The previous examples illustrate the practical value of linearized models in solving operational problems in both fossil and nuclear power stations. However, the large rapid power variations in accident situations invalidate linear models, and comprehensive non-linear simulations are crucial in order to provide confirmation that internal plant constraint boundaries are never breached (e. g., boiler and turbine temperature profiles). Statistics [59,65] indicate that a station’s con­nection to its Grid network will almost certainly be disrupted during normal operation by impacts on transmission lines from large birds, aircraft or lightning. Granted a functioning reactor shutdown (scram) system, a particular accident control strategy must be devised to restrict the induced thermal stresses across the plant so that its longevity is not compromised. For example a temperature difference of some 100 °C across a steam-generator tube potentially causes rupture. This fault situation belongs to a set of so-called Design Base Accidents,[48] and the following fast reactor example in Figure 3.9 demonstrates the necessity of

i. industry specific experience,

ii. a transparent one-to-one relationship between control and controlled variables, and

iii. a thoroughly validated non-linear simulation, for which the experimental data are acquired as far as possible from broadly similar plants and electrically powered heat-transfer rigs.

Because power is no longer extracted from a station’s turbo­alternators after a Grid disconnection, their steam control valves (TCVs) must be abruptly closed to prevent over-speeding and conse­quential damage. In the assumed circumstances, a safe shutdown of the nuclear chain reaction is achieved by unlatching a more than sufficient number of gravity-driven absorber-rods. Though the chain reaction is terminated, some 6% of pre-trip reactor power is initially produced from the radioactive decay of fission products and the significant thermal energy residing in plant coolants and metalwork [117,118]. The correspondingly diminished steam production can evidently be dissipated in the station’s condensers for which purpose heat transfer processes are first maintained by emergency power supplies and then by the promoted natural circulation. Thermodynamic efficiency is gener­ally promoted by preheating boiler feed water with steam bled from a number of points along a turbine, so closure of the TCVs causes a rapid fall in feed water temperature. The sodium coolant in fast reactors has an especially large thermal capacity and provides a highly efficient mode of heat transfer [64] which in these circumstances could aggravate temperature differences across tubes of the counter-flow steam genera­tors and Intermediate Heat Exchangers (IHXs). With a full recirculation boiler design [117,142] (Lamont), preheated feedstock from a deaerator is usually injected downwards [117] along the length of a steam drum or occasionally into downcomers, so as to make up some 10% of the boiler input. Consequently, water-inlet temperatures with this design are well buffered thereby reducing the induced hoop stresses in boiler tubing. However, economic considerations favor fast reactor stations with once — through boilers (Benson) [117] without a steam drum, so water-inlet temperatures can therefore change far more rapidly to aggravate the potential for damaging thermal shocks. Accordingly, some fast reactor

plant designers in the United States advocate [152] an extra standby tank of preheated feed water. However, a simply implemented trip sequence for once-through boilers in fast reactor stations is now described that achieves acceptable thermal stresses without any addi­tional capital equipment [141].

A schematic diagram for the fast-reactor system under considera­tion is shown in Figure 3.9, and it includes components considered for a proposed. British commercial system (CFR) with helically tubed once-through boilers.[49] The plant actually consists of one reactor, eight counter-flow IHXs, four counter-flow boiler units and two turbo­alternators to generate an electrical output of 1320 MW. For detailed non-linear digital simulation studies with the JCBARK[50] program, symmetrical operation at full-power is first investigated. A typical or average channel is modelled for the reactor, IHXs and boilers with the actual power transfers derived by straightforward linear scaling. After the TCVs and reactor scram-rods are abruptly tripped [58], it is proposed that the primary and secondary sodium pumps are operated with mass flow rate control (rather than the more usual speed) to effect

W 1s(t) = 0.1 + [W 1S(0) — 0.1](1 + t/12) 1 — primary kg/s

W2s(t) = 0.1 + [W2S(0) — 0.1](1 + t/12)-1 — secondary kg/s

(3.14)

Matched primary and secondary sodium flows as above prevent exces­sive temperature differences and thereby damaging hoop stresses in IHX tubing. Over-pressurization of the steam generators is mitigated by steam dumping [142] which as a percentage wD of the full-load value is according to

wD = 0 for P < 165 bar

wD = 80(P — 165)/8.75 for 165 < P < 173.75bar (3.15)

wD = 80 for P > 173.75 bar I

Due to preheated water held initially in the feed trains and deaerators, the inlet water flow can be maintained for 10 s before colder liquid begins to enter the boiler unit with the shortest feed main. At this point in time tfeed the water feed pumps’ set point and control valves are switched to match the natural recirculation rates for the primary and secondary sodium circuits. The form of the waterside heat-transfer correlations suggests that this artifice broadly attenuates temporal rates of boiler-tube temperature changes by the inverse ratio of the pre-trip water-inlet flow rate to that existing any time thereafter. In addition to mitigating thermal stresses, the proposed shutdown strategy attempts to conserve density disparities between “hot and cold legs” of the sodium circuit so as to encourage natural circulation.

Simulated inlet and outlet temperatures for the IHXs in Figure 3.10 and the inlet temperatures of a steam generator in Figure 3.11 confirm the effectiveness of the proposed accident-control procedure for the full-load situation with tfeed = 10 s. Corresponding normalized waterside inlet and outlet flows in Figure 3.12 clearly reveal the closure of the TCVs, the opening of the steam dump to the station’s condensers, and the feed water flow switch at 10 s. Individual feed mains vary in length, and those of the PFR at Dounreay corresponded to a delay tfeed of 10-14 s. Robustness of the proposed control strategy is demonstrated by the predicted temperature transients in Figures 3.13 and 3.14, with the longest feed-water flow switch at 14 s. Though temperature changes at a boiler inlet have somewhat larger excursions

than before, they remain acceptable and IHX temperatures are hardly affected. Because radioactive decay power decreases with pre-trip reactor power and time, a full-load trip appears as the worst-case scenario [59]. Additional simulation results (not shown) for a range of load factors and tfeed = 14 s confirm this inference as well as the desirability of identical primary and secondary sodium-pump run-down rates.

Industry-specific experience and a thoroughly validated non-linear simulation have been shown to be essential for devising normal and

_i_

150

accident control strategies in nuclear power plants at the preconstruc­tion stage. With this simulation available, Nyquist techniques using real frequency responses are the obvious choice for designing controllers for normal maneuvres. Personal experience and this example also suggest that ad hoc accident-control strategies cannot be humanly conceived if a controlled variable were to be a function of several control variables (i. e., via a scalar matrix). The interventions of reactor safety trip — systems and acceptable rates of thermal change intrinsically impose markedly different response times for the controlled variables in nuclear and fossil-fired power stations. These result in the desirable one-to-one

relationships between the control and controlled variables as illustrated in Sections 3.1,[51] 3.2, and 3.3. Widely different response times were also engineered in early self-adaptive systems for oil-well drilling [153], missiles [154] and communication receivers [155] in order to create more tractable SISO control problems.