It is argued that however reliable the primary shutdown system is made, its failure to work as required cannot be proven to be incredible. The argument hinges largely on ‘common mode failure’, i. e., that however reliable the system and whatever redundancy is provided in the control rod system, there is a finite possibility that a single fault could incapacitate the whole system. Such faults might be, for example, seizure or failure of mov­ing parts, a consequence perhaps of a common fault in manufacture or maintenance, or an unlikely event such as core or dome displacement which systematically obstructs the control rod insertion route.

To provide an irrefutable case of incredibility of fail­ure to shutdown when required, a totally independent secondary means of shutdown (SSD) is provided. The combination of two different and separate shutdown systems, both engineered to the highest standards can be shown on a statistical basis to provide incredibility of failure to shutdown when required.

The independent system chosen is the fast insertion of nitrogen, neutron absorber, into the bottom of most of the interstitial channels not used for control rods. The injection is very fast using gaseous nitrogen stored under high pressure. Quick-acting valves open on a sig­nal that the primary system has not, or may not, shut the reactor down.

The principle involved is that enough nitrogen is stored under high pressure so that, when needed, it can fill about half of the interstitial brick columns with nitrogen within a few seconds of an event such as the following:

SHOCK ABSORBER (NORMAL STATE!

SHOCK ABSORBER (COLLAPSED STATE)

• Very fast fall in the pressure drop across the dome (which might imply a dome failure that could ima­ginably impede control rod entry).

• Fuel outlet temperature rise in excess of what would be expected with normal control rod operation.

• Control rod height measurements that might indi­cate some obstruction to free control rod entry into the core.

When tripped by one of the above parameters, ni­trogen at about 160 bar is released by a quick acting (and duplicated) valve arrangement into sixteen mani­folds. An outline of the arrangement is shown in Fig 2.93. These manifolds pass through the vessel bottom cap and each one feeds a number of intersti­tial channels distributed around the core. The chan­nels are the same diameter as control rod channels and extend over the height of the active core. They fill with nitrogen and shut the reactor down within about ten seconds of initiation, a typical breakdown of the time to shutdown is:

• Initiating signal from guardlines to trip

valves fully open 4.9 s

• Nitrogen transit time from trip valves

to bottom of core 1.7 s

• Time to fill SSD channel 3.5 s

The SSD channels have a vent at the top, sized to permit fast displacement of CO2 by nitrogen but not so large as to let the nitrogen out too quickly.

The nitrogen store is divided into two sections. The first-stage store, is sized to fill the channels quick­ly but to depressurise in about half a minute. The second-stage store is much larger but is orificed to pass only 20% of the initial filling flow from the first-stage store. Typical flow rates from the two stores are shown in Fig 2.94.

The reason for continuing the injection of nitrogen after shutdown is that since post trip cooling of the fuel is required, the circulators have to be kept run­ning at about 10% full flow and this CO2 flow would drive the nitrogen back down out of the SSD chan­nels if they were not continuously topped-up. This low nitrogen flow is maintained for an hour or so until the nitrogen content of the gas in the circuit, within the fuel channels and the interbrick passage­ways, is sufficient to hold the reactor shut down.

If, subsequent to the SSD trip it is found to be spurious, and provided the requisite number of con­trol rods are shown to have entered the core, the nitrogen injection can be cancelled thus conserving nitrogen and reducing the amount of nitrogen purging preparatory to restart. On the other hand, if the SSD trip proves to be genuine and it is not possible to show that sufficient control rods have entered the core to maintain the reactor shut down in the longer term, provision is made for an alternative means of reactor hold-down or long term shut down so that the reactor can be eventually depressurised with the release of nitrogen. This alternative hold-down is pro­vided by a tertiary shut down (TSD) system in which boron-containing glass beads are blown into 32 of the SSD channels. The scheme for this is shown in Fig 2.95. Beads 3 mm diameter are stored in 32 hop­pers. When released from the hoppers a controlled CO2 flow drives the beads along 19 mm pipework up to the top of the channels and fills each one in ten to fifteen minutes. Provision is made for eventual removal of the beads under gravity assisted by a small driving pressure or suction but full retrieval cannot be guaranteed.

Both nitrogen and bead systems have been exten­sively tested in laboratory simulations and supported by detailed calculations. The nitrogen system has been tested in a reactor to confirm the flow dynamics and its nuclear performance. The bead system has been tested in a special test facility replicating the essentials of the reactor. On those sites, Hartlepool, Heysham and Torness, that have the bead system, a test and training facility incorporating reactor quality equip­ment has been installed adjacent to one of the reac­tors. The reason for this particular provision is that injection of glass beads results in a certain amount of fragmentation (1%), so dust and chips of neutron absorbing material may be distributed around the core in positions where they are not retrievable. Instead of injecting beads into the reactor therefore the bead system is tested in parts. Firstly, the CO2 propulsion system, which includes flow measurement gauges, is fully tested. Secondly, bead freedom-of-flow from the hoppers through the swept tee-piece in the CO2 line, is tested with the reactor isolated to ensure there is no accidental injection of beads into the core. Third­ly, the integrity of the bead injections line from the swept tee-piece into the core is confirmed by two in­dependent methods, one of these is an acoustic echo technique, the other is a balling-through technique. In the former, a sound pulse is injected into the outer end of the pipework and the echoes coming from joints, bends and the far end of the pipe are recorded as a fingerprint of the particular pipe run. Defects like cracks, holes, kinks and obstructions will show up on repeat testing at intervals over reactor life. In the latter test a ball of graphite, or other suitable material, is blown through the pipework and the back pressure of the driving flow is again recorded as a typical and reproducible fingerprint of the individual pipe showing changes in pipe section, bends, leaks and obstructions.

To meet the station safety criteria, an emergency in­dication centre (EIC) is provided remote from the CCR, In the EIC, instrumentation is provided to monitor the safe shut down of the reactor in the event of loss of the CCR. The EIC is equipped with a post-trip monitoring mimic and a limited number of additional indications. The only control provided is a reactor trip control, all other control actions being required local to plant.

8.3 Alarm system

Alarm presentation in the CCR is primarily via the computer-based VDUs using a hierarchical system of displays, i. e., total unit alarm overview, plant area alarm lists, detailed plant formats. All alarms are available for display on the VDUs, but in addition some are also displayed on conventional facia annun­
ciators for the reasons discussed in Section 9.6 of this chapter.

Where alarm indications are required local to plant, ‘intelligent’ local alarm systems (LAS) have been pro­vided. These systems have the facility to transmit alarm information to the central data processing sys­tem via a data link. This enables the CCR operator to interrogate any local alarm system on demand.

The main feed control system is designed to:

• Control the level of water in each of the four steam generators at all power levels from 0 to lOO^o, including reactor post-trip.

• Reduce the pressure drop across the feedwater re­gulator valves at part-load to avoid undue wear.

• Maintain the water inventory in the feed system of each of the two turbines, and to avoid an ex-

cessive mismatch of the levels of water in the two de-aerators.

The first aim is accomplished through the steam gen­erator level control subsystem acting on the feedwater regulator valves. The second and third aims are ac­complished by the feed pump speed control subsystem.

Steam generator water level

For each steam generator, the steam generator water level measurement is compared with its demanded val­ue to form a water level error signal which is then compensated by a P and I controller. To the resultant signal is added the difference between the steam flow and the feedwater flow, which serves as an anticipa­tory signal, and the composite signal is then shaped by a further P and I controller to give the required feedwater regulator valve position. The demanded value of steam generator level is a fixed setpoint within the system.

During the operation of the reactor at very low power levels, as during start-up, the steam flow and feedwater flow signals are not suitable for use in the control system, and so a secondary control system is provided for operation at low power. This system uses the rate of change of reactor power in place of the difference between the steam and feed flows, and the output signal from the second P and I controller is then used to position the bypass regulator valve.

The main and bypass feed valve positions and the feed valve position demands are monitored for correct response to control system demands.

The high radiation fields which exist in nuclear reac­tors cause many changes in neutronic, physical and. chemical properties of materials. This section consi­ders the principal effects of irradiation on the isotopic content of the fuel, the burn-up of fissile atoms and build-up of fission products and heavy elements, and explains the consequences of these changes for core reactivity and neutron flux distributions in magnox, AGR and PWR systems. The effect of irradiation on graphite properties is also considered and its sig­nificance in gas-cooled reactors is discussed.

2.1 Removal and build-up of heavy elements

The principal nuclear processes occurring during irra­diation which affect reactor operation are the burn-up of fissile isotopes, the build-up of transuranic ele­ments, some of which are fissionable, and the build-up of fission products which absorb neutrons to varying degrees.

In thermal reactors the predominant fissionable isotope at start of fuel life is U-235. Most of this is destroyed by fission, in which process it is converted usually into two lighter fission fragments. Some of the fission products have high absorption cross-sections

for neutrons and therefore play an important role in reactor neutron balance. A small proportion of the U-235 destroyed is converted by neutron capture to U-236 which is non-fissionable, weakly absorbing and does not have a very significant effect on reactor performance.

Fast neutron induced fission in U-238 contributes a small fraction (about 4% in AGR) to the total fission rate. This contribution remains fairly constant with life since the total removal rate of U-238 is small relative to the amount of U-238 present, i. e,, about 98% of the uranium atoms.

The destruction of U-235 follows approximately an exponential in time since the removal rate of U-235 is given by the rate at which neutrons are absorbed:

oNj/St = — N5 I ffa5 (E)o(E) 6E (3.1)

which, if the neutron flux level and energy spectrum remain constant can be integrated to give:

Ns(t) = N5(O)e7a50t (3.2)

where Ф is the total neutron flux and cra5 is the spectrum-averaged neutron absorption cross-section.

The next most important isotopic change is the build-up of Pu-239 through neutron capture in U-238 and subsequent radioactive decay of the Np-239 so produced.

The production rate of Pu-239 is given approximate­ly by the equation;

5N9(t)/6t =

-N9 f <ra9(E)0(E)6E + N8 |ас8(Е)ф(Е)6Е (3.3)

which, in the case of constant neutron flux level and spectrum, and noting that Ng remains nearly constant,

can be integrated to give:

N9(0 = N8 (0c8/”a9)(l — e-“a9®‘) (3.4)

The Pu-239 content therefore increases during burn — up but tends to an equilibrium level. Since the fission cross-section in Pu-239 is high, the build-up of plu­tonium becomes an important contribution to fission rate; indeed by the time fuel is nearing discharge about half of the heat generated in thermal reactors comes from the fission of plutonium. Another important feature of Pu-239 is that its fission and capture cross — sections ary with energy in a different manner from U-235. The cross-sections of Pu-239 have a broad re­sonance within the thermal energy range, at about 0,3 eV. The consequence of this is that relative reaction rates in Pu-239 and the uranium isotopes are sensi­tive to neutron spectrum changes, in particular those caused by changes in temperature within the reactor lattice. The implications of these cross-section differ­ences on temperature coefficients of reactivity are dis­cussed in Section 3 of this chapter.

Some of the neutrons absorbed by Pu-239 lead not to fission but to radiative capture and the produc­tion of Pu-240. This is not fissionable by thermal neutrons but since it has a high neutron capture cross- section it becomes a significant factor in the neutron balance, accounting for about 10% of neutrons ab­sorbed at the end of fuel life in AGR. Another sig­nificant feature of Pu-240 is that the neutron capture cross-section has a resonance close to the top of the thermal neutron energy range (about 1 eV). Broaden­ing of this resonance and changes in neutron spectrum lead to a negative reactivity temperature coefficient contribution from this isotope.

Neutron capture in Pu-240 leads to the production of Pu-241 which is fissionable and contributes a small but significant component of heat generation, increas­ing to about 10% of the heat source at end of fuel life in AGR.

The changes with irradiation of the relative contri­butions to fission rate from the uranium and pluto­nium isotopes is shown on Fig 3.1 for typical magnox, AGR and PWR fuel.

2.2 Fission product build-up When fission occurs the nucleus splits, usually into two fragments, which are not necessarily the same in each fission. The fission products range in mass number from about 70 to 160, but are preferentially distributed in two peaks around about mass numbers 90 and 130. Each fission product isotope has its own neutron absorption cross-section and decay half-life if it is radioactive. The build-up of fission products therefore constitutes an increasing neutron absorber in the fuel. By far the most important of these fis­sion product isotopes is Xe-135 on account of its very large neutron absorption cross-section (3.5 x 106 barns). Since it is also radioactive and has a fairly short half-life of 9.2 hours, the xenon builds up to a saturation level which it reaches after twelve hours or so.

The construction and means of operation of control rods are described in Chapter 2; this section is con­cerned with their utilisation in reactor control. Control rods may be divided into two major groups:

• Black rods, so-called because they are highly ab­sorbing of neutrons; this is achieved by boron steel inserts so that any thermal neutron entering the rod wj]J almost certainly be absorbed. These rods are used mainly for start-up and shutdown.

• Grey rods, so-called because they are less absorb­ing of neutrons’;, they are made of steel without the boron steel inserts. These rods are used mainly for fine trimming of reactor temperatures when the reactor is at power and, particularly in AGRs, for xenon override during load reductions (see Section

5.5 of this chapter).

5.2.1 Control rod worth

The reactivity worth of a control rod is determined by the effect which it has on the multiplication con­stant keff. Typical worths, i. e., the theoretical difference between keff with the rod fully out and kerr with the rod fully in, all other parameters re­maining constant, are as follows:

magnox AGR

Black rod 60-90 mN 160-170 mN

Grey rod 15 — 45 mN 80 mN

The range of values given here encompass the range of gas-cooled power reactors in the CEGB, with the following exceptions. Wylfa (magnox) has more con­trol rods in its large core than the other magnox stations, but the total reactivity worth of the rods is comparable with that at the other magnox stations. Duneeness В (AGR) has fewer control rods than the other AGRs, but their total worth is comparable with that at the other AGR stations. It should be noted that the values were derived by taking the total worth of the rods and dividing b> the number of rods; the worth of an individual rod may vary from the average because it is dependent on the neutron flux in which it is operating, the presence or absence of other rods and the condition of the reactor (shut down, starting up or at full power), so an individual rod may be worth up to twice the average value given above. The reactivity characteristics of control rods vary due to a number of factors as follows.

The first stabilising effect to consider is neutron leak­age. As the neutron flux increases the diffusion of neutrons out of the core will increase. This effect acts on a timescale of milliseconds, associated with the diffusion time of the neutrons. It is more significant in other modes of instability as we shall see later.

The second stabilising effect is the negative fuel temperature coefficient of reactivity. As fuel tempera­ture increases, the resulting negative change in reac­tivity tends to oppose the increase in neutron flux which is causing the increase in temperature. This effect has a time constant of 10-20 seconds.

The third effect depends on the age of the reactor core. At start of life the temperature coefficients of reactivity of the moderator in a magnox reactor and the fuel outer sleeve in an AGR are negative, and are therefore stabilising, but they soon become positive as fuel irradiation proceeds (see Section 3 of this chapter).

In all reactor systems the pressure vessels are insulated and cooled. Cooling is necessary to limit the differ­ential and absolute temperature of the steel and con­crete. In a concrete pressure vessel, thermocouples are embedded in the concrete at various depths from the liner to assess the temperature differential across the concrete in two planes. On the concrete vessel, cooling is achieved by massing cooling pipes on the liner and around the penetration liners. The temperature is adjusted by controlling the water flow through the cooling pipes which are arranged in discrete groups for this purpose. Once at full power the concrete becomes thermally ‘soaked’ and adverse changes in temperature conditions will only occur over long time scales.

The steel pressure vessel is usually cooled by air and adjustment of the flow is limited to the volume of air pumped through the cavity between the vessel and its thermal shield. Individual areas of the vessel are difficult to control but because of design this is not of great importance.

The operator’s role is to monitor temperatures in the vessel over long time scales. Fast changes in tem­peratures are not possible because of the large thermal masses involved. Once set up, adjustments may only be found necessary if reactor conditions are grossly changed and then generally only to the bulk tempera­tures of the cooling medium.

Zirconium is a grey, low density, metal with a hexa­gonal close packed crystal structure up to about 840°C and a body centred cubic structure beyond this; its melting point is 1852°C. It has a low neutron cross — section (see Table 1.9) only bettered by beryllium and magnesium. However, this was not apparent from the earliest measurements which were made with samples containing substantial amounts of hafnium, with which it occurs in nature. The successful use of zirconium for reactor cladding depended upon the removal of haf­nium by the van Arkel process. For purposes of nu­clear fuel cladding, the corrosion resistance of the pure element is inadequate and two routes were fol­lowed to remedy this which have resulted in two series of alloys; the Zircaloys (which are essentially Zr/Sn alloys) and Zr-Nb. In the main, PWRs use Zircaloy-2 and Zircaloy-4, the composition of which are shown in Table 1.15.

In the following brief description of PWR fuel, the figures in brackets refer to the British PWR. PWR fuel rods typically consist of 3-4 m long (3.85 m) smooth, cold worked, Zircaloy (Zircaloy-4) tubes of about 10 mm (9.5 mm) outside diameter and 0.6 mm (0.57 mm) wall thickness, The tubes are plugged and seal welded at each end and they contain solid, dished end, fuel pellets which, in the British PWR, are held in place by a hold-down spring located with­in the 0.19 m long plenum at the top end; other de­signs may also contain a bottom end plenum. The fuel rods are pressurised with helium to a cold pressure of about 20 bar. The rods are assembled into (193) bundles which are open at the sides and, according to reactor type, may be between 13 x 13 and 17 x 17 rods square (Fig 1.40). The fuel is held in position by a series of spacer grids whose axial separation along the rods is about 0.5 m. The grids are made from heat treatable Inconel using a square section tube for the outer ring with brazed-in strips to form the indi­vidual cells. Punched-out dimples and finger springs on these strips hold the fuel rods in place, the ob­jectives being to restrain bowing, prevent vibration and promote mixing between sub-channels whilst, at the same time, resisting fretting corrosion and allow­ing axial movement of rods due to thermal expansion.

Not all the cells of the array are taken up by fuel, around 20 contain Zircaloy guide thimbles which are fixed to the grids and the top and bottom nozzles. These allow the insertion of control rods, burnable poisons, neutron sources or they may be void; the central cell normally contains instrumentation. The British PWR has a coolant pressure of about І 56 bar, the inlet and outlet coolant temperatures being 293°C and 325°C respectively.

There have been several attempts to correlate PWR operation inside or outside the co-ordinated chemistry area on Fig 1.63, with circuit activity levels and dose rates. Such a correlation may be difficult to establish due to the earlier operating chemistry, plant faults and the time taken for circulating and deposited ac­tivity levels to reach a new equilibrium following a change. However, following the analysis of a wide range of plant data there is evidence of a statistically significant reduction in circuit dose rates following adherence to a co-ordinated primary circuit chemistry during early fuel cycles. The data from emergent new PWR plant, with co-ordinated chemistry established as early as possible in plant operation, will further establish this point. Meanwhile other supportive plant practices are being developed.

The major concern of the reactor operator is to pre­vent the reactor from experiencing any damaging in­cident which could exceed the License Requirements in terms of activity release or jeopardise the plant availability. Careful continuous surveillance in moni­toring the fuel is paramount to these objectives, since evidence from post-irradiation examination (PIE) has shown that ingress of CO2 into the clad/fuel inter­face can cause chemical reaction with heavy oxide formation. In these circumstances there is a rising response in BCD signal as the uranium bar is in­creasingly exposed.

The degree of oxidation must be restricted other­wise the local clad temperature may approach that which would cause the clad to ignite unless the re­actor power is reduced or shutdown.

Classification of fuel failures

The failed fuel operating experience to date has tended to segregate all fuel failures into either fast or slow burst categories. This early fuel designation has now become widely accepted. The definition to which failed fuel is assessed and classified is generally related to a time period for the BCD count to double in mag­nitude.

Fuel discharge criteria

To enable the operator to respond to every ‘failed fuel’ signal, rules were developed which specified pre­cisely what action should be taken. However, with the varying designs of BCD system layouts, it was not possible to achieve exact uniformity and rules were invariably written to reflect individual station BCD system design,

1.7,2 BCD sensitivity

The total signal ‘as measured’ in a precipitator unit is a combination of signals from different sources. The general components that contribute to the mag­nitude of the overall precipitator count are commonly referred to as CA, CB and CN:

• CA — the count from fission products emitted

by a burst fuel can. [17]

• C N — background counts from other sources, usually electronic noise, gamma activity from gas in chamber, residual activity on the wire.

CA and CB are measured only when the precipitator wire has an electrical potential, whereas CN is always present. With CB and CN constant, successive counts discriminate rises in CA. Only CA and CB are de­pendent upon the gas transit time (see Fig 2.23).

Fic. 2.23 Variation of signal with delay time

Historically the sensitivity of the BCD equipment is generally related to the activity released from an ima­ginary 1 mm2 of exposed bare uranium. This method of calculating sensitivity was useful in assessing the performance of the various BCD designs, although in practice the actual count level measured when com­pared with PIE examinations of the discharged fuel exposed area was never correlated to a satisfactory degree.

In the design of BCD systems, it is necessary to have sequential channel scanning facilities to econo­mise on equipment and supporting services. It is therefore extremely important in optimising the BCD sensitivity that the timing of the channel selector valves, solenoid control valves, precipitator indexing and the counting circuits are carefully arranged so as to avoid ‘smearing’ from previous and proceeding channels.