6.1 Start-ыр

Before start-up is attempted on any reactor system it is important to ensure and identify that each piece of plant or equipment is:

• Fully commissioned.

• Meets criteria laid down to check the functions, correctness and safety of operation of all plant and equipment.

• All safety systems have been checked for function, trip and alarm settings and that they are fully active.

7.1.1 Recommissioning checks

Before any reactor system is brought into service, either for its initial start-up or following a shut down for maintenance or overhaul, then all those pieces of plant, equipment or systems must have undergone a recommissioning check.

The extent of these checks depends upon the scale of work carried out, but if the reactor unit is, say,

being brought back from its biennial overhaul then extensive recommissioning of all the plant components is necessary. The range of checks may vary from a complete commissioning of a gas circulator and its drive components to the simple checking of the remote operation of a series of valves.

Because of the particular duty of a piece of plant or equipment it may be necessary to carry out these checks during the start-up phase, hence it is neces­sary to commence the start-up without alt recommis­sioning procedures having been satisfied before the unit is considered fully operational.

Pre-start-up commissioning checks Following a biennial overhaul virtually all plant and equipment will have had extensive work carried out on it, which means that when it is available it must be considered as having been just built or constructed. Commissioning therefore must be carried out as though it was new plant and must start at a very basic level.

For example a gas circulator has many components, extending from the drive motor or turbine to the circulator shaft seal which will prevent the leakage of high pressure cooling gas. The variety of components that will require recommissioning may include the following, although this list is not exhaustive:

• Lubricating oil pumps.

• Seal oil pumps.

• Main shaft speed-regulating mechanism.

• Shaft jacking pumps.

• Oil coolers and filters.

• Operations of the jacking system (on/off stationary seal).

• Operation of the seal oil pressure regulators.

• Function of interlocks, which may also be for safety as well as operational sequence.

Most of these checks may be done prior to the re­actor start-up phase, the circulator, for example, will be running and operationally sound before reactor power raising commences. Only a few other checks will be necessary as the circulator is brought to its final running condition.

All available plant and equipment must be given complete commissioning inspections and tests where practically possible before start-up, the only exceptions being those that require the unit to be running at normal reactor pressure, temperature or load.

Commissioning during the start-up phase

Not all commissioning can be done prior to com­mencement ot control rod withdrawal. For example, burst cartridge detection equipment will need moni­toring closely during power and temperature raisins to ensure that it is following the increase in reactor temperature.

Similarly, flows on circuits and subcircuits on pres­sure vessel coolant systems will need adjusting.

This phase of commissioning w ill be described dur­ing the start-up checks which will be dealt with later

on.

The chief problem in this area for zirconium alloys is that of stress corrosion cracking due to a combination of stressing from pellet clad interaction and corrosion from the fission products, principally iodine. The im­portant pellet clad interactions in water reactors arise from power uprating or ramping and, in principle, are identical to those already discussed in the section cowring stainless clad: the maximum clad strains oc­cur owr radial pellet cracks at the (hour-glassed) ends of the most highly rated pellets. The additional factor of iodine serves to reduce the clad ductility by stress corrosion cracking at these critical positions.

Л typical sequence of events leading to fuel failure by this mechanism might be as follows: the fuel is irradiated tor a period of time at more or less steady power; the power is then changed to a new, higher level where, after a further period of time, failure occurs. The low and high power levels could be separated by a shutdown. Any or all of the following parameters are likeK to have a bearing upon the failure probability:

• The iucl burn-up achieved before the ramp which mainly determines whether the fuel and clad are in contact and, hence, the clad stress.

• fhe increase in the power which determines the 4iress and strain levets due to the mechanical inter­action between fuel and pellet.

* The ab-olute power Ieet which controls the fuel und clad temperatures and the diffusion of fission

products. [9]

sible. additional pellet cracking which could pro­duce a burst of iodine release.

• The hold period at [lie higher power level which should be long enough for failure to occur by stress corrosion cracking.

The measures employed to minimise the occurrence of such failures aim to reduce the rate of power rise o er the critical power lev els. Such considerations will include local power rises due to flux shaping and will obviously have an economic penalty in terms of lost capacity. Other measures have consisted of de­sign :hanges to the fuel, including the use of smaller diameter rods (to reduce fuel temperatures, hence io­dine release), pre-pressurisation of the rod internally to reduce the extent of clad creep down and (in CAN DU and later BWR fuel) the use of a lubricants diffusion barrier at the fuel-clad interface.

Manual, mechanical, electrochemical and ultrasonic re­moval of contamination from components is widely established. The techniques are used either on remov­able components in dedicated plant or in limited ap­plication to fixed components.

Whole-circuit chemical decontamination is being developed for PWR systems, although various pro­cesses have been used in BWR systems. The main difficulties for a PWR are the need to ensure that no deterioration of circuit materials takes place, the intractable nature of chromium-rich PWR oxides and the need to obtain a worthwhile decontamination factor.

In general, PWR systems will require a two-stage chemical decontamination, consisting of an oxidising treatment (alkaline potassium permanganate) followed by an acid chelating agent (diammonium citrate). The oxidising step is required to convert Fe and Cr species to their highest oxidation state, and the acid chelating agent then takes these species into stable chemical solution. Other variations are the use of acid potas­sium permanganate followed by a mixture of citric and oxalic acids, which is claimed to reduce the quan­tities of rinse water, and the use of low oxidation state metal ions (V2+, Cr2+) (the low oxidation state metal ion or LOMI process), with a complexing agent to retain the reductant and dissolved species in solu­tion (Bradbury et alt 1980 [34]).

Whichever system is pursued, it is essential to prove the decontamination efficiency of the chemicals and the absence of any deleterious effect on system ma­terials. The management of waste arisings must also be considered, together with suitable access to the system to be treated and the rate of re-contamination of cleaned surfaces.

bulk system provides a useful back-up for the oup system, particularly during plant maintenance. fr°has been engineered to operate to a high level of Liability and can cater for numerous extreme plant failure modes such as total loss of both compressors, loss of cooling water and reactor shutdowns, as well Vthe normal equipment fault modes (i. e., equipment failure where standby facilities exist). Apart from compressors this system is fully segregated from the other BCD systems, thus avoiding common mode

failure.

Group system

The group system continuously monitors all fuel chan­nels "in batches of 32 channels, The sensitivity is appreciably higher than in the bulk system and it provides the main safety system. The basic arrange­ment is to combine the common sample from each of two primary selector valves (PSV) servicing 16 fuel channels. The group sample outlets from each pair of PSVs are routed horizontally through the guide tube assembly array so as to avoid gas buffeting to the BCD penetrations, For ultra high reliability, the system (apart from precipitators) has been engineered with moving mechanisms.

Single-sample system

The single-sample system is used to perform routine individual monitoring of all fuel channels. The sen­sitivity of the system is very high. The time taken to complete a reactor scan is approximately seven hours. However, other duties performed include searching for failed fuel and continuous surveillance on ‘suspect’ fuel, Search operations usually follow the receipt of an alarm from the group system. The control circuit immediately identifies which pair of PSVs is in an alarm condition and rapidly indexes all 16 SSVs to locate them; it continues the failed fuel search by sampling sequentially the two PSVs so as to locate failure. The time taken to complete the search opera­tion is approximately twenty minutes.

For lock-on operation the single-sample system is used to monitor continuously up to 16 ‘suspect’ fuel channels or fuel channels being refuelled.

The ‘Laddie’ is a multi-aperture magnetic ferrite core device with the apertures along its length forming cross-rungs like a ladder (Fig 2,63), The device is about 20 mm long and 3,5 mm wide and 2 mm thick. The cross-rungs have windings. The set, reset and output windings deal with pulses and the hold windings are energised with 10 mA DC signals. The hold current is the output of the relevant trip unit and its presence represents the healthy state, corresponding to relay contacts being closed. In the trip state the trip unit output, i. e., the hold current, falls to a nominal zero current corresponding to opening of trip contacts.

The principles of guard line operation are shown in Fig 2.67. The pulse generator outputs set 1 and set 2, displaced in phase by 180°, are fed to alternate laddies. Each laddie (after the first) relies for its reset pulse on the amplified output of the previous laddie. Cessation of operation of any laddie results in the progressive failure of subsequent laddies to reset and the trip passes along the guard line, so that finally the pulse/DC converter loses its input and its DC outputs to the control rod clutch contactors fall to zero. To prevent the guard lines automatically resetting after clearance of a fault, the last pulse amplifier receives its output from one of the DC outputs of the pulse/DC

In the general arrangement shown in Fig 2.63, the trip unit hold current is passed through the hold windings causing the cross-limbs to be saturated. If the magnetic flux in the reset of the core is initially at point a on the B-H loop (Fig 2.64) and a pulse is applied to the set winding, a pulse will appear at the output winding. As the flux in the core is now at point b on the B-H loop any further pulse applied in the same direction to the set winding would not cause another output pulse. If a pulse is now applied to the reset winding, the flux in the core will be reset to point A and a reverse polarity pulse will be generated in the output winding; this reverse output pulse is not used. If now another input pulse is applied, another output pulse will be generated. Thus by applying a succession of set and reset pulses a train of output pulses will be generated.

If the saturation of one or more of the cross-rungs is removed by removing the direct current through both of the hold windings on a rung, the flux from the next set pulse will divert down the hold rung and no output pulses will appear. The six hold windings can be interconnected in various ways to perform logic functions.

Figure 2.65 shows how ‘2 out of 3’ trip logic is ac­complished using a single laddie core, and ‘2 out of 4* trip logic using two iaddic cores in series (Fig 2.66).

converter, an external supply being momentarily con­nected to reset the line after a trip.

This system consists of two major plant components:

• Fuelling plug unit housing the internal sampling pipe.

• Mobile trolley and its ancillary equipment.

Plug unit

The sampling pipework is routed from the channel sampling point, just above the gag unit, through the plug unit up to the closure housing. To accommodate the differential movement between the gag unit and the closure unit, a metallic flexible convoluted hose is used to connect the closure unit connection and the rigid pipework. Figure 2.96 shows a typical single channel BCD coupling arrangement.

The hose is positioned in a U-shaped configuration to control and ensure that the axial movement of 381 mm can be accommodated without overstressing and premature failure. Unlike the magnox reactor, all of the AGR internal pipework is replaceable.

The closure unit houses a ‘fixed half-connector’ which forms part of the standard ancillary equipment. From this point on, the equipment for all reactors is identical.

During non-sampling periods, the fixed half-con­nector is further sealed using a ‘standard sealing cap’ which reduces the leakage rate to 3 cc/s.

Sampling operation

The ‘standard sealing cap’ is removed and a free half — connector is attached to the fixed half-coupling. At­tachment is achieved with the reactor pressurised. The unit is in the form of a T-shaped handle of suf­ficient length to reach the fixed half-coupling, usually located some 610 mm beneath the reactor floor level,

I

■s*

У

u

and still be at a reasonable working height above the operating floor level (see Fig 2.97).

If a fault situation occurs in which the ‘free half — handle’ cannot be removed using normal operating procedures and the fuel stringer requires discharging, then the free half-handle has been designed so that it can be disconnected, even if the seal in the fixed half-coupling remains open. The disconnection is achi­eved by simpl> rotating anti-clockwise the outer tube of the handle, this segregates the lower unit and the rotation of the outer sleeve brings a PTFE seal into operation. After disconnection, the lower portion of the handle is further sealed by using a special emergency sealing cap (see Fig 2.97).

This special emergency sealing cap still retains the sampling mode function.

The T-shaped handle is connected to the mobile trolley using a 12 m long metallic flexible hose coated with shrink-fit sleeving for easy handling. The trol­ley is connected to the service line connections of purge, sample effluent, power supply and the alarm circuit.

The mobile BCD trolley

The mobile BCD trolley (Fig 2.98) contains both the mechanical and electrical equipment to enable ALL monitoring functions to be achieved. The me­chanical components consist of a Mark 2 precipita­tor, flow meters, solenoid and needle valves, pressure controller, pressure and temperature gauge, non-return valves, a selector valve, heaters and filter units. Self­sealing couplings are used to connect to the services.

The electrical equipment is constructed in a modu­lar arrangement and consists of an integration module, alarm unit, alarm clock, output amplifiers, photomul­tiplier unit, power supply and precipitator EHT. All preset controls are enclosed by a lockable perspex cover together with the module trolley adaptable timers (one for overall system timing and the other the ‘soak’ timer).

Normal operating controls are panel-mounted at one end of the unit, and the read-out equipment and preset control panel mounted at the other end. All side panels are removable for access to equipment for maintenance.

Three electrical sockets for the attachment of mains, remote alarm and signal output, and two beacons used for alarm (red) and control (green) complete the gen­eral equipment supply.

The degree of distribution depends on particular cir­cumstances; for Heysham 2 AGR the control loops shown in Fig 2.122 are distributed amongst a number of processors as shown in Fig 2.123, These form part of the total system shown in Fig 2.121. The input/ output hardware capacity for this system, per re­actor unit, is 2600 analogue and 1440 digital inputs and some 1000 output signals. Such systems are pro­
grammed in the CEGB high level engineer-orientated language, Cutlass, discussed in Volume F, Chapter 7.

A plant simulator is used to check the hardware and software before it is used with the actual plant. — The computer-based DDC system facilitates the use of VDU displays, and these are designed to give an effective display of the operating conditions of the plant being controlled and the control status of the controllers.

The main control loops are as follows:

* Fuel channel gas outlet temperature T2 is regulated to maintain the desired average T2 temperature and to control instability that can occur across the core. This is done by moving control rods in re­sponse to the error between the T2 temperature desired values and the average temperature of gas leaving the fuel channels. There are 45 control rods arranged in two groups corresponding to CU2 and CU3 of Fig 2.123.

• Steam temperature is regulated to maintain the desired boiler transition point temperature. This is done by control of the set of 24 valves in re­sponse to the error between transition point tem­perature and its desired value. The valves control the flow of feedwater to each half-unit of the 12 boiler sections. At lower loads the temperature

POINT TO POINT SERIAL LINKS HO

(HIGH LEVEL DATA LINK CONTROL) TO SO AND SS

INPUT/OUTPUT

Fig. 2.123 Corurol loop distribution at Heysham 2

measurement is made from other parts of the boiler. The loops are allocated to control processors on a quadrant basis corresponding to CU6-9 of Fig 2.123.

• In order to keep the valves within their working range the total feed flow is controlled by the half­unit valves, the average pressure drop across them being regulated by feeding back to the feed pump turbine. This loop is implemented in processors CU10 and CU11 of Fig 2.123.

• Steam pressure is regulated by control of the gov­ernor valve in response to the error between mea­sured steam pressure and the desired set point. The control is implemented in processors CU4 and CU5 of Fig 2.123.

Some functions are implemented in redundant main and standby processors. For example, CU5 is a stand­by for CU4.

On reactor trip, automatic changeover of control of the steam valves from the load rejection controller to the plant trip controller is initiated. In this case, the no-load temperature demand is used in place of the cold leg reference temperature in the calculation of the steam dump demand. The full signal is then di­vided equally between the two individual program­mers which are then used to modulate the first two banks of dump valves associated with each turbine — generator. If one condenser is not available then all dump valves of the remaining condenser open, to­gether with the atmospheric dump valves.

There is no dead band in the plant trip controller and so the two banks of dump valves are immediately tripped open. As the error signal falls, indicating that the reactor coolant temperature is being reduced to­wards the no-load value, the dump valves are modu­lated to regulate the rate of removal of decay heat and thus gradually establish the equilibrium hot shut­down conditions.

Steam header pressure controller ~

Residual heat removal at operating temperature is maintained by the steam header pressure controller, operation of which is selected manually when required.

The pressure of steam in the steam header is com­pared with its demanded value to form an error sig­nal, this is then processed by a P and I controller to lorrn a demand signal which is used to modulate die opening of the cooldown valves of both turbines. The cooldown valves form the first bank of dump ‘ aiv ev

The cooldown valves may also be used to maintain ‘teadv conditions while the first turbine-generator is nchronised and block-loaded, and during the final 4tage^ oi off-loading and plant cooldown.

Steam generator power-operated relief valves During normal plant operation, the steam generator PORNs operate during steam pressure transients in the event ol insulticient steam relief capacitv via the turbine bypass system, to minimise lifting of the steam generator safely relief valves.

For each steam generator, the pressure of steam in the ^team line is processed by a P and I controller. :t is then compared with the pressure demand to form a pressure error signal. When this error signal exceeds a preset dead band, the excess error is used to modu­late the steam generator power-operated relief valves such that the valves become fuliv open below the minimum lifting pressure of the steam generator safety valves.

The PORVs are also the safety classified route for the controlled removal of reactor heat following re­actor trip, and ajfe used during normal plant cooldown when the main steam isolating valves are closed or when the main turbine bypass system is not available. Therefore, safety classified manual controls are pro­vided for the PORVs.

The function of a burnable poison is to absorb neu­trons at a time when the reactivity or rating of the fuel would otherwise be too high, but to burn out so that the poison does not constitute a permanent pa­rasitic absorber. The desired neutron absorption characteristic is achieved by using a material with very high neutron capture cross-section such as boron or gadolinium, located in discrete, self-shielded quantities. In AGRs, gadolinium oxide is contained in stainless steel toroids positioned in the fuel support grids and braces. The gadolinium isotopes used, Gd-l55 and Gd-157, have cross-sections of 7 x 10J and 16 x 10J barns and, as a result, virtually all neutrons falling on the toroid are immediately absorbed in the surface layer. The destruction of the gadolinium proceeds layer by layer, the effective surface area, and there­fore neutron absorption rate, decreasing with time until it is burnt up. The broken line on Fig 3.4 (b) shows the effect of burnable poisons arranged in four toroids per element in inner zone feed fuel in AGRs. The poison had been designed to produce a reactivity curve which is essentially flat early in fuel life. The fuel enrichment has been increased to compensate for the absorptions in poison and maintain the mean over-life reactivity. The net effect is a reduction of about 0.05 in k«, initially, burning out after about 5000 MWd/t irradiation.

In PWRs, the poisons may be incorporated as poi­son pins, replacing fuel pins in the fuel assemblies in the initial fuel loading in order to reduce the re­activity over the first fuel cycle.

Rod worth is affected by changes in mean fuel irra­diation. This is not because of any changes in the performance of the rods, but merely the way in which the worth of a rod is calculated. The reactivity worth of a control rod is determined by the effect it has on the multiplication constant keff as explained at the beginning of this section. The multiplication con­stant keff is made up of four main factors and the values of some of these factors change with fuel ir­radiation. Absorption of neutrons in control rods is accommodated in the thermal utilisation factor, as is absorption of neutrons in other materials including fuel. As absorption in fuel varies (due to variations in isotopic content), so the importance of absorption in control rods changes relative to absorption in fuel and the rod worth appears to change. This pheno­menon affects the value of control rod worth by up to a few percent only.

This phenomenon has a similar effect on other ab­sorption processes such as xenon worth (see Section 2 of this chapter), i. e., xenon worth varies with mean fuel irradiation by up to a few percent even though the absorption rate of neutrons in Xe-135 is unchanged.

Rod worth also varies with core temperature for a similar reason, and to a lesser extent because of the variation of capture cross-sections with thermal neutron energy. Variation of rod worth with core temperature and with fuel irradiation are taken into account in theoretical studies, but are not noticable to the reactor control engineer in day-to-day operation amongst the many other factors affecting rod posi­tions for reactor control.