9.11.1 Sequence control

There is a large number of functions to be carried out from the CCR during a hot start, but the num­ber of operator actions can be greatly reduced by the use of sequence control and interlocks. The remote control of the plant is a combination of the following systems, in addition to the modulating control de­scribed in the previous Section 9.10:

(a) Remote manual control with direct-acting circuits controlled by the unit operator.

(b) Remote manual control of items normally con­trolled automatically. This manual control is pro­vided in case the automatic modulating control system fails or is outside its operating range. There are certain permissible combinations of control loops on auto or manual, and the system is de­signed to accommodate these configurations.

(c) ‘Operational’ sequence control, its action being initiated by the unit operator, where it is required to permit hot start-up and to reduce the operator workload during start-up or emergency conditions. Further details are given in Volume F, Chapter 3,

Operational sequences (c) above are provided using Cutlass software in the Heysham 2 control micro­processors (Figs 2.121 and 2.123):

• TUI and CU4 Main turbine run-up.

• CU10 Gland steam sealing system.

• CU10 Main boiler feed pump turbine

run-up.

• CU10 and CU11 Start/standby feed pump stop
and start.

In order to ensure the adequacy of reactor cooling after a trip, an automatically sequenced system is pro­vided as described in Section 8 of this chapter.

9.11.2 Interlocks

The integrity required of interlock systems depends upon the severity of the incident that would re­sult from failure. As an example, CEGB has ascribed target reliabilities for AGR fuel route interlocks as follows:

Class А: Ю"6 failures per annum

Class В: 10"4 failures per annum

Class C: 10~2 failures per annum

By comparison, automatic reactor protection has a tar­get reliability of 10-7 average probability over 5000 h of a failure to meet a demand to trip.

The standard of an interlock may be expressed as:

F = NPjPM

where F = required integrity (failures per annum)

N = number of operations per annum

Pi = probability of interlock being required ^ per operation

P2 = probability of occurrence of the designed hazardous event subsequent to the inter­lack failure

f = probability of interlock failure per demand

Typically the number of operations for fuel route equipment (N) is 200; Pi and P2 can be taken very pessimistically as unity. Thus, for a Class A inter­lock the probability of interlock failure per demand is 5 x 10~9. Such figures can only be achieved by redundant systems, with diversity in the type of equip­ment in each system to avoid common mode effects, as discussed in Volume F, Chapter 8.

For interlocks, the usual practice has been to im­plement systems and provide protection of some plant using electromagnetic relays or hardwired solid state circuits. These can be arranged in configurations incor­porating redundancy to achieve the required reliability. Typically, Class A interlocks have been implemented using triplicate systems, Class В with duplicate systems and Class C with single systems.

Recently there has been a tendency in the process industries generally towards the use of computer-based

vstems in these applications. Such systems have advantages in flexibility when constructing and mod­ifying the logic. They enable the suppliers to satisfy a large variety of needs with a common type of hardware, the variations being provided by different software or ‘firmware’ appropriate to each applica­tion. Such computer-based systems are used as one or more channels of the interlock and, since they — an be considered a vcr different technology from that used in hardwired systems, they provide an ef­fective way of introducing the diversity necessary in Class A svstems to reduce probability of common mode failure problems.

These systems also have the advantage of being easily interfaced with other computer-based systems, so providing colour VDU displays and logging of the status, and facilitating their incorporation into larger logic or closed-loop control systems. As in the case of automatic protection, sophisticated self-checking can be incorporated in the design, and they can be arranged such that it is possible to determine easily the logic actually present in the system at any time, using a listing of the programs.

As in the case of the use of computers in reactor protection applications, their use in high integrity interlocks and control necessitates very careful con­sideration of software integrity, this matter is dis­cussed in Volume F, Chapter 7.

Steam is supplied from the main steam header to the two main turbines by way of the turbine stop valves and the turbine control valves (throttles). The stop valves are designed to shut off the steam flow to each turbine quickly under emergency conditions, while the control valves are intended to control the flow of steam to the turbine under normal operating condi­tions as directed by the turbine control system.

The main station load demand is sensed at the tur­bines. The turbine throttle valves respond to changes of grid frequency through the speed governor (the speed droop), these governor gear responses being re­set in the long term by the load control system which also contains a signal from the grid frequency (the load droop), The speed governor also provides pro­tection against turbine overspeed.

During normal load control, the speed governor drives the turbine throttle valves at variable speeds corresponding to station load changes of up to 10% per ftiinute. Abnormal conditions, such as automatic load runback, require the throttle valve to be closed at a constant 10% per minute. The effect of turbine throttle movement on steam flow is linearised in the electronic governor.

The station load demand is divided between the two turbines as directed by the station operator.

Irradiation effects on the isotopic content of fuel are calculated in a lattice cell calculation in which neu­tron transport processes are represented in a ‘cell’, consisting of a fuel pin or cluster of pins and its share of moderator, with a boundary condition to express neutron leakage into or out of the cell. The neutron energy spectrum is calculated throughout the fuel and moderator of the cell and all the neutron reaction rates necessary to calculate build-up and burn — up processes as given, for example, by Equations (3.1) and (3.3) are deduced. Burn-up steps are then per­formed to predict the change in density of all relevant isotopes with irradiation. Periodically the lattice cal­culation is repeated in order to take account of the changes in neutron spectrum and flux distribution arising from the modified isotopic content.

The infinite lattice multiplication constant k„ is then calculated from the integral of the fission-rate

multiplied by the number of neutrons produced in fission, divided by the total number of neutrons absorbed in all isotopes present.

The code mostly used for lattice calculations in magnox and AGR is ARGOSY, which incorporates a collision probability solution of neutron transport in the fuel linked to a diffusion theory solution in the moderator. However, for certain purposes, such as a burn-up of flux fine structure, the rather more sophisticated and flexible \ IMS code is used. The basic WIMS model is a DSN solution of the neu­tron transport equation in a number of energy groups which is chosen by the user, but other solution meth­ods are also available. It is a version of WIMS which is employed routinely for PWR lattice calculations.

Control rods are of two types according to their reactivity worth, black and grey. Further divisions are made according to the rods’ functions. These divisions are not definitive, as will be seen later. We must also come to terms with the different names given to the functional classes by different designers.

Bulk rods

Also called coarse rods. These are black rods, a mag — nox reactor generally contains 60-90 and an AGR 35- 45, distributed evenly across the reactor core. Wylfa, however, the last of the magnox series, has 153 coarse rods in its large core, but the total worth of these rods is comparable with the total worth of coarse rods in the other magnox reactors, The principal function of these rods is to shut down the reactor and maintain, in the shutdown condition, a suffi­ciently low value of keff to ensure safety under all conditions. Withdrawal of bulk rods enables the re­actor to be started up. At steady full power condi­tions the bulk rods are generally fairly-well withdrawn from the core. At Berkeley and Hunterston A (magnox reactors) a few bulk rods remain more-substantially inserted in the core at power to assist in radial flux shaping (see Chapter 1). On all magnox reactors it was envisaged that bulk rods could contribute to xenon override during load reductions, but over the years the advances in mean fuel irradiation have meant that on some stations the bulk rods are so far withdrawn at steady full power that they offer only limited scope for xenon override.

One important difference between the early magnox reactors and the later magnox and AGRs is the se­quence of withdrawal of bulk rods on start-up. In the early magnox reactors bulk rods are withdrawn as one group, keeping all the rods nominally at the same height as each other. When the reactor achieves full power the bulk rods are still significantly inserted (and are progressively withdrawn as the Xe-135 builds up), and this insertion causes a distortion, sometimes severe, of the axial flux shape and hence the axial temperature profile. In the later magnox reactors and all the AGRs, however, the withdrawal sequence is as follows. The bulk rods are divided into two, three or four groups, and one group at a time is with­drawn. Each group is withdrawn fully before the next group commences withdrawal. Thus at any one time only a fraction of the rods are in the disadvantage­ous position which causes axial flux distortion, so the distortion is much less pronounced.

Auto control systems for magnox reactors and AGRs are described fully elsewhere. In this section the dis­cussion will be confined to their roles in controlling spatial instabilities.

In magnox reactors and the Dungeness В AGR the regulating rods are arranged in a pattern which is clearly designed to control the spatial instabilities described above, A typical magnox arrangement is shown in Fig 3.31. Where auto control systems are used, deviations are sensed by fuel channel gas outlet thermocouples and the control loops, one per sector, cause the regulating rods in the associated sectors to be wound up or down as necessary to maintain the control temperatures constant. On some magnox sta­tions these auto control systems are not used, mainly because of difficulties in demonstrating that the in­stalled instrumentation provides adequate protection against all credible faults which can occur with an auto control system. At Trawsfynydd it was necessary to gang together pairs of radial sectors so that they now have effectively five sectors. Operating staff have shown that they can cope adequately with transients and instabilities without auto control, they move the regulating rods manually in much the same way as the auto control system.

Examination of Fig 3.31 shows that the first radial mode is covered by having a central sector and radial sectors. The first and second azimuthal modes are covered by having eight radial sectors. Wylfa has a novel arrangement (Fig 3.32) which performs the same functions.

On AGRs other than Dungeness В (which has five control zones) many more auto control loops are provided, one for each of the 35-45 regulating rods.

This is 10 enable the reactor power output to be continuously optimised, and clearly it offers more than adequate cover for spatial instabilities.

It is usual to conduct a leakage survey on each re­actor at monthly intervals and the results recorded and compared with previous measurements to assure that no deterioration is taking place. Also after any major shutdown where there has been interference with the primary coolant circuit (maintenance of plant and equipment breaking into normally pressurised systems), a loss of coolant survey is carried out whilst the reactor is being pressurised. This survey will cer­tain])’ contain measurement^ for carbon dioxide at the points where work on the pressure parts was under­taken. Any defect found will have to be remedied.

The SGHWR is referred to here as an example of the design variations made possible by the physical separation of moderator and coolant.

The SGHWR was developed by the UKAEA, be­ing seen as combining the best features of Candu and BWR. The only SGHWR in operation is the 100 MW(e) prototype located at Winfrith in Dorset and commissioned in 1967. Further exploitation of the de­sign is not economically justified in comparison with commercially well-established alternatives.

Table 1.8 indicates the design of the SGHWR. As in Candu the moderator is heavy water contained in a calandria. However, the calandria tubes and the concentric pressure tubes are vertical and the coolant is light water. As in the BWR, the coolant is allowed to boil as it passes through the core and this steam drives the turbine, thus eliminating the separate steam raising plant of Candu. The SGHWR is therefore a direct cycle design.

The penalty of using light water coolant, with its rather high neutron capture cross-section, is that the UO2 fuel must be enriched to about 3%. A fuel stringer and its end fittings occupy the length of the pressure tube. During the off-load refuelling opera­tion the fuel stringer is removed in one lift and re­placed by a new stringer.

Small momentary changes in reactivity is by ad­justment of the height of the D;0 moderator in the calandria. The moderator is dosed with boric acid and long term reactivity changes is by regulation of the acid concentration.

The SGHWR is housed in a large containment building which includes the turbine hall.

In the graphite fuel sleeves there are two sources of internal stress, thermal gradients and fast neutron flux gradients. Following initial loading into the reactor, thermal stresses are generated which are compressive at the hot-inner surface and tensile on the cooler-outer surface. During irradiation these stresses are fully re­lieved by irradiation creep. On cooling the sleeves dur­ing removal from the reactor, internal stresses equal in magnitude, but opposite in sign, to the relieved thermal stress will be generated within the graphite sleeve.

In the reactor fast neutron flux at the bore of the sleeve is approximately 20% greater than the outer-

rface of the sleeve. As with the main core bricks SjJ. |gads to the bore shrinking at a faster rate than I ‘ QUtside surface, giving tensile stresses in the bore. The strain causing this stress is relieved by secondary but is continuously replenished by fast-neutron — fluvinduced shrinkage. Steady stress results when the rate of strain relief (creep rate) balances the rate of strain input {shrinkage rate).

The properties of the fuel element materials are dis­cussed in detail in Chapter 1.

Problems

• Can ductility The can may be considered as an extensible envelope for the bar and any reduction in ductility could result in failure. Maximum ura­nium dimensional changes occur at can temperatures of >250°C which corresponds with a ductility minimum for magnesium. Ductility can be improved by reducing the can grain size and this has led to a duplex loading pattern in which cans operating at <350°C have a grain size of 0.127 mm. These are called LTA cans.

It is possible to generate fission gases in the can by neutron interaction with impurities and this leads to a gradual reduction in can ductility from about 90% to between 10 and 30% (as judged by

Fig. 2.3 Magnox fuel elements of the polyzonal type and the herringbone type with integral lugs

tensile testing). However, the effect appears to sat­urate at 3000 MWd/t and even at the end of life the can has sufficient ductility to accommodate the uranium bar dimensional changes.

• Creep resistance The magnox end fittings must prevent stack collapse and the splitters minimise bowing of the uranium bar. In order to predict component deformation the creep mechanism must be identified.

Creep strength can be improved by using duplex materials or by coarsening the grain size of the sin­gle phase alloy. The latter procedure is adopted for the canning alloy Magnox AL80 which must provide strong fins for high temperature operation. This is done by annealing the cans at 500°C prior to service. These are called HTA cans.

• Magnox ignition All the magnox alloys will burn in CO2 if held at a constant temperature close to the melting point. Since the oxidation of ura­nium is exothermic this raises important safety considerations.

margin enabling greater power to be obtained. For example, at Oldbury, operating at a channel gas out­let temperature 1°C below target corresponds to a reduction in output of 2 MW in 225 MW. Similar considerations apply to other operating parameters.

The response time of the measurement is not im­portant for long term monitoring, but for reactor protection equipment it must be consistent with the figures assumed in the fault studies. If the measuring device is part of a closed loop control system, its response time may be important from the viewpoint of loop stability.

Reliability is important insofar as failure of a measuring device may not allow the Operating In­structions to be satisfied. F~or devices feeding the reactor safety system the failure rate must be small so that spurious reactor trips do not occur and there is high confidence in proper operation for real fault situations.

The equipment originally installed in the magnox stations has now (1988) been largely replaced by more modern equipment, some of which is similar to that fitted to AGRs [2].

^ hiie some relatively old types of detectors are still in use in magnox stations, most of the electronic equipment has been replaced.

5.2.2 Thermal columns

In the case of magnox reactors with steel pressure vessels, the detectors are mounted in ‘thermal col­umns’. These are so called because they are made from columns of graphite bricks which thermalise (slow down to thermal energies) the neutrons escaping from the core (Fig 2.43). These slow neutrons enable more sensitive detectors to be used than if the fast neutrons from the core were measured. Lead shielding of the detectors is used in some cases to reduce the gamma flux relative to the neutron flux.

5.2.3 Artificial neutron sources

Spontaneous fission in the fuel is insufficient to pro­vide enough neutron flux at the detectors when the reactor has been shutdown for a long period. Artifi­cial neutron sources are usually installed (Fig 2.43) to augment the reactor shutdown power level to the order of watts so that instrumentation ranges can be reduced to six or seven decades. Stainless-steel-canned antimony beryllium makes a suitable neutron source. The antimony, becoming т-active when the reactor is at power, has a half-life of 60 days and when the reactor is shut-down the antimony gammas react with the beryllium to produce photo-neutrons.

□