The moderator feedback mechanisms for AGRs are similar to those for magnox reactors. The effect of Pu-239 build-up on the moderator feedback coeffi­cient is a less pronounced function of irradiation than for magnox as a result of the use of enriched fuel. The radial fine structure mechanism is somewhat more important than for magnox, consequently the coefficient is positive at start-of-life (1.6 mN7 °С) risine to about 14 mN/°C at discharge (inner zone feed fuel) with a fuel cycle equilibrium value of about S mN/°C. The numbers quoted are for the Hinkley Point В design and exclude contributions from the outer graphite sleeve. This has a coefficient which varies from -0.25 mN/°C at start-of-life to 2.5 mN/ °С at discharge for inner zone feed fuel. Recent calculations for Heysham 2/Torness indicate a com­bined sleeve and moderator coefficient initially of -0.14 mN/°C with a fuel cycle equilibrium value of about 8 mN/°C.

The formula above is written for reactor thermal power, rather than neutron power as indicated on neutron flux measuring instruments, and it is the neu­tron power which, via fission, provides the thermal power. Neutron power can only be varied by changes in reactivity Дк. Thus, for example, tf a change in gas flow occurs and it is desirable for reactor tem­peratures to remain constant, then a change in neu­tron power must occur to match the change in gas flow; as will be seen in the following paragraphs, the change in power may occur:

• Naturally as a result of the characteristics of the

reactor system.

• Automatically as a result of auto control systems.

• Manually as a result of operator action.

The second and third of these effects are straight­forward since any control system, whether automatic or manual, seeks to drive a given parameter to a desired value. The first effect, however, can be open — ended and divergent, and here we are referring to temperature coefficients of reactivity and to xenon.

Temperature coefficients of reactivity which have negative values are stabilising effects because they op­pose the disturbing influence (see Section 3 of this chapter), but from the reactor control engineer’s point of view they are of limited value unless the overall temperature coefficient, i. e., the combination of all temperature coefficients of reactivity, is negative. It is fortunate for the reactor control engineer however that the faster-acting of the temperature coefficients of reactivity (time constants of 10-20 seconds) are negative, since if they were positive then control would be much more difficult, for example, manual control may be impossible.

Temperature coefficients of reactivity which have positive values are destabilising because they reinforce the disturbing influence (see Section 3 of this chapter). Fortunately they are slower-acting (time constants of 10-20 minutes) and are therefore readily controllable in all but severe fault situations. Auto control systems to maintain reactor gas outlet temperature constant are included in many magnox reactors, primarily be­cause of the destabilising effects of the positive moderator temperature coefficient of reactivity.

Changes in xenon concentration, brought about by changes in neutron power, are also destabilising for the first few hours of a transient because the change in production rate of xenon lags behind the change in neutron power (see Section 2 of this chapter). From the reactor control engineer’s point of view it is these first few hours which are important, since in this time the battle to keep the reactor at power will be either won or lost.

6.5.1 Reactor protection

On the basis of a detailed safety analysis, reactor pro­tection requirements are defined in the form of a trip schedule. This schedule is particular to each power station but has many features that are common to all stations. Tables 3.5 and 3.6 give examples of trip schedules for magnox and AGR stations respectively.

Reactor protection equipment is provided to meet the requirements of the schedule and operational as­pects of these protection svstems are discussed in the following sections.

Proof testing

Regular proof testing is necessan to establish that the protection ssstem rei:ubi! i[y performance is be­ing met. Proof testing takes trip units out of service for the duration of the test and may cause pans of the system to be in the tripped state so that if other units are tripped, a spurious reactor trip is ini­tiated. This requires close vigilance of the alarms oc­curring on the protection system during proof testing operations.

Establishing reasons for trips

The reason why a reactor trip has occurred has to be established before start-up can be initiated. This procedure is assisted by post-incident logs produced by the computer-based loggers that record the se­quence of alarms and data as described in Volume F, Chapter 7.

PWRs are operated with highly reducing primary water chemistry (Hillner, 1977 [15]); a basic addi­tion of ammonium or lithium hydroxide maintains low acidity to minimise corrosion of the reactor com­ponents. The dissolved oxygen levels, which mainly arise through radiolytic decomposition of water, are kept to about 0.05 ppm through additions of hydro­gen and/or ammonia. Under these conditions and at typical cladding temperatures of <350°C, oxidation takes place slowly and follows cubic kinetics Aw3 = k]t, where Aw is the weight gain/area due to oxi­dation, t is time and к ] is a temperature dependent constant. As with parabolic oxidation, it is believed that such ‘cubic oxidation’ indicates a diffusion con­trolled process and, though the exact mechanism is uncertain, the rate controlling step is probably migra­tion of oxygen ions through the scale with new oxide being formed at the metal/oxide interface. Some of the hydrogen formed by dissociation of the water on the oxide surface diffuses through the scale and dis­solves in the metal. At temperatures between 250°C and 400°C, oxidation of the Zircaloys continues in this way until weight gains of 30 to 40 mg/dm2 are achieved (equivalent to an oxide thickness of 2 to 3 fim) at which point linear oxidation commences when Aw = kjt.

Assuming a 300-day refuelling cycle and clad tem­peratures of around 300°C, linear oxidation would first occur during the second cycle. Measurements of oxide films on irradiated rods indicate that the oxide thickness may be as much as three times thicker than those predicted from out-of-pile experiments. Whilst some of this discrepancy could have arisen from difficulties in estimating temperatures in the presence of a heat flux and a =4 thick scale (which is

also likely to have tangential cracks), Garzarolli et al (1980) (16) and HiHner (1982) [15] have concluded that in-reactor corrosion rates are, indeed, greater than the out-of-pile values. It is likely that this is due to the effect of neutron bombardment either on the oxide itself or on the coolant chemistry.

Oxidation is also influenced by the initial surface condition of the clad and is enhanced by the presence of dissolved oxygen in the coolant. At very high oxy­gen levels the severe non-uniform attack known as nodular oxidation has also been seen, though this is more usually associated with BWRs where such high oxygen potentials are common. With the water chem­istry, clad temperatures and fuel burn-ups normally used, waterside corrosion is not a problem in PWRs.

Zirconium has a strong affinity for both oxygen and hydrogen and, as well as forming a stable oxide and hydrides, both elements have high solubility in the metal with hydrogen reaching a level of about 75 ppm at 300°C before hydride precipitation occurs. Hydro­gen ingress to the metal can occur through waterside corrosion or through the loading of insufficiently dried fuel pellets. In the latter case extensive hydride forma­tion has been observed with a marked loss in ducti­lity. For hydrogen absorbed during normal operation, however, there is no evidence that the performance ot Zircaloy clad is in any way affected, though pro­blems have been encountered with delayed hydrogen cracking in the stronger Zr-2.5 Nb alloy used in the CANDU reactors (Coleman and Ambler 1977 [17]). Zircaloy-4 has greater resistance to hydrogen uptake than Zircaloy-2. Oxygen solubility is more important in that it could affect the mechanical properties of the j phase in a loss-of-coolam accident.

t kid shape changes

Shape changes in PWR fuel occur by two principal

mechanisms:

• Radial creep of the clad which produces ovalisation,

circumferential shortening and ridging.

A number of operational practices and plant additions have been identified as contributing to the require­ments of dose rate minimisation. Some of these prac­tices are likely to find wide acceptance because they are operationally convenient and are known to be of benefit, for example, preconditioning metal surfaces. Others have not yet been widely adopted because they are not proven in terms of any adverse effect on cir­cuit materials (e. g., chemical decontamination), or because a clear cost benefit cannot be shown.

Alternative coolant chemistry

The use of alternative alkaiising agents has been re­ferred to earlier. However, there is little incentive to change from lithium hydroxide. There is increasing experience and data base with lithium hydroxide with no major quantifiable benefit in using sodium hydrox­ide, potassium hydroxide or ammonia. It is possible to use a high lithium hydroxide concentration in order to ensure a significant positive temperature coefficient of solubility of deposit (crud). This would ensure that any crud deposited in the core would tend to dissolve and the process of corrosion product deposition and activation in core inhibited. However, there is concern about increased zircaloy fuel clad corrosion in con­centrated lithium hydroxide solutions, and excessive crud deposition from high impurity coolant undergoing single-phase heat transfer. Further data assessment is required in order to validate this proposal.

There are other technical options which would re­duce the operational concentrations of lithium and boron. The use of a burnable poison such a gado­linium in the fuel could result in the maximum boron level being reduced to 300 ppm, with a consequent reduction in the lithium concentration for co-ordinated chemistry control. This would reduce the load on the CVCS ion exchange plant and make the pH control easier and more stable. Similarly, the use of highly enriched B-10 boric acid could lead to a reduction in current operating boron levels by a factor of 4-5.

However, significant development work is necessary for these options to be feasible, and at present the use of highly enriched B-10 boric acid is considered prohibitively expensive.

This unit (see Fig 2.24) is the central component of the BCD system. Its function is the collection of beta emissions from the decaying nuclei, principally iso­topes of the inert gases krypton and xenon (see Fig

2.25)

, contained in the reactor gas samples during transit through the chamber which are repelled onto a wire held at a negative potential of 5 kV. The time interval in which the ions are being collected on the wire is known as the soak period. At the end of each soak period the wire is indexed rapidly into the count­ing unit (snatch time), where the emission of the beta daughter particles during subsequent decays is de­tected in the phosphor unit. The phosphor is coupled to a low-loss light-guide and photo-multiplier unit which is used to enhance the magnitude of the beta emissions before entering the counting system (see Fig

2.26) . The time interval in which counting takes place is generally referred to as the counting period (denoted as counts per period or cpp).

The temperature rate trip units, of the servo-reset type, have a trip level normally maintained at a pre­determined level above the signal to give maximum protection. Figure 2.61 shows a schematic diagram of the unit; the input signal is filtered, temperature- compensated, and backed-off against the trip refer­ence level. The resulting signal is then chopped, AC amplified and demodulated. In a typical system this output, which represents the ‘margin to trip’ of the channel gas outlet (CGO) temperature signal, is then

RATE TRIPS ON RATE OF CHANGE OF TEMPERATURE 200 C/MIN INCREASING 10 C/MIN REDUCING

Fig. 2.61 Temperature rate trip amplifier

-ompared with a preset level by comparator СО I, ^ ■ difference in level producing a drive to integrator ^hose output (to the input circuitry) is such as "reset the trip margin to its correct level. The inte­grator resetting rate is limited so that while normal operational temperature changes are followed by the sero-reset action, a rapid rise in fuel element tem — ’rature (corresponding to a reactor fault) results in [he marsrn amplifier output falling until at zero mar — [he~suard line outputs are tripped. Slow faults are followed by integrator action, but eventually pro­duce a trip at a level determined by the point at which integrator output falls to zero and resetting ceases. To EUard against dangerous failure of the integrator, a hiah margin trip is also provided which operates into [he zero margin trip circuit.

Detailed specifications for a typical temperature rate trip unit are given in Table 2.11.

Seutron flux [rip amplifier units Pulse counting channels These are used for protection shen the reactor is shutdown. They are of the design discussed in Section 5.2 of this chapter. In addition to the required high flux level trip, low flux level and polarising supply failure also produce a trip to guard against Tail-danger’ equipment faults. The ‘period’ out­put is used to control a ‘period freeze’ safety interlock which restricts rate of increase of reactor power during start-up to a safe level. The trip units producing the outputs to the guard lines and interlocks are contained in a separate chassis and are of the fail-safe phase — sensitive AC amplifier type. A facility is provided for checking these channels for satisfactory operation while at full power by measurement of pulse ‘pile-up’.

Logarithmic DC channels These are used to provide the period freeze safety interlock at power levels above the maximum covered by the pulse channels. The detec­tors are of the type described in Section 5.2 of this chapter. A period signal which controls the period freeze safety interlock, using fail-safe trip units, is housed in a separate chassis as for the pulse channel. A trip unit output at 1—5*^6 full power is also provided which permits auto rod control above that power level.

Excess flux shutdown amplifier channels These are arranged to provide tripping against reactivity faults. Ihe shutdown amplifiers have an action very similar 10 ^hat ol the servo-reset temperature trip unit de­scribed earlier, a preset trip margin being maintained to protect against fast faults, with a high level trip which terminates slow faults. A schematic diagram is shown in Fie 2.52.

Cas circulator protection Two methods of sensing loss oi gas circulator operation are provided:

• Gas circulator underspeed A sensor, adjacent to a notched wheel on the end of the gas circulator

shatt, produces a pulse rate proportional to circu­lator speed. This pulse rate is converted in the trip unit to a DC voltage proportional to speed which is compared with a preset trip reference level. The resultant signal is chopped, AC amplified, demodu­lated and used to provide the outputs to the guard lines. When circulator speed falls to the level at which the input signal falls below the trip reference level, the demodulator output and guard line out­puts fall to zero.

• Gas circulator undervoltage This equipment detects loss of voltage to the gas circulators. A voltage signal from the gas circulator supply pro­vides power to the guard line outputs of the trip unit; when the voltage signal falls below a certain level the guard line outputs fall to zero.

Gas circuit protection In magnox reactors, the tvpes of gas circuit protection required are rate-of-change of pressure and high pressure. Additionally, AGRs are provided with low gas pressure protection.

• Rate-of-change of gas pressure This is sometimes called the <5P/6t trip. This equipment protects against reactor depressurisation, a schematic arrangement being shown in Fig 2.62.

The reservoir is connected to the vessel via a re­strictor and so the reservoir pressure equals the re­actor pressure. A ramp change in reactor pressure produces a pressure drop across the restrictor which increases until, in the long term, the reservoir pres­sure changes at the same rate as the reactor pres­sure. If a rapid rate of fall of pressure occurs due

Table 2.11 (cont’d)

Integrator

Ouiput range

InJieanon

Following rarei:

Rising inpm Falling input Accuracy Stability

Fast up.’down rates

Output limit

Accuracy

Setting

Quiescent (steady state) margin

Setting range Setting Resolution Accuracy

Effects of ambient temperature

Margin Trip level

Trip approach alarm and fault alarm

0-500°C

Front panel meter scaled 0-500°C

IеC per minute (preset)

"°С minute (preset)

; 10% of preset rate Better than і 12%

100% of output span per minute (fixed)

Set in the range 0-100% of output span

5% of output span Preset at 120°C 0- 100% of margin meter span Preset at 20°C

±0.25% of margin meter span ±2% of margin meter span

In the range 0-55°C the following setting accuracies will be inside the stated limits

2°C

3°C

0.5% of margin meter span + 0.25% of input span

to depressurisation, the restrictor pressure drop will exceed the setting of the differential pressure switch SW1 which then indirectly interrupts and provides a trip signal to the guard lines. Differential pressure switch SW2 detects fail-danger leaks on the reservoir side of the restrictor.

• High or low gas pressure This equipment protects against boiler failure and consists simply of a pres­sure switch (SW3 in Fig 2.62) which indirectly inter­rupts the outputs to the guard lines. Similarly, a low pressure switch protects against slow depressuri­zation faults which could occur at a rate less than the setting of the 6P/5t trip.

With the introduction of oxide fuel pellets clad in a sealed stainless steel tube, the need for rapid detection of failed fuel elements was not considered to be a

requirement, unlike the magnox fuel. Cladding failure and the possibility of ingress of CO2 into the clad/pellet interface is not detrimental to the fuel integrity. Location and removal of failed fuel was primarily to reduce the magnitude of fission products contained in the reactor coolant without posing a
health hazard from plant leakage or maintenance. The AGR, unlike the magnox reactor, is designed for man access to carry out detailed plant inspection of components within the reactor envelope, which by definition requires a ‘clean’ environment to enable reactor inspection.

The AGR stations are fitted with more sophisti­cated computer systems than the magnox stations, with powerful computers driving colour VDUs that pro­vide alphanumeric, graphical and pictorial displays. Such systems are more fully described in Volume F, Chapter 7, and provide the following facilities:

• Extensive logging of plant parameters including recording on magnetic tape for off-line analysis.

• Displays on VDUs of plant parameters.

• Detection of off-normal plant parameters and treat­ment as alarms.

• Detection of on/off alarms.

• Alarm handling and analysis.

• Closed loop control of channel gas outlet tempera­tures by digital control.

ThereJs considerable reliance on the computer system for both manual and automatic operation. Very high reliability is obtained from such systems, for example an availability, of 99.97% was obtained at Hinkley Point B. The systems incorporate a standby proces­sor which is stored between two reactor units and this can be switched-in should a processor fail. The computer systems at Hartlepool and Heysham l have a double highway system, enabling continued opera­tion in the presence of a highway fault. When not used on-line, the standby processor is used for off-line data processing tasks, but these are off-loaded when there is a demand for this processor to take over from a faulty processor.

The software systems are relatively complex and there is a very large number of inputs and data base. This requires a continuing process of software ‘main­tenance’ to keep it up to date with changes on the plant and computer facilities, and requires substantial resource with programming expertise on the station.

Although the original equipment is in use, it has been augmented by more modern systems. Typically a data link is provided from the original processor to the new one and this also has some input scanners.

At Hartlepool, Heysham 1 and Heysham 2 there is more extensive direct digital control of the plant.

Heysham 2

An on-line computer system at Heysham 2 is in­stalled for each of the two reactor/turbine-generator units, i. e., in principle, the system is unitised. The system provides the main channel by which the op­erator receives data and alarm information about the plant. Further details are given in Volume F, Chapter 7, which also explains the underlying computer technology.

The system, illustrated in Fig 2.121, comprises a highly distributed network of approximately 100 com­puters for the station and incorporates redundancy and diversity to give high availability. The distri­bution facilitates parallel activities during software development on different computers at different loca­tions, incremental testing, installation and commis­sioning and ultimate replacement when the hardware becomes obsolete.

Analogue signals, i. e., 4-20 mA, thermocouple outputs and other special signals are scanned in blocks of 512 by intelligent analogue multiplexers (AI) that deal with the total of inputs as shown in Fig 2.121. Digital on/off inputs are scanned by intelligent digital multiplexers (DI) that deal with some 4000 inputs per unit. The multiplexers feed signals to the central ‘superminis’ through data links.

The control centre microprocessors have their own input multiplexers but are connected together, and to the central data processing system, by a duplicated local area network implemented in Ethernet. This net­work enables the VDUs to be used for displaying data and control terms, and for diagnostic and reinstate­ment purposes after down-line loading.

The data processing system also provides the fa­cilities shown in Fig 2.121. These systems are pro­vided to handle the output of particular plant sys­tems and are programmed in CUTLASS by plant specialists. The systems communicate to the central processors by point-to-point HDLC links.

The two unit central processing systems consist of three superminis, one (SD) handling data, another (SA) handling alarms and a third (SS) that can han­dle the work of SD or SA and acts as a standby to either.

This redundant arrangement meets the requirement for a single fault not affecting the service to the operator. Bulk storage is provided with 80 MB of ro­tating disks units with moving heads. The output of this data processing system serves five colour VDUs mounted in the unit control desk, two on the super­visor’s desk and one on the auxiliary electrical panel. There is also a number of mobile VDUs to be used at the most convenient locations, as required. Per­manent records are provided in the Data Office by printers and magnetic tape that can be used to analyse data on separate computers.

The system includes the display of alarms initiated by microprocessor-based local alarm systems installed in local to plant cubicles.

Changes to the software have to be strictly con­trolled and when these have been authorised they are made through the amendment system supermini lo­cated in the Amendment Office. This system serves both units.

Further details of computer system design are given in Volume F, Chapter 7. Further details of the AGR computer systems are given in [3,4].

The steam dump control system is designed to:

• Allow the station to accept sudden load rejections, up to the capacity of the steam dump system, with­out leading to a reactor or turbine trip and without excessively overloading the condensers.

• Allow the station to run through the trip of one turbine-generator out of two, without leading to a reactor trip or to a trip of the second turbine-

generator.

• Allow the station to run through the trip of both turbine-generators without leading to a reactor trip,

if below 50% power.

• Remove the stored energy and residual heat fol­lowing a reactor trip and to bring the station to equilibrium conditions at zero power without actua­tion of the steam generator safety relief valves.

• Proside control of steam generator pressure at zero power and allow manually controlled cooldown of the plant.

The first two aims are accomplished through the load rejection control subsystem in response to reactor
coolant temperature. The third aim is accomplished through the plant trip control subsystem in response to reactor coolant temperature. The fourth aim is accomplished through the steam pressure control sub­system in response to steam header pressure.

The main steam dump system is arranged to dump steam from the main steam header into the conden­sers of the two main turbine-generator units via the dump valves. The dump valves to each unit are ar­ranged into three banks which open (and close) se­quentially, the first two banks dumping steam into the condensers while the third bank, the atmospheric dump valves, dumps steam directly to atmosphere. In addition, one power-operated atmospheric relief vaKe is installed on the outlet piping from each steam generator upstream of the main steam isolation valves.

The capacities of the three banks of dump valves for each unit in terms of total reactor steam flow are 14%, 15.75% and 5.25% respectively, giving a total dump flow of 29.75% to each condenser and 10.5% to atmosphere. The capacity of each steam generator PORV is 4.6% of total reactor steam flow.

The steam dump control system consists of three subsystems which are actuated according to the state of the plant. The load rejection controller prevents a large increase in reactor coolant temperature following a large, sudden decrease of station load. Following a reactor trip, the plant trip controller takes over to re­gulate the rate of removal of decay heat and thus grad­ually establish the hot shutdown conditions. Finally, residual heat removal at operating temperature is main­tained by manual selection of the steam header pres­sure controller which is also used for plant cooldown.

Operation of the steam dump system during small load fluctuations is inhibited by an interlock system which is defeated on detection of loss of load (or reactor trip). The system senses rate-of-change of turbine-generator’load and allows power to the dump valves when this exceeds a preset value, corresponding to a 10% step change of station power or a sustained 5% per minute ramp decrease of station power. The dump valves remain inhibited when the reactor coolant temperature is below a preset lower limit or when the condenser of the associated turbine is not available. The interlock on the cooldown valves, the first bank of dump valves, may be bypassed manually to allow a controlled cooldown of the station.