trip switch is pro­vided on the control desk (see Volume F, Chapter 6).

Operational vetoes may be installed to permit veto­ing of a trip group for reactor conditions in which its protection is not required and is operationally restrictive. Where this is done, the vetoes are inter­locked with other protection to prevent operation of the reactor in an unprotected condition.

However, it should be noted that operator action may be involved in the longer term after a reactor trip to ensure reactor cooling.

Fig, 2.59 Double ‘2 out of 3’ trip system in reactor guard lines

Maintenance

The safety trip system is designed to achieve its required reliability when tested at three monthly inter* sals. Maintenance vetoes are not provided on modern stations owing to the difficulty of guaranteeing that 4ich vetoes are removed after maintenance; the trip channels are allowed to go into the trip condition during maintenance.

Ammeters are provided (Fig 2.60) to check correct

operation,

6.7.1 Control rods

As described earlier in the magnox section, control rods are provided for two purposes. Firstly, as their name implies, they control the rate and distribution of heat aeneration in the fuel by absorbing more or less neu­trons as required. Secondly they are connected to safety circuitry that enables them to trip (this is the fast in­sertion of a large quantity of absorber) when required to prevent a fault situation from developing.

As in magnox stations, control rods are of two ‘worths’. Some are opaque to neutrons (black) and are generally only inserted when it is intended to shut down the reactor, though they can be used for flux shaping and power level control if necessary. The others are translucent to neutrons (grey) and are intended to be inserted about halfway into the core, i. e., they are nor­mally in a position where, by inserting them further or by withdrawing to some extent, the total or local power level can be adjusted. The potential reactivity of the core and the size and number of grey rods are generally designed to achieve a nominal 50% insertion of the grey rods. As local and general reactivity changes occur or when power changes are required in the core, the grey rods can be expected to move in the range 25% to 75% insertion.

Grey rods are made from stainless steel which is a moderate neutron absorber. Black rods contain stain­less steel tubular inserts with about 4% boron added to enhance the absorber worth. Materials are selected for their resistance to long term oxidation, since their operating temperature when inserted to maximum flux position may be up to 600°C. A further material con­sideration when designing rods is that boron steel swells under irradiation and clearances of boron stainless steel inserts must be sufficient to ensure that control rod sheaths do not split. Clearance however must not be excessive since this tends to reduce heat transfer and raise temperatures.

Black and grey rods are geometrically similar (and therefore have to carry clear external type identification) and their insertion routes (standpipe, control rod guide tube and core channel) are identical. Both types are designed to articulate, i. e., they are made up of six, seven or eight hinged segments, so as to reduce any possibility of failure to insert in the event of an exces­sive or unexpected distortion of the charge path. Each rod is attached to the chain of a control rod plug unit which contains the rod operating mechanisms. Since the chain passes through the hot above-dome region ol the guide tube, cooling reactor inlet gas is allowed to pass up the guide tube from the below-dome region via ports which also supply a down-flow to cool the rod itself.

The general arrangement of a control rod stringer is shown in Fig 2.91. Hartlepool and Heysham / control rods have a different articulation feature to that used in most AGRs, being built on a tie rod; but for both arrangements adhesion of the contacting surfaces at the articulating joints is prevented by applying hard coatings of chromium carbide.

In the event ot an accidental drop into the reactor, for example, due to breaking the control rod chain, a shock absorber is installed at the bottom of each con­trol rod channel (Fig 2.92).

The shock absorbers are designed and tested to ab­sorb the energy of a full rod drop from the highest operating position, plus a further drop from the highest recovery position. The highest operating position is with the rod nose joint above the top of the active core and the highest recovery position (using an emergency re­trieval grab) is with the nose of the rod just within the fuelling machine. The stiffness of the shock absorber is low enough to prevent damaging reactions on the graphite bricks or shock absorber supports and to pre­vent rod damage that might impede recovery. Allow­ance is made for irradiation-induced hardening of the shock absorber material.

The central control room (CCR) design is such that the station can be operated from the CCR during normal power operation, start-up and shutdown by one operator per unit and one control room super­visor. One assistant may be provided to assist on either a unit or station basis if necessary.

As far as possible, all unit controls and indications relating to start-up, normal power operation, shut­down and post-trip operation are mounted on the unit operator’s desk. Operational philosophy and space requirements dictate that some controls and indica­tions be mounted on vertical panels.

All other data required for commissioning, main­tenance, efficiency, administration or record purposes

T 13l E 2.14

display centre which is accessible from the CCR.

Each reactor/turbine unit has its own desk and vertical pane! on which is mounted conventional equip­ment for communication, display and control. A se­parate desk is provided for the supervisor which includes communications facilities, VDU displays to allow monitoring of unit performance, station services

DAO — Deaerator outlet

MSA — Methods for sampling and analysis

1C — Ion chromotography

EAAS Electrothermal (‘nameless’)

atomic absorption spectrometry

and electrical auxiliaries supply alarms. There are vertical panels for the cooling water system, station and reactor general services, fire alarms, station elec­trical system and high voltage switchgear system.

The layout of the room is shown in Fig 2.119. The desks and panels utilise the CEGB DIN modular design described in Volume F, Chapter 6. This modu­lar concept allows the desk layouts to be optimised

late in the construction programme to suit operating procedures.

The layout is based on the use of computer-driven visual display units (VDUs) as the primary source of information (i. e., data and alarms) and it is intended that normal power operation can be monitored and controlled from the centre section of the desk. Con­trols and indications are provided on the wings of the desk for less frequent operating regimes, i. e., start-up and shutdown.

Hardwired indications and alarms are provided to supplement the VDU displays, for the following

reasons:

• To enable the plant to be maintained at steady load without the computer system available.

• Where there is ergonomic advantage in having dis­plays directly associated with controls.

• To provide diverse indications where necessary to meet safety requirements.

• To safely shut down and monitor post-trip cooling without the aid of the computer system.

As a result of the extent of the post-trip cooling sys­tems, and the large number of plant state changes initiated by the eight sets of post-trip sequence equip­ment (PTSE) described in Section 8 of this chapter, the mimic has been designed to provide a functional overview of the state of post-trip cooling (Fig 2.120) and is mounted on the unit panel. In the short term post-trip, the operator is not required to monitor the detailed actions of the PTSE. He is required to es­tablish, with the aid of the mimic, that an adequate number of post-trip heat removal trains are operating and that reserves of coolant are adequate.

The pressuriser control system is designed to:

* Maintain the mass inventory of the reactor coolant system by controlling the pressuriser level accord­ing to the reactor coolant temperature, so that the coolant in-surges and out-surges which occur during load changes may be accommodated without undue loss from or make-up to the reactor coolant system, or a reactor trip.

• Control the primary coolant pressure so as to avoid undue discharge through the pressuriser relief or

safety salves.

Pressuriser level

The pressuriser water level is compared with its de­manded value to form the water level error signal, which is then compensated by a proportional/integral — derivative (PID) controller to provide the demanded charging flow. The letdow-n flow is isolated if the pressuriser water level falls below a low level setpoint to avoid uncovering the heaters and to maintain the »’Vater inventory of the primary circuit. Reactor coolant ls discharged to the letdown line from a crossover leg of the RCS.

The charging valve position and valve position de­mand are checked for correct response to control system demands.

The demanded value of the pressuriser water level is programmed as a function of the estimated average coolant temperature in the primary circuit, so that at part-load the water level is reduced from its full load value in order to match as closely as possible the contraction of the water in the primary circuit as its temperature is reduced.

Pressuriser pressure

The pressuriser pressure is compared with its demanded value to form the pressure error signal which is then compensated by a PID controller to form the actuation signals for the pressuriser heater and spray controls. Increasing the heater power increases the pressuri­ser pressure, and increasing the spray rate decreases the pressuriser pressure. The pressuriser proportional heater controller demand is checked for correct re­sponse to control system requests.

The 78 electrical heaters are located near to the bottom of the pressuriser. Eighteen of the heaters are proportionally controlled to correct pressure devia­tions arising from small disturbances in the reactor and primary circuit. The remaining (back-up) heaters are switched on when the pressuriser pressure control requires more heat than can be supplied by the pro­portional heaters. Operation of all the heaters is inhibited when the pressuriser water level is low and likely to uncover the heaters. Heat losses from the pressuriser, including heat losses due to the small, continuous spray, require the proportional heaters to be at approximately half power at full load steady — state conditions.

Pressuriser spray from the nozzle located in the top of the pressuriser is initiated when the pressure con­troller spray demand exceeds a given value. The spray rate then increases proportionally with increasing spray demand, until the maximum spray flow is reached. Steam condensed by the spray reduces the pressuri­ser pressure back towards its demanded value. A small, continuous spray is normally maintained to reduce thermal stresses and to help maintain uniform water chemistry and temperature in the pressuriser. The spray valve positions are checked for correct re­sponse to control system demands.

.«•дІрь.

&