The essential electrical system is the power source for the mechanical post-trip heat removal plant. Normally power is supplied by the national grid system, but should this fail, the diesel generators are switched in by the post-trip sequencing equipment. The system is energised at all times, since in addition to its role in post-trip heat removal, it is also a secure source of supply to many systems which are normally opera­tional, and thus it is an integral part of the overall station electrical system.

The overall arrangement of the system is shown in Figs 2.116 and 2.117. In a similar manner to the

Fig. 2.116 Main and essential electrical systems

other components of the post-trip heat removal systems, the essential electrical system comprises two diverse X and Y systems, with each system consisting of four independent trains of equipment (A to D), one for each reactor quadrant. The X and Y systems are designed to be electrically independent.

There are eight diesel generators on the station generating at 3.3 kV, each generator supplies one train on each reactor, i. e., the AX generator provides power to both the AX train on reactor 7 and the AX train on reactor 8. The X diesels are rated at -■2 MW and the Y diesels at 6.7 MW.

The 11 kV boards associated with the A and В quadrants are supplied from the 132 kV grid system through a three-winding station transformer. Those associated with the C and D quadrants are supplied through individual unit transformers and the gen­
erator transformer from the 400 kV grid system; the main generator is connected via a 23.5 kV gen­erator circuit-breaker, which allows the generator and unit transformers to remain in service with the unit shutdown.

The 11 kV switchboards provide a grid supply to the 3.3 kV essential auxiliaries boards. A single 11/

3.3 кV auxiliary transformer is connected to the 3.3 kV X board of each train, and an interconnector from this board is arranged to supply the 3.3 kV Y board of the same train. If however the 11 kV supply should be lost whilst the PTSE is active, this interconnector is opened and the X and Y boards are then each supplied by their respective diesel generators.

Each 3.3 kV essential auxiliaries board supplies an associated 415 V essential services board. Motor drives at the 3.3 kV level are indicated on Fig 2.117,

all other post-trip motor drives are at the 415 V level.

The 415 V essential services boards also provide power to the battery-backed no-break systems. The X train no-break systems comprise a 220 V DC sys­tem for switchgear closing, а ПО V DC system for switchgear control and a 415 V З-phase AC system for essential motor drives, the main guard lines and instrument supplies.

The Y train no-break systems consist of ПО V DC for switchgear control and ПО V AC single-phase for
instrumentation. Spring-closing is employed for the Y train switchgear.

After every reactor trip, all diesel generators are started and X to X or Y to Y interconnectors are opened. However, whilst the grid supply is available it remains the preferred source of power to the es­sential electrical system; if this should be lost to any

3.3 kV essential auxiliaries board, then the normal supply route to that board is disconnected, all major loads are cleared at 3.3 kV and 415 V level and the diesel generator connected before the loads are again

reconnected. All actions are carried out automatically by the PTSE.

Inspection of the reactor pressure vessel falls into three main areas:

Reactor vessel shell Equipment is provided which is capable of performing ultrasonic examination of the vessel welds from the vessel internal surface (with the reactor internals removed) and the refuelling cavity flooded. The equipment consists typically of a central telescopic support column positioned over the axis of the vessel and supported by three equi-spaced arms mounted on the vessel flange. Attached to the lower end of the central support column is a second tele­scopic arm capable of extension in the vessel radial direction. This second telescopic arm carries an array of ultrasonic transducers, the number and position­ing of wrhich will be determined by the inspection required. The equipment is capable of longitudinal extension sufficient to perform inspection of the low­er head to transition ring weld, and radial extension sufficient to perform inspection of the pipework to nozzle safe-end weld. The equipment control and data acquisition centre is located outside the reactor build­ing, thus minimising dose to operators performing the inspection.

Equipment is also provided to perform external ex­amination of the nozzle to pipework safe-end welds. This equipment takes the form of remotely operated track-mounted devices capable of performing both dye penetrant and ultrasonic scans of the entire weld. Equipment is provided capable of performing an ex­amination of the vessel-to-nozzle welds from the ex­ternal surface. The data acquisition and equipment control systems are located in a low radiation area.

Reactor vessel closure head The vessel head and its associated equipment (studs, nuts and washers) is re­moved prior to refuelling and stored dry on a stand within a shielded area. Ultrasonic examination of the head-to-flange weld is carried out externally using a remotely operated device. Sufficient access is provided to permit ultrasonic or dye penetrant examination of the control rod drive mechanism housing welds. Auto­matic equipment is also provided to perform ultra­sonic inspection of the closure head studs.

Reactor internals The reactor internal structures are removed from the vessel and stored under water in the refuelling cavity. Remotely operated visual inspec­tion equipment (CCTV cameras) is provided to per­form underwater examination of these components.

The site licence requires that a set of Safety Rules must be provided to give instruction as to the control and protection of personnel, to specify procedures that must be adopted and to give the limits and specifi­cation for radiation dose. Although the site licence gives limits for radiation dose levels, in general the safety rules are tighter and therefore used without prejudice to the site licence.

The safety rules make provision for personnel to be appointed to two categories:

• Senior Authorised Persons (SAP).

• Accredited Health Physicists (AHP).

Senior Authorised Persons have the responsibility to specify the conditions under which any job that has a radioactive content is to be carried out. Such con­ditions are entered in a radiological section of a safe — tv document which controls work or access to plant and areas. The information which is specified is il­lustrated in the follow ins list:

• Radiation limits imposed.

• Dosimetry required to monitor and measure the radiation dose received.

• The protective clothing required to be worn (this may include respirators or breathing apparatus).

• Confines and boundaries that are required around the work.

• Zone classification (type of radiation and or con­tamination),

• Access route between any change room and the work.

• The type of monitoring and whether required con­tinuously, intermittently or not at all.

• Time validity for the safety document.

The Accredited Health Physicists have the responsi­bility to provide a health physics service and this is illustrated as follows, although it is not a compre­hensive list:

• Advice to Senior Authorised Persons.

• Provide a dosimetry service.

• Carry out those health physics requirements within the site licence.

• Provide services for the disposal of waste.

• Give advice to the Station Manager on health physics matters and provide him with necessary statistics.

• Provide clothing and associated laundry services.

• Provide a monitoring service on and off site for the emergency plan.

• Give health physics advice to management during an emergency.

The safety rules cover two other major areas of control. These are the specifications of specific radia­tion and contamination zones, and the limiting doses to classified persons and members of the public. Controlled zones are split into two major types: con­tamination and radiation. Radiation zones have four categories (Rl, RII, RIII and RIV), the higher the R-number the greater the radiation level. RIV zones are required to have restricted access and are locked off. RIII zones would have restricted access. Contami­nation zones also have four categories: Cl and CM are contamination zones with just surface contami­nation of floors, walls and equipment, СІ 11 and CIV zones are those with airborne radioactive substances. CIV zones are sealed and access is barred except where special clothing and breathing apparatus is worn. The higher the C-number then the greater the hazard that exists.

Radiation limits are given as absolute limits but are qualified depending upon the part of the body affected. The limiting whole-body dose for a classified person is given as 5(N-18) rems, where N is the age of the person in years. The normal limiting annual dose is 5 rems (a rem is the unit currently used to express radiation), but this is qualified by not more than 3 rems in a calendar quarter. This is a whole — body dose and figures are quoted for individual parts and organs of the body where relaxation from the foregoing is given, providing the whole-body dose is not exceeded.

Members of the public and non-classified persons are limited to a whole-body dose not exceeding 0.5 rem per year.

2.2.1 Fast feedback effects

Magnox reactors use metal fuel and are operated to only a fairly low fuel bum-up. There is no modera­tor in the fuel so that the principal contributor to fuel temperature feedback is resonance broadening in U-238. Since U-238 concentration is virtually inde­pendent of irradiation it might be expected that the fuel temperature coefficient of reactivity would remain constant. That this is not so is due to the build-up of fission products.

The Pu-239 and Pu-240 resonances do not contri­bute to fuel feedback through the broadening me­chanism as they are produced mainly on the surface of the fuel (where the U-238 captures occur). There is little self-shielding and hence little contribution to fuel feedback. However there are two mechanisms which do make contributions to fuel feedback. The non-l/v absorption cross-section of U-235 gives a negative contribution which becomes smaller with ir­radiation and spectrum hardening by the magnox cans and, to a lesser extent, by U-238 give a positive effect through the Pu-239 resonance. The overall result is that the fast-acting feedback coefficient is initially about -1.3 mN/°C, reaches a value of about -1.0 mN °С at discharge (5500 MWd/t), giving a value of about -1.15 mN/°C at fuel cycle equilibrium.

2.2.2 Slow feedback effects

The feedback effects due to bulk graphite temperature changes are highly dependent on irradiation. Initially the moderator temperature coefficient of reactivity is small and negative due to the non-I/v cross-section of U-235. As Pu-239 builds up the temperature co­efficient becomes more and more positive. Typical values are -1.4 mN/°C at start-of-life, 16 mN/°C at discharge and an equilibrium value of around 12 mN/°C.

In the AGRs, the main factor which it is believed could impede the free entry of control rods into the core is distortion of the top dome (gas baffle). The articulation of control rods has been included to ca­ter for limited non-linearity of the control rod path. Checks are carried out from time to time to ensure that the rods can move freely; on some AGRs these checks are assisted by some of the coarse rods having fewer articulation joints (Hinkley Point B) or no arti­culation (Dungeness B), these rods are called ‘sensor rods’.

The secondary shutdown system in the AGRs is a nitrogen gas injection system. Nitrogen is a good absorber of neutrons, for example, it has been esti­mated that filling the Hinkley Point В reactor with nitrogen at a pressure approaching normal operating pressure would have a reactivity worth in excess of -20 Niles, twice the worth of the control rods. Nitro­gen at adequate pressure is capable of maintaining the reactor shut down for any reactivity state of the reactor core.

At Hinkley Point В and Dungeness В the nitrogen injection is initiated at the discretion of the operating staff. Plant abnormalities such as sensor rods jam­ming or failure of several control rods to fully enter the core on reactor trip will indicate the need for nitrogen injection. At Hartlepool and Heysham 1 the nitrogen injection may also be initiated automatically by tripping of the secondary shutdown (SSD) guard lines, the two tripping parameters being rate-of-change of top dome differential pressure (TDDP) and chan­nel gas outlet temperature (CGOT). The CGOT trip covers top dome failures which are insufficient to trip on TDDP. Tripping of the SSD guard lines also trips the main guard lines, thus releasing the control rods into the core. In all AGRs the displaced CO: rnav be vented through the blowdown system to ensure that the reactor gas pressure does not rise sufficient­ly high to lift the safety valves; at Hartlepool and Hevsham /, however, it has been calculated that the nitrogen injection will not cause the reactor gas pres­sure to exceed safety valve lift pressure if CO: is not vented off.

In the maenox reactors with steel pressure vessels, the main factor which it is believed could impede the free entry of control rods into the core is distortion of above-core components by the gas forces arising from failure of a top gas duct. Boron ball shutdown devices (BBSD) have been provided in these reactors to cover such an event. This is not normally known as a secondary shutdown system, probably because that name had already been taken b the secondary shutdown rods! (which were provided for a quite dif­ferent purpose). However BBSDs are included in this section because the reason for their existence is logi­cally related to the AGR SSD system.

A BBSD consists of a hopper filled with small boron steel balls and a release mechanism which will allow the balls to fall under gravity into a thimble in the reactor core when the rate of fall of reactor gas pressure exceeds a given value. There are typically 20 BBSDs in each reactor. The balls are recover­able. The boron balls are of sufficient worth to ensure that the reactor can be adequately shut down, their reactivity worth is typically about — 1 Nile. BBSDs are not normally claimed as first or second line pro­tection against particular faults, but it is usual to demonstrate their effectiveness by starting the reactor shutdown for biennial overhaul with the release of one or two BBSDs.

Tertiary shutdown systems

In AGRs the secondary shutdown system, nitrogen injection, is regarded as temporary. In the event of a more permanent shutdown being required, and if it is not possible to insert sufficient control rods into the core to aehieve this, the tertiary shutdown (TSD) system is used.

At Dungeness В and Hinkley Point В the TSD system is to fill the reactor internals with water. Clearly this is irreversible. The TSD pipework is not complete; at Dungeness В short closing lengths are provided to make the final connections on the day, at Hinkley Point В much of the pipework is tem­porary and must be installed to enable the operation to be carried out. The reactor will be cooled to about 50°C prior to filling to ensure that the fuel does not overheat between the cessation of normal cooling and the completion of filling, and to minimise the water flashing to steam on the hot components and displac­ing the neutron-absorbing nitrogen. Once commenced the filling must be completed because normal cooling cannot be restored.

At Hartlepool and Heysham / the TSD system is to fill a number of specially designated core chan­nels with boron-impregnated glass beads. The beads are blown in under CO: pressure. The beads should be recoverable, but it cannot be guaranteed that suf­ficient will be removed to take the reactor to power again. Unlike Hinkley Point В and Dungeness В the TSD plant is complete, so it could be in operation within a few hours of a possible need being identi­fied. Therefore if there is reason to believe that the control rod and SSD system together cannot maintain the reactor subcritical, the TSD system could be op­erated before the xenon has decayed.

In magnox reactors the ultimate shutdown system is boron dust injection, although it is not normally referred to as tertiary shutdown. A portable hopper and pump can be connected to the gas circuit near a blower inlet. Two powders, one a sticking agent and the other containing neutron-absorbing boron, will be mixed and pumped into the gas circuit. The blower will be running in order to distribute the mixture into the core. The boron dust, aided by the sticking agent, adheres to the hot surfaces within the reactor core and its reactivity worth ensures permanent shutdown.

Clearly the irreversible shutdown systems described above are under strict administrative control, requiring the authority of the Station Manager to proceed.

General gas composition The operational require­ments are summarised in Table 3.8 which indicates the concentrations of various components of the cool­ant gas.

Moisture in primary coolant In AGRs this is sig­nificant for safety since: [36]

• If not corrected, a high moisture level may lead to corrosion in the cooler part of the primary circuit.

In the case of Heysham 2, two systems are provided:

(a) Bulk moisture system

Reactor gas is bled from the bottom of the boiler annulus in quadrants A and C to two mirror dew­point instruments. These operate at a gas pressure of approximately 1.5 bar, but the pressure is not controlled. The output of these instruments is a dewpoint signal over the range — 50°C to + 40°C, and a pressure signal from an internal pressure transmitter.

Each dewpoint instrument has a dedicated mi­croprocessor. These convert the dewpoint tempera­ture signal into moisture weight parts per million concentration, using the pressure signal to give automatic compensation for the operating pres­sure. There is a 4-20 mA signal from each micro­

processor which is linear with concentration for the range 0-400 wpm.

The microprocessors also give a 4-20 mA signal which is linear with dewpoint over the range -30°c to + 40°C.

The moisture concentration and dewpoint signals are fed to the data processing system to appear on data displays (including trends with time) and alarms, the dewpoint indication being used when shut down and depressurised. Alarms are generated within the data processing system for ‘moisture level high’, ‘moisture level very high’, ‘high rate of increase of moisture level’, and ‘extra high rate of increase of moisture level’.

The moisture concentration signals are also fed via alarm amplifiers to give a grouped direct-wire facia alarm ‘moisture level very high’.

The system is not affected by oil ingress since this will plate out before reaching the instrument.

(b) Boiler leak detection system

The boiler leak detection system gives a means of identifying which quadrant has a leaking boiler in the event of an increase in moisture concentration. Reactor gas is sampled from each of eight loops which take gas from each circulator discharge back to its inlet. There are four moisture-sensitive cry­stal oscillator moisture detectors. Each detector monitors the difference in moisture concentration between two diametrically opposed points by al­ternate sampling using solenoid valves (about 30 seconds per sample):

• Detector 1 monitors gas bled from loops around circulators A1 and Cl.

• Detector 2 monitors gas bled from loops around circulators A2 and C2.

• Detector 3 monitors gas bled from loops around circulators B1 and Dl.

• Detector 4 monitors gas bled from loops around circulators B2 and D2.

Each detector is connected to its own dedicated microprocessor. While detector 1 is sampling loop Al, the datum is taken as the last reading from loop Cl, and vice versa. The output from each of the microprocessors, normally 4-20 mA for ±50 wpm, is decoded within the data processing system by means of a signal indicating which loop of the two is currently being sampled to give a non-oscillating moisture difference between the two loops.

Alarm relays raise alarms on the data processing system in the event of a difference of 50 wpm.

Oil in primary coolant This indicates whether or

not the oil leakage from the circulator motor com­partments is excessive. If this is so and the reactor is operated with a high oil concentration in the pri­mary coolant, this could lead to heavy carbonaceous deposits on the fuel pins, with a significant reduction in the heat transfer coefficient and corresponding increases in pin temperatures.

In the case of Heysham 2, the oil in the primary coolant detection system is intended to delect increases in the oil concentration in the CO; primary coolant and in this event to identify which circulator is the source. Gas is sampled from the discharge from each circulator via pipework leading out through the in­strument penetration in each quadrant to an instru­ment rack at the +3,9 m level.

There are four gas analysis systems, one per quad­rant. Each contains a photo-ionising detector cell consisting of an ultra violet lamp producing ionis­ing photons. A potential difference is applied to elec­trodes within the cell and the current carried by the ions produced by the photons is proportional to con­centration. The detector operates within an oven at 240°C and sample lines are trace heated to prevent condensation. The detector operates at a pressure of 0.8 bar.

The analysis system is differential to compensate for the effects of background organics produced from methane which is injected into the primary coolant to inhibit graphite core corrosion. The systems each contain a rotating valve and cooling coils so that the detector can give outputs for the following for comparison:

1 Circulator I gas uncooled.

2 Circulator 1 gas cooled (i. e., condensables removed).

3 Circulator 2 gas uncooied.

4 Circulator 2 gas cooled.

5 ‘Span’, i. e., reference concentration of propylene in CC>2-

6 ‘Zero’, i. e., pure CO2.

The output signal from each detector is fed to a de­dicated microprocessor. These provide 4-20 mA sig­nals for circulator 1 oil concentration (0 to 1 ppm) and circulator 2 oil concentration. The repeatability is ±0.003 ppm. The microprocessor also performs the sequence control of the rotating valve, on a settable time basis from 1 to 64 minutes per sample.

In the event of these measurements not coming up to expectations, oil ingress will be measured by hydrogen balance and discrete propene measurements at each gas circulator outlet as at existing AGRs.

The good resistance of 20/25 steel to high tempera­ture oxidation in CO2 was one of the main reasons why it was chosen for use in the Windscale AGR. In high temperature (>500°C) CO2 the steel forms a protective oxide, the composition of which ranges from Fe304 on the outside to mixed spinels closest to the metal substrate. The rate of scale formation is controlled by the diffusion of chromium from the metal through the oxide so that the kinetics are es­sentially parabolic, with a rate of scale thickening which gradually decreases as the scale thickens. Since the process is diffusion-controlled it is markedly tem­perature dependent, the rate constants having activa­tion energies of about 240 kj/g or more (Simpson and Evans, 1985 [13]). As the chromium diffuses into the scale, the underlying metal becomes corre­spondingly depleted. Since it is the chromium which largely promotes formation of the protective spinel oxide, it follows that local disruption of the scale, by mechanical interaction or temperature cycling, can expose a chromium depleted layer to the oxidising coolant. Oxidation will now result in the formation of a non-protective oxide and, as this grows, the oxide/metal interface will move into the body of the metal until the chromium level reaches about 18.5% when a protective oxide will once again form (Lobb and Evans, 1983 [14]). This, in outline, is the me­chanism for the formation of pits.

As with the oxides of uranium, the thermal expan­sion coefficient for the clad oxide is quite different from that of the cladding steel. Consequently, it will be appreciated that once an oxide has formed on the surface of the clad, large decreases in pin temperature will produce differential thermal contraction between

the two which will cause the oxide to have very high compressive stresses. If the temperature decrease is large and/or the oxide is thick, the elastic energy associated with these stresses can be sufficient to overcome the interfacial bonding energy between the oxide and the substrate, causing the oxide to spall. Laboratory tests commonly show such effects and, because of this, devices (central inertial collectors — CICs) which collect such spalled oxide were installed in ail the UK’s CAGRs. The main reason for doing this was to minimise contamination of the boilers by the highly radioactive oxide dust.

Operation of the reactors to date has shown little need for the CICs. The main reason for this seems to be that thermal contraction of the clad in the most affected positions is limited by its permanent contact with the fuel pellets. Since the UCb pellets and the clad oxide have similar coefficients of thermal expan­sion, the oxide is not so highly stressed as might have been suggested by laboratory tests (on unsupported steel coupons). Even so, it is quite possible that if, in future, peak clad temperatures are allowed to rise, the greater oxide thicknesses will allow the spalling threshold to be crossed.

Having described the reasons for the major require­ments of RCS primary coolant water chemistry control, and identified a typical primary coolant water speci­fication, it if. necessary to consider how such a chem­istry is best maintained in operation. The plant to enable such control is described later.

Early PWR operation tended to place emphasis on maintenance of the chemistry specification without any additional need to control the Li/B ratio and, by implication, the pH over a restricted range. A typical operational sequence would start with a high boron concentration at the beginning of a fuel cycle, with a lithium 7 concentration of the order of 1.0 ppm in the middle of the range. As power was increased the Li-7 concentration increased due to the B-10 (n, a) Li-7 reaction, together with a gradual reduction in boron on reactivity grounds, therefore the pH in­creased. Later in the fuel cycle Li-7 would be removed from the coolant by ion exchange operations in the CVCS in order to meet the specification, and towards the end of the fuel cycle Li-7 production decreased further as the boron concentration was reduced to a low level. Eventually, in anticipation of the reactor shutdown the Li-7 concentration would be allowed to fall to a very low value. The pH therefore varied significantly throughout the fuel cycle.

During the early years of operation there was also considerable awareness of the increasing primary cir­cuit activity levels, which were leading to increased doses to operational and maintenance personnel.

The most extensively monitored location was the steam generator channel head after shutdown, as the radiation field contributes significantly to the dose to personnel engaged in routine steam generator tube inspection. Such data is also the most reliable, as the activity can be monitored directly without attenuation by shielding and the dimensions and geometry of the location with respect to the detector is reproducible in most plants. Other areas routinely monitored in­clude various primary coolant pipework locations.

The conclusion drawn from the analysis of a con­siderable amount of plant data, including studies of in-reactor crud samples taken from fuel and pipework, is that the increasing activity levels are primarily due to corrosion products from out-of-core components.

It is concluded therefore that there is a mechanistic link between an unco-ordinated control of the RCS chemistry, which allowed wide variation of pH through a fuel cycle, and the release and deposition of acti­vated corrosion products. The corrosion products are known to have complex composition and morpho­logy, and the process of release/transport/deposition shown in Fig 1.56 is a function of system chemistry, hydrodynamics, heat flux, surface condition and sur­face temperature.

Investigation of the effect of chemistry on corrosion product solubility and release indicates that there is
a relationship between corrosion product solubility, temperature and the pH resultant from a range of Li/B ratios. Early studies of magnetite solubility in dilute aqueous acid and alkaline solutions saturated with hydrogen (Sweeton and Baes 1970 [32]) yielded graphs of iron solubility against temperature at var­ious pH as shown in Fig 1.57. If the isotherms are plotted for Fe solubility and OH- concentration (or pH) for relevant PWR temperatures (Fig 1.58), it is apparent that the temperature coefficient of the iron solubility could change from negative to positive as the pH of the primary coolant changed due to varying Li/B ratios.

In order to emphasis the point, data from Fig 1.58 which is relevant to PWR operation is presented in Fig 1.59 (Solomon 1977 [29]), where 300°C approxi­mates to the fuel clad temperature and 250°C is representative of the in-core coolant temperature.

For a coolant condition in which magnetite has a negative temperature coefficient of solubility it will precipitate on hot surfaces, whereas for a positive temperature coefficient magnetite will tend to dissolve from hot surfaces. The hypothetical situation for no crud transport by dissolution would require a zero coefficient of solubility and this is calculated to be pH

6.6 at 300°C for magnetite.

As noted earlier, Sandler (1979) [30] has shown that PWR fuel crud was based on the non-stoichiometric composition and structure of nickel ferrite. Subse­quently Sandler and Kunig (1981) [33] studied the so­lubility of nickel ferrite in boric acid solution in the

Fig. 1.58 Iron solubility as a function of hydroxide
molality

presence of hydrogen, using an experimental flow system used earlier for high temperature alkaline solutions by Sandler and Kunig (1977). This indicated that a zero temperature coefficient of solubility for nickel ferrite occurred at pH 7,2 at 300°C.

In applying a requirement to minimise the tem­perature coefficient of solubility of corrosion products

to a PWR operational fuel cycle, it is necessary to display Fe solubility as a function of temperature for relevant combinations of В and Li concentration. This is shown in Fig 1.60, 1.61 and 1.62 for 1100, 500 and 100 ppm В respectively at various lithium concentra­tions. The condition of minimum iron solubility (mini­mum change of iron solubility with temperature) over the range 285-330°C is achieved at progressively lower Li concentrations as В concentration decreases.

If this process of dissolution and precipitation of corrosion product derived species is analysed in terms of chemical equilibrium, it is possible to mathemati­cally predict the lithium concentration for a given boron concentration that corresponds to the minimum iron concentration and zero temperature dependence of solubility. The results of such a calculation are shown graphically in Fig 1.63 which represents the со-

Fjc. 1.60 Iron solubility plotted against temperature
for solutions containing 1100 ppm boron and varying
lithium concentrations

Fig. 1.62 Iron solubility plotted against temperature
for solutions containing 100 ppm boron and varying
lithium concentrations

ordinated control of Li and В throughout a PWR fuel cycle, for optimum control of circulating corrosion products and activity levels. RCS chemistry conditions outside the operational window would be expected to lead to dissolution or precipitation of corrosion pro­ducts and result in enhanced activity transport around the circuit.

Figure 1.63 indicates that the co-ordinated chemistry control is continued down to low lithium/low boron levels at the end of the fuel cycle. Operationally, there may be advantage in maintaining a minimum lithium concentration (e. g., 0.7 ppm) for boron concentrations below about 360 ppm. This would be to maintain a pH high enough to minimise corrosion and is illu­strated by the horizontal section on Fig 1.63.

Fig. 1.63 PWR operational chemistry —
recommended lithium concentration range as a function
of boron concentration

The main purpose of the burst can detection (BCD) equipment is to provide early warning to the reactor operator of the presence of a failed fuel can. Sam­ples of reactor coolant are withdrawn from various sampling points and monitored врйіеск for increases in their fission product level relative to background level which normally remains reasonably constant. Sur­face uranium contamination (usually 3 mg/element) left on the magnox can during manufacture releases fission products into the gas circuit, the level of which is used as a reference standard.

Ideally the data provided by the BCD gear should give the reactor operator sufficient time to check for authenticity, i. e., to confirm that the count is not a ‘spurious’ reading caused by plant malfunction.

1.7.1 Fuel

The uranium fuel rod is clad in a magnox can sealed at both ends by welding (Fig 2.22) which:

• Prevents the escape of fission products released during burn-up into the reactor coolant gas in which their activity is a health hazard and restricts main­tenance work on plant.

• Prevents the ingress of the reactor coolant CO; which causes severe corrosion of the fuel rod, lead­ing to oxide build up.

Control and protection

The use of common equipment for reactor control and protection is not generally permitted, because a common-mode fault on control equipment could re­sult in a reactor fault coincident with loss of one trip group.

Safety interlocks

For some protection applications, an interlock to pre­vent the occurrence of an unsafe reactor condition may be preferable to a trip group. In such a case the ‘safety interlock’ must be designed to a similar stand­ard to the equivalent trip group; with similar redun­dancy, diversity and reliability requirements.

Operator action

The safety trip system is designed to provide protection entirely independently of operator action. No reliance is placed on operator resetting of trip levels on modern stations, auto reset trip amplifiers being used where necessary. The operator can initiate a trip at any time, however, as a high integrity manual trip switch is pro­vided on the control desk (see Volume F, Chapter 6).

Operational vetoes may be installed to permit veto­ing of a trip group for reactor conditions in which its protection is not required and is operationally restrictive. Where this is done, the vetoes are inter­locked with other protection to prevent operation of the reactor in an unprotected condition.

However, it should be noted that operator action may be involved in the longer term after a reactor trip to ensure reactor cooling.

Fig, 2.59 Double ‘2 out of 3’ trip system in reactor guard lines

Maintenance

The safety trip system is designed to achieve its required reliability when tested at three monthly inter* sals. Maintenance vetoes are not provided on modern stations owing to the difficulty of guaranteeing that 4ich vetoes are removed after maintenance; the trip channels are allowed to go into the trip condition during maintenance.

Ammeters are provided (Fig 2.60) to check correct

operation,