SAFPWR home page

Reactor protection by rod dropping

Trip logics

Reactor protection trip [or "AU" for Arret d'Urgence] (dropping all the rods) is triggered whenever some reactor protection variable values, generically (1a) noted "y", exceed their trip threshold level "y_au".

An example of the trip logics is illustrated on fig 1 for a rod withdrawal accident.
z1, z2,... represent the elevation, at times sec1, sec2,....of a typical rod group, in course of its accidental extraction.
end_step, core calls CAU which tests for au condition status (y > y_au ?).
When reached, at sec_au, a trip instrumentation delay dsec_au is still added before reaching the time sec_drop from which the group start falling.
At following steps, do, core sets drop_condition = true as soon as (sec > sec_drop).
On the figure, this is obtained in the course of step 5.
Rods start actually dropping from sec_drop but, in processing step5, the position z5 remains relevant for all the trip step duration.
The following step (6) is processed with correct position z6. This simplification anomaly leads to a small overestimation of the y peak.
read, core_config organizes the protection data input:
core_config
Lstau
&Au;: generic AU data valid for all trip types.
dsec_au, already defined;
sec_drop: may be imposed to force drop at specified time;
zmingr: [elevation Z; Min; Group] base minimum position for the rods, in case it is positive
&Auf2c
f2c_au=: excess neutron flux trip level for (f2c > f2c_au) trip.
It is a NAMELIST input terminated by /.
Actually f2c is the nuclear power as monitored by neutron flux detectors. This signal gives only a relative estimation of nuclear power and needs therefore to be rescaled to a "reference" thermal power calculated by core heat balance.
&Audphdt; [AU; (d/dt) flux PHi] trip protects the reactor in case of an abnormal flux time derivative caused, for example by an accidental, undetected, drop of one or several rods.
(1a:b) represents the general trip condition.
xi is the set of system variables involved in the trip; there are related to y by a trip function (1b), generally expressed in terms of operators G(s) of Laplace variable s.

Let us firstly introduce the elemental trip operators.

(2a) is the general lag-derivative operator used in dφ/dt protection.
φ is the neutron detector signal and φn its nominal value.
The lag delay time τ must been adjusted to avoid spurious tripping.
This trip protects the core against the effects of an undetected rod drop.
As the trip is triggered by a too rapid flux decrease, < must be used instead of > in the trip condition (31.1a) and the trip threshold is thus negative.
(2c) represents the trip relation in time domain.
This differential equation is similar to that of the delayed precursors and is solved by same techniques.
In the present case, the flux log derivative ω is available at bos and eos, (as omphc ).
Assuming its evolution is linear with time over the step, the analytical solution will be (4), with coefficients obtained from (3).
For ε < epstau, the truncated series development are used to avoid 0/0 indetermination.

(5a) is the simple lag operator with primitive (5b), assuming that x varies linearly.
In the derivation operator (6a), if x, (not dx/dt), changes linearly with time, the solution will be (6b).
At last, the lead-lag operator (7a) has (7b) as analytical primitive, assuming again a linear variation of x.
In some cases, G may include (8a) products of basic operators.
Instead of applying the operators in succession as in (8b,c), we prefer, in order to avoid accumulation of discretization errors, to firstly decompose algebraically the product GH into a sum of basic operators (8d), and thereafter summing (8e) the result of the successive basic operators.

Reactor thermal protection

The high flux trip is fast, but not accurate, because the measured flux provides only a relative estimation of power, which must be recalibrated on the thermal power taken from the system heat balance.
It protects the fuel against excessive temperature in case of fast reactivity transients such as rod ejection, but does not allow assessing the coolant heat removal capability .

This function is taken care by the "thermal reactor protection system".

Designing core thermal limits starts with representing (fig 2), in plane (tec, q2c), of core inlet temperature vs thermal power, the limit lines corresponding to each phenomena which could endanger safe operation.
A first limit would cover core outlet boiling, a second, overheating of fuel at hot spot due to overpower, a third, the loss of coolant heat removal capability by boiling crisis (loss of Departure from Nucleate Boiling), ....
These "physical limits" depend also on additional parameters such as pressure, core flow, enthalpy form factors, axial power profile, .....
For practical protection implementation, the set of "physical limits" are firstly converted into two "thermal protection limits" (fig 3) drawn in the operational diagram of tavc=(tec+tsc)/2 vs datc=tsc-tec.
These two "protection limits" are supposed to be bounded by the various with "physical limits" with sufficient margin.

The ot-dt [Over;Temperature-Delta;T] limit protects for effects linked with excessive coolant temperature whilst the
op-dt [Over;Power-dt] protects for effects due to excessive power.
Like the core physical limit, the protection limits receive as parameters secondary variable (p, wec, ...).
On the protection diagram, proper margin must be allocated between the nominal operating "state point" (datcn,tavcn) and the protection limits for supporting operational transients without tripping the reactor.

As it is not feasible to install temperature measurements right at core inlet and outlet, or even within the loops pipes, the thermometer sensors are located (fig 4) into small temperature sampling lines extracting a little flow at inlet and outlet of steam generators from nodes itcl_odt and ithl_odt of loop_l input as Lstl/itcl_odt and ithl_odt.

The average and difference values of those temperature samples are noted t_odt and dat_odt (1,2) whilst their, ideal, corresponding values at core boundaries are noted tavc and dtc (5,6).

The actual implementation of the odt protection vary with individual plant design.
We present here a possible typical example. The adaptation of the program to any other design would require minor recoding.

Remind that (1:3) define the difference, average and deviation values of "odt" temperatures. tnc is the nominal average coolant temp.
opdt protection
(7) exhibits the opdt trip condition which compares the observed odt delta temp at eos ("2") to trip threshold (8):
c0_opdt represents the nominal stationary trip margin ratio.
On the protection diagram, it is the relative margin of the nominal point from the opdt line.
cdt_opdt * dt2_odt term represents the slope of the line.
(9): lag-derivative correction by t_odt which anticipates the effect of t_odt deviation from nominal
(12): fdai_opdt: this term (not yet implemented in the program) accounts for effect of axial power distribution deviation from its nominal design value.
It is represented by daic = current out the top section of the flux detector minus the bottom value.
Normally, (8) would also include a correction term for wec deviation from nominal, represented for example by the deviation of frequency of pumps motor electrical supply.
otdt protection.
(13,14): otdt trip condition with c0_otdt as the nominal static ratio.
The static part (s=0 in (15)) of the cdt_otdt * ydt_otdt term represents the slope of the otdt line.
The otdt trip relation also includes a static correction for pressure deviation from nominal and a daic correction.
(19,20) are the static form of the protection relations.
There are also calculated to simulate what would be the protection response if the temperatures could be taken at core boundaries.

Verification of odt protections

The physical limits are established on the basis of a "thermal design" conservative representation of the core ("design" power profile, bounding FΔh,....) which are supposed to provide adequate safety margin from the actual core in transient condition.
In addition, the opdt and otdt trip protection lines are themselves bounded by the physical limits.

It is not obvious to be able representing the dynamic effects of water transport in loops and sampling line by means of simple sets of first order lead-lag operators.
For example, the transfer function for a transport time τ in a pipe is e-τs and is usually approximated by 1/(1+τs).
In addition, such transport lead/lag operators should normally be applied to the original tec and tsc temperature signals rather than to their average/difference combination.

Consequently, the only procedure for assessing the protections is by submitting the system to set of transients sensitive to the dynamic effects and evaluating the protection margins directly in terms of the real safety limits such as max fuel temperature at hot spot, DNBR margins,....
Note that SAFPWR allows nevertheless editing the margins against physical limits which would be calculated on a thermal core model (multi channel,....) more realistic than in our model.
However reactor thermal design is usually done in steady state condition, with enthalpy distributions which may markedly differ from the transient ones.
In order to investigate this effect, the program may also calculates, on demand, the stationary condition of the core, for some "state points" (thermal power, inlet flow,...) of transient. The trick is to insert pseudo ini,heat-gen cases at chosen steps.