The decay heat boilers are isolated and stored dry during normal reactor operation, and the boilers, along with the decay heat feed, steam and condenser cooling system are automatically introduced into ser­vice post-trip.

The systems comprise feed pumps, boilers, flash vessel, condenser feed tank, control valves and a re — circulatory condenser cooling system. Four boiler feed pumps draw water via a common suction header from the condenser well and deliver to the boilers by a common discharge header; two of the four pumps are adequate for the design duty. Individual feed lines run to each quadrant from the discharge header; feed is introduced into the boilers at a fixed rate.

The boiler pressure is regulated at 35 bar by steam control valves; saturated steam from each boiler is directed into a common flash vessel, and then into the decay heat condenser.

The condenser is cooled by a closed loop water circulation system, rejecting heat to the atmosphere via air cooled heat exchangers. The condenser and cooling system have a design rating of 30 MW; in the immediate post-trip period, excess steam is vented to atmosphere and water is automatically made-up into the condenser from the feed tank via level control ‘■alves, until such time as the system becomes fully recirculatory.

The condenser air cooling system consists of a sin­gle loop per reactor with four forced-draught air­cooled heat exchangers, each with two fans, and four pumps which circulate the cooling water through two nests of condenser tubes.

8.2.2 Emergency boiler feed system (Y)

The emergency boiler feed system is designed to sup­ply 10^o of the normal boiler feed to the main boil­ers, when they are operating at 80 bar. There are four emergency boiler feed pumps per unit, drawing water from three reserve feedwater tanks via a com­mon suction main. The discharge main is split on a half-reactor basis by a normally closed interconnect­ing valve, and thus the pumps normally operate in pairs; individual feed lines run into each quadrant area, and duplicate electrically-operated isolating val­ves are located (in parallel) adjacent to the boilers. A single pump of a pair has the capacity to provide the duty flow to the two associated boiler quadrants.

The boilers are vented to 80 bar and controlled at this pressure by the low pressure (LP) vent systems (one per quadrant); the reactor heat is rejected to atmosphere by dumping the steam via a flash vessel. Interconnections between pairs of boilers via the steam mains provides redundancy in the venting systems.

Orifices in the feed pipework limit pump flows in the event of quadrant pipework failures or boiler depressurisation faults, to prevent overloading of the pumps.

The fail-safe arrangement of the RCCAs (control rods) ensures that a very high reliability of reactor tripping is achieved. However, the failure of several control or shutdown rods to insert is tolerable for nearly all faults and in some cases, such as loss of coolant accidents (LOCA), the reactor is even less sensitive to rod drop failure, since moderator voiding alone achieves a satisfactory level of initial shutdown.

Nonetheless, it is postulated for design purposes that control rod insertion could fail totally when re­quired, such a phenomenon being known as ATWT or ATWS (anticipated transient without trip or scram). To ensure that reactor shutdown can still be achieved, a secondary shutdown system is provided which is capable of rapidly increasing the concentration of boron in the coolant passing through the core. This system, called the emergency boration system, is de­signed to be activated automatically if more than one RCCA fails to enter the core fully when a trip signal is generated by the primary reactor protection system.

Because of the negative overall temperature co­efficient of reactivity of a PWR, failure to trip is not of itself unacceptable and in fact results typically in reactor conditions stabilising at a few percent of rated thermal power, with coolant temperatures and pres­sures somewhat higher than normal. However, it is the difficulty of recovering from this stage before excessive off-site release occurs that requires the pro­vision of alternative shutdown means.

Direct introduction of extra boron into the core region is not practicable and as a result a very rapid response is required from the EBS. Because the event that precedes the failure to trip may also interrupt electricity supplies to the reactor coolant pumps mo­tors, it is vital to introduce the extra boron into the primary circuit within the first few seconds, while the pumps are still rotating relatively quickly. If this is not done, the rapidly reducing coolant flow will not be sufficient to carry the boron into the core region and shutdown will not be achieved.

Thus, the EBS avoids the delay inherent in ad­ditional pumps starting, by utilising the developed head of the reactor coolant pumps themselves as they run down, to displace concentrated boric acid solu-

tion into the circuit from normally isolated parallel circuits.

As shown in Fig 2.137 these circuits consist of four vertical cylindrical tanks, each connected to the suction and delivery of one reactor coolant pump by pipes containing rapid-opening valves. The pipes are kept as short as practicable by locating the four storage tanks within the primary loop compartments; the sizing and layout of the pipes and tanks are cho­sen to minimise flow resistance and thus to ensure that, when the valves open, the concentrated boric acid solution is displaced into the reactor coolant pumps’ suctions as rapidly as possible. For similar reasons, each suction and delivery line has a com­bined sampling and drain line located as close as pos­sible to its isolating valve to enable complete filling of each EBS circuit.

The design features just discussed ensure that, if an ATWT sequence is detected, removal of the power supplies that hold the EBS valves closed will shut down the reactor and keep it subcritical. The EBS is also activated or some non-ATWT faults, since it provides additional margin to criticality if cooldown of the primary circuit subsequently occurs. The 3 m3
of 7000 ppm boric acid solution in each of the EBS circuits is sufficient for the most demanding ATWT faults, even if one circuit fails to operate completely,

10.2.10 In-service inspection (iSI) equipment

The requirement to perform periodic in-service in­spection and testing on a pressurised water reactor primary circuit, and its associated nuclear auxiliary systems, can result in significant radiation doses to plant operators performing the examinations. In order to minimise the total ‘man-renT burden to the station staff, careful consideration has been given to the de­sign and layout of the systems and components.

In addition, whenever practicable, the use of re­motely-operated automatic equipment is allowed for in the design.

Significant gains are expected to be realised from the use of such equipment by providing adequate operator training facilities. These facilities accurately represent the access restrictions likely to be encoun­tered on the plant. By adequately training operators in the use of the equipment in the training facility, not only will inspection times be reduced* thus reduc-

ing operator radiation exposure, but also plant shut­down time will be kept to a minimum.

The requirement for periodic inspection arises from one or more of the following:

• Good engineering practice developed from the op­eration of conventional and nuclear plant to date.

• Statutory requirements related to either general industry safety practice or specific nuclear safety requirements specified as per the station operating licence conditions.

• Where design analysis indicates that a particular component or part is subject to a high duty, the designer may call for periodic inspection.

• Analysis of the performance of similar components and systems already in operation. This aspect is particularly important for inspection to detect and monitor the incidence of degradation modes pre­viously observed in similar components.

The in-service inspection of pressure parts, compo­nents and structures important to nuclear or person­nel safety is carried out during the annual refuelling and maintenance shutdown periods. The work is pre­planned to a programme such that the totality of the necessary inspections is completed within the required period.

The Ionising Radiations (Sealed Sources) Regulations were made by the Secretary of State for Employment under the Factories Act 1961. These regulations are lor the protection of employees to which the Factories Acts apply, where sealed sources are used and stored. Scaled sources are any radioactive substance sealed in a container or bonded within material. This ex­cludes waste contained for disposal or nuclear fuel within its canning material. These regulations apply to CEGB sites which are licensed for reactors under the Nuclear Installations Act І965.

The regulations make provisions for:

* Instruction to employees on the hazards involved.

• Appointment of competent persons to exercise supervision.

• Classified workers (who must be over 18 years of age) who work with ionising radiations.

• The provision of film badges and dosemeters.

• Health register, medical examination and a radiation dose record, and preservation of these records for 30 sears.

• Other regulations that deal with the identification of sources, measurement of radiation and defining radiation areas, and precautions relating to certain processes using sealed sources.

• Specifying maximum permissible radiation doses as those specified by the International Commission on Radiological Protection.

Axial expansion

In the inter-element gaps there is thermal flux peak­ing (no U-238 absorptions). Axial expansion of the fuel elements reduces the flux peaking and conse­quently reduces the absorptions in the fuel pin end caps, giving a small positive contribution to feedback in AGRs.

Density effects

In water moderated and cooled reactors the modera­tor density decreases with increasing temperature. This results in less scattering of the neutrons and a harder neutron spectrum. The fission rate of U-235 is then reduced as a consequence of its non-l/v cross-section. The effect of this is to reduce the number of thermal neutrons in the system giving a negative feedback effect. A further small effect arises from the expulsion of water from the core due to expansion of the cans. These mechanisms are complicated by the presence of boron in the water (boron is a strong neutron ab­sorber and is used to control reactivity in PWRs), Increasing the moderator temperature reduces the boron concentration giving a positive contribution to feedback. At sufficiently high boron concentrations the overall moderator feedback coefficient would be­come positive.

The prime consideration when the reactor is shut down is to ensure that the fuel and graphite are ade­quately cooled. A considerable amount of heat is contained within the graphite (70 MWh if 2000 t of graphite change by 100°C), also heat will continue to be generated in the fuel after shutdown because of:

• The release of delayed neutrons capable of causing fission.

• The decay of fission products.

• The decay of heavy isoropes.

The delayed neutrons are exhausted within minutes, but some fission products and heavy isotopes have long halflives so the total afterheat, called ‘decay heat’ or ‘fission product heat’, remains significant for many days. Figure 3.27 shows how this heat decays with time.

Fig. 3.27 Decay heat after shutdown
This curve shows the amount of heat which continues
to be generated in the fuel after shutdown. Note that
the curve is plotted on a logarithmic timescale to
enable many days to be shown without loss of detail
in the first few minutes. Decay heat is expressed as a
percentage of the reactor power before shutdown; thus
for an AGR which has been operating at 1500 MW
the decay heat one minute after shutdown is about З^о
or 45 MW. This curve is for an AGR which has been
operating at steady full power for several days before
the shutdown, so that the fission products and heavy
isotopes have built up to equilibrium concentrations.

If the reactor remains pressurised with a full charge of CO:, the core is easily kept cool with small amounts of gas circulation and boiler feedwater flow. The amount of cooling applied wall depend on the core temperature to be achieved, for example, if the re­actor is shut down for access it will have to be much cooler than if it is shortly to be restarted. If extensive maintenance is to be carried out, as during an over­haul, and cooling circuits are required to be shut down for maintenance, attention is paid to the Operating

Rules which specify the minimum plant which must be available for core cooling.

Forced circulation of reactor gas is not always re­quired. Natural circulation is adequate at some stations under certain conditions, particularly some magnox stations where the boilers are sufficiently high relative to the core to establish an adequate thermal syphon, As the shutdown proceeds and the fission product heating decays, the probability of natural circulation being adequate improves.

In some respects a shutdown reactor is more diffi­cult to control than a reactor at steady full power. Because of the high load factors of CEGB reactors, shutdown is an infrequent event, so the reactor con­trol engineer is most accustomed to power operation. Many less familiar constraints apply when the reactor is shut down, the transient behaviour of the plant is very different when shut down, and many unusual and non-standard operations can be carried out on a shutdown reactor. Great care is taken when control rods are removed for access or maintenance, particu­larly if adjacent rods are removed, in order to main­tain the shutdown margin of reactivity. Where the reactor control engineer does not have direct control of operations within the reactor core, strict adminis­trative systems are set up and maintained to assure reactor safety while shut down and when the reactor is restarted.

The reactor design is optimised for full power op­eration, so particular care is necessary while shut down to ensure that plant limits are not exceeded. For example, the fuel sheath in a magnox reactor is less ductile when cool than it is at operating temperatures, so care is taken in control of reactor cooling to re­strict the rate of change of temperature. Another example is that the steel pressure vessel is more sus­ceptible to brittle fracture when cool, so restrictions are necessary in operations at standpipes to ensure that the vessel is not subjected to impact, and these restrictions are written into the Operating Rules.

Finally, control of the reactor while shut down is as required to prepare the reactor for restarting. For example, minimum temperatures must be achieved before starting up, as outlined in Section 5.3 of this chapter, so it is disadvantageous to overcool the reactor. The plant required for start-up is made available as the need arises.

Scope

The function of the primary coolant is to remove heat from the reactor core and transfer it to water tube boilers in the associated gas circuits. The controlling limits are specified in the station Operating Rules. At Berkeley, for instance, the operator is required to monitor and control the primary coolant with respect to the following parameters:

Gas purity Pressure Mass flow Temperature Reserve levels

In connection with gas purity and for both magnox reactors and AGRs there are sources of water that include release of water already absorbed within the reactor core, the radiolytic breakdown of methane in AGRs, the radiolytic/thermal breakdown of oil enter­ing the system and boiler leaks allowing water into the coolant circuit.

Gas driers are installed and blowdown is used to control moisture concentrations below that which might cause corrosion of reactor internals or affect the per­formance of the failed fuel detection (BCD) system.

Measurement of the bulk moisture level is necessary to check on the performance of the moisture control systems and to provide data used in calculations of moderator integrity. Typical concentrations are quoted
in Tables 3.7 and 3.8, i. e., around 10 vpm for magnox and 30 vpm for AGRs and measurements are required within ±5% accuracy of ±2 vpm, whichever is the greater. Response time is an important factor because the boiler leak has to be detected before a significant quantity of water has entered the reactor.

In the case of magnox reactors, the prime reasons for the limit is the reduction in magnox ignition temperature with increasing moisture. The normal Operating Rule limit for magnox stations is 500 ppm by weight of water in the reactor coolant.

Since CAGR clad is weak, it generally remains in close contact with the fuel. When the reactor is shut down the temperature of both clad and fuel may drop to around 300°C, UO2 has a lower thermal expan­sion coefficient than steel, but, since it also runs at a much higher temperature than the clad, any differen­tial thermal expansion between fuel and clad will be small. The chief exception to this is in lowly-rated fuel гиппіпШШ high clad temperature, these conditions usually^reing found in some pins in the top one or two elements of the stringer. Here, a large reduction in reactor power can produce plastic ratcheting strains in the clad which cause the pins to elongate (Stacey, Jones and Bradshaw, 1976 [10]).

On return to power, the pellets may re-stack causing the individual inter-pellet gaps to accumulate to form a single large gap below the anti-stacking pellet. Such occurrences can lead to problems with the collapse of the clad into gaps.

The formation of inter-pellet gaps allows the pos-

hilitv of pin length decreases by the process known as creep shortening [10]. This is more pronounced at high clad temperatures in the presence of many small oaps (rather than a Tew big ones) and is generally beneficial since it helps prevent the formation of large inter-pellet caps, an objective which is further aided b "minimising the frequency of shut downs and re­actor trips. Recent trends have been towards the in­clusion of greater numbers of anti-stacking pellets uhich increase, the rate of creep shortening.

The third main type of pellet/clad interaction of relevance to CAGR is that which arises during power transients. When an operating fuel pin experiences an increase in power, perhaps as a result of a fault, the temperatures of both pellet and clad increases. Such a power increase will produce differential thermal expan­sion which may cause the pellet to strain the clad; be­cause of ‘hourglassing’ (also known as ‘wheatsheafing’, Fie 1.36) such effects peak at the ends of pellets. Were that all, there would be little cause for concern since thermal strains are small. Difficulties arise, however, because this thermal strain is not uniformly distributed around the circumference of the clad but is instead localised through two main effects (Gittus 1972) [II]: first, ciad-pellet friction concentrates the deformation at that part of the clad which lies close to radial pellet cracks; second, the presence of a cross-clad tempera­ture gradient allows the hotter side of the clad to ex­perience greater strains. Such concentrated strains are greatest in highly rated, solid, fuel and, as seen during the early operation of the Windscale AGR prototype, can be sufficient to cause pin failure.

The normal operation of a nuclear power reactor will generate fission products within the fuel, which will be released to the coolant if the fuel clad fails. The і memory of fission products can be estimated by computer calculation and a small release to the coolant is usually assumed to occur during normal operation.

Fission products such as iodine, caesium, krypton and xenon are detectable in the primary coolant at serv low chemical concentrations. Gaseous krypton and xenon are controlled by continuous removal by the purge hydrogen to the volume control tank of the CVCS, and caesium levels are controlled by removal on the CVCS cation ion exchange bed. The most important elements which will occur in fission pro­ducts are given in Table 1.23.

The aqueous chemistry of some of these elements such as iodine is complex, and the chemistry of others is not well established, either for the fuel clad gap or primary coolant environment. The fuel clad gap ts the small (usually annular) volume between the so­

lid fuel (rod or pellets) and the inside surface of the fuel clad.

10.7.12 Actinides

The nuclear species known collectively as ‘the acti­nides’ are formed in nuclear fuel by neutron capture followed by beta decay:

U-238 (n, a) U-239 — Np-239 Pu-239

The biologically significant actinides are given in Table 1.24 and possible sources in the primary coolant are fuel cladding failures and irradiation of traces of ura­nium (termed tramp uranium) present as contamination

on the zirconium alloy fuel clad. A typical contamina­tion level would be 0.1 g uranium for a whole fuel charge and consequent coolant levels would be below 1 wppb (one part in 109).

The chemistry of the actinide species in PWR pri­mary coolant under near-neutral conditions will be dominated by hydrolysis reactions forming very in­soluble hydroxide colloids. Some species such as plu­tonium and uranium form colloids which carry a small cationic charge, and can readily ‘plate-out’ on metal surfaces or corrosion products. In this case the acti­nide would be subject to any transport mechanism of the parent corrosion product and could migrate around the circuit. The chemistry of the actinides can also be influenced by temperature, pressure and the forma­tion of complexes with the borate ion.

The turbines used in magnox stations are of the same basic design as those used in conventional plants. However the use of dual steam cycles and the rela­tively poor steam conditions from the boilers has led to slight variations.

Of the magnox stations, six employ dual cycles where both HP and LP steam supplies the main tur­bine. The LP steam is introduced part way down the HP cylinder to mix with the partly expanded HP steam. Two sets of governor valves are provided to control the relative flow rates of HP and LP steam. To allow for variation in reactor performance from assumed characteristics, and to ensure equal load shar­ing between turbines where several are supplied from the same reactor, adjustments can be made to the governing characteristics. The point at which the LP valve lifts relative to the HP valve and the ratio of LP to HP governor valve lifts can be varied over a certain range.

At Oldbury and Dungeness A, ail the steam gen­erated by the HP boilers, at a higher pressure than the other dual cycle stations, is supplied to small back pressure turbines which drive the gas circulators. The steam is then reheated before mixing with the steam from the LP boiler to supply the main turbine. Be­cause the main turbine has only a single steam supply, the governing system is much simpler than for the other type of dual cycle stations.

With the relatively low steam conditions available to the turbine, the exhaust area through the last rows of the LP blading is relatively large compared with conventional modern reheat turbines of a similar out­put in order to reduce the amount of kinetic energy lost in the steam entering the condenser. To obtain the larger exhaust area, some stations use higher rated conventional turbines, e. g., Berkeley has 120 MW de­signed turbines producing 83 MW. At Sizewell A, the turbines pioneered the use of 0.914 m long LP blades rotating at 3000 г/min with a blade tip velo­city exceeding 1.4 times the speed of sound. A 1500 r/min shaft speed was chosen for the Oldbury design to limit stresses in the long final LP blades.

The low steam temperature to the turbine resulted in a high exhaust wetness and led, therefore, to the use of interstage water separators or steam-to-steam reheaters at all of the stations. At Sizewell A, for example, steam leaving the HP cylinder with a 3% moisture content is passed through a two-stage sur­face type reheater where it is dried using bled steam, and then superheated using live steam taken from before the HP stop valves. The moisture content of the steam leaving the LP cylinder is thus reduced to about 8% avoiding serious erosion of the last rows of LP blades. This steam drying process is achieved without any loss in performance, because the loss due to using steam for reheating is balanced by the improvement in efficiency of the LP cylinder and the increased adiabatic heat drop per unit mass of steam.

Redundancy

By the use of more than one detector and trip unit, i. e., exploiting redundancy, single failures do not pre­
vent the reactor being tripped. In UK reactors three or four detectors and associated trip units are used to trip the reactor on certain tripping parameters.

Diversity

There is a significant risk of failure of protection due to common-mode faults in equipment, errors in safety calculations or human error. This risk is re­duced by the use of diversity. Wherever possible, protection against each reactor fault is provided by two trip groups each sensing a different reactor para­meter. Different measurement techniques and equip­ment designs are also used to reduce the effects of probability of common-mode failures.

An example of the choice of two diverse parameters to protect a magnox reactor is reactor depressurisa — tion. Either rate of fall of pressure or rate of rise of fuel element temperature can trip the reactor.

The actual tripping parameters for a typical magnox reactor are listed in Table 2.10.