For operational control and accounting purposes, the station requires a system which monitors the loca­tion and condition {i. e., irradiation, rating, dwell time, etc.) of all fuel on site, whether in the reactor, store or ponds. In addition, the station site licence and international regulations impose formal requirements. In order to fulfil all the various needs and obliga­tions, comprehensive record-keeping systems have been developed and at each station the systems fall into two categories. Firstly, a iocat fuel route paperwork system ensures adequate standards of control over the various fuel movements, thereby involving an amount of recording and checking. Secondly, a highly sophis­ticated computer-based system, in addition to record­keeping, provides other importance information such as calculated isotopic content data of irradiated fuel elements prior to their despatch from site. This in­formation is required by BNFL and also by Euratom and the International Atomic Energy Agency in sup­port of international safeguards work. Also contained within the computer-based record system is fuel cost data which is regularly updated so as to assist the CEGB in meeting its obligation to supply electricity economically.

8.4.1 Fuel records system

In order to apply administrative control over the han­dling and movement of fuel within the fuel route, more than 60 forms have been designed for use at the job. This paperwork constitutes the fuel route record system in which the important fuel manoeuvres may only take place following the issue of the rele­vant form, suitably authorised by approved signatories. Many of the forms require certain checks and re­cords to be made at given limes during the different operations. The diversity and complexity of this paper­work system is far too detailed to w-arrant a full description here, but it is nevertheless important that its existence and overall objectives are understood. The life of each fuel element, once it has been re­ceived on site, is also monitored and recorded by com­puter at the CEGB’s computing centre in London, using a complex programme called FULER. This par­ticular programme is part of a much larger suite of programmes known as ADOS (AGR Data Operating System), the function of which is to model each re­actor core as irradiation accrues and refuelling takes place so that various operating parameters such as can temperatures, channel powers and element irra­diations can be calculated. Although FULER per­forms several functions within this larger network, the maintenance of fuel records is its main task and much of the data required by the program is extracted from the fuel route paperwork system just described. FULER performs its record updating by using a sim­plified computer model of the fuel route so that elements are moved, within the records, between fuel store, reactor channels, buffer storage tubes, and skips in the ponds from which they are eventually des­patched in flasks, all movements taking place soon after they actually happen in practice. This is achieved
by specifying within each FULER run, details of re­fuelling, stringer dismantling and other fuel move­ments as soon as the relevant information becomes available from the fuel route paperwork system.

As also happens with magnox fuel records (NFER), FULER will provide an isotopic inventory (i. e., ura­nium and plutonium isotopic weights) for discharged fuel, according to its initial enrichment and the irra­diation it has received. Once a skip has become fully loaded within the records, the program automatically computes the necessary information for the entire skip contents by referring to the isotopic data which is stored elsewhere. A packing sheet is then generated showing the isotopic weights for each element in the skip.

At approximately monthly intervals during reactor life, all the FULER files comprising the fuel records are interrogated via a powerful information system so that routine checks and printouts can be made of the contents of the different parts of the records. Comparisons are then made with the results of a physical count (audit) of fuel elements at the various locations on the station to ensure that the records system is accurate. Typical data stored for each ele­ment within the records include identification number, reactor channel and axial position, uranium weight, discharge irradiation, loading and discharge dates.

This part deals with the dose assessment of workers and the arrangements between the dosimetry services and the employer. The CEGB runs its own dosime­try services from each of the nuclear licensed sites. Where further more-specialised techniques are required (for example, whole body counting) outside agencies are employed.

This part deals also with the health monitoring of radiation workers, and requires that medical records are kept.

Part 5: Arrangements for the Control of Radioactive Substances

This part deals with how the radioactive material is used, accounted for, and transported. It further deals with the prevention of radioactive material from entering the body of a person, and requires that wash­ing facilities and personal protective equipment are provided.

The fuel in a PWR is uranium dioxide in the form of solid pellets about 13.5 mm long and 8.2 mm in diameter. These are contained within zircalloy-4 (an alloy of zirconium) tubes about 3.7 m long, the full length of the reactor core. A fuel assembly consists of 264 of these tubes or pins, together with 25 other tubes used variously to guide absorber rods (control rods) or to house instrumentation, and are arranged in a 17 x 17 square array. There are about 193 such assemblies in the reactor core. The uranium is en­riched in the isotope U-235 to overcome the reactivity taken up by the natural (light) water which, unlike magnox and AGR reactors, acts both as coolant and as neutron moderator. The zircalloy is not itself a significant absorber of neutrons. The neutron absorber boron, in the form of boric acid, is added to the water coolant so that its concentration can be steadily decreased to compensate for loss of reactivity as the fuel is irradiated.

In common with other reactor types, fission pro­ducts are produced during irradiation. The majority of these, under normal conditions, remain trapped within the fuel pellets but a fraction of them escape into the narrow gap between the pellet and the zirc — ailoy clad, and between the slightly concave ends of the pellets themselves. An additional source of radio­activity which has to be taken into account, is that arising from corrosion products which become acti­vated by irradiation as they are carried through the core by the coolant. It is ultimately the purpose of the fault studies to show that the dose received as a consequence of release of some of these radioactive materials is acceptably low given the predicted fre­quency of occurrence.

Fault categories considered are as follow-s:

• Inadvertent reactor trip.

• Increase in heat removal by the secondary system.

• Decrease in heat removal by the secondary system.

• Electrical supply system faults.

• Decrease in coolant flow in the reactor coolant system.

• Reactivity faults.

• Pressure transient induced by changes of reactor coolant inventory,

• Decrease in reactor coolant inventory (loss of coolant).

• Anticipated transients without trip (ATWT).

• System-related faults.

• Radioactive releases from systems not within the nuclear steam supply system.

• Internal and external hazards.

From these broad categories a detailed schedule of initiating faults is drawn up and contains some 130 faults. Fault sequences, i. e., an initiating fault fol­lowed by other independent failures, are then identi­fied which are within the design basis; essentially those with a predicted frequency of more than about 10 ^7/ year.

To avoid the need to carry out transient analysis for every fault sequence, a prohibitive task, bounding faults or limiting design basis faults are selected. The selected sequencies are those which lead to:

(a) The most onerous demands on plant components such as the containment and pressure vessel, or

(b) The most onerous demands on the reliability of safeguards systems, or

(c) The potential for the largest release of radioactivity to the environment.

Transient analyses are carried out for the identified limiting design. The transients are assessed against defined limits, as relevant to (a), (b) or (c) above. The limits depend to some extent on the fault being considered. For example, for ‘frequent’ faults (defined as initiating faults of frequency in excess of 10 _3 per year — for which diversity of protection and safeguards systems is generally provided), it is ne­cessary to show that fuel clad failure will not occur. For less frequent faults (‘infrequent faults’), clad fail­ure is acceptable provided the fuel itself does not fail disruptively such that ability of the core to be cooled could be affected. The limits for the latter in the case of loss of coolant accidents, for example, are that the peak clad temperature does not exceed 1204°C (2200°F), that oxidation of the clad at any point does not extend beyond 17°7o of the clad thick­ness and that not more than l^o of all the clad in the core is oxidised. These limits ensure that significant embrittlement of the clad does not occur and that hydrogen production is insufficient to lead to an ex­plosive concentration.

In principle, the categories of faults that require assessment for a PWR are similar to those for mag — nox and AGRs. However, the behaviour of the PWR is, in general, very different because of the funda­mentally different design and the fact that the water coolant can change phase and become steam if pres­sure is reduced, the change in phase causing a rapid decrease in heat transfer from fuel to coolant. In simplified terms the characteristics of faults are de­scribed in the following paragraphs.

Shielding against radiation from the irradiated fuel elements is provided by storing the elements under pond water, typically of 6 to 7 m in depth. Controls are applied to the stacking of fuel skips, this being normally limited to double stacking. Interlocks on the pond cranes and other equipment limit the height to which the fuel skips and individual elements can be raised during transfer and handling, such that an ade­quate depth of water for shielding, i. e., about 3.7 m, is always maintained.

At those stations where the fuel transport flasks are loaded in the pond, there are interlocks to prevent the flask being raised without its lid.

Other precautions include installed instruments such as high and low pond water level alarms, and gamma radiation monitors. Anti-syphon precautions are com­monly included in pond water treatment supply or delivery lines. Strict health physics controls are applied to the removal of items from the ponds.

Internal shielding walls fitted with stop gates enable the various working areas of the pond to be segregated and drained for maintenance work.

OSC controller

Once the OSC has been declared fully operational the OSC controller would have the following respon­sibilities:

• The overall direction of off-site radiation moni­toring.

• Advice to the police and local authorities on any actions necessary for the safety and welfare of the public.

• Liaison between the site emergency controller and all outside organisations providing advice and as­sistance.

• Liaison with the Department of Energy nuclear emergency briefing room.

• Liaison with the Nil emergency centre.

• Liaison with CEGB headquarters via the nuclear emergency information centre.

• Liaison with, and advice to, the representatives of central and local government departments and agencies present at the OSC.

• The dissemination of information to the public and the news media via the press briefing centre.

The CEGB Health and Safety Department representatives

The Director of Health and Safety, together with the Principal Health Physicist and Principal Inspector would be available to advise the OSC controller on all aspects of nuclear safety with particular reference

to:

• Health physics aspects of the emergency with par­ticular reference to the coordination of actions ne­cessary for the protection of the public and for the assessment of population dose.

• Licence requirements.

• Emergency plant operation.

The Director of Health and Safety would also assist with the preparation of press statements and with media briefing.

Government technical adviser (GTA)

When appointed by the Department of Energy, the responsibilities of the GTA (see Section 6.3.3 of this chapter) would include:

• Briefing government officials at the OSC and in London on the course of the accident.

• Liaison with the OSC controller and representatives of all local and central government departments and agencies at the OSC.

• Advice to the police and local authorities.

• Acting as principal government spokesman at press conferences and media briefings.

• Giving the ‘all clear’ for people to return home.

Although it would be inappropriate to devote too much time at this juncture to a detailed description of the AGR, a brief review of some of the funda­mental design concepts are crucial to a clear under­standing of the function of the fuel cycle. Much of the following relates specifically to the AGR design at Hinkley Point В, on the basis that any minor de­partures from it for other AGR stations will be un­important — the principles will be the same.

A typical AGR core consists of a graphite cylinder of approximately 10 m diameter perforated by some 300 or so fuel channels, each about 300 mm in dia­meter, the interstitial positions being occupied by the control rods. The fuel elements themselves are each approximately 1 m long containing 36 stainless steel clad fuel pins located inside a double graphite sleeve. In order to ease the refuelling process the AGR has been provided with single channel access, enabling each fuel assembly to be charged to the reactor via its own standpipe. Each fuel assembly consists of a plug unit, comprising closure unit, gamma shield plug and gag unit, connected to eight fuel elements by a stainless steel tie bar. At its upper end the plug unit is used to seal the standpipe and lower down it con­tains an adjustable gag for controlling the gas flow in the channel. The composite, which can be handled as one entity by the fuelling machine, is some 25 nt in overall height and is called a ‘stringer’, each reactor contains some 300 fuel stringers.

As was common practice with earlier reactor de­signs, the AGR control rod system has been subdivided into groups of coarse (black) and fine or regulating (grey) rods, each with their own separate tasks. A total of 81 rods provide the 44 coarse rods used during start-up and power raising and normally fully withdrawn thereafter, and the 37 regulating rods which offer fine control and are normally partly inserted during operation. It is the regulating rods, whose task is to help maintain control over the radial power distribution during all stages of reactor operation (i. e., start-up, steady power running and refuelling) and so importantlv linked to the fuel cycle, which are of prime interest here. Each is located on a ‘1 in 8’ channel array in interstitial positions (Fig 3.48) and

Fic. 3.48 Regulating rod array
Arrangement of the regulating control rods in
interstitial positions on a 4 in 8’ fuel channel array
provides for a good degree of control over the local
power distribution. The automatic control system
regularly scans the gas temperature conditions in each
of the eight channels in a control ‘box’ and adjusts the
axial position of the rod accordingly.

responds automatically to eight channel gas outlet temperatures in surrounding fuel channels. With this arrangement four fuel channels are situated adjacent to the rod itself, the other four being equidistant from two rods, thus providing a good degree of local control. During operation the axial positions of the individual regulating rods vary from between 15% and 85% penetration, with a mean position, under ideal conditions, of close to 50%. There is a tendency for rods to be well withdrawn when local refuelling is due.

Annual monitoring and control of the effects of oxida­tion has produced information which is included in basic ‘ground rules’ covering the following topics:

• Oxide growth predictions at varying temperatures and gas compositions for a range of steels.

• The effects of coatings and surface treatments.

• Methods of assessing silicon content of materials, where this is unknown.

• Calculation methods for oxide growth in assemblies.

• Calculation methods for strain in assemblies.

• Calculation of bolt failure probability, thread disengagement and weld cracking.

Using the ground rules, calculations of the effects of oxidation on individual components are made, typical examples being:

PROTECTIVE STAGE

Oxide is a dense, even, dull gtey in colour. Very adherent, almost pure magnetite (FEjO.) Oxide growth roughly follows parabolic law, i e

w’ ■ к twhere n>2

Rate constant k) not closely related to gas pressure CO content, water content, or silicon content of steel Shot blasted surface has slightly higher rate than a poiisneo surface

Rale constant roughly increases with temperature Duration of this stage is much more sensitive to material and environment than rate constant.

Duration is inversely related to temperature, motslure. CO and surface roughness

Application of etch primer eg PA 21 can reduce length of protec live stage

BREAKAWAY STAGE

Further oxides grow through ano above protective

layer Excrescences which started at transition stage

are linked up over whole surface

Rough granular porous oxide. Cracks form m oxide ai

edges especially on lew silicon steel Films generally

vey aahereni until weight gams very high —

kOmgfcmr

Growth virtually linear

W = W,* kit-t. l

Rate constant increased Dy temperature, moisture, pressure and reduced by silicon content of steel Surface iinish has no effect on breakaway oxioatton rate.

Oxide contains about б^о by weight of caroon ie an approximate equi-molar mixture

Fig. 3.70 Stages of oxidation

• Bolted joints of charge pan structure or support systems within the reactor.

• Joints and linkages of core and charge pan support

structure.

• BCD and thermocouple supports throughout the reactor.

• Support structure of boiler units.

• Clearances of moving surfaces and assessing their effectiveness.

• Weld assessment.

For all these items, the material analysis and dimen­sional data are stored in a computer program. With the addition of the predicted oxide thickness, a strain and iailure probability is calculated for every compo­
nent. Annually, all the results are presented to the Nil in a document known as The Part 1 Oxidation Assess­ment which covers all reactors on each site.

This document is followed by the Part 2 Oxidation Assessment. In it, the practical consequences of the failure of any item shown to be suspect in the Part I Assessment are evaluated, i. e., the debris hazard, the loss of integrity of loss of movement are all considered as necessary (Figs 3.75 and 3.76). It is normally possi­ble to demonstrate that even where failure probabilities are quite high, there is either sufficient redundancy in the structure to cope, or the effects of failure are negligible.

From the beginning of the nuclear power programme in the United Kingdom, the development of nuclear generating capacity was accompanied by a clear percep­tion of the associated nuclear risks. In particular the CEGB recognised that the many factors involved in assessing the design and operation of a nuclear power reactor were both wide ranging and complex, and as a result decided to set up a completely new department independent of design, construction or production line — management with the following responsibilities:

• To provide independent, dispassionate and objective assessment of the nuclear safety of plant and pro­cesses on the CEGB system where potential hazards might arise, and to help ensure that adequate pro­vision for safety is made in the design, construction, commissioning, operation and decommissioning of nuclear plant. [40] standards of radiological protection. To provide independent scrutiny and surveillance as necessary. In addition, the department acts as a channel of communication through which the technical aspects of undertakings or obligations on nuclear health and safety matters on nuclear licensed sites are ne­gotiated with the Nuclear Installations Inspectorate and the authorising Government Departments.

The department, set up in 1959, was initially entitled The Nuclear Health and Safety Department but, fol­lowing the Health and Safety at Work Etc. Act 1974, its responsibilities were broadened to include conven­tional safety and its title was changed to Health and Safety Department.

In 1987, following the reorganisation of the CEGB, a Corporate Health and Safety Department was formed by bringing Regional Medical Advisers, Regional Safe­ty Advisers, Regional Fire Officers, and their respec­tive staff, under a common line management with the existing CEGB Headquarters Health and Safety Department. The Corporate Health and Safety func­tion was also made functionally responsible for Health Physicists and Accredited Radiological Safety Advi­sers assigned to specific locations throughout the CEGB, although such personnel remained under the line management control of the appropriate Divisional Directorate.

The Health and Safety Department is now the cen­tral and independent authority within the CEGB on all aspects of health and safety. It makes full use of expertise within the Health and Safety function else­where within the CEGB and external to it.

The role involves gathering information, formulat­ing policy and setting standards, negotiating safety requirements with the appropriate authorities, provi­ding expert guidance, and monitoring performance. The objective throughout is to provide a robust frame­work within which all levels of line management and each employee can discharge their primary respon­sibilities for health and safety.

The department is headed by a Corporate Director who is directly and immediately responsible to the Chairman of the CEGB on all significant safety mat­ters, particularly in the nuclear field. Whilst the func­tion of the Corporate Director and the department is advisory, with no executive authority, it is necessary for locations to obtain HSD agreement on any matter involving nuclear safety before formal approval is requested from the regulatory authorities, thus pro­viding effective independent control.

The HSD organisation is set out in Fig 4.2 and consists of five branches, each led by a branch head. They are; Nuclear Safety Operations, Nuclear Safety Development, Medical, Industrial Safety, and Health and Safety Strategy Branches. The department’s com­plement is some 186 qualified scientists and engineers who carry out safety assessments on all aspects of

design and operation. Included in this number are the field officers as mentioned above and the nuclear inspectors who are permanently sited at the nuclear power stations and Berkeley Nuclear Laboratories who provide independent, unbiased and informed scrutiny of all activities affecting nuclear safety. The terms of reference of the branches are as follows.

Late somati^g£fects are those which manifest them­selves in the5^dividual exposed years after the ori­ginal exposure. The latent period is much longer than for the acute radiation syndrome and is found to be inversely proportional to the absorbed dose. This de­layed response may result from either acute or chronic exposure.

Among the most important late effects are cancers, life span shortening, genetic mutation, embryological

effects and cataracts.

The late stochastic effect of cancer induction is now considered to be the controlling effect in the deter­mination of radiation exposure limits, consequently its study has greater significance to radiological pro­tection than the more dramatic effects of the acute radiation syndrome.

There is no unique disease associated with the long term effects of radiation. The effects express them­selves in human populations as a statistical increase in the incidence of certain already-existing conditions. Because of the low normal incidence of these con­ditions it is usually necessary to observe large popu­lations of irradiated people in order to measure the increase, using statistical and epidemiological tech­niques. In addition to the large number of people needed for the sample, the long latent period provides an added complication which necessitates long term studies.

The commissioning of a nuclear power station extends from late in construction until full commercial op­eration is achieved. It is the process of setting the plant to work, providing evidence (as far as practicable) that the construction has been correctly carried out and that the design intent is met. It is also necessary to make certain that testing is sufficiently compre­hensive to demonstrate to the Licensing Authority that the plant is safe to operate and ensure that at all times during the commissioning process the appropriate safety constraints are observed. The administration of commissioning for a new power station in the CEGB is laid down in the ‘Plant Completion and Station Commissioning Procedure for New Power Stations’. However, for nuclear power stations there are also statutory requirements.

The site licence requires the licensee to set up a committee, known as the Station Commissioning Com­mittee (SCC) to administer the testing. There is also a requirement to divide the commissioning programme into stages which reflect the increasing nuclear safety implications in progressing through fuel loading, initial power raising and finally to full power operation. The licensee is not allowed to proceed from one stage of the commissioning programme to the next without the

explicit consent of the Health and Safety Executive <HSE).

The SCC is usually set up some two years before the expected fuel loading date. It is chaired by the station manager and has representatives from the con­tractor, GDCD design and project management, the health and safety department, the headquarters opera­tions department, the research department and the staff from the region in which the station is being built.

A second committee is also set up, the Plant Com­pletion Committee (PCC) responsible for ensuring that the preliminary testing of plant items is correctly carried out. The PCC is not specifically mentioned in the site licence but clearly is extremely important in laying the ground work for the activities of the SCC. It is chaired by the project manager who is respon­sible for the construction of the station and has a more site-orientated representation.

The SCC calls for Papers of Principle to be writ­ten for all the testing required and gives these papers its formal endorsement. These documents, which may also cover the PCC tests, are then furnished to the HSE. Detailed test schedules are drawn up which provide the step by step instructions to the commis­sioning team based on the principles already endorsed.

The detailed schedules for the PCC tests are en­dorsed by the PCC and those for the SCC tests by the SCC. As each test is finished, a Test Completion Certificate is drawn up and signed by representatives from the contractor and the operators. Where the test is more than a simple set of checks ticked off on a check sheet, a test report is written which not only describes the conduct of the test but lists any reservations or qualifications arising from the tests. If a reservation can only be. cleared by modifying the plant, such modifications must be processed using an agreed procedure. This procedure may involve the Nuclear Safety Committee and, if the modification is of sufficient safety significance, the approval of the HSE may be required before it is implemented. The SCC is then responsible for commissioning the modi­fied plant in the normal way. The test reports are endorsed by the appropriate committee who also agree on any action required concerning the reservations. The SCC test reports are furnished to the HSE and provide the necessary justification to them that it is safe to proceed to the next stage of commissioning. The HSE may wish to witness certain tests which they nominate in advance. It is the responsibility of the SCC to ensure that the Nil Site Inspector is informed when these tests are to take place with sufficient notice to allow him to be present. Failure to do this may result in the need for the test to be repeated with the inspector present.

The stages of the commissioning programme usually take the following form:

Stage 1: Core dryout cold unfuelled engineering test,

hot unfuelled engineering tests, control rod

drop tests and safety circuit checks. During this stage a very small amount of fuel may be loaded to check its mechanical behaviour under gas pressure and flow conditions.

Stage 2: Load full charge of fuel, physics tests at low

power, hot fuelled engineering tests. Fuel­ling machine test, control rod drop tests, check safety circuits.

Stage 3: Raise power to some intermediate value

usually less than 50% power, steam to main turbine-generator, reactor trip.

Stage 4: Raise power to maximum attainable, tests on

entire system under operational conditions.

The commissioning period usually terminates with a 72-hour run at maximum power and at that time, with the agreement of the HSE, the SCC is usually disbanded. If, however, there appears the need for major modifications to the plant during the course of commissioning, the work of the SCC may be ex­tended until this work is complete and the modified plant is commissioned.