Patent Number: 050911392
Section: summary

This invention relates to a thermal limit monitor system for a nuclear power plant. More particularly, an apparatus and process is disclosed for preventing in real time thermal limit violations caused by requested power increases. BACKGROUND OF THE INVENTION This invention relates to boiling water nuclear reactors. Such nuclear reactors increase their power output by two well known expedients. The first of these expedients is the increase in coolant flow through the reactor. Simply stated, increased coolant flow increases the amount of moderator present in the reactor. Fast neutrons from the nuclear reaction are moderated in greater number, promoting additional nuclear fission reactions and power output increases. Alternately, the nuclear reaction can be controlled by so-called "control rods". These rods when inserted within a reactor core absorb thermal neutrons and inhibit the nuclear reaction. When control rods are withdrawn, less thermal neutrons are absorbed. Instead of being absorbed, the thermal neutrons find their way into the promotion of further nuclear fission reactions. Power output increases, Those having skill in this art will realize that the above description constitutes a gross simplification; this simplification can help in the understanding of materials that follow. Nuclear fuels are typically arranged in fuel bundles. The fuel bundles themselves contain side-by-side tubes, the tubes being filled, and sealed at both ends with the fissionable material trapped inside. The water coolant in the reactor is relied upon to both moderate the fast neutrons and extract heat from the individual fuel rods. In the absence of the extraction of the heat from the individual fuel tubes, damage to the fuel can occur. One type of damage that can occur to tubes within a fuel bundle results from a departure from nucleate boiling. In nucleate boiling individual steam bubbles form on the tube surface (at so called bubble nucleation) as heat is transferred to the coolant. As the bubbles rapidly form and leave the tube surface a very agitated coolant condition exists at the tube surface promoting a very efficient heat transfer process--nucleate boiling. When a departure from nucleate boiling occurs a steam film forms adjacent to the wall of the tube. The steam film is inefficient in extracting heat from the tube. When such a steam bubble forms, it is possible that the metal of the tube can become overheated from the nuclear reaction and the structural integrity of the tube can be lost. To make absolutely certain that this type of casualty does not occur, all fuel bundles in boiling water reactor configurations are assigned bundle power limits to prevent a departure from nuclear boiling. Other types of damage to a fuel rod can occur as a result of an overpower condition even while operating in the nucleate boiling regime. The power level of a fuel rod determines the temperature distribution within the rod. A higher power level requires a higher rod operating temperature to drive the nuclear generated heat out of the rod to the coolant. Operation of fuel rods at too high a power level can result in fuel melting or fuel expansion that strains the confining tube the extent that tube failure occurs. These types of rod failure mechanisms depend on the power generated per unit length of fuel rod tube. A third type of catastrophic tube failure condition is possible during severe loss of coolant accident (LOCA). During a LOCA the moderator coolant is lost between the fuel rod tubes. The loss of the heat transfer medium causes the residual decay heat from the nuclear fuel to rapidly heat up the fuel tubes to high temperatures. At these high temperatures radiation heat transfer between tubes is a significant heat transfer process. It is a characteristic of radiation heat transfer to tend to transfer heat from hotter fuel tubes in the fuel bundle to colder tubes. Thus the peak fuel tube cladding temperature during a LOCA has been found to be limited by controlling the average fuel rod power at each axial elevation of a fuel bundle prior to a LOCA. This is possible because fuel rod residual decay heat power during a LOCA is directly proportional to operating fuel rod power prior to the LOCA. If fuel tubes become too hot (in excess of approximately 2200.degree. F.), the zircaloy alloy tubing metal chemically reacts vigorously within the steam environment. The chemical reaction releases combustible hydrogen gas and embrittles fuel tube cladding. High temperature cladding has reduced integrity for containing fuel and radioactive materials and is subject to shattering from the thermal shock of rapid cool down when the reactor system is reflooded with water during LOCA recovery. Limits are therefore imposed on the maximum average fuel rod operating power in a fuel bundle at each axial elevation prior to a LOCA, to limit the peak fuel rod tube cladding temperature that could be reached during a LOCA. The types of operating thermal limits can therefore easily be summarized. First, since the overall power output of a fuel bundle can result in a departure from nuclear boiling the overall power output of each fuel bundle is monitored to maintain nucleate boiling. The bundle power at which departure from nucleate boiling is predicted to occur, the critical power, is divided by the monitored bundle power and the ratio parameter termed the bundle critical power ratio, CPR. The CPRs of all bundles must exceed unity to prevent a departure from nucleate boiling. Second, it is of concern that no rod anywhere within a fuel bundle at any point exceed design temperatures. Since fuel rod temperatures are determined by the rod power per unit axial length, operating limits on rod linear power (power per unit length) are established. The operating linear powers of all sections of all fuel rods are effectively monitored and compared to the limits during operation. Finally, within each fuel bundle the average linear power at each elevation is determined and compared to limits to assure acceptable consequences during a potential LOCA. The classification of the above thermal limits is also subdivided. A first thermal limit is chosen and denominated as an "operating thermal limit". This operating thermal limit is a limitation of normal day to day steady operation. It is the object of routine nuclear plant operational power increases not to exceed these so-called operating thermal limits. Operating thermal limits include margin allowances for unplanned power increases or heat transfer degradation as might occur during abnormal system transients or accidents. In addition to the operating thermal limits, there is a second and more stringent limits known as safety thermal limits. The safety thermal limits reside at or near the point where damage to the fuel tubes can occur. Obviously, the goal of plant operation is to remain within operating thermal limits so that safety limits are never violated. Plant instrumentation is provided to assure that operating and safety limits are not violated on operator initiated power increases by core flow increases and control rod withdrawal. SUMMARY OF THE INVENTION In a boiling water reactor, the power output of the reactor is monitored by conventional local power range monitors. Preferably, these local power range monitors each measure the amount of thermal neutron flux present and output proportional electrical signals. These electrical signals give the power range of the reactor in the vicinity of the monitor. In a boiling water reactor, monitors are distributed throughout the whole reactor core in vertical strings. Each vertical string has a group of typically four power monitors attached to it. These power monitors are spaced in elevation such that the whole boiling water reactor core can be monitored both in columns and in rows. For purposes of both the prior art monitoring of the reactor and the monitor here, the reactor is subdivided into square columnar blocks of 16 fuel bundles in each block. For each block, there are assumed to be four monitor strings located at the four corners of the block. As there are four local power range monitors on each string and these local power range monitors are spaced equally vertically, the region is covered by a total of 16 local power range monitors. A region of such fuel bundles is controlled by four discrete control rods. If any or a combination of the four discrete control rods is withdrawn, the neutron flux increases, and thus the power will increase. Such power increase will be indicated on an immediate basis by the local power monitors. In prior automatic fuel protection instrumentation schemes, the prevention of exceeding thermal limits has been confined to the withdrawal of control rods with mandatory human supervising action required to maintain operating limits. Increases in flow that would violate operating or safety limits have not been automatically monitored and censured. Instead the reactor core is constrained to operating thermal limits at reduced core flows such that the power increase associated with a core flow increase to maximum system capability will not result in a violation of fuel safety thermal limits. Thus operator errors or flow control system failures that could result in violating of operating limits, but not safety limits, are recognized. The design philosophy which allows the unplanned short duration violation of operating limits relies on the small likelihood of an additional concurrent abnormal transient or accident event which could cause further degradation to violate safety limits. Sufficient instrumentation inputs are provided to the plant process computer such that the reactor operator is periodically provided a complete picture of the performance of reactor fuel in relationship to established operating limits. There is, however, no automatic enforcement of compliance to fuel thermal operating limits. The current situation is similar for operator initiated power increases by control rod withdrawal. Established operating limits assure that a single erroneous control rod withdrawal will not degrade fuel performance from operating limits to a safety limit violation. However, in this instance complete control rod withdrawal is not covered by the established operating limits. The local power increase associated with the completed withdrawal of some limiting control rods is so high that to do so would require very restrictive operating limits that could sometimes require reactor total power to be restricted below the design level in order to meet the requirement. Instead, during control rod withdrawal an automatic monitoring system is provided which utilizes the local power monitor signals as input to override the operator requested control rod withdrawal (viz. block further withdrawal) as necessary to assure fuel safety limits are not violated assuming withdrawal is initiated with fuel near the control rod on operating thermal limits. In current boiling water reactor (BWR) nuclear power stations, the analogous monitoring device is called a rod block monitor or RBM. The RBM uses the in-core power (neutron flux) monitors for its basic monitoring information source. The core power and thermal limit status then can be related by processing the readings of the local power monitors. The 16 local power monitors of each four corner strings are assigned to two channels in the prior art RBM: the bottom (A) and above the mid-plane (C) detectors in one channel, and the top (D) and the below the mid-plane (B) detectors in another channel. The average of the (typically 8) detector inputs in each channel forms an RBM signal. Block/Alarm occurs when the signal exceeds a preset setpoint. The RBM rod block setpoint to prevent safety limit violation is determined based on a theoretical core power and thermal limit calculation response prior to the beginning of each fuel cycle (i.e., the period between reactor refuelings). The calculation is based on the assumption that initially the core is operating at the operating limit, and that a rod withdrawal error is initiated from a hypothetically worst control rod pattern which gives the worst thermal limit change with control rod withdrawal. With such a continuous rod pull, the relative amount of RBM channel output increase which is accompanied by a thermal limit change from the operating limit to the safety limit is defined as the rod block setpoint. This rod block setpoint is thus dependent on assumed conservative initial conditions. Typically this setpoint is determined only for the rated power rated flow condition. Consequently, this current method is not based on comprehensive study of the correlation between thermal limit change and RBM signal change, and does not consider the true existing absolute thermal margins of the core. Experience has shown that current RBM setpoints restrict (block) control rod withdrawal much more often than necessary and is conservative. However, it can be seen that with such a system based upon the assumption of initial operation within an operating limit, that defeat of the safety system would be possible. Simply stated, by making assumptions of operation within thermal operating limits in succession and requesting rod withdrawals in succession, multiple sequential requests could cause violation of the thermal limits. However, since conservative values between instrument response and core power increase are normally chosen, these conservative values while assuring and contributing to the remarkable safety record of nuclear power plants to date, unnecessarily inhibit operation of the plant in maneuvering from a low power state to a higher power state. Further, since the effects of flow increase are ignored in such rod blocks, a level of automatic safety precaution is omitted which would be desirable to include. It should be understood that nuclear reactors can be continuously monitored by online computers. Typically, these online computers recurrently put together three dimensional core thermal performance profiles which accurately predict both the thermal state of the core as well as the local power range monitor readings. Unfortunately, even though such computations are now performed by modern fast computers in the order of once every two minutes, they are insufficient in their speed to provide "real time" rapid response predictions of the consequences of planned reactor flow or control rod position changes relative to fuel thermal limit performance. Accordingly, there is a need for an automated thermal limit monitor which will inhibit in real time requests made for increased power that would violate either operating or safety limits, whether it be based upon rod withdrawal or increases in coolant flow. SUMMARY OF THE INVENTION A computed model of reactor power output is read periodically to computer memory and retained in memory in a three dimensional matrix. This retention occurs between regular updates on the order of every two minutes. The reactor is conventionally monitored in groups of 16 fuel bundles each. Each 16 bundle group is monitored in real time as to its thermal neutron flux by four vertical strings of local power range monitors, each string having one of four power monitors disposed at four different elevations extending the height of the fuel in core. Each bundle group is controlled by four control rods and is assumed to be subject to uniform flow change with overall reactor flow change. The automated thermal limit monitor (ATLM), takes as inputs all power range monitor information from the BWR reactor core on a continuous basis to two channels, one channel for determining operating limits, the other channel for determining safety limits. (Redundant functional configurations can be implemented in each channel if desired for increased reliability but is not assumed in the reference configuration discussed.) These signals are processed inside the system according to different algorithm requirements for the protection of fuel thermal limits, i.e., minimum critical power ratio (MCPR) and maximum linear heat generation rate (MLHGR). (Extension of the MLHGR procedures discussed to the singular maximum average planar linear heat generation thermal limit parameter (MAPLHGR) is straight forward.) The system also takes as input the on-line absolute core thermal parameters limits, together with a set of built-in parameters called A and B factors which are functions of core power and control rod position, and the operating thermal parameter limit (or safety limit) at the current power and flow conditions. Based on the above information, the system calculates signal setpoint values for MCPR and MLHGR, respectively. The ratio of the instantaneously scanned power monitor value to that value at some initial state forms the ATLM signal. These setpoint values (normalized to some initial state) are compared with the instantaneously scanned ATLM signals continuously to determine whether a control rod withdrawal block command or core flow block command should be issued. If an instantaneously scanned and processed ATLM value approaches its setpoint, then rod block (or flow block) will be issued. This then assures that the core thermal limits are not violated on rod withdrawal or flow increases. This invention disclosure not only describes the system configuration and functional logic of rod block and flow block, it also describes the design bases of the A and B factors in the system algorithm which are fundamental to the whole ATLM system. The configuration concept, functional logic, and the form and design of the A and B factors constitute the bulk of the ATLM design invention disclosure. An object of this invention is to disclose a system for blocking requests for core power increase in real time based upon a current model of the reactor thermal profile. An advantage of the disclosed process and apparatus is that it is applicable both to requests for rod withdrawal and to requests for flow increase. An additional advantage is that manipulation of the plant can include rod blockage when operating thermal limits versus safety thermal limits are in danger of violation. No longer is it required to have a system for monitoring requests for increased power theoretically issuing block orders based upon safety limits. A further advantage of the disclosed system is that it can be utilized in a backup module to monitor and block requests for power increase when safety limits are approached. It is ideal for the high degree of operating safety redundancy required in nuclear plants. An additional advantage of the disclosed system is that the operator is assisted in real time of avoiding violation of operating thermal limits. This avoidance of violation is based upon the absolute and current operating thermal state of the reactor. Consequently, the operator is assisted in achieving optimized radial and axial power shapes during power ascension to rated condition throughout rated power operation. Yet another advantage of this invention is that since the system is based on actual online local power range monitor results, the reactor can be operated with better flexibility within its thermal limits. Since blockages only occur based upon the difference between the actual operating state of the reactor and the requested power increase, overly conservative practices relating to local power range monitor output are no longer required. The disclosed protocol within its metes and bounds assures operation within the operating thermal limits. Summarizing the functional operational objectives of the system it will be found that the disclosed system: a) Adapts core thermal limit information from the plant process computer and the local power information from the NMS (Neutron Monitoring System). to perform comparisons based on its own algorithm independent of the process computer, and to issue rod block (or flow block) commands when the absolute operating thermal limit is approached. In the event the operating limit rod block function fails, a backup module will issue a rod block command when the safety limit is approached. b) Through rod block function and estimated thermal limit by the ATLM, the operator is assisted not only in avoiding violation of operating thermal limit but also in achieving optimized radial and axial power shapes during power ascension to rated condition and throughout rated power operation. c) Utilizes actual on-line core monitor results for better flexibility in rod withdrawal maneuvers. With ATLM, the rod(s) can be withdrawn until the operating limit is reached. d) With its independent protection algorithm which is based on absolute core thermal limits, the ATLM allows for automated control rod operation. The RBM will not be able to allow for automated control rod operation because it is not based on absolute core thermal limit and it assumes the core is always on or having a margin from the operating limit. Consequently, it cannot automatically provide the operating limit protection the ATLM can for automated control rod operation where repeated requests are made to withdraw a control rod that would result in a thermal limits violation if allowed to proceed if only RBM is used.