The special requirements of once-through boilers and
their need for very pure water makes it important to monitor the quality. A typical set of requirements and the measuring techniques used are summarised in Table 2.14.

Each of the four primary coolant loops in the reactor is provided with four measurements of the cold leg temperature Tcoid. The cold leg temperatures are mea­sured downstream of the reactor coolant pumps.

The cold leg temperature signals from each loop are ‘auctioneered’ in the signal selection system which se­lects the highest signal. The selected signal is then compared with the programmed cold leg temperature signal, TC ref. to form the TCOid error signal which de­termines the control rod speed demand. The reference cold leg temperature, TCret. is a linear program of the total power output from the two turbines, Qtcrb-

Power mismatch

The power mismatch channel provides fast response to a change in load by means of the turbine load feed-forward signal. It also reduces nuclear power overshoot.

There are four ex-core nuclear detectors, one per quadrant of the reactor, and each is subdivided axially into four sections.

The signals from these ex-core detectors are cor­rected for inlet temperature variations from the no­minal full power cold leg temperature, according to experimentally determined density correction factors, and further corrections are determined from periodic comparisons with in-core detector readings to obtain the average quarter-length powers within the reactor core. The nuclear power signals determined from the summations of the quarter-length powers are then auctioneered in the signal selection system which se­lects the highest signal.

The mismatch between the total station load and the reactor nuclear power is calculated and then com­pensated, the resultant error signal being added to the compensated temperature error signal.

This final compensated error signal is then trans­formed into a rod speed signal and a rod direction sienal. These rod speed and direction signals are then transmitted to the control rod drive equipment.

The control rods and the rod reference speed are checked for correct response to control system demands.

Control rod drive equipment

The control rod drive equipment (CRDH) organises the movement of both the shutdown banks of RCCAs, as required by the reactor temperature control system or the station operator.

The system is composed of controllers, controls and hardware necessary to raise or lower the control rod and shutdown rod banks. There are three banks of control rods which, in either automatic or manual mode, are moved by the CRDE in a prescribed se­quence with predetermined overlap between them, in response to rod speed and direction signals from either the reactor temperature control system or the man­ual controls. During power operations, the shutdown banks are fully withdrawn and reactor power is modu­lated by the control banks. The maximum speed of the rods is such that, in case of accidental withdrawal of the rods, the maximum reactivity release rate does not exceed 35 mN/s, allowing for the overlap between successive banks of control rods.

The total error signal, ETCOici, sent to the rod speed programmer is the sum of outputs of the cold leg temperature.

1.5.1 Policy

The Executive of the CEGB confirmed the applica — [ion of Quality Assurance on 6 September 1982 in the following terms:

• it is the policy of the Central Electricity Generating Board that for all items of power generating and transmission plant and associated systems there shall be in force appropriate arrangements for providing assurance of quality at al! stages from design to de-commissioning.’

1.5.2 Quality assurance

A nuclear power station consists of nuclear safety — related and non-nuclear safety-related plant.

Quality assurance is an essential aspect of good management which combines all the administrative and practical job-orientated activities affecting the quality of a product or service.

The supply, installation, setting to work and use of safe and reliable systems, plant and equipment requires that it shall be designed, built, commissioned, operated and maintained within the framework of a system that defines responsibilities and structures to ensure that at each stage;

• The required quality is properly defined. —

• The required quality is obtained.

• The attainment of the required quality is verified.

All the planned and systematic actions necessary to provide such a system are known as The Quality Assurance Programme.

It consists of two main and indivisible components:

• Quality administration which brings together all the organisational conditions, the establishment and updating of the quality assurance programme (the documented, written texts), the systems for pre­servation of records and documents, the identifica­tion and verification of corrective measures when necessary and the processes for auditing.

• Quality control which relates to the measurements and control measures taken to prove that the phy­sical characteristics of an item or service meet the specified requirements.

The above analysis of reactor kinetics, both prompt neutrons in Section 4.1 and delayed neutrons in Sec­tion 4.2 of this chapter, has assumed that a given value of reactivity, once established, remains constant for the duration of the transient. A situation as sim­ple as this can exist at low power, say up to about 100 kW, provided that core temperatures remain con­stant; reactivity is then determined by control rod position.

However at higher powers, where the heat pro­duced is sufficient to influence the temperature of the fuel and the moderator (or at low power if core temperatures are changed by, for example, changes in gas temperature due to changes in boiler waterside conditions), then temperature feedback effects come into play whereby changes in fuel temperature and/or moderator temperature cause changes in reactivity. The theory of temperature feedback is covered in Section 3 of this chapter, and the practical aspects in reactor control are covered in Sections 5.3 to 5.6 of this chapter.

3 Reactor control

Changes in temperature may arise in a variety of ways. They may be caused by changes in neutron power as discussed in Section 5.5.2, or they may be caused by changes in gas flow as discussed in Section 5.5.3 of this chapter. All these changes in temperature are originated within the reactor core. This section is con­cerned with changes in temperature originating outside the reactor core, i. e., changes in reactor gas inlet tem­perature. These arise primarily due to changes on the water/steam side of the boiler. It is not appropriate in this section to consider in detail the thermodynamics of the boiler, only those aspects which are necessary for the purposes of this section will be considered.

Some reactors have auto control loops to maintain reactor gas inlet temperature at a desired value. In these reactors the reactor gas inlet temperature will therefore either remain constant or it will change in response to a change in the demanded value; in ex­treme cases it may change because the disturbance is so severe that the auto control loop is unable to maintain it constant.

Changes in water/steam conditions in the boiler may occur because of faults such as reduction in steam flow to main turbine(s), failure of boiler cir­culating pumps on drum boilers, reduction or increase in feed flow to boilers. Changes may also occur as a result of actions by the reactor control engineer in order to change, particularly to raise, reactor gas inlet temperature; this applies to the magnox reactors with­out auto control loops on this parameter.

Note that the formula at the beginning of this section relates power, gas flow and, in particular, tem­perature rise from reactor inlet to outlet. If reactor gas inlet temperature increases, and neutron power (and gas flow) remain the same, then reactor gas out­let temperature will also increase. In this case the dynamic behaviour of reactor core parameters, in­cluding temperature feedback, is very similar to that already described in Section $.5.3 for a decrease in gas flow, only the detailed time constants differ. Thus all the remarks made in Section 5.5.3 about arresting the rise in temperature, avoiding over-correction, etc., also apply in this case. The main differences are that the time constants relating the initial disturbance to the effects on fuel and moderator temperature are noticeably shorter, also there is a reactivity advantage in this case because the average moderator temperature (at constant reactor gas outlet temperature) is higher due to the increase in reactor gas inlet temperature.

It is this reactivity advantage which is of value in situations w’here the reactor is in danger of shut­ting down due to ‘temperature poisoning’ as described earlier in Sections 5.5.2 and 5.5.3 of ihis chapter. ‘Temperature poisoning’ is normally associated with an uncontrolled reduction in the temperature of the moderator in a magnox reactor coupled with an in­adequate release of reactivity from the available con­trol rods. ‘Xenon poisoning’ is normally associated with an increase in xenon worth due to a reduction in neutron power coupled with inadequate reactivity available from the control rods. In these cases a deliberate increase in the reactor gas inlet tempera­ture will provide additional positive reactivity from the consequential increase in moderator temperature. Note that this strategy applies equally to AGRs and magnox reactors, although AGRs are much less likely to have inadequate reactivity and are therefore much less likely to require this strategy.

On reactors with auto control loops on reactor gas inlet temperature, the reactor control engineer needs only to change the demanded temperature on the controller; the controller will then adjust the boiler feed flow or gas flow as appropriate to the particular station in order to achieve the desired effect.

On reactors w’ithout this auto control loop, i. e., magnox reactors with drum boilers, the usual method of raising reactor gas inlet temperature is to increase the operating pressure on the steam side of the boiler by reducing the throttle valve opening on the main turbine(s). The increase in LP steam pressure has the most noticeable effect, because the LP evaporator tubebank is towards the bottom of the boiler and therefore has a dominant effect on the gas tempera­ture at the exit from the boiler. On some stations the LP and HP steam admissions to the main turbine(s) are regulated separately, in these cases only the LP throttle valves need to be adjusted. At Berkeley the HP and LP throttle valves are linked so that in normal load changes such as reactor start-up the reactor gas inlet temperature is maintained constant; this is normally an advantage. At Dungeness A an increase in LP steam pressure will cause the steam — driven blowers to slow down unless HP steam pres­sure is also raised to maintain the HP-LP pressure ditferential across the blower turbines.

In changing the reactor gas inlet temperature at any station, note is taken of any restrictions on the rate of change of this parameter as described in Sec­tion 5.3.3 of this chapter.

On magnox stations with drum boilers, great care is taken in applying this strategy because the cumu­lative time constants are large and therefore there is a deceptively long time delay between the initial action in adjusting the main turbine throttle valves and the final result of an effect on neutron power. As mentioned previously, good training is important to equip operating staff with the necessary skill and knowledge to deal with such a situation, because it rarely occurs in practice.

An interesting strategy is sometimes adopted at Old­bury (magnox reactors with once-through boilers). The normal method of carrying out a substantial controlled load reduction is to reduce gas flow at constant tem­perature. Reference to the formula at the beginning of Section 5.5 shows that a reduction in power can also be achieved by increasing the reactor gas inlet tem­perature while gas flow and reactor gas outlet tem­perature are maintained constant, and this method is sometimes used at Oldbury, for example, if it is anti­cipated that in a planned load reduction xenon over­ride may be a problem. The increase in reactor gas inlet temperature is achieved by increasing the de­manded value on the associated auto controllers which respond by decreasing the LP boiler feed flows. Re­actor gas outlet temperature is held constant by the associated auto control system. To maintain the re­gulating rods within their useful operating range the bulk rods are inserted to compensate for the positive reactivity arising from the increase in moderator tem­perature, and this provides the improved override ca­pability for the ensuing xenon transient. Increases in reactor gas’inlet temperature of up to 40-50°C have been applied for this purpose, for example, to permit a reduction in turbine load for on-load condenser cleaning. The method was used to great effect on one occasion in April 1981 when disturbances on the Na­tional Grid required Oldbury’s generation to be re­duced to about 30% of normal full load in order to match the demand of the Bristol area. The load re­duction was achieved by a combination of reducing blower speed and increasing temperature, and the ne­cessary load changes throughout the day to match the demand of the Bristol area were made by changes in blower speed. This included a period when further grid connections left Oldbury alone supporting the Bristol area load and regulating the local frequency by blower speed changes until grid connections were restored.

Regular visual checks of the reactor temperature pattern must be made, usually at a maximum of two hour intervals. Sufficient instrumentation is provided to give a general picture of the temperature distribu­tion through the fuel, graphite, core restraint, core support and pressure vessel. Regular visual checks are usually an Operating Rule condition and when used by an experienced operator will identify any irregu­larities early before problems arise. It is the duty of the operator also for commercial reasons to run his plant at maximum generation. He will be looking for hot zones which in themselves may restrict general temperatures to avoid exceeding limits imposed by the operating documents.

The limiting operating temperature for both mag — nox and AGRs is determined by the transient rise that would occur following a rapid loss of coolant. The transient rise must not give a probability of fuel failure or melting greater than 1 in a 100. The high capital cost of nuclear plant makes it implicit that the maximum output from the reactor must be achieved bearing in mind the safety of the fuel.

Mention has been made of the cross-pin temperature gradients which exist in CAGRs. In general these are such as to produce cross-pin temperature differences of up to 30°C, though the exact value varies from ring to ring and even changes direction part way up the channel. This temperature gradient is believed to be the primary cause of pin bowing (Crossland, 1982 [12]). At clad temperatures below about 650°C axial creep elfects are negligible and the main cause of pin bowing is differential thermal expansion (thermal bowing) of the pellet stack and/or the clad. Such bowing is restrained by the grid and braces which cause the pin to be stressed; it is the relaxation of these ‘■tresses v-hich makes the bow permanent.

In this type of bow the hotter side of the pin be — vomes convex. Since this reduces the cross-sectional area available for coolant on this side of the pin, the v’ltect is to further increase the cross-pin temperature difference, i. e., positive feedback occurs. Fortunately the design of the fuel is such that thermal bows, even including feedback, are very small in CAGR.

At higher clad temperatures (typically in the upper half ot the fuel stack) the main source of pin bow­ing is differential creep shortening. As already men­tioned, creep shortening is the process whereby axial creep occurs at inter-pellet gaps. If there is a cross — clad temperature difference, this process will occur more rapidly on the hotter side, so that the inter — pellet gaps will become wedge-shaped and the pin will bow. The process depends upon there being sufficient numbers of inter-pellet gaps and high enough tem­peratures to produce axial creep. These provided, the potential for pin bowing is much greater than with thermal bowing, although there is a major difference: in the case of differential creep shortening, the hotter side of the pin becomes concave so that the bowing itself tends to reduce the cross-pin temperature dif­ference, i. e., negative feedback occurs. This ensures that such bowing is self-limiting and relatively benign.

At burn-ups beyond about 10 to 15 GWd/t differ­ential fuel swelling (due to the inexorable production of solid fission products) takes over from differential creep shortening as the major source of pin bowing. This produces a small but steadily increasing pin bow which is directed outwards towards the graphite sleeve.

Having discussed the main features of, and require­ments placed upon, the RCS chemistry, it is appro­priate to identify a typical primary coolant specifica­tion as given in Table 1.25. The following additional comments can be made:

• The electrical conductivity will be determined by the concentration of boric acid and lithium hydroxide.

• Similarly, the pH will be determined by the con­centration of boric acid and lithium hydroxide and will be maintained at 6.8-7.0 at normal operating temperatures in the primary coolant. [13] centration maintained in the coolant, the residual oxygen will not exceed 0.005 ppm.

• The chloride and fluoride concentrations are main­tained below the maximum regardless of system status and temperature. Chloride and fluoride are always regarded as potentially detrimental to aus­tenitic stainless steels, and in addition fluoride is limited in order to preclude attack of the zircaloy clad.

• The hydrogen level is controlled by means of the hydrogen overpressure at the volume control tank.

• Suspended solids are determined by filtration through a 0.45 цт pore filter, and are an indication of the circulating corrosion product level and the potential for fuel clad fouling.

• Thermal and hydraulic conditions in the core can result in a limited degree of sub-cooled nucleate boiling-heat-transfer. Alternatively, excessive par­ticulate deposition from single phase heat transfer in the presence of high impurity levels can also ini­tiate boiling-heat-transfer. In either case boiling heat transfer will be conducive to deposition and if magnesium, calcium, aluminium and silica are pre­sent they will be incorporated into the deposit. This will result in densification of the deposit, increased loss of heat transfer and an increased potential for high lithium hydroxide concentrations at the clad surface with a resulting corrosion risk.

Core reactivity, and hence reactor power, is controlled by vertical movement of neutron-absorbing material into and out of the reactor core. Control rods in the form of straight steel tubes about 7.6 mm in diameter and about 6.1 m long provide this neutron absorbing material. The control rods are suspended above the core and can be lowered or withdrawn at a steady controlled rate into vertical channels of circular cross — section, uniformly distributed across the core, when required to effect changes in reactor power or shut­down. They are designed to fall under gravity when the reactor trip system is operated or upon loss of electrical supplies, The rods are subdivided into a coarse control rod system and an automatic zone or sector control rod system. Coarse rods have a large neutron absorbing capacity and are termed black rods, whereas the zone (sector) rods have a lower neutron absorbing capacity and are termed grey rods.

Typically, an average sized magnox reactor will have about 100 coarse control rods, normally separated into four lifts, with the core divided into eight to twelve

es each with additional four auto-control rods. A Z°Паrate group of coarse rods provide an additional futdown capability against the unexpected or par — . iar fau[t conditions. These rods are termed safety ‘ods and at Wylfa, for instance, are incorporated into V, m of the coarse control rod system.

01 coarse control rods contain boron steel inserts in — dc the steel tubes absorbing virtually ail incoming neutrons. Because of this affinity for neutrons the 1 nserts are sheathed in steel cylinders to prevent the ossiblc spread of boron steel particles with subse­quent poisoning of the reactor. The bulk of the re­actor control rods are of this form, being manually operated and used during start-up to produce criti­cality and thereafter to raise power steadily to op­erating levels. They hold sufficient negative reactivity to maintain the reactor sub-critical under all normal operating conditions. Safety rods provide additional shutdown capability should some unexpected devia­tion in power occur. They are normally held in re­serve for unexpected divergence during shutdown when the coarse rods are fully inserted. At Wylfa a selected group of centrally placed rods, forming part of a lift of the coarse control rod system, are available for use as a radial trim facility. At other stations, zone rods (erey rods) perform this function. These trim rods, together with absorber channels, are used to flatten the flux distribution across the core and hence allow a larger number of channels to operate at peak rating, thus increasing the reactor power.

Auto-control zone rods do not contain the boron steel inserts since such powerful neutron absorption is not required for the function of these rods, which are under automatic control when the reactor is at power. The zone control rods within a zone operate as a group independently of other zones to compensate for a change in the gas outlet temperature of the zone. They may also work in a ganged way: for example, an increased demand for power from the turbine — generator leads to a fall in steam pressure, and then by operation of the automatic overall control system to an increase in blower speed. This in turn leads to an increase in coolant flow and a decrease in reactor gas outlet temperature. Selected rods within all the /ones (the auto-control zone rods) then move out together to maintain gas outlet temperatures constant. The boron-10 isotope, which is present to about in naturally-occurring boron, is the effective neutron absorbing material in the boron insert since its neutron capture cross-section is many orders of magnitude greater than that of the more abundant boron-1]. However, helium and lithium are formed vdien boron-10 captures neutrons. This leads to inter­nal stresses and a tendency to swelling of the insert in the control rod after high irradiations. Significant control rod damage has been found to occur when die amount of boron-10 burnt up in any part. of the rod is about 1 To by weight of the rod material. Since straightness of the control rod is of paramount importance in ensuring ease of entry of the control rod into the core only minor rod distortions can be tolerated. Hence there is little point in using concen­trations of boron-10 greater than 1% or of natural boron greater than 5.5%. Boron inserts containing about 4% natural boron are used widely in the UK and give an adequate in-pile life,

A shock absorber in the form of either a broach, whose cutting action is arranged to give a smooth deceleration, or a collapsible tube is incorporated at the bottom of the control rod to prevent damage to permanent parts of the reactor should a control rod be dropped accidentally. Neutron absorption and gam­ma irradiation cause heating of the control rods and they have to be cooled to remove the heat generated, the cooling flow being restricted to the minimum in order to reduce gas circulator power. Because of the radiation levels involved, it is customary to make provision for removing the complete control unit as­semblies (including rod, shield plug, cable and drive) for servicing in a remote handling facility whilst the reactor is on load.

A typical control rod installation is shown in Fig 2.21. In order to carry out shutdown of the reactor when required, the control rod mechanisms (actua­tors) are designed so that, when de-energised, the con­trol rods fall rapidly into the core under the action of gravity. This is achieved by hanging the control rods from a winch driven by a synchronous motor with a low gear ratio, so that the weight of the rod can rotate the de-energised motor in the event of a trip.

The control rod mechanism (actuator) is locked on to a standpipe on the top of the reactor and forms part of the pressure vessel, the electrical connections being taken out through pressure seals. The control rod standpipes pass through the biological shield and must, therefore, be fitted with concrete shield plugs to preserve the integrity of the shield. As much as pos­sible of each control rod unit is on the inactive side of the shield plug, the cable or chain from the rod passing through the plug to the drive. However, the drives work in pressurised carbon dioxide in a very dry atmosphere, and the lubricants used must be suit­able for these conditions. The control rod mechanism presents a low inertia to the rod under trip conditions giving fast acceleration into the core for emergency shutdown. The maximum speed of fall is limited by regenerative braking either in the driving motor or in brake discs rotated within the poles of a magnet.

To restrict the rate of rise of reactor power to a safe value, the control rod drive motors and power supply system are designed so that the motor speed cannot exceed the maximum design value even under fault conditions. This is achieved by using synchro­nous motors supplied from high integrity low frequen­cy generators with a design frequency in the range of 0 to 2 Hz.

In steel pressure vessel stations secondary shutdown units are fitted to the top of some control rods. In

Fits. 2.21 Typical control rod installation

the event of sudden depressurisation, the suspension

bie is released and the control rod falls rapidly under free-fall conditions to shut the reactor down as quickly as possible.

Boron-ball emergency shutdown devices have been installed in each of the steel pressure vessel magnox reactors. These rapid, though short term, shutdown devices eive an additional protection to the reactor should insufficient control rods enter the core in the eent of a depressurisation by fracture of a top or bottom duct. The devices are automatically initiated by rate-of-change in gas coolant pressure. These additional devices acting alone will give prompt inser­tion of sufficient negative reactivity to control the immediate fuel temperature transient and to prevent reactor divergence for some hours after shutdown. They are intended to provide an additional lirtife of protection to the more conventional shutdown systems.

Essentially the device consists of a tubular hopper suspended immediately above the reactor core and filled with boron steel balls. At Bradwell and Dun — eeness At the balls are retained within the hopper by a mushroom valve which is held in the closed posi­tion by an electromagnet at the top of the stand­pipe operating through a connecting rod. Tripping of the electrical supply to the magnet allows the valve to open and the balls to pour into a thimble tube situated within a reactor channel. At other magnox stations the actuator for opening the mushroom valve is based on a mechanical ball latch, which is op­erated directly by the rate-of-change of pressure across the length of a bellows unit. This device is a self — contained unit mounted within the standpipe.

A typical design at a magnox station would consist of 16 to 24 shutdown devices per reactor. Each tubu­lar hopper, made from 127 mm diameter tube and about 2.13 m long, has a capacity of 113 kg of boron steel balls. The hopper is suspended inside a guide tube which is attached to a refuelling standpipe shield plug extension and locates into a reactor fuel chan­nel containing the thimble tube. The use of a fuel charge/discharge standpipe location makes the guide tube necessary since on-load removal and replacement of the shutdown device is necessary to facilitate re — luelling of the surrounding channels; the design of guide tube ensuring both shielding of the tubular hop­per from the gas forces and location into the reactor channel.

In addition, each magnox reactor is now fitted with a boron dust injection facility which provides a means of injecting neutron absorbing powder into the core as an ultimate shutdown system. This system once initiated cvould ensure that complete and permanent shutdown of the reactor would occur.

Two powders are employed in the injection pro­cess. The first powder to be injected would be boron inoxide (В; О і), which softens and sticks to the chan­nel components at temperatures in excess of 300°C and therefore acts as an adhesive for the second powder. This is boron carbide (B4C) which is the major neutron absorbing material. The injection faci­lity consists of mobile injection units which can be connected, under clearly defined managerial control, to permanently installed pipework leading to the gas coolant circuit. A common design of building is em­ployed at all magnox stations to house all the equip­ment necessary for powder injection with the excep­tion of the permanently installed pipework.

Simple redundancy and diversity increase the pro­bability of success of tripping. To prevent a reactor trip resulting from a single equipment fault, coincident logic is used so that at least two channels must be in the tripped condition before a reactor trip is ini­tiated; the minimum arrangement for redundancy is therefore ‘2 out of 3’ logic. Such a group of trip channels is termed a ‘trip group’. The logic scheme is illustrated in Fig 2.57 for a relay ‘hammock’ circuit.

POWER SUPPLY

A

T ж t 2.Ш

The trip outputs of all trip groups are brought together in logic trains termed ‘guard lines’. In the later stations, each trip group operates into each of three or four guard lines by a separate set of lo­gic, so that when two trip channels in any one trip group go to the tripped condition, all guard lines are tripped, but if two channels in separate groups go to the tripped condition, the guard lines do not operate; this reduces the probability of spurious trip­ping, The guard line outputs are combined in ‘2 out of 3’ or ‘2 out of 4’ logic to actuate the reactor shutdown systems. This scheme is illustrated in Fig 2.58.

The redundancy and diversity requirements neces­sitate the provision of tW’O different trip groups of ‘2 out of V logic for each reactor fault, and with in­dividual trip channels designed for high reliability an adequate standard of protection is achieved (Fig 2.59).

2A1 2A2 201

-tXCh

292 2C1 2C2

■ CONTROL ROO SUPPLIES

FiG. 2.58 Basic ‘2 out of 3’ trip system in reactor guard lines

This is not difficult to achieve with two separate trip groups for each reactor fault. A further criterion is that the protection shall operate in the presence of any two simultaneous random faults on the trip sys­tem, and this also is satisfied by having two trip groups per reactor fault.

Where the provision of two diverse ‘2 out of 3’ trip groups is impracticable, it may be permissible to use a single ‘2 out of 4’ group if the frequency of the protected reactor fault is very low. This arrangement complies with the two-fault criterion, but does not satisfy the MO-7 per demand’ requirement, as the possibility of common-mode faults would not permit a reliability of better than 10~4 per demand to be claimed for a single non-diverse trip group.