6.7.1 Control rods

As described earlier in the magnox section, control rods are provided for two purposes. Firstly, as their name implies, they control the rate and distribution of heat aeneration in the fuel by absorbing more or less neu­trons as required. Secondly they are connected to safety circuitry that enables them to trip (this is the fast in­sertion of a large quantity of absorber) when required to prevent a fault situation from developing.

As in magnox stations, control rods are of two ‘worths’. Some are opaque to neutrons (black) and are generally only inserted when it is intended to shut down the reactor, though they can be used for flux shaping and power level control if necessary. The others are translucent to neutrons (grey) and are intended to be inserted about halfway into the core, i. e., they are nor­mally in a position where, by inserting them further or by withdrawing to some extent, the total or local power level can be adjusted. The potential reactivity of the core and the size and number of grey rods are generally designed to achieve a nominal 50% insertion of the grey rods. As local and general reactivity changes occur or when power changes are required in the core, the grey rods can be expected to move in the range 25% to 75% insertion.

Grey rods are made from stainless steel which is a moderate neutron absorber. Black rods contain stain­less steel tubular inserts with about 4% boron added to enhance the absorber worth. Materials are selected for their resistance to long term oxidation, since their operating temperature when inserted to maximum flux position may be up to 600°C. A further material con­sideration when designing rods is that boron steel swells under irradiation and clearances of boron stainless steel inserts must be sufficient to ensure that control rod sheaths do not split. Clearance however must not be excessive since this tends to reduce heat transfer and raise temperatures.

Black and grey rods are geometrically similar (and therefore have to carry clear external type identification) and their insertion routes (standpipe, control rod guide tube and core channel) are identical. Both types are designed to articulate, i. e., they are made up of six, seven or eight hinged segments, so as to reduce any possibility of failure to insert in the event of an exces­sive or unexpected distortion of the charge path. Each rod is attached to the chain of a control rod plug unit which contains the rod operating mechanisms. Since the chain passes through the hot above-dome region ol the guide tube, cooling reactor inlet gas is allowed to pass up the guide tube from the below-dome region via ports which also supply a down-flow to cool the rod itself.

The general arrangement of a control rod stringer is shown in Fig 2.91. Hartlepool and Heysham / control rods have a different articulation feature to that used in most AGRs, being built on a tie rod; but for both arrangements adhesion of the contacting surfaces at the articulating joints is prevented by applying hard coatings of chromium carbide.

In the event ot an accidental drop into the reactor, for example, due to breaking the control rod chain, a shock absorber is installed at the bottom of each con­trol rod channel (Fig 2.92).

The shock absorbers are designed and tested to ab­sorb the energy of a full rod drop from the highest operating position, plus a further drop from the highest recovery position. The highest operating position is with the rod nose joint above the top of the active core and the highest recovery position (using an emergency re­trieval grab) is with the nose of the rod just within the fuelling machine. The stiffness of the shock absorber is low enough to prevent damaging reactions on the graphite bricks or shock absorber supports and to pre­vent rod damage that might impede recovery. Allow­ance is made for irradiation-induced hardening of the shock absorber material.

The central control room (CCR) design is such that the station can be operated from the CCR during normal power operation, start-up and shutdown by one operator per unit and one control room super­visor. One assistant may be provided to assist on either a unit or station basis if necessary.

As far as possible, all unit controls and indications relating to start-up, normal power operation, shut­down and post-trip operation are mounted on the unit operator’s desk. Operational philosophy and space requirements dictate that some controls and indica­tions be mounted on vertical panels.

All other data required for commissioning, main­tenance, efficiency, administration or record purposes

T 13l E 2.14

display centre which is accessible from the CCR.

Each reactor/turbine unit has its own desk and vertical pane! on which is mounted conventional equip­ment for communication, display and control. A se­parate desk is provided for the supervisor which includes communications facilities, VDU displays to allow monitoring of unit performance, station services

DAO — Deaerator outlet

MSA — Methods for sampling and analysis

1C — Ion chromotography

EAAS Electrothermal (‘nameless’)

atomic absorption spectrometry

and electrical auxiliaries supply alarms. There are vertical panels for the cooling water system, station and reactor general services, fire alarms, station elec­trical system and high voltage switchgear system.

The layout of the room is shown in Fig 2.119. The desks and panels utilise the CEGB DIN modular design described in Volume F, Chapter 6. This modu­lar concept allows the desk layouts to be optimised

late in the construction programme to suit operating procedures.

The layout is based on the use of computer-driven visual display units (VDUs) as the primary source of information (i. e., data and alarms) and it is intended that normal power operation can be monitored and controlled from the centre section of the desk. Con­trols and indications are provided on the wings of the desk for less frequent operating regimes, i. e., start-up and shutdown.

Hardwired indications and alarms are provided to supplement the VDU displays, for the following

reasons:

• To enable the plant to be maintained at steady load without the computer system available.

• Where there is ergonomic advantage in having dis­plays directly associated with controls.

• To provide diverse indications where necessary to meet safety requirements.

• To safely shut down and monitor post-trip cooling without the aid of the computer system.

As a result of the extent of the post-trip cooling sys­tems, and the large number of plant state changes initiated by the eight sets of post-trip sequence equip­ment (PTSE) described in Section 8 of this chapter, the mimic has been designed to provide a functional overview of the state of post-trip cooling (Fig 2.120) and is mounted on the unit panel. In the short term post-trip, the operator is not required to monitor the detailed actions of the PTSE. He is required to es­tablish, with the aid of the mimic, that an adequate number of post-trip heat removal trains are operating and that reserves of coolant are adequate.

The pressuriser control system is designed to:

* Maintain the mass inventory of the reactor coolant system by controlling the pressuriser level accord­ing to the reactor coolant temperature, so that the coolant in-surges and out-surges which occur during load changes may be accommodated without undue loss from or make-up to the reactor coolant system, or a reactor trip.

• Control the primary coolant pressure so as to avoid undue discharge through the pressuriser relief or

safety salves.

Pressuriser level

The pressuriser water level is compared with its de­manded value to form the water level error signal, which is then compensated by a proportional/integral — derivative (PID) controller to provide the demanded charging flow. The letdow-n flow is isolated if the pressuriser water level falls below a low level setpoint to avoid uncovering the heaters and to maintain the »’Vater inventory of the primary circuit. Reactor coolant ls discharged to the letdown line from a crossover leg of the RCS.

The charging valve position and valve position de­mand are checked for correct response to control system demands.

The demanded value of the pressuriser water level is programmed as a function of the estimated average coolant temperature in the primary circuit, so that at part-load the water level is reduced from its full load value in order to match as closely as possible the contraction of the water in the primary circuit as its temperature is reduced.

Pressuriser pressure

The pressuriser pressure is compared with its demanded value to form the pressure error signal which is then compensated by a PID controller to form the actuation signals for the pressuriser heater and spray controls. Increasing the heater power increases the pressuri­ser pressure, and increasing the spray rate decreases the pressuriser pressure. The pressuriser proportional heater controller demand is checked for correct re­sponse to control system requests.

The 78 electrical heaters are located near to the bottom of the pressuriser. Eighteen of the heaters are proportionally controlled to correct pressure devia­tions arising from small disturbances in the reactor and primary circuit. The remaining (back-up) heaters are switched on when the pressuriser pressure control requires more heat than can be supplied by the pro­portional heaters. Operation of all the heaters is inhibited when the pressuriser water level is low and likely to uncover the heaters. Heat losses from the pressuriser, including heat losses due to the small, continuous spray, require the proportional heaters to be at approximately half power at full load steady — state conditions.

Pressuriser spray from the nozzle located in the top of the pressuriser is initiated when the pressure con­troller spray demand exceeds a given value. The spray rate then increases proportionally with increasing spray demand, until the maximum spray flow is reached. Steam condensed by the spray reduces the pressuri­ser pressure back towards its demanded value. A small, continuous spray is normally maintained to reduce thermal stresses and to help maintain uniform water chemistry and temperature in the pressuriser. The spray valve positions are checked for correct re­sponse to control system demands.

.«•дІрь.

&

Quality is defined as that standard necessary to op­erate and maintain the station in a manner that com­plies vith the Station Design Intent and Final Safety Report, incorporating modifications made from time to time by the Station Modification Procedure. Op­erating Rules, Management Memoranda, Generation

Operating Memoranda, Technical Operation Memo­randa, Safety Memoranda and other statutory or man­datory instructions.

1.5.3 Hierarchy of documents

The description of the system to establish an appro­priate and acceptable level of quality will be embodied in the following hierarchy of documents:

• Part I A Handbook setting out the overall po­licy, management and procedures for the QA programme.

• Pan 2 A Handbook describing the management and procedures covering the quality assurance ac­tions for a department or functional area agreed and authorised for issue by the Station Manager.

• Part 3 Plans, schedules, procedures, instructions, drawings and records for defined items, processes, services, contracts and projects.

1.5.4 Implementation

All nuclear power stations are required to have a system of quality assurance and all new stations will have that requirement written as a condition of their site licence. For existing stations consideration is being given by the Nil to take the formal step of issuing it as a licence condition.

The operating staff in the reactor control room;

• Supervise the reactor while it is shut down.

• Start-up the reactor.

• Control reactor output to match electrical genera­tion requirements and turbine-generator availability.

• Optimise reactor output when full load generation is required.

• Shut down the reactor.

At al! times the operating staff ensure that the reactor is operated safely and within the limits laid down in the Operating Rules.

Operating techniques vary from station to station, just as the type of plant varies from station to sta­tion. In this section the general and common features of operation are described.

To enable the operating staff to carry out the functions listed above, they are provided with a range of operating information and plant controls. The principal information presented includes:

• Neutron flux, calibrated in units of reactor heat output.

• Temperatures, including reactor gas inlet and outlet, fuel channel gas outlet, graphite moderator, fuel can surface, structural items.

• Reactor gas flow; this may be measured directly, or it may be inferred from such parameters as gas circulator speed or circulator inlet guide vane position.

• Reactor gas pressure.

• Control rod positions.

• Boiler water/steam conditions and turbine electrical generation.

The principal plant controls provided include:

• Control rods to regulate the neutron flux and hence the reactor power.

• Reactor gas flow controls to regulate the transfer of heat from the reactor core to the boilers.

• Boiler feedwater controls to ensure that the reactor heat can be disposed of. [33]

The temperature rise is from reactor inlet to outlet. This formula is useful when considering the effects on reactor power of changes in gas flow at constant temperature and changes in temperature at constant gas flow; specific heat is assumed to remain constant. Where the temperature rise is high, as in AGRs at full power, the variation in specific heat with tem­perature cannot be ignored if accuracy is important, so where an accurate result is required it is more usual to perform the calculation in terms of enthalpy — rise rather than specific heat and temperature rise. However for the purposes of this section the formula as expressed above is adequate.

Control rods directly influence the reactor power. If the gas flow remains constant, changes in neutron power will affect reactor temperatures; this is the usual situation during the early stages of start-up and at nominal steady power. On the other hand, if the temperature rise is to be kept constant, changes in neutron power will have to be matched by changes in gas flow; this is the usual situation during gross power changes.

Magnox and AGR cores are of fairly large dimensions, so it is possible for situations to develop in which power may be increasing in one part of the core and decreasing in another. Power oscillations with a periodicity of several hours may also occur. There are several modes of this type of instability, characterised according to the pattern of rising and falling power. To examine the processes involved in a power oscil­lation let us consider the simplest mode, called the ‘fundamental mode’, in which the power change is uniform across the core, і e., total reactor power rises and falls in an oscillatory manner. It must be emphasised that the reactor behaviour described in this section is of theoretical interest only, since the oscillation is not normally observed because the auto control system or the reactor control engineer will maintain stable conditions. However, in order that the auto control system designer and the reactor control engineer can assure stability, an awareness of the phe­nomenon is required.

Let us suppose that the reactor is operating at steady power with uniform conditions across the core when a uniform disturbance, for example, the raising of a group of bulk rods, causes the reactor power and temperatures to increase. Assuming that the auto control system on reactor gas outlet temperature is inoperative and that the reactor control engineer takes no action to arrest the rise in power and tempera­tures. The progress of the transient from this point onwards depends on a number of factors, some will have a stabilising influence and some will be desta­bilising; the timescales on which they operate are also significant.

It is not possible to instrument every fuel element in a reactor because of the very high numbers, so an alternative method has to be adopted to assess the highest fuel element temperature in the reactor. It is probable that not more than 2.5ro of the fuel ele­ments are instrumented. Such a small proportion makes it statistically difficult to derive an assessment ot temperature. To give a confident result other rele­vant temperatures have to be taken into account.

The assessed temperature arrived at by means of a statistical analysis using fuel element temperature, channel gas outlet temperatures, bulk core inlet and outlet gas temperatures.

The result of the sum gives a maximum temperature of any fuel element in the reactor and it is this tem­perature which determines the operating condition tor driving the reactor.

Core restraint structure

The determination of the maximum operating tempera­ture and temperature differentials between adjoining components is necessary to avoid mechanical failure of the structure due to differential expansion. Once at full power and with the components thermally ‘soaked’ problems should not occur, but with changes of power and temperature strict observation of temperature of the restraint and support core structures is essential.

The reactivity of graphite to air is important in the magnox steel pressure vessel stations since a loss of coolant pressure with consequent air ingress is con­sidered a ‘credible’ accident. Fault study calculations are regularly carried out using appropriate graphite data, since the oxidation reaction is exothermic and the resulting heat release could raise temperatures in the core and so further increase the rate of the oxi­dation. It is thus important to demonstrate that the release of heat from graphite oxidation, and from other sources such as the oxidation of amorphous carbon deposits and from the release of stored ‘Wigner’ ener­gy can be contained by natural circulation until pony — motor or full flow blower power cooling flow can be reinstated.

The chemical reactivity of the graphite increases with irradiation, both through neutron damage af­fecting the reactivity of surface sites and also through the opening of closed pore structure by the radiolytic oxidation during normal operation. Further catalytic material, e. g., metal oxides, may accumulate raising the potential oxidation rate in oxygen. The quantity of the more reactive deposits also increase throughout’ reactor life. Therefore extensive monitoring of these related graphite chemical properties is carried out and used in conjunction with established models to predict the core state for future operational periods.

The computer program ‘RHASD’ (Reactor Heating After Shut Down) takes account of these and other relevant core data in calculating fuel and graphite temperatures throughout this hypothetical transient. Pessimised data is employed to ensure that both graph­ite and fuel temperatures peak at a safe value and then show a subsequent fall if subsequent operation of the reactor were permitted.

AGRs (air)

In AGRs, the maximum credible accident does not result in air ingress into the graphite core and hence the thermal reactivity of graphite-to-air is not of ma­jor concern. However, there are two instances where a knowledge of air reactivity can influence reactor operation. Firstly, major reactor overhauls are carried out in an air environment and it is necessary to deter­mine the maximum acceptable temperature during the subsequent raise power sequence when the air has to be purged and a CO2 atmosphere established. Second­ly, if a fuel pin deposit burn-off-coolant, e. g., 1-10 vpm О;/CO2 has to be adopted at any time. In addition the fuel stringer will see an air environment subsequent to its removal from the reactor and it is necessary to define acceptable temperature limits for the graphite sleeves. Experiments have therefore been carried out to measure the reactivity between modera­tor and sleeve graphite, both virgin and irradiated.

AGR reactors (carbon dioxide)

During normal AGR operation the temperature of the moderator is so low that thermal oxidation by CO2 is negligible. This is also the case for the graphite fuel sleeves but in this latter case, due to the higher temperature, it has been necessary to confirm this by experiment with both virgin and irradiated graphite samples, although no effect of irradiation has been observed. In some designs of AGR, graphite bearings have been used as boiler supports and experiments have been carried out to confirm their design life, although in this case the radiation levels are low and no irradiated samples were tested.

The procedures currently adopted in the UK to pro­tect magnox fuel during pond storage have evolved over many years, the main objective being to avoid exposure of the uranium fuel to pond water with con­sequent corrosion of the fuel and release of activity.

Pond water chemistry is accordingly specified to suppress magnox corrosion and hence penetration of the cladding [38]. Chloride and sulphate ions, and to a lesser extent silicate, have been shown to be aggres­sive towards magnox, but for pHs greater than about 11, the higher the pH, the higher the levels of chlo­ride and sulphate which can be tolerated. Water treat­ment is needed to maintain such alkaline conditions in an open pond where carbon dioxide can be absorbed from the air, and the demands for treatment can ef­fectively limit the sensibly achievable pH. Accordingly, magnox pond water is specified to be not less than pH 11.5 with a target value of 11.7, and the combined chloride and sulphate limit is specified at I g/m3 with a target value of 0.5 g/m3. Magnox fuel is most vulnerable to chloride excursions in the early stages of pond residence during the time in which a protec­tive corrosion film is forming on the surface [39]. Recently discharged fuel has been affected by transient increases in bulk pond water chloride levels of < 5 g/m3. In view of the widespread use of sand pressure filters and the less aggressive effect of silicate ion, only a target level for silicate of 1 g/m3 is set.

CVCS — CHEMICAL 4 VOLUME CONTROL SYSTEM ^-4 — NORMALLY CLOSED HX — HEAT EXCHANGER

Fig. 1.65 Boron thermal regeneration system

Several stations have installed cooling plant to re­duce water temperatures to about 15°C and hence reduce magnox corrosion rates further.

Magnox corrosion can be increased by galvanic coupling with the mild steel from which the storage skips are made. The skips are painted but the paint
deteriorates in use and therefore it is recommended that only skips with paint in good condition are used for storage.

Occasionally, corrosion product sludge has accumu­lated in station ponds and has had a deleterious effect when in contact with magnox. The sludge is known
to concentrate chloride and this may be responsible for the increased magnox corrosion, but it is also possible that the blanketing effect of the sludge allows local departures from the bulk pond water chemistry to develop. It is therefore recommended that ponds should contain minimum corrosion product.

Exposure of uranium to pond water has occur­red through mechanical damage to element1;. In one instance the cause was traced to a discharge route, which was subsequently modified to reduce element impact, but the desplittering and delugging of ele­ments has been found to be a more common source of damage. Efforts have been made to reduce the amount of desplittering and delugging damage and the operation is often delayed until shortly before element despatch.

As uranium corrodes in pond water, the fission product caesium it contains is released essentially com­pletely, strontium to a lesser extent [40]. The con­sequences of having failed fuel in a pond depend essentially on the area of uranium exposed. This can change substantially as corrosion progresses, particu­larly if a swollen element is involved and the corrosion penetrates the porous annulus. In this case, release rates from a single element can be of the order of a hundred mCi Cs-137/day, whereas the release from an element with a damaged end fitting exposing un­swollen uranium can be only a few /rCi Cs-137/day. More rapidly releasing elements can be identified and given priority for despatch. Caesium removal plant is common on magnox stations. The uranium dioxide corrosion produced is not adherent but forms a sludge, which if disturbed and redistributed can become an airborne radiological hazard. This is another reason why pond sludge should be kept to a minimum level, preferably by preventive measures but alternatively by mechanical removal [41].

When magnox fuel is identified as failed in reactor, it may be bottled before discharge to the station pond and then later sent for PIE to characterise the failure. Occasionally bottle seals leak, admitting pond water. The corrosion of uranium in moist atmospheres, as opposed to immersion conditions can lead to uranium hydride, accompanying uranium dioxide, as a corro­sion product in significant amounts, such that when the bottle is eventually opened, the uranium hydride may oxidise rapidly and exothermically, causing an occasional ignition of the uranium bar. Good sealing of fuel bottles is therefore important.

The main systems necessary to remove decay heat are primary circuit CO2 circulation and secondary circuit boiler feedwater. Such systems generally involve cir­culators and pumps which require electrical and aux­iliary systems to function, e. g., circulator seal oil.

The condensing cooling water system will normally also be used post-trip to condense secondary side steam and return feedwater to the boilers. Loss of this sys­tem can be tolerated however, as the boiler steam can be discharged to atmosphere. The key design criterion is therefore an adequate guaranteed supply of feed water from tanks or mains supplies.

In addition, it is important to provide information on the plant state and confirmation of the satisfac­tory operation of the post-trip heat removal system to the operator. Required systems therefore include instrumentation together with any necessary control facilities where there is operator involvement. For example, the operator may be able to correct any post-trip cooling system failures. Reasonable access provision is therefore required to any local control where the operator may be expected to take action, and systems may be provided to enhance main con­trol room habitability.

It is then necessary to show that the post-trip cooling duty, which must be initiated within a rela­tively limited time of a shutdown or trip, is met on a reliable basis. The systems design should have ade­quate redundancy to cover, for example, plant out for maintenance or plant failures. For relatively frequent events such as normal shutdowns, the reliability of the post-trip heat removal system must be extremely high. This may be achieved on magnox stations by continuing to run the normal cooling system. For ex­tremely unlikely faults, the design target reliability can be reduced to achieve the same overall risk level.

Finally, in essential system design, it is necessary to establish whether systems should be initiated and op­erated automatically or whether the operator should carry out this role. Generally, the operator can only be used where actions are relatively straightforward and well defined and the timescale available for action is a minimum of some 15 to 30 minutes. Other rele­vant factors include whether actions can be taken from the central control room or have to be taken locally on the plant, the complexity of indications available and the consequences of maloperation.