As has already been noted the cooling of the fuel is key to the preservation of the fuel-related containment barriers. Cooling the fuel reduces the chance of clad failure as well as maintaining the effectiveness of the fuel matrix as a means of confining fission products. Systems are provided to both maintain the coolant inventory as well as to ensure a continued heat rejection route. The safety systems providing the core cooling functions are described below for each reactor type.

PWR safety systems

At power the normal heat removal route is via the steam generators to generate steam to power the turbine. When the reactor trips the turbine is also tripped and the steam is diverted to the condenser. If it is not possible to reject heat to the condenser then energy is removed by discharging steam via the steam line atmospheric relief valves. The feed flow to the steam generators must be reduced to match the heat generation rate. In some plants the main feedwater pumps may continue to be used, but with reduced flow, while in others the main feedwater pumps are tripped and auxiliary/emergency feedwater pumps are brought into service. Even plants which have the capability to continue using their main feed pumps will have auxiliary feedwater pumps, which will be automatically initiated on detection of low water levels in the steam generator.

The auxiliary/emergency feedwater pumps can be either electrically driven or driven by small steam turbines. Given the importance of the feed systems it is normal to provide diverse as well as redundant feedwater trains. In many cases this is achieved by having both electric and steam-driven pumps, but some plants use additional electrically driven pumps with diverse electric supplies.

Provided that the circuit is intact there should be no loss of primary fluid. The plant will initially be maintained at ‘hot shutdown’ (subcritical at normal operating temperature and pressure), but if it is necessary to cool the plant down then it will be necessary to inject borated water to compensate for both the shrinkage of the coolant inventory and the reactivity increase associated with the cooling of the core. This is achieved via the CVCS system (see Fig. 10.8) but in some plants this may be supplemented by a diverse charging system drawing borated water from a dedicated high boron concentration water tank.

As with any high pressure system, the consequences of a failure of a section of high pressure pipework must be protected against. The classic design approach was to provide protection for the worst pipe break, often referred to as the ‘maximum credible accident’. For PWRs this is the failure of the hot or cold legs of one of the main circulation loops, which results in a large loss of coolant accident (LOCA). The high pressure coolant flashes off to a steam/water mixture as it is discharged into the containment, and because the whole circuit depressurises, the water in the vessel boils off, essentially emptying the circuit. This shuts down the fission process even without the control rods being inserted, though the protection system will also initiate a reactor trip.

The fission process may be shut down, but stored energy and decay heat must be removed so systems are provided to reflood and cool the core. This is achieved by the use of the emergency core cooling system (ECCS), which consists of a series of pumps, which draw borated water from the refuelling water storage tank (RWST) and pressurised tanks (accumulators) containing borated water. In the case of the limiting large LOCA, the accumulators will discharge into the cold legs when the circuit pressure falls below the pressure of the nitrogen cover gas in the tanks (~4.5 MPa) because they are normally only isolated from the circuit by non-return valves. There is normally one tank for each loop and they are sized so that they will refill the lower plenum and downcomers following a large LOCA. The reflooding of the core is completed by water injected by the low head safety injection system (LHSIS).

Although the design basis for the systems is set by a hypothetical double-ended guillotine failure of either the hot or cold leg, this is an extremely unlikely event since this type of failure is rare and the breach opening would tend to be progressive rather than instantaneous. It does, however, provide a limiting case for the water delivery rate required of the LHSIS and hence the pump specification.

Water is initially drawn from the RWST. The boron levels are such that the core will remain subcritical even if the control rods have failed to insert. The water will quench and then cool the core to limit the maximum fuel rod temperature and thereby limit fission product release. Water will be discharged through the breach in the circuit and will collect in the containment sumps. When the level in the RWST has fallen to a low level the LHSIS pump suction is realigned to draw water from the containment recirculation sumps. In some modern plants and in advanced PWRs, the refuelling water is stored inside the containment in an internal refuelling water storage tank (IRWST). This is in the bottom of the containment building and acts also acts as the sump removing the need to switch over to recirculation. Initially the cooling is provided by the thermal capacity of the cold RWST water but in the longer term the LHSIS water is cooled by the residual heat removal system heat exchangers, which are cooled by the component cooling water system.

The ECCS must be able to deal with the complete range of possible LOCAs, ranging from small pipe failures to large breaks. In the case of the smaller breaks the circuit pressure will not fall as rapidly and will tend to stabilise at a pressure where the core decay heat is balanced by the heat losses from the circuit. The circuit heat losses will mainly consist of the energy flow through the breach and any heat removed by the steam generators. Heat removal via the steam generators will only take place when the primary circuit pressure remains above the secondary circuit pressure. This means that to cope with all possible sizes of circuit breach, it is necessary for the ECCS to be capable of injecting water at a wide range of pressures. However, the LHSIS pump characteristic is such that it is capable of delivering large quantities of water at low pressure but has a limited delivery pressure head and so cannot be used at high pressure. Thus a second system is generally provided to inject at high pressure: the high head safety injection system (HHSIS). In some cases this system is referred to as the intermediate pressure injection system since it is designed to deliver at pressures below full operating system pressure. The charging system (part of the CVCS shown in Fig 10.8) can provide injection at or above normal operating pressures and can deal with very small LOCAs. In some designs the charging and HHSIS functions are carried out using the same pumps.

In general ECCSs inject into the cold legs of the circulation loops since these feed into the downcomers and the inlet plenum. However, it may also be necessary to inject into the hot legs. Since boiling may occur in the core the dissolved boron in the coolant will concentrate in that region and periodic injection into the top of the core via the hot legs was introduced to mitigate the build-up of boron crystals in the upper parts of the core. Some designs also have lines, which allow direct injection into the reactor vessel.

Figure 10.14 shows a schematic of the Sizewell B safety injection systems. Also shown is the containment spray system. In many plants the spray and low head injection pumps can be realigned to do either LH injection or spray duty.