The reactivity of graphite to air is important in the magnox steel pressure vessel stations since a loss of coolant pressure with consequent air ingress is con­sidered a ‘credible’ accident. Fault study calculations are regularly carried out using appropriate graphite data, since the oxidation reaction is exothermic and the resulting heat release could raise temperatures in the core and so further increase the rate of the oxi­dation. It is thus important to demonstrate that the release of heat from graphite oxidation, and from other sources such as the oxidation of amorphous carbon deposits and from the release of stored ‘Wigner’ ener­gy can be contained by natural circulation until pony — motor or full flow blower power cooling flow can be reinstated.

The chemical reactivity of the graphite increases with irradiation, both through neutron damage af­fecting the reactivity of surface sites and also through the opening of closed pore structure by the radiolytic oxidation during normal operation. Further catalytic material, e. g., metal oxides, may accumulate raising the potential oxidation rate in oxygen. The quantity of the more reactive deposits also increase throughout’ reactor life. Therefore extensive monitoring of these related graphite chemical properties is carried out and used in conjunction with established models to predict the core state for future operational periods.

The computer program ‘RHASD’ (Reactor Heating After Shut Down) takes account of these and other relevant core data in calculating fuel and graphite temperatures throughout this hypothetical transient. Pessimised data is employed to ensure that both graph­ite and fuel temperatures peak at a safe value and then show a subsequent fall if subsequent operation of the reactor were permitted.

AGRs (air)

In AGRs, the maximum credible accident does not result in air ingress into the graphite core and hence the thermal reactivity of graphite-to-air is not of ma­jor concern. However, there are two instances where a knowledge of air reactivity can influence reactor operation. Firstly, major reactor overhauls are carried out in an air environment and it is necessary to deter­mine the maximum acceptable temperature during the subsequent raise power sequence when the air has to be purged and a CO2 atmosphere established. Second­ly, if a fuel pin deposit burn-off-coolant, e. g., 1-10 vpm О;/CO2 has to be adopted at any time. In addition the fuel stringer will see an air environment subsequent to its removal from the reactor and it is necessary to define acceptable temperature limits for the graphite sleeves. Experiments have therefore been carried out to measure the reactivity between modera­tor and sleeve graphite, both virgin and irradiated.

AGR reactors (carbon dioxide)

During normal AGR operation the temperature of the moderator is so low that thermal oxidation by CO2 is negligible. This is also the case for the graphite fuel sleeves but in this latter case, due to the higher temperature, it has been necessary to confirm this by experiment with both virgin and irradiated graphite samples, although no effect of irradiation has been observed. In some designs of AGR, graphite bearings have been used as boiler supports and experiments have been carried out to confirm their design life, although in this case the radiation levels are low and no irradiated samples were tested.

The procedures currently adopted in the UK to pro­tect magnox fuel during pond storage have evolved over many years, the main objective being to avoid exposure of the uranium fuel to pond water with con­sequent corrosion of the fuel and release of activity.

Pond water chemistry is accordingly specified to suppress magnox corrosion and hence penetration of the cladding [38]. Chloride and sulphate ions, and to a lesser extent silicate, have been shown to be aggres­sive towards magnox, but for pHs greater than about 11, the higher the pH, the higher the levels of chlo­ride and sulphate which can be tolerated. Water treat­ment is needed to maintain such alkaline conditions in an open pond where carbon dioxide can be absorbed from the air, and the demands for treatment can ef­fectively limit the sensibly achievable pH. Accordingly, magnox pond water is specified to be not less than pH 11.5 with a target value of 11.7, and the combined chloride and sulphate limit is specified at I g/m3 with a target value of 0.5 g/m3. Magnox fuel is most vulnerable to chloride excursions in the early stages of pond residence during the time in which a protec­tive corrosion film is forming on the surface [39]. Recently discharged fuel has been affected by transient increases in bulk pond water chloride levels of < 5 g/m3. In view of the widespread use of sand pressure filters and the less aggressive effect of silicate ion, only a target level for silicate of 1 g/m3 is set.

CVCS — CHEMICAL 4 VOLUME CONTROL SYSTEM ^-4 — NORMALLY CLOSED HX — HEAT EXCHANGER

Fig. 1.65 Boron thermal regeneration system

Several stations have installed cooling plant to re­duce water temperatures to about 15°C and hence reduce magnox corrosion rates further.

Magnox corrosion can be increased by galvanic coupling with the mild steel from which the storage skips are made. The skips are painted but the paint
deteriorates in use and therefore it is recommended that only skips with paint in good condition are used for storage.

Occasionally, corrosion product sludge has accumu­lated in station ponds and has had a deleterious effect when in contact with magnox. The sludge is known
to concentrate chloride and this may be responsible for the increased magnox corrosion, but it is also possible that the blanketing effect of the sludge allows local departures from the bulk pond water chemistry to develop. It is therefore recommended that ponds should contain minimum corrosion product.

Exposure of uranium to pond water has occur­red through mechanical damage to element1;. In one instance the cause was traced to a discharge route, which was subsequently modified to reduce element impact, but the desplittering and delugging of ele­ments has been found to be a more common source of damage. Efforts have been made to reduce the amount of desplittering and delugging damage and the operation is often delayed until shortly before element despatch.

As uranium corrodes in pond water, the fission product caesium it contains is released essentially com­pletely, strontium to a lesser extent [40]. The con­sequences of having failed fuel in a pond depend essentially on the area of uranium exposed. This can change substantially as corrosion progresses, particu­larly if a swollen element is involved and the corrosion penetrates the porous annulus. In this case, release rates from a single element can be of the order of a hundred mCi Cs-137/day, whereas the release from an element with a damaged end fitting exposing un­swollen uranium can be only a few /rCi Cs-137/day. More rapidly releasing elements can be identified and given priority for despatch. Caesium removal plant is common on magnox stations. The uranium dioxide corrosion produced is not adherent but forms a sludge, which if disturbed and redistributed can become an airborne radiological hazard. This is another reason why pond sludge should be kept to a minimum level, preferably by preventive measures but alternatively by mechanical removal [41].

When magnox fuel is identified as failed in reactor, it may be bottled before discharge to the station pond and then later sent for PIE to characterise the failure. Occasionally bottle seals leak, admitting pond water. The corrosion of uranium in moist atmospheres, as opposed to immersion conditions can lead to uranium hydride, accompanying uranium dioxide, as a corro­sion product in significant amounts, such that when the bottle is eventually opened, the uranium hydride may oxidise rapidly and exothermically, causing an occasional ignition of the uranium bar. Good sealing of fuel bottles is therefore important.

The main systems necessary to remove decay heat are primary circuit CO2 circulation and secondary circuit boiler feedwater. Such systems generally involve cir­culators and pumps which require electrical and aux­iliary systems to function, e. g., circulator seal oil.

The condensing cooling water system will normally also be used post-trip to condense secondary side steam and return feedwater to the boilers. Loss of this sys­tem can be tolerated however, as the boiler steam can be discharged to atmosphere. The key design criterion is therefore an adequate guaranteed supply of feed water from tanks or mains supplies.

In addition, it is important to provide information on the plant state and confirmation of the satisfac­tory operation of the post-trip heat removal system to the operator. Required systems therefore include instrumentation together with any necessary control facilities where there is operator involvement. For example, the operator may be able to correct any post-trip cooling system failures. Reasonable access provision is therefore required to any local control where the operator may be expected to take action, and systems may be provided to enhance main con­trol room habitability.

It is then necessary to show that the post-trip cooling duty, which must be initiated within a rela­tively limited time of a shutdown or trip, is met on a reliable basis. The systems design should have ade­quate redundancy to cover, for example, plant out for maintenance or plant failures. For relatively frequent events such as normal shutdowns, the reliability of the post-trip heat removal system must be extremely high. This may be achieved on magnox stations by continuing to run the normal cooling system. For ex­tremely unlikely faults, the design target reliability can be reduced to achieve the same overall risk level.

Finally, in essential system design, it is necessary to establish whether systems should be initiated and op­erated automatically or whether the operator should carry out this role. Generally, the operator can only be used where actions are relatively straightforward and well defined and the timescale available for action is a minimum of some 15 to 30 minutes. Other rele­vant factors include whether actions can be taken from the central control room or have to be taken locally on the plant, the complexity of indications available and the consequences of maloperation.

The fission products present in the reactor coolant give valuable information on the integrity of the cladding of the uranium fuel.

In CC>2-cooled reactors, a system of on-load fuel monitoring and failed fuel location called ‘burst can detection’ (BCD) was developed for the Calder Hall reactors. Gas samples are piped to a special detector and the fission products have to be detected against a background of neutron induced activity. Discrimina-

tion against this is achieved by a method of electro­static precipitation and subsequent measurement of the beta-emitting daughter products. Originally de­veloped for magnox reactors, this precipitator method was subsequently adapted for AGRs.

A recent development is to record the signals from two equal successive periods. The first signal is ap­proximately proportional to the short-lived and long — lived fission products in the gas sample. The second signal is approximately proportional to the compo­nent from the longer-lived fission products, so that the difference of the two signals gives a measure of the shorter-lived components. This ‘split-count’ tech­nique gives an improved indication of early failure of AGR fuel pins.

In magnox stations, the channel containing the failed fuel is located by a fixed-pipe sampling system with automatic selection valves. In AGRs there is also a fixed sampling system, but selection of the channel being sampled is by a flexible hose that is manually attached to each channel in turn. A method of auto­matic selection is being investigated.

The buffer store accepts freshly discharged fuel as­semblies whilst their fission product heat generation decays to a rate compatible with the cooling arrange­ments at the irradiated fuel disposal facility (IFDF). It consists of a number of water-cooled pressure tubes, known as buffer tubes, within which the fuel assemblies are placed and cooled by the natural con­vection of heat to the pressure tube walls by pres­surised carbon dioxide.

Only eight buffer tubes were provided initially at Hinkley Point В but a further 14 were subsequently added. The decision to extend the facility resulted from operational experience of part load batch refuel­ling which had not been originally envisaged as a normal operational route. At Heysham 2, the fuel route was designed from the outset to permit a 28 day cooling period for all fuel assemblies prior to transfer to the irradiated fuel disposal facility, as a means of easing the duty on the cooling system for that cell. In consequence, the buffer store at Heysham 2 contains 32 buffer tubes.

Figures 2.126 to 2.128 show the general arrangement of building layouts and the plant within them.

The auxiliary building houses the bulk of the equip­ment for reactor auxiliary and safety systems includ­ing the chemical and volume control system (CVCS), the residual heat removal system (RHRS), the high pressure coolant injection system (HPCIS) and the containment spray system. The auxiliary building inter­faces directly with the reactor building to allow the direct passage of pipes and cables between the two buildings.

Main steam and feed pipework from and to the steam generators leaves the reactor building through the separate steam and feed cell, w’hich also houses auxiliary steam-driven safety equipment. The fuel build­ing contains the spent fuel storage pond and also interfaces directly with the reactor building to allow fuel to be passed between the reactor and the fuel storage pond. It is the reception point for new fuel and also contains the spent fuel flasking facility and loading bay for transport of spent fuel from site.

The control building houses the main control room, data processing room, the primary protection system, the component cooling water system (CCWS) plant and heating and ventilation plant.

The mechanical annexe interfaces with the steam and fuel cell to allow the optimum passage of the main steam and feed pipework between the reactor building and the mechanical annexe/turbine house.

As well as housing the main steam and feed pipe­work and major turbine system ancillaries, the me­chanical annexe contains the main change and power block security facilities.

The following major principles have been adopted for the layout of plant and service within buildings:

• Redundant safety classified equipment is located within different segregated principal fire areas, in accordance with the principles agreed with the Nu­clear Installations Inspectorate, particularly those concerning penetrations through principal fire bar­riers, and are allocated to electrical separation groups in an appropriate manner to maintain redundancy and hazard protection.

• As far as practicable, cables are routed away from corridors or plant rooms.

• Smoke vent stacks with pressure-actuated dampers are installed to facilitate heat and smoke removal from the control and auxiliary buildings. [22]

10.1.3 Heating, ventilating and air conditioning (HVAC)

Each building contains a HVAC system to provide a suitable environment for personnel and equipment and to control the spread of airborne contamination under normal and faulted conditions. The design of each HVAC system is dictated by the functional re­quirements of the buildings and equipment which it senices.

Typically the role of the HVAC systems has up to four elements:

• Cooling of important plant items.

• Control of radioactive release post-fault.

• Personnel comfort and safety (including smoke con­trol following fires).

• Control of contamination spread.

The cooling of safety classified plant is generally accomplished by independent room coolers served by the component cooling water system, or by closed loop air conditioning systems. Radiological releases are controlled by the use of filters and charcoal beds. Personnel comfort is maintained by fans, air condi­tioning and steam/electric heating systems, as appro­priate. Fire dampers are used to isolate designated fire areas; fans are provided to pressurise stairways following a fire and are also available for smoke re­moval following fires. Contamination control is dis­cussed in the next section.

Because the process of fission product decay leads to the generation of significant quantities of heat, even when the reactor is shut down, continuous cooling qf the reactor core is required in order to achieve and maintain the low temperatures (well below 100°C) required for refuelling, maintenance or repair of the reactor and its coolant system. As explained in Section 12 of this chapter, this cooling is achieved by the residual heat removal system (RHRS) when the re­actor coolant temperature is about 177°C or less.

The RHRS (Fig 2.142) comprises two parallel heat transfer loops, each containing a centrifugal pump and a vertical shell and U-tube heat exchanger. The pumps each draw reactor coolant leaving the core from one of the RCS hot legs and pass it through the heat exchanger tubes, in which it is cooled by component cooling water flowing through the heat exchanger shell before returning it to a pair of RCS cold legs, and thence to the core inlet. The pumps and heat exchangers are located on the lower floors of the auxiliary building and the suction and delivery pipework therefore penetrates the wall of the reactor containment building. All RHRS components and pipe­work are constructed from austenitic stainless steel and the design pressure is approximately 39 bar.

The RHRS equipment is sized so that with both loops operating, the primary circuit can be cooled from 177°C to 60°C (the temperature at which re — — actor. dismantling can commence) over a period of about 16 hours, this representing an acceptably small impact on the critical path of the refuelling and main­tenance operations planned during the shutdown peri­od whilst leading to reasonable equipment sizes. To maximise system reliability, each RHRS loop uses se­parate services and supplies of electrical power and cooling water. Furthermore, two additional identical pumps normally serving as containment spray pumps are provided with cross-connecting pipework, which enables. either to be used in place of an RHR pump if necessary. All electrical and control equipment is diesel-backed.

Because the RHRS equipment is located outside the containment and has a relatively low design pressure, very stringent precautions are taken against inadvertent exposurlfof the RHRS to the primary circuit when the latter is at high temperature and pressure. Each of the suction lines contains three motorised gate valves in series, and any one remaining closed will isolate the RHRS from the primary circuit.

These valves are separately interlocked to prevent opening when pressure is too high. On the delivery

t

side, multiple non-return (check) valves provide re­liable isolation.

Heat exchanger performance is dependent on the coolant flow rate and the temperature difference be­tween the primary coolant and the component cooling water; to aoid too rapid cooling, which could in­crease thermal stresses in reactor components, the heat exchanger How-rate can be throttled using a manually controlled butterfly valve, A bypass line, containing an automatic butterfly valve, ensures that the pump flow rate remains roughly constant at 800 m’/h per RHRS loop.

Reactor cooling via the RHRS would also be needed in the event of a fault which necessitates repairs to the reactor itself, the primary and secondary circuits or equipment inside the reactor building. One RHRS loop has sufficient cooling capacity to match the de­cay heat production rate about 4 hours after reactor trip or shutdown, to prevent reactor temperature ris­ing above 177°C and to cool the primary circuit to 93°C within a further 12 hour period. This enables the circuit to be completely depressurised and cold shutdow-n conditions to be reached. The RHRS equip­ment is designed to withstand or be protected from all significant external and internal plant hazards, including a safe shutdown earthquake, and rigorous fire segregation is provided between the two equipment loops.

In the special case of a loss of coolant accident (LOCA) causing rapid emptying and depressurisation of the primary circuit, the RHR pumps act as part of the emergency core cooling system which is de­scribed in the next section.

Although the basic phenomena of fuel irradiation are similar in PWRs to AGRs and magnox reactors, there

are some important differences due principally to different operating conditions. One difference arises from the batch refuelling in PWRs, which necessitates a high level of reactivity control to balance the re­activity change throughout a fuel cycle, and results in a substantial change to power shape at the end of each cycle. Another factor is that reactor control is effected by uniform boron poisoning of the coolant to accommodate slow reactivity changes and by move­ments of a control assembly bank to provide rapid control. There is no individual rod assembly control system, PWR also achieves higher power density and hence higher xenon levels than in AGRs.

The limiting factors which determine the maximum power and temperatures at which the reactor can be operated, and the optimisation of the reactor for maximum electrical generation within those limits, are covered elsewhere in this volume. This section is con­cerned with deviations from steady power, i. e., the kinetic behaviour of reactor parameters. Consider the formula:

Power = gas flow x specific heat x temperature rise

The temperature rise is from reactor inlet to outlet. Although this formula may not be suitable for accu­rate calculations, it is adequate for the purposes of this discussion. In this section we shall consider:

• Changes in power at constant gas flow and its ef­fect on temperatures.

• Chances in gas flow at nominally constant tem­perature and its effect on reactor power.

• Changes in temperature at constant gas flow and its effect on reactor power,

Note that a change in power does not affect gas flow unless the change is so large that blowers which are steam-driven, either directly (Oldbury and Dun­geness A) or indirectly via auxiliary turbine-generators (Bradwell and Hinkley Point.4), are affected by re­ductions in steam flow.

Although some of the factors, particularly power and temperature, are interactive, giving rise to com­plex dynamic behaviour of the reactor parameters, in this discussion we shall endeavour as far as possi­ble to consider the effect of changing one variable at a time. It is hoped that this will aid the under­standing of the principles.

Scope

Specific types of reactor, e. g., magnox and AGR, and specific examples of the two types are provided with a wide variety of C and l systems to suit their par­ticular needs.

Magnox Reactors

Flux scanning Equipment, described in Chapter 2, is provided to enable the axial neutron flux distri­bution to be determined at a number of points across the reactor core. The frequency of flux scans is stated in the Station Operating Instructions and is typically six months to two years. For example, at Hinkley Point A power station with magnox reactors, flux scanning is normally carried out once per year follow­ing the return to power of each of the two reactors from its biennial overhaul: this is the only time when it is possible to cover the complete operational range of control and rod positions.

Delayed neutron detection The status of delayed neu­tron monitoring equipment on CEGB magnox stations is:

(a) Installed, active, and normally capable of tripping the reactors at:

Berkeley Bradwell Dungeness A Hinkley Point A Sizewell A

Due to operational problems and electrical inter­ference effects the equipment may be vetoed under conditions which may include refuelling, electric welding in certain areas, local lightning storms and equipment faults.

(b) Installed but vetoed, hence never capable of trip­ping reactors at Trawsfynydd.

(c) Not installed in concrete PV reactors, i. e., Oldbury and Wylfa.

(d) Equipment installed as (a) and (b) above is vir­tually identical in all cases.

AGRs

Liner leakage and penetration sampling Liner leakage detection and penetration sampling equipment is pro­vided to confirm the absence of significant leakage of primary coolant.

In the case of Heysham 2, the liner leakage holes are normally capped at their upper end and open to the safety shutdown room at their lower end. When required the portable liner leakage sampling trolley is connected to each hole in turn. The upper end of a hole will be uncapped manually and a pump will draw air down the hole and through the analyser. The measured CO; concentration on a 0 to lOO^o scale may be multiplied by the measured flow — to yield the leakage rate.

The trolley is connected via flexible couplings and discharges to the H and V extraction ducts.

The sampling holes can be fitted with additional pipework to provide suitable disposal of leaking gas if a significant leak were to be detected. The trolley is equipped with flow and inlet pressure indication. The portable system is designated Safety Class 3 and QA level 4.

The CO2 in air monitoring system allows detec­tion of leakage which may occur prior to more severe failure of the monitored parts which are pressurised with CO;, thus giving the operators a chance to reduce the economic and radiological consequences. Alarms are raised in the CCR only, unless a sample also serves a personnel protection role.

The installed CO;-in-air monitoring 12-point ana­lyser samples the safety shutdown room H and V extraction and would alarm a major leakage.

Seismic instrumentation Instruments are provided to fulfil the following functions:

• To raise an alarm in the CCR and E1C to warn the operator that a seismic event in excess of the operator shutdown earthquake (OSE) {0.05 g) has occurred.

• To allow the operating staff to assess the situation following a seismic event.

• To provide information for any subsequent analysis of a seismic event.

This section does not apply to the seismic switches used to inhibit secondary shutdown action which are part of the safety system. All seismic instrumentation discussed here performs a monitoring function, alert­ing the operator when some investigation is required. It does not initiate automatic actions.

The seismic instrumentation has no direct safety role. Failure of the instrumentation does not affect reactor safety, generation or the ability to shut down. It does have a role in assessing the integrity of plant following an earthquake and is thus assigned Safety Class 4 and QA level 4.

The equipment is designated Seismic Category A. This is both to give assurance that the information on the earthquake is available and to ensure that those items located in the safety room do not collapse onto safety equipment.