The previous sections have outlined general disturbances to the reactor core. These disturbances may be ameliorated or aggravated by the control system or by human action.

2.6.1 Survey of Types

It is worth surveying possible initiators for the general disturbances so far considered, in particular, external initiators.

(a) Flow perturbations might arise from

(1) loss of electrical power to the plant or plant components result­ing in a loss of pumping power;

(2) pump mechanical failures;

(3) control malfunction.

(b) Reactivity perturbations might arise from

(1) the introduction of bubbles into the system;

(2) seismic deformations through structural movement;

(3) control malfunction;

(4) refueling accident.

(c) Thermal perturbations might arise from

(1) loss of feedwater supply;

(2) feedheater or turbine malfunctions resulting in a loss of heat removal capability;

(3) control malfunction in secondary and tertiary loops.

In each case a control malfunction is a possible cause of an accident, and as a result a controller error is treated in any safety assessment. The actual course of events depends critically on the mode of control used in any particular plant.

2.6.2 Control Modes

The control philosophy is shaped by certain restrictions which are set by plant material considerations and by the plant characteristics themselves.

The main requirements are: (a) a constant turbine stop-valve temperature, and (b) minimized temperature gradients in the vessel and in primary components. Whether or not these requirements are achievable depends on the time constants throughout the circuits of the system.

In a steam-cooled system which is a partly indirect cycle by virtue of the reheat cycle, load-following is possible if the feed supply-valve is administe­red correctly while the turbine stop-valve is varied. If the time constants and temperature feedback coefficients are suitable then this could be the control philosophy.

In a liquid-metal-cooled fast breeder the long delays in the intermediate circuit combined with positive void coefficients rule out load-following. A load-setting procedure is therefore a necessary control mode. This might take the following form: set the flow in the primary and secondary circuits; adjust the feed circuits; and adjust the reactivity in the core through control absorbers to meet the main control requirements listed above. The main problems are the difficulty in getting temperature signals from the core and the need to optimize control rod movement for small temperature changes.

Thus in the LMFBR control system, malfunctions might give rise to disturbances in primary, secondary, or feed flows, in reactivity, or possibly in a combination of all four.

In a given design a fault-tree analysis of the protective logic and the control system will be needed to decide on possible combinations of control operations that could give rise to adverse core effects. A faulty reduction of flows in the heat transfer loops following a signal of increased outlet temperatures would be an example of a gross control malfunction. The analysis of such possible malfunctions will need a combination of the analytical techniques discussed in Chapter 1.

One other possible control mode incident aggravation is worth mention. Noted above was the need to optimize control rod movement for small temperature changes. This optimization sometimes means the movement of a number of control rods in a staggered mode that makes it difficult to know what reactivity state the system is in at any given time. This ignorance of the reactivity state of the system hampered the diagnosis of the Fermi incident (see Section 4.6) which occurred during start-up.

Each control system must be treated as a special case for analysis.