On Budget and Ahead of Schedule.)

aA One day, all power stations will be made this ways (On budget and ahead of schedule.)

At Sizewell in Suffolk, Britain's first Pressurised Water Reactor is presently under construction.

It's one of the biggest engineering projects ever commissioned in Britain, involving 115 British companies and employing 4.500 people on site. What's more, it's both on budget and well ahead of schedule (to begin generating the first electricity in 1994). The company responsible for the Sizewell B project is Nuclear Electric plc. We own and run

the twelve nuclear power stations in England and Wales, producing well over one sixth of the country's electricity. Since being formed in 1990, we have performed

rather well, with the last twelve months showing nothing but continued improvement. Output is up, productivity is up and unit pro-

duction costs are down. The new addition of Sizewell B to our country's

generating capacity will help ensure a balanced energy supply well into the next century. That's because it's no ordinary power station. It's the shape of things to come.

To visit a Nuclear Power Station, or for more information, write to Nuclear Peter Haslam, Nuclear Electric plc, 123 Pall Mall, London SWlY 5EA. W Electric BE NUCLEAR ENERGY

FEBRUARY 1993 VOLUME 32 NUMBER 1

Nbihdby the Bitish Nuclear Energy 5oilndodce a dsriuedb Contents use, I 4 4. News and comment 2 9 TAnnual dinner and lecture * Japan * UK Fast Reactor R&D * ule.s otherwiesta. Canada refutes Gardner * In Russia * Uranium supply and demand ISSN4:0140-4067 SLecture NucWrEneryispublishedbitmonthly a 50 years of nuclear energy - a glance at the past, a look into the is sent free to BNES members- For nfon- future. C. Lewiner 9 the UK, C11 1in Wsrn Eucpen125 overseas, includIing air poag otside the ,I e Papers Department, ThomasTlfrd s Ltd Special issue on Instrumentation in the Nuclear Industry: papers teepon01-876MS, tele 29810S C G fax 0 3 4 . Cpresented at the seminar held on 6 October 1992 at the addrm should be sent to Sbscriptios Institution of Civil Engineers, which presented a cross-section of Records D t T achievements and developments in instrumentation throughout the Avedisients nuclear industry. Rtes are aail froSean amy 1al18sThomas TBNFL THORP plant radiometric instrumentation. H. F. Hampson 15 Sizewell 'B' nuclear sampling system. 0. C Hills 23

r -e Application of acoustic instrumentation for use in liquid metal fast o breeder reactors. T. Lennox, J. A. McKnight and R. Rowley 29 1-7 Great George Ste, L n 5 Developments in digital instrumentation for Nuclear Electric's (UK) power plant. G. Hughes and D. B. Boettcher 41 Phoocpying~ in the USA, beon at A new development in personnel monitoring. R. J.Fletcher 53

- Total process surveillance (TOPS). J. H. P. Millar 57

h c C Cover photo: Thirty exponential piles resembling this one were built to furnish to C basic information before the construction of the first nuclear reactor. These s piles were akin to modern criticality experiments of preliminary pile assemblies, Ar falthough, as the papers in this issue demonstrate, far more care is now taken in the monitoring and instrumentation of such tests! (Courtesy: Argonne National Laboratory).

Editorial Board Chairman and Honorary Editor. Dr V.S. Crocker Thoas Td S e Ld Members: F.J.L. Bindon, Consultant, K.T. Bowes, NNC Ltd, Knutsford; Dr P.J. Bramah, UKAEA, Springfields; K. Gilmour, Rolls Royce & Associates; M. Griffiths, Taylor Woodrow, statentme or oD. Grundy, BNFL pk; C.M. Hall, Nuclear Electric pic, D.T. King, retired; Dr E.A. Little, UKAEA, Harwell LaboratoWy; A. Martin, Consultant: K.S.B. Rose, AEA Technology, Harwell; A. Rowe, thattethor of te cUKAEA, Culcheth; J.B. Sayers, AEA Technology, Winfrith; R. Strong, retired; Dr B.O. Wade, UKAEA, Harwell Laboratory; Dr S.P. Walker, Imperial College of Science, Technology and Medicine Corresponding Members: G.W.K. Ford, AEC, Australia, Sutherland, NSW; P.H. Spencer, Electncity Supply Commission, South Africa; Dr C.Wood, Electrical Power Research Institute, USA; E.C.W. Perryman, Canada Branch Chairmen: S.Gordelier (Western Branch), Nuclear Electric pk; B.A. Keen (North- n West Branch), NNC Ltd, Knutsford Ltd, Dorester. - Production Editor: S.R. Temblett Executive Secretary: P.A.F. Bacos Annual Dinner and Lecture

The BNES Annual Lecture, which preceded the industry's 1992 Annual Dinner, was once again a great success. Madame Lewiner's lecture is printed in full in this issue and shows in clear terms the approach of France to nuclear power in many aspects - including recruitment and Madame Lewiner's own thoughts. It was interesting to note her suggestion of using women for the promotion of nuclear power. This is an idea that needs pursuing but would it be sensible in the UK with the small numbers of women working in the industry on the technical side? The Annual Dinner organized by BNES, the Institute of Nuclear Engineers and BNF had an attendance of 827, and well merited the numbers. With an excellent lecture, a well chosen menu and an after dinner talk by Sir Bernard Ingham that will be remembered for its jokes, caustic comments and advice for many years to come, the evening can be claimed a memorable success. Such events enable personnel within the industry to meet each other, discuss problems and in general get to know each other in an informal atmosphere. Let us hope that they will continue. Next year's dinner is already being planned. a

Top right: Madame Lewiner, President of the European Nuclear Society, delivering the Annual Lecture 50 years of nuclear energy - a glance at the past, a look into the future.

Top left: Dr Pooley, President of the BNES addressing the 1992 Annual Dinner.

Bottom: Dr Pooley presenting the Powden Prize to Mr G. Hughes of Nuclear Electric, for his paper Remote measurement of LMFBR subassembly outlet temperatures by ultrasonics published in the August 1992 of Nuclear Energy.

Nud. Energy, 1993, 32, No. 1, Feb., 2-8 Nuc. Energy, 1993, 32, No. 1, Feb. NEWS AND COMMENT Japan

Recent editions of Atoms in Japan at about the same stage as France and programme, the engineering design show Japan's continued commitment 4 to 5 years behind the USA. A activity of which will start in 1993. to nuclear power. In July 1992 Japan chemical process is also being Some £32 million is also required to had 42 nuclear power plants in developed. The technique is start clinical testing of heavy particle operation with a gross capacity of considered technologically mature and beams for cancer treatment - Eastern 3340 MW(e). By the end of 1993 by the adjustment of plant scale it is Europe and the former Soviet Union three more plants should be in thought possible to reduce enrichment are not forgotten, with some £19 operation and nuclear electricity cost below present USDoE prices. million being requested for safety generation should approach 30% of An Advisory Committee on assurance work on nuclear plants. total capacity. Uranium Enrichment looking at the Elsewhere within the budget £6-5 total Japanese situation recently million is requested for Soviet Union Enrichment concluded that the development of related work for microphone systems Although there is an oversupply both AVLIS and MLIS should be to be installed to detect coolant situation in the world's uranium continued but that the development to leakage in two plants, the training of enrichment market, Japan has, over the next transition stage should be Russian engineers in Japan and visits the years, developed its uranium postponed because set technical levels to Russia. It is planned to modify the enrichment technology. At present it is had not been reached. This decision core and cooling system of JOYO, the using so-called conventional metallic was reached in the light of the experimental fast reactor, to enable its drum centrifuges and has a capacity of enrichment oversupply situation, with power to be raised from 10 MW to 14 150 000-300 000 SWU/a. According Japan presumably thinking that time MW. This increase, which will be a to October 1990 targets, Japan's was on its side. boost for the irradiation testing of installed nuclear capacity in 2000 materials, will cost about £120 should be 50 500 MW with 72 5000 1993 nuclear budget million. Next year it is intended that MW by 2010. On this basis the Nuclear budget proposals for the PNC will start the construction of the uranium enrichment requirements will fiscal year 1993 show a substantial RETF at the Tokai Works. This be about 6 million SWU/a in 2000 and increase from those for 1992. In facility will confirm the reprocessing 8 million SWU/a in 2010. September, the Atomic Energy technology for fast breeder reactor Japan Nuclear Fuel Ltd (JNFL) Commission said that the requests fuel will cost more than £500 million plans to expand the capacity of its would amount to 1190 683 million over the next five years. Nearly £40 Rokkasho Enrichment Plant by (-£978 million, T195=£l) in the million is being allocated towards the 150 000 SWU/a to yield a capacity of general account (up 3.4%) and construction of a new high 1-5 million SWU/a by 2000. Japan's 1260 882 million (-£1338 million) in temperature test reactor, with initial policy is to have a certain level of the special account from power criticality in 1998 (1996 previously). domestic enrichment capacity and resource development (up -8%) The spend on Mutsu, Japan's nuclear technology. It recognises, however, totalling £2316 million, up some 6%. ship, is also intended to continue. that its present centrifuges are not The budget proposals are wide Some £20 million is being requested competitive economically and it thus ranging and a number of examples and for 1993, for decommissioning, intends to develop more advanced highlights are given below, maintenance and management of machines and research other possible The Science and Technology Mutsu related facilities, research on enrichment technologies. Agency have requested £36 million for improving marine reactors and High performance machines, which the international fusion ITER (continued on page 8) are longer and spin faster than the present machines, are planned using advanced materials. If this plan proceeds smoothly the last 450 000 UK Fast Reactor R&D SWU/a out of the planned 1-5 million SWU/a by 2000 will be supplied by high performance centrifuges. Later Though the 'coal review', with its collaborated effectively with European the early metallic drum machines will possible implications for nuclear partners, the government decision be replaced by the high performance power, should be prominent when this looks untimely, particularly as there type. issue of Nuclear Energy is published, appears to be a resurgence of interest Research is also taking place on the government's decision to cease in a number of countries. Atomic Vapor Laser Isotope funding fast reactor research and The nuclear industry, for reasons Separation (AVLIS) and Molecular development from April 1993 needs which are not technical, looks Laser Isotope Separation (MLIS). It some comment. Commercially the case particularly vulnerable at present and would appear that a target enrichment for fast reactors is strategic and not it is to be hoped that the 'coal review' of 5 % has not been obtained with short-term. In such a circumstance it will not cast yet another blow on the MLIS whilst on AVLIS it is reported is sensible that fast reactor develop- industry. In these circumstances it is that though the enrichment target has ment is a partnership between industry important that the merits of nuclear been reached, the main target of 5% and government - as in Japan, France power and the UK nuclear industry enrichment at 1000 SWU/a has not. and the USA. Also, having devoted so are promoted as strongly as On AVLIS it is thought that Japan is much effort to fast reactor R&D and possible. ai

Nuc. Energy, 1993, 32, No. 1, Feb. 3 NEWS AND COMMENT Canada refutes Gardner An epidemiological study of childhood of unexposed fathers. An odds ratio of There was no evidence (Table 1) of leukaemia in relation to the pre- greater than I -0 indicates a higher an elevated leukaemia risk in relation conception occupational exposure of risk among children of exposed fathers to any exposure period prior to fathers to ionizing radiation has been but it is necessary to consider the conception (lifetime, six month or 3 carried out by an academic team for confidence intervals (CI) and tests of months) or to any exposure type the Canadian Atomic Energy Control statistical significance computed for (total, external or tritium). Also there Board. The study had twice as many each result, was no significant gradient of effect cases of childhood leukaemia as the study around Sellafield by Gardner et Table 1. Comparative fequency of cases and controls among different parental al and had ample statistical power to exposure periods and their statistical significance check the Gardner result. However, the Canadian study found no evidence Paternal exposure Cases Controls Odds 95% Cl LR test (1 df) of any significant effect of parental (n= 112) (n=890) ratio and p value radiation exposure on childhood leukaemia. Total whole body dose (tenW pis tritam): roSv The study team from the Before conception Universities of Toronto and British 0 106 837 1-00 - 0-08 ColombiaiandotheoOnto an r 01 6 53 0.87 0-32-2-34 p=0.78 Colombia and the Ontario Candaer During 6 months prior to conception Treatment and Research Foundation 0 107 849 1.00 0.00 employed a case-control methodology. -0.1 5 41 0-96 0.34-2-77 p=0- 95 The cases comprised 112 children During 3 months prior to conception aged 0-14 years who died from or 0 107 849 1.00 - 0.00 were diagnosed with leukaema during .1 5 41 0.96 0.34-2.77 p=0. 9 5 1950-88 and whose mothers resided Before diagnosis in the vicinity of an operating nuclear 0 103 826 1-00 - 0-15 f_0-I 9 64 1.19 0.51-2-73 p=0.70 facility on Ontario. For every case, 8 External whole body dose: roSv controls who had not developed Before conception leukaemia were selected and matched 0 106 837 1-00 - 0-08 for date of birth and mothers place of _0-1 6 53 0.87 0-32-2-34 p=0-78 residence at the time of birth. Six of During 6 months prior to conception the control children died prior to the 0 107 850 1 00 - 000 development of leukaemia in their >0.1 5 40 1.00 0.34-2-87 p=0.99 associated case and had to be During 3 months prior to conception discarded, leaving 890 controls for 0 107 850 1.00 - 0.00 comparison with the 112 cases. 5 40 1-00 0-34-2-87 p=0-99 Domaaonw the upati l iatn Before diagnosis Data on the occupational radiation 0 103 826 1.00 - 0.15 exposure of the 1002 fathers were _0-I 9 64 1.19 0.51-2-73 p=O.15 obtained through the Canadian Triiu dose (internal whole body dose): jnSv National Dose Registry and subsequent Before conception examination of employees' records. A 0 112 876 1-00 - Exact test* total of 95 fathers had a record of 0-I 0 14 0.00 - p=0.25 occupational exposure; 52 were During 6 months prior to conception reactor workers, 31 uranium miners, 0 112 880 1.00 - Exact test* 10 in other industries, I medical 20-1 0 10 10wioher ndusries, 1nwmedicaDuring 3 months prior to conception 0-00 - p=0-40 worker and one unknown occupation. 0 112 880 1-00 - Exact test* Radiation doses were largely due to a0-1 0 10 0.00 - p=0-40 external gamma radiation but also Before diagnosis included tritium in the case of reactor 0 111 869 1-00 - 1-29 workers and radon for the uranium a0-I 1 21 0.36 0.05-2-77 p=0.26 miners. The doses were evaluated for Radon exposure (internal lung dose): WLM the father's whole life up to con- Before conception ception, during the six months prior to 0 108 868 1-00 - .12 conception, during the three months 20-.I 4 22 2-80 0.39-20.0 p=0.29 During 6 months prior to conception prior to conception and for the father's 0 108 873 1-00 - 2.54 whole life up to the month of ao-l 4 17 5-17 0-53-50.1 p=0-11 diagnosis of leukaemia in his child. During 3 months prior to conception The statistical analysis of the data 0 108 873 1-00 - 2.54 included the calculation of the odds >0.1 4 17 5-17 0-53-50-1 p=0-ll ratios by means of conditional logistic Before diagnosis regression analysis. An odds ratio of 0 107 866 1-00 - 3.40 1 .0 indicates that the risk of 0.1 5 24 7-89 0.68-91.0 p=0.07 leukaemia in the children of exposed Abbreviations: C1 = confidence interval; LR = likelihood ratio; *Fisher's exact test fathers is equal to that in the children df = degrees of freedom p = probability. 4 Nuc. Energy, 1993, 32, No. 1, Feb NEWS AND COMMENT

Table 2. Comparative frequency of Paternal exposure Cases Controls Odds 95% CI LR test (I d) cases and controls (n= 112) (n=890) ratio and p value with increasing dose (Table 2). The Total whole body dose (external plus tritium): roSv largest but least stable relative risk Before conception estimates were related to uranium 0 106 837 1-00 - 0.19 (2) mines. Only five cases of childhood 0.1-49 4 39 0-80 0.26-2-47 p=091 leuakaemia were found in the region -50 2 14 1-09 0-21-5-55 surrounding the Elliot Lake uranium During 6 months prior to conception 0 107 849 1-00 - 0.14 (2) mines, so information relating to 0-1-4-9 2 20 0-80 0-17-3-66 p=0-93 radon exposure arose from those five 2:5 3 21 1-13 0-30-4-21 matched sets of cases and controls. Before diagnosis Given that statistical significance was 0 103 826 1-00 - 0-79 (3) not achieved, that the majority of 0-1-49 6 39 1.27 0.49-3-32 p=0-8 5 radon dose would be to the lungs 50-99 1 14 0-62 0-07-5-00 rather than other tissue and that a pre- >100 2 11 1-57 0-26-9-60 vious study found no raised incidence External whole body dose: mSv of childhood leukaemia in this region, Before conception 0 106 837 1-00 - 0-37 (2) it was concluded that the observations 0-1-49 4 41 0-77 0-25-2-36 p=0- 83 were due to random variations a50 2 12 1,29 0-23-7-00 associated with small numbers. During 6 months prior to conception It was concluded that there was no 0 107 850 1-00 - 028 (2) association betwen childhood 0.1-4-9 2 21 0-77 0-17-3-49 p=0- 87 leukaemia and the occupational ;:5 3 19 1-27 0-33-4-82 exposure of fathers to ionizing Before diagnosis radiation prior to conception. This 0 103 826 1-00 - 0.51 (3) finding is not consistent with the 0 -1-49 6 41 1.21 0-47-3-13 p=0-68 50-99 1 15 0.61 0-07-4-82 0-27 (1)* Gardner et al result from a study of _100 2 8 3-00 0-33-27-3 p=0.60 children born in the vicinity of Radon exposure (internal lung dose): WLM Sellafield. Using data published in the Before conception two studies it is calculated that there is 0 108 868 1.00 - 1.86 (2) only one chance in 500 (p=0-002 ) 0-1-49 2 16 1-89 0-21-17-3 p=0-39 that the odds ratio of 8-2 reported by -50 2 6 5-14 0.48-55.2 1.83 (1)* Gardner et al (for fathers with a p=0- 18 whole body dose of > 10 mSv in the During 6 months prior to conception six months prior to conception) could 0 108 873 1.00 - 2-54 (2) 0-1-4.9 3 13 5-30 0-48-58-5 p=0-28 be correct on the basis of the new 5 1 4 4-92 0-29-82-8 1-78 (1)* Canadian results. p=O- 18 Gardner et al also raised the Before diagnosis possibility that the Sellafield findings 0 107 866 1.00 - 3-39 (2) could be due to exposure to chemicals. 01-49 3 16 7.43 0-54-103 p=O-18 For the majority of the nuclear a50 2 8 8.54 0.54-135 2.52 (1)* workers in Ontario this seldom p=O-11 occurs. 0 Abbreviations: CI = confidence interval; LR = likelihood ratio; *Test of linear trend df = degrees of freedom p - probability. Nuclear power in Russia Location Type No. of Capacity: Year of In 1991, Russian nuclear generation units MWe net shutdown totalled 170 TWh. The nuclear share Novovoronezh VVER-440, 1000 3 1720 2001-2010 of total generation is 11 -4%, but this Kola VVER-440 4 1644 2003-2014 rises to 23-4% in the European part Kalinin VVER-1000 2 1900 2014-2016 of Russia. Balakovo VVER-1000 3 2850 2015-2018 There are 28 operating units and 9 all VVERs 12 8114 sites in the Russian Federation (see Table) with a total capacity of Leningrad RBMK-1000 4 3700 2003-2011 19 693 MW(e) net. In 1991 there were Kursk RBMK-1000 4 3700 2007-2015 165 unplanned events. Of these, 125 Smolensk RBMK-1000 3 2775 2012-2020 were classed below the lowest level of all RBMKs 11 10975 the INES . Six were classified in Belojarsky BN-600 1 560 2010 Level 1, two at Level 2 and two at Bilibino EGF-6 4 44 - Level 3. 45 events resulted in unscheduled shutdowns, 1 -61 per other types 5 604 reactor. all stations 28 19693

Nucl. Energy, 1993, 32, No. 1, Feb. 5 NEWS AND COMMENT Conference and meetings calendar

BNES Fusion Nuclear science

28 April 1993 20-23 April 1993 3-8 April 1993 Conservation and uncertainty in Dense Z-pinches, 3rd international Radiation chemistry, Miller seismic design, seminar, London conference, Imperial College, conference, CRC Gray Lab., 10-13 May 1993 London, UK Windermere, UK Remote techniques for nuclear 7-9 June 1993 19-23 April 1993 plant, international conference and Plasma science, international Mathematical methods and exhibition, Stratford-upon-Avon, UK conference, Inst. Nuc. Phys. Acad. supercomputing in nuclear 20 May 1993 Sci. Russia, Novosibirsk, CIS applications, international Environmental risk assessment 27 September-I October 1993 conference, ENS/OECD-NEA et al, and management, seminar, Fusion reactor materials, 6th Karlsruhe, Germany London, UK international conference, JRC Ispra, 13-14 July 1993 20 May 1993 Stresa, Italy The bicentenary of the birth of Annual General Meeting, London 11-15 October 1993 George Green, a celebration, Fusion engineering, international R. Soc/loP/Univ. of Nott. et al, symposium, IEEE, Hyannis, USA Nottingham, UK 19-23 July 1993 Control__and_ Nuclear and space radiation ntro a in effects, international conference, Nat. Lab., Snowbird, USA instrumentation Nuclear market 2-5Sandia November 1993 Nuclear science, symposium, IEEE, 3-10 February 1993 San Francisco, USA 18-21 April 1993 Nuclear market trends and utility 12-17 December 1993 Nuclear plant instrumentation, partnering, conference, ANS, Chemistry and migration control and man-machine interface Amelia Island, USA behaviour of actinides and fission technologies, conference, ANS, 28 February-3 March 1993 products in the geosphere, 4th Oak Ridge, USA Nuclear insurance, conference, international conference, Univ. 20 April 1993 US Council for Env. Awareness, Georgia/IAEA, Charleston, USA Activators, sensors and San Diego, USA 10-16 April 1994 instrumentation, meeting within 14-16 April 1993 Methods and applications of Annual Physics Congress, loP, Japan Atomic Industrial Forum, radioanalytical chemistry, 3rd Brighton, UK 26th annual conference, Tokyo, international conference, ANS, Japan Kona, USA 11-14 April 1994 Advances in teactor physics, Energy Nuclear fuel and topical meeting, ANS, Knoxville, USA 5-8 April 1993 Nuclear technology Global warming: a call for international co-ordination, 4th 21-24 March 1993 international congress, Global Fuel cycle, conference, US Council 21-24 March 1993 Warming International Centre, for Env. Awareness, Dallas, USA Nuclear engineering, 2nd Chicago, USA 8-10 September 1993 international conference, ASME/ 3-7 August 1993 Uranium and nuclear energy, 18th JSME, San Francisco, USA Energy conversion engineering, annual symposium, Uranium 20-21 April 1993 28th intersociety conference, IEEE, Institute, London, UK Modern methods in stress and Atlanta, USA 3-6 October 1993 relaxation analysis, conference, 23-24 September 1993 Uranium seminar, US Council for IoP, Sheffield, UK Power generation choices: costs, Env. Awareness, Tucson, USA 25-28 April 1993 risks and externalities: an 17-21 April 1994 Towards the next generation ight international perspective, Light water reactor fuel water reactors, topical meeting, international symposium, performance, international ENS, The Hague, Netherlands OECD-NEA/ORNL, Washington, conference, ANS, West Palm 25-27 May 1993 USA Beach, USA Nuclear technology, annual 6 Nucd Energy, 1993, 32, No. 1, Feb, NEWS AND COMMENT meeting, GAF/GNS, Cologne, 26-29 April 1993 6-10 June 1994 Germany Robotics and remote systems, 5th Radiation protection, IRPA 21-24 June 1993 topical meeting, ANS/ORNL, regional congress, NRPB et al, Zirconium in the nuclear industry, Knoxville, USA Portsmouth, UK 10th international symposium, 10-13 May 1993 ASTM, Baltimore, USA Remote techniques for nuclear 25-29 July 1993 plant, international conference, Safeguards Pressure vessel and piping, BNES, Stratford-upon-Avon, UK conference, ASME, Denver, USA 16-18 August 1993 1-5 August 1993 Reactor operating experience, 16th 11-13 May 1993 Environmental degradation of biennial topical meeting, ANS, Long Safeguards and nuclear materials materials in nuclear power Island, USA m ement, 15th annual systems, 6th international 13-18 November 1994 symposium, ESARDA, Rome, Italy symposium, Westinghouse, San Human factors in nuclear power Diego, USA operations, topical meeting, ANS, 15-20 August 1993 Washington, USA Structural mechanics in reactor Safety and technology, 12th international conference, Univ. Stuttgart, reliability Germany Radiological 8-10 September 1993 Modelling and simulation for the protection 22 March 1993 nuclear industry, international The transportation of hazardous conference, INucE et al, Glasgow, cargoes by sea, IBC, London, UK UK 1-2 April 1993 25-29 April 1993 12-15 September 1993 Radiation protection Emergency preparedness and Future nuclear systems: emerging measurements: theory and response, 4th topical meeting, fuel cycle and waste disposal practice, meeting, SRP, Oxford, ANS, Long Island, USA options, international conference, UK 19-23 May 1993 ANS, Seattle, USA 7-8 April 1993 Safety and reliability, European 3-7 October 1993 NCRP 29th annual meeting, conference, Eur. Safety and Rad. International nuclear congress and Arlington, USA Soc., Munich, Germany exhibition, AECL/CNS/CNA, 19-22 April 1993 19-23 September 1993 Toronto, Canada Molecular mechanisms inradiation Physics and methods in criticality 5-8 October 1993 mutagenesis and carcinogenesis, safety, topical meeting, ANS, Nuclear thermal reactor international seminar, CEC/US DoE Nashville, USA hydraulics, 6th international topical et al, Doorwerth, Netherlands 13-14 October 1993 meeting, CEA/IAEA, Grenoble, 20-22 April 1993 Engineers and risk issues, annual France Radiation protection optimization, conference, Safety & Rel. Soc., 2-6 October 1994 4th European seminar, CEC, Manchester, UK European nuclear conference and Luxembourg 26-28 October 1993 exhibition, ENS/Foratom, Lyon, 5-7 May 1993 Nuclear power plant safety France Individual monitoring of radiation, standards, international conference, international conference, CEC et al, IMechE, London Villigen, Switzerland 24-27 May 1993 Operation, Measurement assurance in dosimetry, international symposium, Waste management maintenance and IAEA, Vienna, Austria 29 August-3 September 1993 Reactor dosimetry, 8th ASTM- 28 February-4 March 1993 Euratom symposium, ASTM/CEC, Waste management, symposium, Vail, USA ANS/IAEA, Tucson, USA 10-11 February 1993 31 August-3 September 1993 25-29 April 1993 Decommissioning of nuclear Environmental transport and High level radioactive waste facilities, international conference, dosimetry, topical meeting, ANS, management, international IBC, London, UK Charleston, USA conference, ANS et al, Las Vegas, 27 February 1993 14-17 September 1993 USA Past operation of Nuclear Electric Intakes of radionuclides, detection, 14-18 June 1993 plc power stations, evening assessment and limitation of Safe management and disposal discussion meeting, IMechE, occupational exposure, workshop, of nuclear waste, international London, UK CEC/USDoE/NRPB, Bath, UK conference, FNES/ENS, Avignon, 19-21 April 1993 24-27 April 1994 France Diagnostic and maintenance Radiological assessment: assessing 5-11 September 1993 techniques, international the impact of nuclear facilities Nuclear waste management and symposium, Conf. Int. des Grandes on human health and the environmental remediation, Res. Elec. a Haute Tension, Berlin, environment, topical meeting, international conference, ASME Germany ANS, Arlington, USA et al, Prague, Czech & Slovak F.R. Nuc Energy, 1993, 32, No. 1, Feb. 7 NEWS AND COMMENT Uranium supply and demand

The Uranium Institute recently issued together with about 100 tonnes of countries, supply will contine to a report Uranium in the New World plutonium. Similar quantities should outstrip demand (approaching 30 Mt Market - A statistical update of also be available from the USA. of SWU/a in 2010) and it is noted that supply and demand 1991-2010 which However, the timing and availability is Russia could make available 10 Mt of contains a wealth of uranium-related obviously uncertain at present. SWU/a of enrichment, which might data. Included in the report, support- Substantial uranium savings can be well be needed if the USDoE closed ing the discussion on uranium require- obtained from recycling. By the year one of its diffusion plants. In any case ments, is a wide-ranging survey of 2010, the savings from the use of Urenco, with its centrifuge technology, world-wide national nuclear power MOX (mixed oxides) could amount to can construct plants rapidly and could programmes with a forecast to the 2200 tonnes natural uranium probably quickly fill some gaps. year 2010. This survey gives a good equivalent per year, and from REPU The report notes that with the insight into the plans and aspirations, 3100 tonnes. Such quantities would gradual breakdown of East-West or otherwise, of a number of countries, make a notable effect on the future barriers, estimates of world supply Several unplanned events in 1991 have demand for uranium. and demand should theoretically be affected the forecast. For instance, Enrichment supply and deu runs possible but the information from Ontario-Hydro revised its plans, which in parallel with that of uranium. many Eastern countries is far from has led to proposed nuclear power World demand for enrichment appears reliable. This also applies to plants being delayed, and North Korea to pose no problem. In western stockpiles. o revealed its future nuclear programme. The demand for nuclear fuel for a reactor is influenced by such factors as load factor, recycling, burn-up, enrichment etc. It is interesting to note the increased burn-up levels forecast. Japan (continued from page 3) Plant. There is also a substantial It is anticipated that they will rise thermohydraulic work. One of the budget request for radiological and reasonably steadily from about 38 000 largest budget items is the Monju, the safety work and facilities. MWd/t in 1990 to approaching 46 000 Japanese prototype fast reactor, which In general, the requests indicate MWd/t in the year 2010. To match should go critical in 1993. Almost Japan's determination to complete the these figures, uranium enrichment £260 million is allocated for fuel cycle and be at the forefront of must also increase, rising from under performance testing and related other research and development - for 3-4% to almost 3.9%. The world- technical development. A much example fast reactors. Whether this wide demand for uranium for reactors expanded (90%) budget of £13 million drive, which unfortunately is not seen over the same period rises from about is requested for the operational in many other countries, will be fully 53 000 t/a in 1991 to about 62 500 t/a expenses for a plutonium conversion successful, can only be judged in the in 2000, remaining flat over the rest facility. The facility will be upgraded, future - but it will not be for the of the period to 2010. making good use of the planned want of trying and effort and An event that appears to have gone shutdown of the Tokai Reprocessing commitment. a unnoticed is that during 1991 the Western world's one millionth tonne of uranium was produced. (Up to that date the figure for the Soviet Union, China and Eastern Europe totalled 720 000 tonnes of uranium). Uranium production appears to be stretchable, but if the planned production figures are used, a gap develops between production and demand around the t Socity year 2000 and new facilities will have w d t a a o rn a w1c r of r- to be constructed or futher material obtained from the Commonwealth of of t Si io to member of a s Bodies, and Independent States, or even perhaps to o t tisfy th Boar of tbe Sociey tha they we actively engd or from the Russian stockpile or from mhein p itifitechical aspecs of tb of any redundant military material. nuclear e y an itancllary sujects. Oversa members e weome the The production demand is affected Soi hambers in many conres. not only by recycling but also by the T Cnttuen Bodies of the Society copise ten of the mt importan pro- availability or military plutonium and engin=mg a si in the UK. highly enriched uranium (HEU). The Isite o possible availability of plutonium and S of HEU is substantial. Some 500 tonnes I o of HEU could be available from nuclear warheads and the strategic stockpile in the former Soviet Union,

8 Nuc. Energy, 1993, 32, No. 1, Feb. 50 years of nuclear energy - a glance at the past, a look into the future*

C. Lewinert

A glance at the past were almost exclusively Europeans. Great Britain paid a It is 50 years today since Enrico Fermi succeeded in special contribution to the knowledge of the nucleus, with controlling the first chain reaction of nuclear fission in Lord Rutherford of Nelson and Sir James Chadwick, whereas Chicago, on December 2nd, 1942. This date is important the French contribution was more orientated towards radio- because: activity, with Henri Becquerel, Pierre and Marie Curie and Irine and Frederic Joliot-Curie. The last pair had forecast (a) it is associated with the birth of nuclear energy and the energy use of nuclear physics and had taken out patents to a larger extent of the nuclear industry (b) 50 years is a very short period in the history of on this matter. humanity. There are almost as many years between History's tribute to nuclear energy the discovery of radioactivity, that is to say of nuclear We do not need to be reminded of the political climate that physics (by Becquerel (1896)), and Fermi's demon- prevailed in Europe in the 1940s, but it had a crucial impact stration, as between Fermi's demonstration and on nuclear energy development. The atomic research circle today. This means that nuclear energy is young and moved from Europe to the USA, as many European scientists that nuclear energy is truly a 20th century conquest emigrated before and during World War II as democratic that has achieved great results within 30 years of and economic conditions were more favourable in the USA. industrial application However, European researchers tried to be active or at least (c) Fermi's demonstration took place in the USA but to watch over what was going on. War delayed the European Europe is the actual birthplace of the atom. This part nuclear effort. Military challenges accelerated research work of the world made and is still making a tremendous on the other side of the Atlantic where atomic scientists were contribution to nuclear science, technology and given the means to proceed with their work. Nuclear energy energy. benefitted from it even if it suffers for a long time, if not forever, from the impact of its first use for military purposes. Europe, the matriarch of nuclear energy Hiroshima remains a worldwide nightmare in the public The European contribution to the science of the atom dates conciousness. back to ancient Greece. In 450 BC, a philosopher named Leucippe formulated the concept of the atom by developing Women nuclear pioneers a theory, according to which materials cannot be indefinitely Before turning to today's achievements, I would like to divided and used the word 'atoms'. Modern Atomic theory come back to nuclear pioneers. Two French women were appeared in the 19th century and was derived from theories mentioned, Marie Curie and Irime Joliot-Curie, but they are and hypotheses made by European (Danish, Russian, English not the only ones - Ida Noddack (Germany) and Lise or French) chemists and physicists, among whom I would Mietner (Austria) and Maria Goeppert-Mayer and Rosalind like to mention John Dalton who, in a sense, continued what Yalow (U.S.A.) - as they were of European origin, if not Leucippe started. born in Europe - may be mentioned for their part in the Greek mythology was also referred to when the latest development of nuclear energy. Five Nobel prizes were elements discovered had to be named - uranium, plutonium, attributed to four of them, Marie Curie having the privilege neptunium. to receive it twice, in physics and in chemistry. The feminine The 20th century has witnessed the development of the contribution to nuclear energy should be emphasized as it status of nuclear physics. The pioneers of nuclear energy coincides with the access of women to scientific studies and careers. Lecture preseoW at the BNES Annual Dinner held n Lndort Decembr The role of women has not been restricted to scientific 1992 tPresident, European Nuclear Society aspects, for they are also present in energy policy circles.

Nuc. Energy, 1993, 32, No. 1. Feb., 9-14 9 LEWINER

In this respect, the nuclear women pioneers were probably Table 1. Countries in which nuclear power contributes to more North American, with Dixy Lee Ray, first woman President than 25% to electricity generation: (1991) IAEA figures of the United States Atomic Energy Commission, and more recently with Mrs Gail de Planque, first woman appointed Country Part of nuclear power commissioner of the Nuclear Regulatory Commission. Last, France 73% but not least, women are now operating nuclear power plants, Belgium 60% Sweden 52% not only as technicians. In France, since 1988, Units 3 and Hungary 48% 4 of Le Blayais nuclear power plant, near Bordeaux, are South Korea 47% under the direction of a 40 year old woman, Martine Griffon- Switzerland 40% Taiwan 38% Fouco. At the initiative of the ENS WIN program (Women Spain 36% in Energy), last May in Helsinki a survey on the situation Bulgaria 34% was launched. We expect Finland 33% of women in the nuclear industry Czechoslovakia 29% to have a precise picture for the next meeting in July 93 in Germany 28% Paris. Japan 27% As regards France, 900 women undertake nuclear activities Slovenia 25% in Electricitd de France, where they represent 5% of EDF nuclear staff (21 500 persons). In the French Atomic Energy natural resources and energy independence is a key Commission (CEA) 910 women have nuclear-related factor in their energy policy activities, representing 4.5 % of the CEA staff (20 000 (c) their prerequisites for economic development lies in persons) and 18% of all women. Women are present in a growing energy demand as well as in a competitive nuclear energy and their number should increase in the future energy production. with hiring policies directed at women and with women gaining better qualifications in science and technology. Western European countries may be divided into thee Another reason for promoting women in the nuclear industry categories is that in public opinion, women are less favourable towards (a) the countries that do not rely on nuclear energy nuclear energy than men. 'Nuclear women' may serve as - Austria, Denmark, Greece, Iceland, Ireland, examples and as agents of communication. Luxemburg, Norway and Portugal (b) the countries that have developed nuclear energy Nuclear energy on December 2nd, 1992 production units but have a moratorium on nuclear On December 2nd 1942, Fermi demonstrated that it would energy - Italy and Sweden. In Italy, nuclear genera- be possible to control the fission of the atom, but it took some tion has been completely stopped for electricity pro- years before nuclear electricity was produced on an industrial duction but it would appear that in its next energy scale but within less than fifty years, nuclear energy achieved plan, the Italian government believes that the impressive results. development of nuclear energy is necessary. In Sweden in 1980, a popular vote decided that the Europe in a pole position nuclear programme would not be extended and the By the end of 1991, 420 nuclear power plants were in Swedish Parliament fixed 2010 as the target closing service in 25 countries throughout the world, representing date for all 12 nuclear units. More recently, in 1990, 17% of electricity production, and 76 nuclear power plants an opinion poll showed that 58% of the public was were under construction. 14 countries rely on nuclear energy in favour of nuclear energy. In 1991, a resolution to meet more than 25 % of their electricity needs. Among was adopted to suppress any reference to a date for these countries, 11 are European - France comes first with stopping the nuclear power plants. From the 75% of nuclear electricity (see Table 1.); in Great Britain, examples of these two countries in which rather the nuclear share amounts to more than 20%. For EC the radical measures were decided against nuclear nuclear electricity share is 30%. energy, we find reasons to be confident in the future If we consider the operational lifetime of reactors, by of nuclear energy, although this doesn't mean it will December 31st 1991, Western Europe totalled 2300 reactor/ be easy, nor must we take it for granted. years without accident, against 1800 years for the USA. (c) the countries that are relying on nuclear energy. Most However, the nuclear energy situation in EC countries shows of these are operating nuclear power plants but are a great disparity as countries have adopted different energy facing some difficulties in the construction of new policies even if they share similar characteristics, such as units. If the need for additional units may not appear urgent in a recessionary period, but the construction (a) they have a high level of technology and highly of a nuclear power plant takes about 6 to 7 years - qualified technicians tomorrow's production must be decided today. Only (b) some, if not most, of them do not have significant two European countries have nuclear power plants

10 50 YEARS OF NUCLEAR ENERGY

under construction - Great Britain, with Sizewell independent body insuring a 'peer review'. This is already B and France with Civaux. Until very recently partially achieved within IAEA but one could find an Finland also had a nuclear project in view. appropriate legal form within an international convention on nuclear safety which is currently in the planning stage and Two accidents rich in consequences which could be freely negotiated by each country. Nuclear energy is young and relies upon rather sophisticated technology. Its short life has been marked by two major The winning cards of nuclear energy accidents: Three Mile Island and Chernobyl. Their causes, There must be some very good reasons why nuclear energy as well as their consequences, cannot be compared but we has achieved such impressive results in such a short time. must be convinced that what we learnt from these accidents I think that the main reason comes from the fact that is essential for a better understanding of nuclear power plants nuclear energy is modern, in its strictest meaning - as well as for the safer operation of existing plants. 'pertaining to the present time'. Three Mile Island (TMI) 1979. This was a major accident It means that nuclear energy is an alternative to the from a technological point of view: the core partially melted challenges today's world is facing but it had no consequences on the environment, or human beings, owing to its design providing a safe containment for (a) a growing demand for energy radioactive releases. Major improvements derived from this (b) a larger concern for the protection of our environment accident were (c) an ever-increasing demand for competitiveness. (a) allowance for the human factor The growing demand for energy. Regarding the first (b) reinforcement of security and control devices and challenge, the growing demand for energy is a prerequisite systems for development, and is more of an absolute necessity for

(c) understanding on how to handle a critical situation. developing countries than for developed countries. According to present estimates, the world population should reach 9 These aspects were very positive for nuclear industry, billion people in 50 years from now. If we make the The negative aspect of TMI were its repercussions in public assumption that the standard of life of this population is half opinion all over the Western world, which led to a stop in that of the USA and that conservation measures only lead the construction of plants, as was the case in the USA, or to an electricity growth equivalent to half of the GNP's a retraction from nuclear energy development in many growth, then electricity consumption should be three times European countries, greater than it is today. Energy production using mainly Chernobyl (1986). The impact of this accident is much fossil fuels might be one of the major endangering factors more important. It affected a Soviet Union nuclear power to our planet if we don't take care. plant and the USSR, for the first time, could not keep a Nuclear energy is gentle on the environment. Energy technological accident secret. Evident weaknesses in the production uses 'natural resources' and when it relies on conception of Soviet nuclear power plants of this type fossil fuels it contributes to the greenhouse effect by emitting (RBMK) as well as in their operation and mainenance were carbon dioxide. The increase in carbon dioxide in our planet's revealed on this occasion. atmosphere is one of the central problems of mankind at the The essential part to be played by containment was turn of the 21st century. It is a man-made phenomenon in confirmed. which energy production and consumption is central. The end of the 'Iron Curtain' encircling the Soviet Union A first step towards reducing the greenhouse effect would and its satellite countries had evident political consequences. be a more efficient use of energy in industrial plants, domestic But this was not the major concern for nuclear energy. What homes and transportation. A second measure would be to is most important for nuclear energy is the consciousness increase national use of electricity generated by nuclear that arose from Chernobyl energy. In this respect, it has been estimated that without nuclear energy is vital for the Central and Eastern nuclear energy, the emission of CO2 due to electricity European countries generation in the EC would be two-thirds higher than at

(b) international solidarity is a must for nuclear energy present, and nuclear power plants reduce CO2 emissions by (c). safety is a key factor for the development of nuclear 700 million tons per year in the EC. The future of nuclear energy. energy can therefore increase or decrease greenhouse gas emissions. According to ENS calculations, CO2 output due Nuclear safety is indeed a major imperative for any nuclear to the entire European electricity sector would rise from the country. If the measures of improvement to be pursued in present 2200 million to 5250 t/a (i.e. x 2 -5) if nuclear power the West or to be undertaken in the East are somewhat were phased out in Europe by 2010 and replaced by coal different, their common target is to develop a safety culture. or gas-fired power stations. In contrast, if Europe doubled The only principle for a satisfactory level of safety is national its nuclear generating capacity over the next 20 years, by responsibility under the international supervision of an 2010, the CO2 output from the electricity sector (including 11 LEWINER

Table 2. Carbon dioxide releases for Europe (in total) for Table 4. Average cost burden of a kWh according to type of electricity sector in million tons per year production (Source: OPEN study 1987)

Scenario 1988 2000 2010 Investment Operation Fuel Total

Actual 2200 - -- Without nuclear 2900 4100 5250 Nuclear 48 22 30 100 Official plans - 3000 3240 Coal (imported) 27 18 55 100 Doubling the nuclear Coal (domestic) 19 !1 70 100 generating capacity - - 1420 Oil 18 i5 67 100 the whole CIS) could be cut from 2200 million t (present Competitiveness of nuclear energy in terms of cost has been level) to 1420 million t (i.e. 55%) (see Table 2). proved for France and also for most other European nuclear Nuclear energy is clean. Another recent concern has been countries (e.g. Belgium, Finland) (see Table 3), provided the handling of waste. In this respect, the nuclear industry that a fair comparison is made between nuclear and other could serve as an example. The nuclear industry is the first sources for electricity generation. Nuclear energy is capital industry to achieve what should be the aim of any industry, intensive but fuel cost is low (see Table 4). i.e. to control its waste. From its origin, the nuclear industry Additional remarks need to be made on the constituent has lain down the prerequisites for the safe handling and costs of energy. disposal of radioactive wastes. Radwaste is carefully monitored throughoutand eptisoatedfrotheth fuelenvronent cycle and mustWesernnucearfossil be managed (a) Fuel costsfuels areto subjecteven larger to market variations price linkedvariations to geo-and and kept isolated from the environment. Western nuclear political events. In this respect, uranium production industry is also the first industry to make use of concentration is better spread throughout the world and reprocess- and confinementdipeson-al of oopythat waste as has opposed prevailed to indilution industry and in ingis of usedspread fuel and th thee recyclingre of of uraniumani and dispersion - a philosophy plutonium is another scapegoat to geopolitical general.prsue Nuclear waste is produced in smaller quantities in com- pressure. parison to the wastes from any other type of power genera- (b) Investment cost for fossil fuel plants will probably tion. A 1000 MW nuclear power plant, supplying electricity be increased in the future by environmental yearto a cityto 2 ofto more3 m3 ofthat high-activity 700 000 inhabitants, waste, plus gives around rise 10 each m3 (c) Dismantlingregulations. costs are included in nuclear electricity of 3 medium-activity waste and 40 of low-activity waste. costs. In France, for instance, 15% of the investment A same size 3 coal power plant produces 200 000 m of ashes cost of a power plant is provided for dismantling by And sam ize noally wplatoducei f 0 e dust. Electricit6 de France. Different types of organization and gypsum annually, without counting filtered dhave been retained by nuclear countries to be sure Nuclear industry has also developed a technology to that the funds for dismantling will exist when neces- reprocess97 herprcssdused itso used fuel and save fuel a natural is fissile resource, fuel and uranium. consists sary.sat OnOn a aor global basis,dismantling dismantling costscst when amount toto 97% of the reprocessed u2 to 5% of the annual cost of production for the of uranium (96%) and plutonium (I %). It is interesting to biggest commercial reactors. This extra cost is keep in mind that 1 gr of Pu contains as much energy as 1 usually included. million gr of oil. Reprocessed uranium and plutonium can (d) Nuclear electricitylueny costs take into account o.r both feed nuclear power plants (breeders or pressurized water costs tkent accunmany ther reactors). Reprocessing of nuclear fuels has not been retained arecosts considered such as environent, as external waste, in the dismantling, case of other that by all nuclear countries. Great Britain and France have a electrici eneration sources. leading position in this field and they even offer foreign ty g companies services in reprocessing their used fuels. Dismantling will be the business of the next century. But Nuclear energy iscompetitive. Competitiveness is the last it already concerns us today, not only for financial reasons but not the least of the challenges of today's world, but because dismantling operations have been started all over the world. We know how to dismantle, we have the technology, for it is derived from the philosophy and rules Table 3. Complete cost of a base load kwh in French that have been adopted on an international basis. Three stages centimes/kWh (Source: DIGEC - Edition 90)indsatnghvbenefedyIAA in dismantling have been defined by LAEA.

Energy sources Cost in French (Actualized costs (a) Stage 1: provisional storage under survey centies in French centimes 199) (b) Stage 2: restricted site release Nuclear 21-22 24-25 (c) Stage 3: total and unconditional site release. Coal 27-32 30-35 Combined cycle We have experience for each stage and for each type of natural gas 28-43 31-47 facility- nuclear power plants or research reactors and fuel

12 50 YEARS OF NUCLEAR ENERGY cycle installations. International co-operation with similar US and Japanese Dismantling started in 1982 and 19 dismantling operations programmes and projects are also of prime importance, as are under way in the frame of the NEA (OECD) co-operative nuclear actors are convinced of the interest and necessity of programme - 13 for reactors and 6 for fuel cycle sites. 7 a greater multi-national dimension enabling them to sell the reactors have already been dismantled to the final stage (No. same product all over the world. 3). By the turn of the century more than 60 nuclear power Last but not least, co-operation continues at the European plants and 250 research reactors will have to be dismantled, level on Fast Breeder Reactors. They should be needed within Nuclear community spirit. Nuclear energy must find its 20 years to insure a sustainable development of nuclear strongest support from the nuclear industry, which is not energy if nuclear energy plays an important role in the energy deprived of all the qualities to ensure the future of nuclear mix, which I personally believe in. energy. Actors in the nuclear industry are few and are inter- Another field for common research is the next stage of national. Specific reasons - the slowing down of nuclear nuclear utilization, that is to say nuclear fusion. energy development after TMI, the capital intensive character of nuclear energy and the limited number of potential What future for nuclear energy? customers - have forced the nuclear industry into anticipat- Nuclear energy's ability to achieve tremendous results or ing the worldwide market in which all industries are now capacity to meet tomorrow's world energy demand need not placed. be emphasized. Instead of the nuclear industry we should refer to the Nuclear energy meets environmental and waste concerns nuclear community, as nuclear actors have demonstrated a as well as competitive requirements, therefore, it should be truly co-operative spirit. Co-operation towards the Central faced with a prosperous future. and Eastern European countries is being developed. In fact, the key prerequisite for the development of nuclear (a) NulaNuclear operators,prtr,truhterascain through their association energyneed for lies nuclear in public energy. acceptance and in the perception of the nuclear (WANO), have set in place assistance programmes Enhancing safety of operation and the design of in the form of exchanges and technical assistance, facin safey facto n adthe de sin of nuclear leading to active twinning of Western and Eastern facilities is a key factor for the development of nuclear nuclear power plants. energy. This means (b) The international (AIEA) or European organization (a) increasing the safety of operation of the existing plant (Euratom) through their visits and reviews (INSAG) by exchanges of information between nuclear insure the 'peer review' essential for nuclear safety. societies and improving the training of operators. (c) The financial aid under the EEC's PHARE and Many measures have already been taken, such as the TACIS programmes is also valuable for funding INPO in the USA, WANO and the active twinning power plant assistance and improvement, of power plants (d) National European safety bodies have undertaken co- (b) increasing co-operation with Eastern and Central operative actions in Eastern Europe to create or European countries in order to help them to upgrade develop their equivalent in each country. existing plants and to complete plants of recent design (e) Utilities participate in the active twinning of nuclear still under construction, thus allowing them to shut power plants but they also associate in joint ventures down the oldest and least safe reactors to develop new production units in Eastern Europe. (c) promoting a real safety culture (d) harmonizing on an international basis the safety Nuclear co-operation is not limited to technological help, objectives it is also orientated towards research and future reactors. (e) increasing honesty towards the public on the incidents Neither the national industries nor the national utilities can taking place in the nuclear facilities. In this respect, work separately any longer on tommorow's reactors. Even the existence and promotion of the international scale if the Western reactors already achieve a very high level of for nuclear events (INES) is an important step. safety, it is recognized that there is room for simplification in the design, operation and maintenance of LWR reactors. This acceptance will be gained through an open objective In the future, risks will be implicitly taken into account with and adapted communication. To communicate you need a appropriate methods at the design stage both for LWR's and network. ENS is this network. ENS provides it as a priority Fast Breeder Reactors, European utilities are getting to European Nuclear industry but also to the international organized to meet the challenge of the future development nuclear community. of nuclear energy by joining the European Utilities Require- This network is a community of more than 22 000 ments (EUR) association. The French and German utilities engineers and scientists of 23 countries to which ENS offers have undertaken, together with Siemens, Framatome and different means of communication their daughter company NPI, the development of the European pressurized reactors. (a) daily, with NUCNET, a fax information service

13 LEWINER

connecting 30 countries in the world background feel uneasy on those subjects. To make (b) every two months, with Nuclear Europe Worldscan known the tributes of nuclear energy to ethics as a (NEW), the most important and most circulated duty towards the people working in the nuclear nuclear paper in the world or with Nucleus, a specific industry as well as towards political and spiritual information letter for politicians, public opinion authorities. It will not be very difficult to point out leaders and journalists which makes a clear statement that nuclear energy respects the unchanging and on nuclear issues: the Club de Rome's position, Fast eternal basis of ethics - the respect of life and Reactors mankind. (c) annually, with the topical meetings organized in Communication on such a subject, in an appropriate different European countries. In 1992, it was language will certainly favourably affect public opinion, TOPFORM, in Prague, the first meeting ever held which for some years has been questioning the moral in a Central European country. In 1993, it will be whic forome lyears as be qstoin e al TOPNUX in the Netherlands. Each year, PIME legitimacy of our civilization as well as that of science and gathers PRs of nuclear enterprises, utilities or technology. international bodies. In 1993, world nuclear PRs will The concentration and confinement principle for waste and meet in Karlovy Vary (Czechoslovakia). This will y for the co on bete placertoyexange comuniain expehienew of power plants are certainly valuable concepts to be the place to exchange communication experiene communicate on, they clearly reveal that nuclear energy is anfindc nw vas fowardsthelic p eopaworgin- among the most responsible industries in the world. ing common values for the people working in the Here we come again, once more, to communication, one nuclear industry is an important factor for progress of the major challenges for nuclear energy which was born even if many nuclear professionals with technical in absolute secrecy 50 years ago.

14 BNFL THORP plant radiometric instrumentation

Dr H. F. Hampson*

The Thermal Oxide Reprocessing Plant (THORP) is in an that the fuel's other characteristics are within the limits by advanced state of construction at BNFL's Sellafield site in a compensating amount or that this can be achieved through West Cumbria. It is anticipated that spent fuel will be blending with other fuels. introduced to THORP before the end of 1992. At a cost of £1800 million the THORP complex is one of the largest Feed pond fuel monitor national or international nuclear projects. The design of the THORP plant calls for equipment capable THORP is divided into two main process areas, the Head of verifying the acceptability of each fuel assembly for End Plant and the Chemical Separation Plant. Fuel for reprocessing in THORP giving a 'go-no go' signal to control reprocessing is received into the Head End feed pond. Within transfer from the feed pond to the shear cave. This monitor the Head End the fuel is sheared and dissolved and within also provides data on irradiation, cooling time, residual and the Chemical Separation area the dissolved fuel is passed initial enrichment for record purposes. through a series of chemical processes which result in the There are two monitoring stations within the feed pond uranium oxide and plutonium oxide product streams. (Fig. 1). Fuel assemblies, after removal from their transport Radiometric instruments are used for solid, liquid and container are presented to one of these monitoring stations gaseous monitoring and employ a wide range of alpha, beta, in order to obtain the go-no go signal. The measurement gamma and neutron techniques. The complexity of these employs high resolution gamma spectroscopy and both instruments spans the whole range from large software-based passive and active neutron measurements, employing fission systems which have required development programmes of chambers located in arrays on two sides of the monitoring several years duration to commercially available state of the position. The cooling time is determined from fission product art instruments, gamma activity ratios which change with time after This Paper is aimed principally at the more complex irradiation. The irradiation is measured either by a gamma systems and describes their role and function within the plant activity ratio technique similar to that used for cooling time control philosophy, determination, by a background corrected measurement of 137CS or by a measurement of the passive neutron emission Head End Plant systems from 244Cm. The final recorded result used is based upon The limiting values of the principal nuclear characteristics a weighted mean from two or all three of these results. The of the irradiated fuel to be reprocessed in THORP have been initial enrichment is determined by a technique which uses set as follows: both passive and active neutron measurement and a look-up table compiled from laboratory measurements and results obtained during commissioning. Maximum initial enrichment: During each measurement the fuel is rotated at 1 rpm and % 235U 4 4 the measurements are repeated at several axial positions. Maximum rating over Dedicated electronics are provided for each monitor and sub-assembly: MW/tU 25 40 each monitor interfaces to its associated fuel removal machine Maximum irradiation over by hardwired I/O and to the Head End Central Computer sub-assembly: GWd/tU 25 40 via a DEC 423 datalink. Minimum decay time prior to reprocessing: years 3-8 5-0 Gadolinium poison monitor elevator Irradiated fuel with some characteristics outside these limits Fuel acceptable for reprocessing is passed up the To may be accepted for reprocessing in THORP on the basis to the shear cave where it is sheared for dissolution. ensure that a criticality cannot be achieved in the dissolver, gadolinium nitrate is added to the acid fed to the dissolver * BNFL Risley, Warrington, UK. to act as a neutron absorber. Gadolinium poison monitors

Nuct. Energy, 1993, 32, No. 1, Feb., 15-22 15 HAMPSON

Monitor Lead Cell Shielded 0 Enclosure 252Cf Neutron Source Module with Source Transport System 0 Hp Ge Detectors to Facilitate Active & Elevator to Passive Measurement (Bottom Mounted) Shear Cave _ /

Gamma Collimator Feed Pond _Pond Wall

All Modules Fuel Monitoring Position with Rotation Adjustable to -- & Vertical Movement of Assembly Accommodate --- - Fission Chamber Detector Modules Different Fuel for Active & Passive Neutron Assay Sizes F Fuel from Storage Pond

Fig. 1. HNO ,,Gd Poison 3 HN03 Neutron Detectors

Neutron __

Sources Processor

Acid Make-up Tank

Ilk

To Dissolver Fig. 2.

(Fig. 2) are used to determine the concentration of gadolinium up of the liquor, the solution temperature will rise, therefore nitrate in the three dissolver feed tanks and in the shear pack temperature measurement and the consequential calibration wash-water tank. There are eight independent monitors compensation are incorporated into the system. If one system corresponding to two detectors per tank. Each monitor in a tank indicates a final concentration below the minimum consists of two He3 detectors positioned vertically at value, the release of poisoned liquor to the process is different heights within re-entrant tubes within the vessel, inhibited. A 252Cf source is mounted on the tank wall diametrically opposite the mid-point of each detector. With appropriate Hulls monitor calibration and standardization to compensate for changes Following dissolution of the fuel, the undissolved in detector efficiency the output signal from the monitor is components cladding etc. (known as hulls) will remain in indicative of the gadolinium concentration. During the make- the dissolver basket. A hulls monitor has been developed and

16 BNFL THORP PLANT RADIOMETRIC INSTRUMENTATION

Monitor Thimble --- Gamma Collimator Rotating Basket of Leached Hulls & Fuel Assembly UeIHardwarel -_. : Germanium 'Hot' Spare

Lead Shield X | -- -- Detector Detector

AT- Polyethyiene - - = Re-entrant Tubes for 7A Shield Neutron Detector & Generator Thermal Neutron -4 Detector & Fast Neutron Detector Packages ,, _ _.

Lead Shield - Polyethylene Shield ..

Graphite--- "1: ' _ .D I Section AA III Fig. 3. engineered to perform specific measurements on these hulls emitters as a requirement for the solid waste encapsulation (Fig. 3). The primary reason for these measurements is to facility. This spectrometer views the dissolver basket via a demonstrate that an adequate leach efficiency for the dissolver collimator set in the cell wall just above the collar used for has been obtained. The measurements also help to ensure the neutron measurement. This collar, shown in Fig. 3, criticality safety in the subsequent handling of the leached contains the fast and thermal neutron detectors and the hulls and to ensure that fuel retention complies with the limits neutron generator probes. These detectors and probes are for interim storage and ultimate disposal or for return to the inserted down re-entrant tubes which are accessible from an customer. The results are also used to demonstrate that operating area. uneconomic fuel retention has not occurred and provide information on material balances and shipper-receiver Chemical separation plant systems differences in the head end. For these reasons it is necessary The liquor from the dissolver, after clarification, is passed to determine the residual fuel content expressed in grams U to the chemical separation area of the plant where the mixed equivalent and the residual fissile content expressed in grams nitrate solution is separated into uranium and plutonium 235U equivalent. It is also necessary to provide an alarm prot steams product streams. facility if these determined values are above preset limits. The residual fissile content of the leached hulls and associated hardware is measured using the differential die- Neutron trend monitoring away technique. This technique is an active neutron technique The primary separation employs pulsed column contactors. in which short pulses of fast neutrons are introduced into The neutron profile measured by neutron detectors located the measurement chamber from a neutron generator. These axially along the length of each column (Fig. 4) is used as fast neutrons thermalize within the chamber and induce an indication of the stability of the column. Any marked fissions in any fissile material present producing a secondary departures from the anticipated profile will prompt an fast flux. It is these secondary fast neutrons which are counted investigation into the state of the column. Knowledge of the and which give a measure of the fissile material present in anticipated neutron profile will be built up during terms of grams 235U equivalent, commissioning and early operation of the plant. This is one Passive neutron counting, together with the fissile content example of trend monitoring to assist plant operation. measured as described above and the initial enrichment data Another example is the strategic positioning of neutron from the feed pond monitors and/or technical records is used detectors close to certain vessels to indicate the build-up of to determine the residual fuel content. fissile material in the vessel. These trend monitors are directly In addition to the above a high resolution gamma connected to the plant-wide distributed control system which spectrometer is used to determine the inventory of gamma provides indication at the central control room.

17 HAMPSON

1mm Cadmium Sheet- Boronated Resin

'A' "')J'A' ! Column

Polyethylene

SECTION BW SECTION AA' Fig. 4.

Absolute neutron monitors Evaporator. This problem was resolved by limiting the mass At certain points within the chemical separation area it is of plutonium fed to the evaporator in a defined period of time. necessary to carefully measure the flow of fissile material. A mass integration monitor was designed which employs two Typical of such areas is the boundary between safe-by-shape alpha weir monitors which measure the gross alpha activity and non-safe-by-shape plant. At such points absolute neutron in the two pertinent plant streams. The outputs from these monitors are positioned. These monitors are not trend monitors are processed by a system employing the same monitors as calibration information is available and applied, standards of reliability as the absolute neutron monitors. This They do not however measure fissile material in g/l, as this mass integrator is a plant trip device which shuts off the feed would necessitate the use of complex conversion factors. To to the evaporator should the limiting mass transfer be alleviate this problem, fuel is selected with appropriate reached. In addition, the system automatically initiates the neutron yields and organized into campaigns. Studies using alpha weir monitor drain sequence and compensates for this FISPIN (a computer code for nuclide inventory calculations) in the mass integration algorithm. across the whole of THORP base-load fuel indicate that all of the base-load fuel can be reprocessed with just four High resolution gamma spectroscopy different alarm settings, and there is a maximum of three Within the chemical separation area of THORP are several trip setting changes without associated washouts in any year systems which employ high resolution gamma spectroscopy if gross neutron counts (neutrons per second) are measured. techniques. These systems are based upon commercially The structure of these monitors is based upon a vessel (Fig. available state-of-the-art spectroscopy equipment and 5) designed to present a fixed volume of liquor to the specially developed processing capacity. A typical detectors. The measurement vessel is surrounded by configuration of such a high resolution spectroscopy system polythene moderator. Within this moderator there are four is shown in Fig. 7. Systems which employ this gamma BF3 tube detectors mounted co-axially with the measurement spectroscopy technique include the % 235U-in-liquor vessel. These detectors are connected in two diametrically monitors, the drum enrichment monitors and the x-ray opposite pairs (Fig. 6) so that a comparison between the fluorescence (XRF) monitors. counting rates of these two channels can be made The % 235U-in-liquor monitors are within the uranium continuously. This will enable any degradation in a particular finishing cycle where uranyl nitrate is concentrated by detector tube performance to be quickly identified. The evaporation. A safe enrichment limit of 1.7% 235 U has electronics employ an auto-test feature in addition to the more been determined for the evaporator feed. Four monitors are usual watchdog facility. provided, one on line and one on standby on the evaporator feed line and one on each of the two feed tanks to the Mass integration monitoring evaporator. A specific problem encountered on THORP was the The drum enrichment monitor is on the uranium finishing necessity to demonstrate the criticality safety of the Salt Free line. The U03 product is loaded into 50 1drums in the drum 18 BNFL THORP PLANT RADIOMETRIC INSTRUMENTATION

Shielding Liquor Flow

-- Detector Tube

S-Detector Tube

Operating Moderator Area

Fig. 5

Alarm Outputs Channel 1

Plant Trip 2 nChannelq4

Output

Detectors Head Amps Processing Electronics Fig. 6.

EG&G! lPulser ICND

Detector

____}" Preamp _j Spectroscopym ovreAt/D MCA ,-VME

EG&G Counter

CND Fig. 7

19 HAMPSON filling plant. It is necessary to ensure that the enrichment as described earlier. The outer surface of these drums is of the product is below a specified value prior to transfer measured for contamination prior to export. The limiting to the drum store. A single measurement system is employed value is 0.37 Bq/cm2 alpha. The surface contamination immediately after the drum filling process. monitor layout is shown in Fig. 9. The monitor employs five The x-ray fluorescence analysis technique is used to ZnS detectors which measure the top and vertical sides of provide a diverse measurement of plutonium concentration the drum. The system interfaces with the drumming plant to that provided by the absolute neutron monitors described control system providing 'pass' or 'fail' signals etc. earlier. Six such XRF monitors are used on THORP. High resolution spectroscopy is used to analyse the fluorescence Plutonium finishing systems spectrum emitted after excitation by a radioactive source to The final stage of the chemical separation plant is identify the mixture of elements presented to the detector and plutonium finishing. In this stage of the process the plutonium thereby determine the plutonium concentration. nitrate from the plutonium purification cycle is converted to storage or export from the plant. Precipitate monitoring plutonium oxide powder for devices are used for level measurement at There is a possibility of insidious build-up of precipitate Radiometric points in the powder processing phase. in the highly-active solvent wash mixer settler in the uranium severalTo provide level control and prevent overfilling, the op e dsnse andcan oerian cni purification plant. A monitor has been devised to measure blenderblende hopper, dispense and can fill hopper, and can fill any such precipitateany uchpreipiatebuid build upu basedbaed uponpona a gammagmma sainaeec rvddwt ee oios are each provided with level monitors. transmission technique (Fig. 8). A gamma source is inserted stationA cobalt 60 gamma source and detector are arranged at to detect a re a r ption into a re-entrant tube in the vessel and an ion chamber is prese t 60igts the increase in gamma absorption positioned below the vessel. The radiation from this preset heights to detect obstructs the gap between them. transmission source is attenuated by the precipitate and the when powder into the product store, each can filled with degree of attenuation is a function of the precipitate thickness Before loading Clearly plutonium oxide is presented to the can contents monitor. Cllealynthe s aeuir for secayofthrandd iztion This monitor provides an assay of the can contents for allowance must be made for the decay of the transmission inventory purposes and customer records. The system uses source. Control of the movement of the transmission source hihrsltoga asetrcpyopovdagma andthestadarizaionsouce roma sieled osiionto high resolution gamma spectroscopy to provide a gamma and the standardization source from a shielded position to inventory of the isotopes and neutron coincidence counting the exposed position is automated. to provide a 24 pu equivalent assay. The monitor consists of a measuring chamber into which the can is loaded (Fig. Drum sae] onta nion mrocnstrem i10). The system employs eighteen He3 neutron detectors The fianl stage in the uranium procesing stream is uranium mounted within the polythene walls of the measuring finishing where the final product, UO3 power, is produced. chamber. The inside and outside wall of the chamber is lined This product is put into steel drums for export from the plant with cadmium and boron loaded rubber. The bottom section of the chamber can be lowered pneumatically to facilitate the entry of the cans to be measured. One end of the well houses a gamma collimator assembly to enable a hyper-pure germanium (HPGe) detector to view the base of the product can through a fixed end-plug. The 240pu equivalent content is determined by neutron coincidence counting. The plutonium isotopic composition is determined by the high resolution gamma spectrometer. Other process radiometric measurements in the finishing line area are

(a) Evaporator overheads monitor - This instrument monitors the oxalate mother liquor (OML) for an The Transmission increase in alpha activity above a preset level. Source overheads are routed into a measurement cell X1il containing a sodium iodine crystal and photomultiplier tube. The system is tuned to measure the 17 keV X-ray and 60 keV gamma rays characteristic of Pu alpha disintegration. (b) Steam condensate breakthrough monitor - This Ion Chamber instrument monitors the normally non-active Fig. 8. condensate for any alpha activity breakthrough, 20 BNFL THORP PLANT RADIOMETRIC INSTRUMENTATION

ZnS VDU Printer To/from Drumming PLC Detectors Terminalaz::: .,,,*4" " De t Detector

IntefaceInterface

DetctorAP"' Interface Microprocessor "

Detector DC DC Line Power SpInterfaceSup i ndicator I Fail

Interface DeoCettector

pGetDetctorte LoeDvcnterf:acfert

Fig. 9. Helium-3 Neutron Neutron Coincidence Combined End Plug " Detector31 Counter-- Automatic Can Loading

& Gamma Collimator sRemoval Equipment "--'--

Hp Ge Detector epa ia

themtieeoRaise/ with th Support r Lower Device for Stand Can Entry & Exit

Fig. 10.

utilizing the same technique as the overheadatiis E i systems which are configured to suit the application monitor requirement. In some cases the radiometric module (e.g. Both of tansferring t orip the evaporator in multichannel analyser) has been specially developed to be the event of an alarm compatible with this VME bus system (Fig. 11). The VME (c) OML over-concentration monitor - The bus system was chosen because of itsmodular nature, its concentrated OML return stream ismonitored by a potential for fast, powerful processing and because of the BF neutron detector and the Pu concentration is expectation of its growth as an industry standard. The VME derived3 from the neutron counting rate. The constant systems employed by BNFL use the OS9 Industrial Version volume feeder transferring the OML to the buffer 2.3 Operating System running Ornegasoft Pascal and C tanks is tripped on high concentration. languages, (the latter being limited to device drivers).

System design and architecture Software The systems described are essentially based upon the same The software is structured on a modular basis to maximize architecture. They employ state-of-the-art radiometric uniformity between the systems and to provide. as far as electronics for gamma spectroscopy, neutron coincidence possible, modules which can be used elsewhere in the future. counting etc. These state-of-the-art modules interface with These modules include

21 HAMPSON (a) MCA device drivers Step 4 (b) Data processing routines The system supplier will produce system maintenance and (c) Diagnostic interface modules. operators manuals. These manuals will contain comprehen- The software was designed using the Yourdon Structured taeanopredbBNLsf.Thywlicuesive information to allow the installed system to be main- and operated by BNFL staff. They will include Method which Methdis a disciplineddisiplnedtecniquwichis technique forfo producingprducng manufacturersained handbooks, drawings, configuration detail, structured models of the software system utilizing computer- software design documentation maintenancedad and aided software engineering (CASE) tools. opeation procedures. All THORP radiometric instrument software has been operating procedures. produced applying the software life-cycle principle established as a standard procedure within BNFL. Essentially this defines rigorous design, QA and project management Conclusion procedures to ensure an auditable route from the initial user The special radiometric irnuments described in this Paper requirement specification to the final software coding. This have been developed and designed in-house by BNFL. The route is set out below, development and design programmes have been of many years duration and have been undertaken at considerable Step 1 expense by the company. This effort was necessary as these A user requirement specification is produced jointly as special instruments in every case contain significant inovation appropriate by R&D and Design staff from BNFL. and original technology. In addition to the special radiometric instruments described Step 2 in this Paper there are many examples of standard radiometric After the award of the contract, the system supplier instruments which are available as state-of-the-art systems. produces a system description document (SDD). This Such systems include cooling water monitors, gamma document details the methods by which the system supplier interlock monitors, liquid effluent monitors, etc. These shall satisfy the requirements of the project. systems have been employed by the nuclear industry for many years and are therefore supported by in depth design, Step 3 operating and maintenance experience on the Sellafield site. After approval by BNFL of the SDD, the system supplier The specially developed systems, together with the use of produces the software system specification (SSS) which the state-of-the-art systems, form an effective response to details the processes defined in the SDD and describes the the challenges imposed by the requirements of a modern module structure and the function of each module. The SSS oxide fuel reprocessing plant. In particular, the requirement will contain the implementation model of the Yourdon for materials control, proven levels of safety and reliability methodology. From the SSS the pseudo-code and code can and reduced operator dosage are met. be produced after approval by BNFL. I I VME I Backplane I I! Processor Ethernet MCA 1/o Watchdog SPply

Serial To PC From Opto 22 Instrument Spectrometer Fault OutputI

Fig. 11.

22 Sizewell 'B' nuclear sampling system

O.C. Hills*

(d) assessing the level of core damage after an accident (e) monitoring the boric acid concentration, and so helping operators to control the level of reactivity in normlionons.Thi adpot-filt Paer,the reactor. Sample-conditioning equipment is provided to cool and pump the liquid samples through the various monitoring and sampling systems. These systems include the integrated The Sizewell 'B' Pressurized Water Reactor power station sampling and analysis package, liquid gamma monitors, design is based on the Bechtel Corporation's Standardized boron meters, gamma spectrometers and grab sample Nuclear Unit Power Plant system (SNUPPS), but has been cabinets. There are also extensive control and data acquisition developed to meet the UK's safety requirements. These systems. requirements include a relatively high quantity of sampling and analysis systems. Integrated sampling and analysis package (ISAP) The reator primary coolant is a mild boric acid solution; The ISAP is responsible for some sample conditioning and the concentration of boron 10 (a neutron absorber) is varied on-line analyses both normally and post fault (Fig. 1). to compensate for fuel depletion. Fission products may leak Its functions are from the fuel and be carried around the primary circuit: these include soluble radionuclides, e.g. caesium-137, volatile (a) measuring radionuclides, e.g. iodine-131, and noble gases, e.g. (i) pH xenon-133. Neutron activation products may be formed: in (ii) conductivity the fuel, e.g. americium and curium; around the fuel from (iii) pressure coolant constituents, eg. nitrogen-16, carbon-14 and tritium; (iv) temperature or from circuit corrosion products, e.g. cobalt-60 and (v) flow rates cobalt-58. The coolant is also dosed with corrosion inhibitors. (vi) hydrogen and oxygen concentrations, both All of these possible coolant constituents need to be in liquid and gaseous samples monitored for control and diagnostic reasons, and so NEI (vii) nitrogen concentrations in gaseous samples Control Systems (NEI-CS), in conjunction with Sentry (b) performing isotopic analyses of liquid and gaseous Corporation, achieve this.sapeis providing the Nuclear Sampling System to samples The main sampling and analysis functions of the Nuclear (c) taking grab samples of liquids and gases, and Themin stemi and aperforming dilutions of up to one thousand to one (to Sampling System are reduce sample specific activity, and so make it safer (a) monitoring the chemical balance of the reactor to handle) coolant to facilitate the maintenance of levels which (d) taking particulate and iodine samples. minimize corrosion mclinize c iand gThere is a main ISAP panel which contains the chemical (b) collecting liquid and gaseous samples for analysis analysers, and dilution system; this is provided by Sentry (c) monitoring a identifying the corrosion activation Corporation and is based on a system widely used in many US PWRs. This equipment is placed behind shielding to products, plus other radioactive gases and liquids minimize operator radiation doses. On the accessible side of the shielding are located the gamma spectrometers and * NEI Control Systems, Rolls Royce Industrial Power Group, Gateshead, UK grab sampling equipment.

Nud. Energy, 1993, 32, No. 1, Feb., 23-28 23 HILLS

. . - -, 55

Fg7. -- plifie e f i ate s l an ay

255,,5

Fig. teSimiideriew ofaterateapli ng dilo analysis paka e sytmisupedamolstoaowair

(a) hingdetoarec instrumwen fomerhigh prssuem accsfoinstcalbationsaepsilfrmotdef

pressures are sensed, to avoid contamination (j) there are minimal interconnectons between liquid and (c) as gases may be moist, instruments have been chosen gas modules to reduce liquid contamination in gas which will not suffer a loss of performance due to systems. moisture, and trace heating has been used to reduce relative humidity Liquid analysis and sampling (d) if there is a leak while a high-activity sample is being Liquid samples are conditioned before reaching the ISAP handled, the ISAP can be washed down by an to reduce their temperature to below 50°C. The temperature installed washing system is monitored and the flow is shut off if this temperature is (e) gamma liquid monitors display sample specific exceeded. Flow measurements are taken at the supply activities to warn personnel to use suitable sample pressure to avoid errors due to dissolved gases. All sample containers if activity levels are high lines are flushed after each sample is taken and a radiation (/I) depending on sample activities, there are different monitor in the ISAP panel ensures that the flushing has been arrangements for transporting grab samples completed satisfactorily. (g) analysis parameters are the result of direct on-line There are three possible routes for liquid samples within measurements, without the need for correction for the ISAP: through a bypass line during system start-up; to

,5 SIZEWELL 'B' NUCLEAR SAMPLING SYSTEM a low-pressure section for pH, conductivity and normal-range pressurizer vapour space can enter the ISAP at a flow rate gamma spectrometry measurements; and to a high-pressure of approximately 6 I/min. The reactor pressurizer samples section for dissolved oxygen, high-range gamma spec- (steam) are first conditioned by condensing; the condensate trometry measurements and grab sampling. The dissolved is removed and the non-condensible gases are then oxygen measurements are in the range 20 parts per million monitored. to 1 part per thousand million, and are performed at high The sample can pass in an undiluted state into an evacuated pressure to prevent excessive bubble formation. In the low- 10 ml vessel in a shielded cart. As with the liquid cart there pressure section a 60 ml vessel containing the sample is are bypass lines through which a subsequent purge (nitrogen) vented to an evacuated 150 ml vessel. The contents of the can pass. 60 ml vessel are heated to further release dissolved gases The sample can be diluted as before, using a four-way from the liquid. The two vessels are then isolated from each valve to collect a 23 Il sample which is swept into shielded other, and the gases pass on for analysis. tongs by nitrogen. The tongs contain a particulate filter, The pressure-reduced liquid samples are routed to the iodine filter and a 15 ml sample vessel. The particulate, conductivity and pH measuring instruments and the gamma iodine and noble gas activities can then be assessed in the spectrometer at approximately atmospheric pressure. In laboratory. normal operation they will not contain more than 60 ml of The sample passes into the gamma spectrometer, either gas per kg of liquid at this pressure. directly or via particulate and iodine filters, and into a gas Conductivity can be measured in the range 0 to 1000 chromatograph which is used to assess the oxygen and ju Siemens cm - 1; the conductivity sensor would be hydrogen concentrations. Finally the sample passes back to removed, infrequently, for calibration. The pH can be the reactor containment or chemical-volume control system, measured in the range 1 to 13; for calibration, standard volume-control tank. solutions can be flowed through the sensor. If an undiluted sample is to be removed, then 10 ml of Liquid gamma monitors liquid can pass under slight positive pressure from the 60 ml Three monitors are provided to measure the specific vessel. The liquid is drawn into a 4 ml vessel in a shielded activity of secondary coolant samples. This can give an cart. When the vessel is full, valves can be set to allow a indication of fuel cladding failures. The specific activity can flush of sample lines through a bypass line within the cart be as high as 3-5 x 1016 Bqm - 3 because of dissolved shielding. This reduces operator radiation exposure, and also fission products and dissolved and suspended activation helps to avoid contamination from any drops of sample which products. remain in the couplings. The monitors are provided by Merlin Gerin Provence: two A thousand to one sample dilution can be performed. A can cover a six decade range (approximately 1 x 1010 to four-way valve extracts 23 Al of sample, which is mixed with 1 x 1016 Bqm- 3 based on caesium-137), whereas the third 23 ml of demineralized water in a 50 ml vessel to achieve can cover an eight-decade range (approximately 1 x l0 to the necessary dilution. The diluted sample can be extracted 1 X 1013 Bqm-3 based on caesium-137). The six decade using a shielded 10 ml syringe. The syringe needle is intro- monitor uses an ionization chamber, whereas the eight decade duced through a small hole in the front of the ISAP panel monitor uses both an ionization chamber and a sodium iodide shielding and penetrates a septum. The sample can then be scintillator, positioned on either side of a sample chamber. drawn out. Both types of assembly are shielded by 10 cm of lead. The detector signals are converted into voltage pulses by a Off-gas analysis and sampling local processing unit which then sends the signals to the main The pressure and temperature of the off-gases which have processing unit which can be up to 200 m away. The been released into the 150 ml vessel from the liquid sample main processing unit digitally displays the specific activity, are measured, and the dissolved gas concentration of the calibration parameters and operating status and has a keypad liquid then inferred. Nitrogen is introduced to raise the vessel for operator interface. The unit could also be programmed pressure to 1 barA. A four-way valve extracts 23 11 of and interrogated via an asynchronous serial link, although sample, which is pushed by nitrogen at 1 2 barA into a 15 ml Nuclear Electric's philosophy is to use 4-20 mA analogue evacuated glass container via a needle and septum arrange- outputs with conventional alarm relays. ment. The off-gas sample passes to a gas chromatograph where its hydrogen concentration is established, and to a Boron meters gamma spectrometer. Two boron meters are provided. At least one will be monitoring the level of boron-10 in the reactor coolant system Gas analysis and sampling at any time. Boron-10 has a very high neutron absorption Trace-heated gaseous samples from the reactor cross-section, and so the boron concentration is important containment, or chemical-volume control system, volume- for controlling the reactor reactivity. This property is used control tank vapour space, plus samples from the reactor in the boronmeter: it contains a 100 GBq americium/

25 HILLS beryllium neutron source, which is separated from a fission- acquisition time. If this cannot be achieved, then a second, ionization chamber by a sample chamber through which the smaller, 10 mi sample chamber is selected. Another detector solution containing boron-10 flows. The whole assembly is views this chamber through a continuously-variable col- surrounded by polyethylene shielding to thermalize the limator aperture. The aperture is closely controlled to within neutrons produced. A pulsed signal is produced by the fission 0-1 mm, and as before is adjusted to give the most suitable ionization chamber, the count rate of which is proportional dead time. Even with high specific activities and small to the number of neutrons reaching it. collimator openings, the loss of resolution due to scattering There is a simple quadratic relationship between the effects etc., is negligible; the low-energy background reciprocal of count rate and boron concentration. becomes worse, however, so that the limit of detection The relationship is modified to take into account the effects becomes poorer for energies below 300 keV. The collimator of temperature variations on sample density, absorption design is such that the shape of the efficiency calibration cross-sections, etc.. The processing electronics produce curve scarcely varies over the full opening range of the signals as analogue outputs and via asynchronous serial links, collimator, so that the efficiency at any point is predictable representing boron concentration both as direct measurements (Figs 2 and 3). If required, the high-range chamber can be and as a rolling average. Alarm contacts are provided for selected in preference to the normal-range chamber to reduce boron concentration and equipment fault. System parameters waiting times in post-accident situations. can be modified via a hand-held programmer. The boron For a representative mixture of nuclides, the normal-range meter will function over the range 0-8000 ppm boron-10, detector can cover a range of approximately I x lW to 10-800 C. 5 x 1012 Bqm - 3, whereas the high range detector can cover a range of approximately 5 x 1012 to 1 x 101s Gamma spectrometer Bqm - 3 . The gamma spectrometer consists of four monitoring -E streams. There is a liquid stream and a gaseous stream, each ES 100 of which is further split into normal and high-range monitoring routes. The gamma spectrometer and collimator 80 system is supplied by Canberra Packard, but all sample handling is performed by NEI-CS. The sample vessels are 8 embedded in the shield wall of the ISAP room, but the detectors, collimators and electronics are in more tenable areas. The usual monitoring sequence is for a sample to enter f 40 a largd sample chamber. This is viewed by a 15% relative- , efficiency high-purity germanium detector through a .- 20 collimator. The collimator comprises of a fixed 12 cm thick E lead block plus a moveable 16 cm thick lead block through - which are 4 holes of different diameters. The fixed collimator o 20 40 0 80100 hole and the largest hole in the moving collimator can be %collimator ooenino lined up, and for the initial acquisition the detector is moved Fig. 2. Percentage transmission efficiency against collimator forward through the collimator holes to give the most opening for a range of energies 122-1332 keV sensitive geometry. The low-range gas chamber is a 5-8 1 Marinelli chamber which has a pocket for the detector head V 1o to enter; the low-range liquid chamber is a 1.3 1 cylindrical E , vessel. The signal from the detector passes via an analogue- C to-digital converter and multi-channel analyser to a Microvax § 20 100% open computer via an Ethernet link. The signal is also converted into pulses which are counted by a count-rate module. This communicates via Ethernet with the computer, which decides s whether the level of counts from the detector is satisfactory. . If it is too high, and thus causes excessive detector dead time, 1 then a loss of resolution occurs; the detector is moved back 1% out of the collimator and the count rate is checked again. 2

If it is still not satisfactory, the next collimator hole is 0_ I I I ! I I 20% open I I automatically lined up between the detector and sample a 0 20 50 100 200 500 1000 200 50 chamber. The process continues until a satisfactory detector Energy: keV dead time is achieved - approximately 15% - which is a Fig. 3. Percentage transmission efficiency against energy (kel) compromise between resolution and length of spectrum for a range of collimater openings

26 SIZEWELL 'B' NUCLEAR SAMPLING SYSTEM The system must be able to operate for long periods in the chemical volume control system and reactor coolant post-accident conditions of high ambient radiation and high drains. Another is for collecting up to five different high- temperatures. The whole area where the detectors and pressure samples, from sources including the reactor coolant electronics are housed would be untenable for some time system and steam-generator blowdown. There is also a post-accident (500C and high ambient radiation levels). To cabinet for collecting isokinetic samples: three samples are cope with this the detectors are electrically cooled to avoid taken from the same point in the reactor cooler system. The the need for personnel to top up liquid nitrogen dewars, and sampling nozzles are capillary lines within 12 mm OD tubing all items of equipment are cooled either with compressed and three are required to give the desired sampling flow rate. nitrogen jets (via expansion nozzles) or refrigeration units. The cabinets are maintained at slight negative pressure Installed energy-calibration sources can be introduced, through charcoal and HEPA extract filtration, plus there is remotely controlled by the operator, and it is envisaged that an internal wash-down system. this could occur regularly, even in a post-accident situation, whenever a detector is not being used. Efficiency calibration Control and data acquisition system requires a source to be introduced in a vessel equivalent to Operation of the nuclear sampling system is controlled by the sample vessel. This would be manually introduced much the control and data acquisition system (Fig. 4). less frequently than the energy calibration source. The system represents sampling sequences as computer 'soft-mimics' and also as 'hard-mimics' - permanent Grab sampling cabinets displays of system pathways, which display the routes being In addition to the facilities provided by the ISAP for normal used at any time. Selection of sampling sequences is via pull- and post-accident sampling, glove-boxes are provided for down computer menus. Once a sequence has been selected, low-activity liquid sampling. One glove-box is for collecting it will continue automatically without the need for further low-pressure samples from seven different sources, including intervention. If the operator interrupts the sequence, the plant

Remote technical support centre

Ethernet

- Sampling control room 1

ITTerminal GammaPyai spectrometer [ I integrator I I I I I liquidGamma monitor 4 I ...----_.. I 'I! LI -Data highwayI-- --- , II I -- I I III IL- -,,' ------

PLC A -- PLCL B ISAP

Pnt i Boron meter

Fig. 4. Communications overview

27 HILLS is returned to a defined state via a system flush where Programmable logic controllers: control system appropriate. Several sequences can be initiated to run There are two PLCs which are responsible for nearly 300 simultaneously, but conflicting sequences are automatically digital inputs, over 150 digital outputs, and 40 analogue inhibited, inputs. One controls the sampling and analysis processes of Some sequences require plant operators to intervene, for the ISAP, gamma liquid monitors, and one of the boron example to connect or disconnect sample chambers; follow- meters; it also interfaces with the gamma spectrometer. The ing such activities, the operator has to advise the computer second PLC controls the sampling and analysis processes that the sequence can continue, associated with the other boronmeter. Alarm messages, status of plant, and read-outs from A portable terminal is provided which can be used for equipment are displayed as part of the computer display and programming and diagnostic functions on the PLCs when soft-mimic system. required. The control part of the system comprises of two programmable logic controllers (PLCs) plus a programming/ Conclusions diagnostics terminal; the data acquisition system comprises It has been our intention to use proprietary equipment with a pyramid integrator and operator interfaces. All informa- good performance records wherever possible. This has tion can be archived to the station optical disk database via included major items of equipment from the UK, where Ethernet. possible, but also from the USA, France and Belgium. These have been successfully integrated into the nuclear sampling Data acquisition system system together with an extensive amount of design and This system logs results from the boron meters, gamma manufacture by NEI-CS. liquid monitors, ISAP and the gamma spectrometer and The result is considered to be one of the most sophisticated, provides operator interfaces with the nuclear sampling but still reliable, nuclear sampling systems yet to have been system. An Allen-Bradley pyramid integrator houses and provided for a PWR anywhere in the world. supports both an information processor - an industrially It is unlikely that there will be developments in the short hardened DEC Microvax computer - and a resource term which could lead to improvements in the performance manager. The Microvax uses a DEXTERITY supervisory- of the system, with the possible exception of the measurement control and data-acquisition package to manage the PLCs, of dissolved hydrogen concentrations. Orbisphere has which runs in a VMS operating system. The resource recently developed an in-line dissolved-hydrogen analyser manager provides an interface between the information which could dramatically reduce the complexity of pipework processor and PLCs via a data highway. This avoids any within a future ISAP, such as that for a follow-on PWR. bottle-necks in the transfer of information.

28 Application of acoustic instrumentation for use in liquid metal fast breeder reactors T. Lennox* J. A. McKnightt R. Rowleyt

e in E Introduction r There are few techniques available for working in the hostile reactor with t conditions of a liquid metal fast breeder reactor (LMFBR). circuits. T s Thermocouples, of course, have been used from the outset, and the resultant development of a sound technology of stainless-steel sheathed mineral insulated cables brought in hben Iits wake other potential applications involving electro- magnetics.' However, it is in the related areas of ultrasonics y te and acoustics that the major advances have been made. Ultrasonic technology is usually thought of as an 'active' rmethod in which sound (usually a pulse) is transmitted into techupm that obviaethe need for such robust a region and is received and interpreted after being modified Uloics hs within that region. The use of active ultrasonics to image i Sst r the inside of a reactor has been well domonstrated on the 2 scsd u Prototype Fast Reactor (PFR) at Dounreay and the value of t s for a of ultrasound for measuring slight internal structural i nlsin displacements has also been discussed through an 3 include the mn international programme. Use of ultrasonics has also been proposed as a technique suitable for detecting the hydrogen released within a steam generator by a water/sodium leak.4 However, this Paper is concerned with the more recent developments in the United Kingdom. They include an ultrasonic temperature measurement device (USTM) and applications of 'passive' acoustics. Passive acoustics is the term used when sounds generated by the plant are detected and interpreted through the application of receiving microphones. These include monitoring of the two sodium circuits of a fast reactor which give rise to two safety devices: acoustic boiling noise detection (ABND) for the primary circuit and acoustic leak detection (ALD) for the secondary. Both of these are con- o fsidered important to the European Fast Reactor (EFR) n oproject.

Use of acoustics in fast reactors There are two main methods of communicating acoustically with the hostile area within a fast reactor. In the case of the primary circuit pool, waveguides, in the form of suitably encased steel rods, can be immersed directly into the sodium. * NNC Ltd, Risley, Warrington, Cheshire, WA3 6BZ, UK. For the secondary circuit steam generators, being of loop t AEA Reactor Services, Risley, Warrington, Cheshire, WA3 6AT, UK. design, waveguide stubs can be welded directly to the

Nuc. Energy, 1993, 32, No. 1, Feb., 29-40 29 LENNOX ET AL.

structure at strategic locations. The ideal method would be applied to EFR could be better than *0.5*C and would to immerse transducers directly into the sodium. Transducers detect partial blockages readily. suitable for the purpose were demonstrated in PFR during a shut-down for imaging purposes, 5 and have since been Primary circuit acoustics developed for use in full power conditions. 6 Acoustic anomaly detection experience from PFR. The acoustic signals from the PFR core are transmitted by six Ultrasonic temperature measurement (USTM) waveguides positioned over the core as shown in Fig. 2. The A primary safety requirement is that the EFR core should waveguides are attached to the inside of instrument guide be protected from overheating, and particularly that the tubes by a coiled spring mounting arrangement which is sodium cooling the subassemblies should not be allowed to designed to reduce acoustic transmission through the boil. The temperature of subassembly outlet sodium is structure. The bottom end of the waveguides are about measured using thermocouples where possible. However, 140 mm above the end of the guide tube and about 270 mm cross-flows make it difficult for thermocouples - however above the exit of the subassemblies. The signals from the positioned - to obtain representative temperature values at accelerometers which are attached to the top end of the certain locations, especially near the edge of the core. A waveguides are passed through head amplifiers, situated close further problem arises if the subassembly becomes blocked, to the reactor top, to the main signal conditioning and data when bulk flow cannot be relied upon to transport the acquisition room. temperature signal to the thermocouple. Additional tech- Recordings of the acoustic signals are made in two ways. niques are therefore required to detect overheating. Firstly, a computer controlled data acquisition system logs The USTM 7,8 technique times ultrasonic pulses echoing various acoustic parameters including the r.m.s. signal from the tops of subassemblies to deduce the velocity of amplitude in three frequency bands every 20 ms and stores sound in sodium and hence the sodium temperature (Fig. 1). digitized samples of the raw acoustic signals on a daily basis. The technique allows remote measurement and the effects Secondly, analogue tape recordings of the acoustic signals of turbulence have been investigated both in water 7 and in can be made as desired to allow a more detailed examination sodium.9 Recent water model tests of a demonstration of the signal characteristics. These recordings of the acoustic instrument for application to EFR subassemblies have signals are made at frequencies up to 80 kHz. demonstrated a precision equivalent to :k2*C for a sub- Reactor background noise. One important observation assembly outlet temperature of 550°C. USTM has also been from the PFR acoustic monitoring system is that the shown to be rapid enough to allow temperature noise to be background noise consists of two parts: the first is a measured.9 Temperature noise should be measurable up to continuous broadband signal and the second a randomly frequencies of 400 Hz, whereas previous limits have been occurring impulsive activity. 5 Hz for coaxial thermocouples and 30 Hz for intrinsic By their very nature, impulsive events can be assessed thermocouples. This could mean that the sensitivity when readily enough by counting the number of excursions above

Measured time-differences

At At it At

Ultrasonic transdlucer

Tops of sub-assemblies

Fig. 1. The principle of ultrasonic temperature measurement

30 ACOUSTIC INSTRUMENTATION IN LMFBRS

im Waveguide RB

Waveguide SA Waveguide RC ,,Instrument shroud tube

Waveguide

Waveguide SB

100 to 130 mm T 1rl1I 11P H I Waveguide SC

Subassemblies Waveguide RA Fig. 2. Positions of acoustic transducers above the PFR core a signal threshold in a given time. If the threshold is set, two standard deviations from the mean of each class. The for example, at four or five standard deviations above the impulsive background is identified as being the result of a r.m.s. level of the overall noise, the number of events due number of causes. Three of the classes include pulses which to non-impulsive (and therefore assumed random) noise is appear to be local to the waveguide and are assumed to be very small. This relatively straightforward method is types of 'rattle' that could be due to the waveguide's extremely useful in some applications (such as cavitation construction or other components contained within the detection) where only one such source is present. However, more sophisticted techniques are necessary when more than 4- one source is present. This turns out to be the case in PFR, pulses that transmit and a similar situation would be expected in any environment of such dynamic complexity. 35- C In the United Kingdom two methods, pattern recognition C Class 3: and location analysis, are being used to distinguish the various 0 C pulseshigh frequency that types of acoustic pulses in the analysis of reactor background 30 C do not transmit noise. Examples of their specific application to PFR are given 3o- below. 'a Pattern recognition anaysis of impulsive sounds. This is ? B B a powerful method of distinguishing between a signal and E 25- Class 2: background noise. Techniques involve the measurement of t pulses B certain features of a data sample which may be used to tra Bthat separate it into one of a number of classes. Data samples 20. a previously gathered from various experimental conditions or from various noise sources can be used to define different AA AClassBBA 5: classes. Algorithms exist that can identify the most significant AA, A pulsespratle features and hence separate the classes. New samples of data 15 A pulses type 2 can then be assigned to one of the classes using various Class 4: rattle recognition algorithms. Previous work in this area of pulses type 1 application has been reported. t 10 - An illustration of this type of processing applied to the 2 4 6 8 10 12 impulsive acoustic background noise in the PFR is shown Crest tactor in Fig. 3. The ellipses defining feature classes are drawn at Fig. 3. Scatter plot of pulses recorded from PFR

31 LENNOX ET AL

instrument guide tube which houses the waveguide. The detectors can be focused on a particular region then the remaining two classes include impulsive sounds transmitted background noise from elsewhere in the system is excluded. significant distances across the core. All five classes have This improves the signal to noise ratio and is a valuable aid appeared consistently during analysis of the background noise to detection. from PFR giving confidence that signatures of the impulsive Figure 4 is an example using the simplest location method. background signals can be obtained which will allow If the pulse arrival times are measured then the location of discrimination from boiling pulses. However, other impulsive the noise source can be calculated for example by plotting activity which apparently does not belong to these classes hyperbolae. A more convenient method when a large number and which appears much less frequently has also been of events are considered is to compare the measured time recorded. To determine a satisfactory boiling detection differences with those computed theoretically for different sensitivity and possible spurious trip rates, a fuller picture points on a notional grid drawn on the reactor core. If the of the impulsive background signals is required and a computation is made for many points on the grid then the modified version of the on-line acoustic monitor, designed grid position giving the minimum residual error between to optimize recording and analysis of the impulsive signals measured and computed time differences can be considered is ready for installation on PFR. to be the source location. Locations are shown for two sets Location of acoustic sources. Location methods" are of of analyses carried out approximately 12 months apart. In value for two main reasons. Firstly it is obviously of interest both cases there is a cluster of locations in the region near to the reactor operator to know the position from which an to waveguide SC. It is possible either that there are a number indication of anomalous acoustic activity is coming. This of individual sources in the same region of the core, or that information is also clearly of value after shut-down as an the scatter may represent errors in the timing of the pulses. aid to correcting the problem. Secondly, if the acoustic In either case the location analysis suggests acoustic events in a fairly localized region, perhaps encompassing about ten February 19% subassemblies which remained acoustically active during a period of at least one year. The origin of these acoustic events has not yet been identified but comparisons with existing data on sodium boiling and fluid cavitation show that the activity is incompatible with either of these.

Acoustic boiling noise detection Sodium boiling has been established as giving rise to an impulse type sound. The problem is to detect this in the presence of background noise which may include other Waveguide SC impulsive sounds. Evidence has been collected from a number of sources as to the acoustic sound levels involved (Fig. 5). Boiling data has been obtained from the CfNa, KNS and SOBOB rigs in France, Germany and the United Kingdom respectively, and also from experiments in the KNK2 reactor and PFR. These, together with the SPXI reactor, have also given typical background levels. The February 1987 results evidently cover a wide range and hence give some uncertainty, none the less it is clear that bulk boiling in a LMFBR core, when vapour is ejected into the main coolant pool, would give out enough sound to be readily detectable. For the localized boiling within a subassembly when the vapour condenses internally, as is characteristic of a completely blocked subassembly, it may be necessary to recognize the event against a background of comparable level. The IAEA Co-ordinated Research Programme on advanced 2 Waveguide SC signal processing, 1 has addressed the particular problem of detecting sodium boiling in the presence of environmental background. Researchers from seven countries have examined benchmark recordings of sodium boiling acoustic Fig. 4. Acoustic source locations from pulses recorded in February signals mixed with varying degrees of random background 1986 and February 1987 noise. The latest results of this study have yet to be published 32 ACOUSTIC INSTRUMENTATION IN LMFBRS

100- source of information on the character and amplitude of u eacoustic background noise in operational SGUs. Vapour ejection Acoustic monitoring system. Twelve acoustic waveguides KNS3 are fitted to the shell of each of the nine PFR SGUs and these form the principal part of the data collection for the on-line lo- acoustic condition monitoring. The superheaters and reheaters have three waveguides at each of four axial levels,

-while the evaporators have four waveguides at each of three CFNA axial levels. The waveguides are positioned to give good E overall coverage of the unit and are spaced so that no part of the SGU is more than 3 m from at least two transducers. *.0-The waveguides are attached to the SGU shell by welding and the accelerometers are screwed on to the end of the

CD waveguide. Each accelerometer has an integral signal conditioning amplifier which is remotely powered from the 2main signal amplifier in the instrumentation room. The 0-1- Local boiling Background accelerometer signals are multiplexed into the main ampli- ' SPX1 _ tiers as required. ; i I (m(dummy crThecore)m condition monitoring is currently performed on an off- E KNS1 SOBOB line basis using tape recordings of the acoustic signals which 0. FR core) are made on a periodic basis. The tape recordings are then processed in a number of ways. Firstly an overall view is 0R01 (dummy core) obtained and displayed. Then areas of particular interest can -- commissioning KNK2 be identified for more detailed analysis. KNK2 General r.m.s. noise pattern. Figure 6 shows a summary PFR of the r.m.s. signal amplitude for all waveguides on each 1985 of the nine units, summarized from data recorded over a 0-001 three-year period from October 1987 and at close to full- Fig. 5. Comparison of sodium boiling signal amplitudes and power operation. All graphs are plotted on the same relative reactor background noise

0 4- but indications are that the signals can be distinguished 3- sufficiently to ensure a detection reliability of less than one , 2- error in 106, with less than one spurious trip in ten years, even when the signal-to-noise r.m.s. signal ratios are much - EZZIZZIIi less than unity, perhaps - 12 dB. Thus it would appear that EvaWora Evaporar 2 Eapotor 3 by using one or other of the techniques reported, localized __ boiling in a reactor will be detectable. 0 4- Secondary circuit acoustics 3- Vibration monitoring on PFR steam generators. An acoustic 2- monitoring system'3 has been installed on the steam 1_ generator units SGUs of the PFR at Dounreay. The system - has the objective of giving early warning of any change in Ret*;ter I Reheater 2 Iehear 3 noise output which could be related to potentially damaging 5 vibrations within the units. Data obtained from this PFR 04- monitoring system is playing an important part in the I development of acoustic instrumentation for leak detection, i although this has not been the primary objective of this j 21 particular installation. VT' The PFR has three secondary circuits each containing an 01 evaporator, a superheater and a reheater giving a total of nine upefrto1 Supefheater 2 Superheater 3 SGUs. Although the design of the units is different from that Fig. 6. Summary of rm.s. acoustic amplitudes for all PFR steam intended for EFR, the measurements provide a valuable generator units

33 LENNOX ET AL. linear scale which shows the range, minimum to maximum, This is an important factor that must be considered in of the recorded r.m.s. signal amplitude for frequencies above designing a signal processing system for an acoustic leak 10 kHz. In general it can be seen that the acoustic signal detection system. Evaporator 3 in particular has a very large amplitude measured on the reheaters is larger than that on value of 5a power factor which is observed on waveguides the superheaters, while the acoustic amplitudes on evaporator at the top level of the unit again in the region of the leakage I are within the range of those measured on the superheaters flows between baffles. and reheaters. It is seen that signal levels are up to nearly Location of sources. While detecting the appearance of a ftur times larger on evaporators 2 and 3. These large new acoustic source is of primary importance for monitoring amplitudes are seen in particular on the waveguides at the the condition of the steam generators, an estimation of its top level on each of these units and are thought to result from location is also particularly valuable since this can be used the effects of leakage flows which occur between diametral to assist inspection teams in the assessment of damage. In and circumferential baffles within the evaporators, addition, the location of a specific source would point to Analysis for impulsive sounds. During examination of the selective monitoring of this area in future. An example of data, particular attention is given to the tails of the probability acoustic source location using the same hyperbolic method distribution for evidence of 'spikiness' in the signal which described earlier for the PFR steam generators is given in may be produced by the presence of impulses due to loose Fig. 8, which charts the course of a rattling source with time. or impacting parts. Features that highlight this include the commonly used kurtosis of the distribution. However, for Acoustic leak detection in steam generators the work reported here a more sensitive indicator has been Passive leak detection picks up the sound produced by developed, the 5a power factor. This is a measure of the water leaking into sodium in the steam generator. This sound power in the signal which is greater than five standard can be due to the velocity of the steam jet (which can increase deviations from the mean normalized to that expected for if it impinges on a target), it can come from the sodium- random signals with a Gaussian distribution, a Gaussian water reaction itself (including liberation of hydrogen signal, therefore, will have a 5a power factor of 1. bubbles) or, under severe leak conditions, it can be produced Figure 7 shows a summary of the 5a power factor for all by the boiling of the sodium. Further sources of noise would waveguides on all units for the same three-year period as Fig. 6. It can be seen that all units have, to a varying degree, WG1 .G3 values for this feature much greater than unity, indicating 0 0 0 0 0 that the acoustic signals have a significant impulsive content. SodiumSdu 2- 0 , outlet / 1/ N) nozzle

200- -

1150-

100- 50 January 1989 0=1 WG9 W06 EvaporMwr 1 Eva" 2 E 3 24

250 200- IMarch 1988 150-January 1990

[too. a 2 3 a 150-1 Peiae e"r2Reheater ~100-.250- 1 m 200-

150 - T w l = W (3 1 = WG 12

suet Iereater 2 upwhe 3 B es3iated Supetleael source location Fig. 7.Summary of 5a power factors for all PFR steam generator units Fig. 8. Location of an acoustic source on PFR Superheater 3 shell

34 ACOUSTIC INSTRUMENTATION IN LMFBRS include the movement of the hydrogen bubbles through grids. leaks have been studied in facilities at both Dounreay and Hydrogen bubbles also have a markedly detectable effect in Bensburg. In a number of these tests acoustic transducers the absorption of certain background frequencies. were placed close to the leak to provide data on the strength The first and successful acoustic leak detection system for of the acoustic signal generated. For this Paper, data obtained fast reactor steam generators was the General Electric's from the Small Water Leak Rig and Super Noah facilities (GAAD) system developed for the Clinch River project in at Dounreay have been used. The details of the experiment 16 the USA, 14 but it is admitted that this is now obsolete in have been reported elsewhere. most technical aspects. ' 5 Proposals for a system on the EFR Transmission characteristics have been determined on PFR must differ from the earlier system in that the transducers steam generators, and water model facilities at Risley have should be easier to install and be fewer in number. It is also been used to assess the effect of the SGU construction on probable that the EFR design of SGU would be noisier than the transmission of sound. 17 There is no doubt that the that selected for Clinch River. These factors indicate that, geometry of the tube bundle itself has a dominant effect and in the interests of economy, the revised passive acoustic leak a theoretical study has also been undertaken to assist the detection system must cope with a poorer signal-to-noise modelling work. 18 ratio. With regard to the remaining items, these have already The following five factors have to be studied, to deduce been discussed in connection with ABND. However, it may detection performance. be noted that the International Atomic Energy Authority (a) The nature of the sound from actual sodium/water (IAEA) study on analytical techniques has now turned its leaks) attention to the matter of water/sodium leaks and is indicating

(b) The manner in which the sound propagates through that signal-to-noise ratios of -21 dB can be handled with the SGU to the detector. confidence. (c) The nature of the SGU background noise. Estimation of leak detection sensitivity. The collected data (d) The peroane SGUdata rouine,n secy can be used to estimate the possible sensitivity of a leak (d) The performance of data analysis routines, especially detection system using steam generators of similar noise when the background is high. performance to PFR. Fig. 9 shows the method. Horizontal (e) Techniques for sound source location, not only to bounds mark the extremes of noise experienced in PFR. With assist the operators in case of a leak, but also to analwcefrtnsiiolse,therpeette provide discrimination against extraneous noises, an allowance for transmission losses, these represent the levels against which the leak must be detected. The sloping Concerning the sound from actual leaks, water/sodium bounds indicate the range of actual sound output from leaks

Noisiest SGU 0" 34eheater g1S

- Quietest SGU

dB Enhancement due to ~17 Suehadvanced data processing

6 0-01- ,

0-001 0-1 anLeak pes rate: 10ocs

Fig. 9. Estimated sensitivity for acoustic detection of sodiumAvater/leaks 35 LENNOX ET AL.

design study has identified a potential requirement for acoustic instrumentation to fulfil safety functions.

Safety functions EFRA have identified potential requirements for the detection of boiling in any subassembly in the core and a specific requirement for the monitoring of the outlet ..... temperature from breeder subassemblies. An acoustic system for the detection of boiling (ABND) is proposed while a , g "....-USTM system for breeder subassemblies is proposed. The function of the boiling noise detection system is to provide protection against the escalation of faults in the beyond- design-basis regime. The function of the ultrasonic tempera- •:,ture measurement system for breeder subassemblies is to provide protection in the design-basis regime. USTM is being "...... "*" -- * ...... considered for the breeder region because the expected flow patterns in this region and the low velocity coolant jet from breeder subassemblies have an adverse impact on the effectiveness of conventional thermocouples.

Engineering implementations Fig. 10. Location of a sound source from the outside of a steel EFR design proposal for the ABND system. A preliminary vessel using beam forming (note the marked positions of the design study has established an outline design which is six transducers) compatible with the various engineering constraints and interfaces. This design concept is an array of immersed as a function of leak rate. The range reflects the fact that omnidirectional transducers positioned by vertical transducer not all leaks, as measured, give the same amount of sound. masts. Each subassembly is within 0.75 m of three trans- With a simple threshold type of detection, the actual ducers to allow a 2/3 trip vote (Fig. 11). The signals from sensitivity will lie somewhere within the enclosed rectangle. the array of transducers will be processed by a software-based For a noisy unit (PFR reheater no. 2) the sensitivity is in signal processing system which will issue signals to the shut- the range 34-67 g/s, while for the quieter superheater no. down system. The software-based signal processing system 3 the range is 0.55-13 g/s. It is clear that, with the latter, allows the flexibility of implementing either simple or a sensitivity of a few g/s would be no great problem. complex trip algorithms including, as appropriate, algorithms At present, it seems likely that a detection sensitivity of to improve the signal-to-noise ratio. I g/s would be required for EFR. From the foregoing, only A total of twelve masts would be needed and to meet the for the quieter unit, and for a favourably noisy leak, could 2/3 voting requirements, each mast would have three this be achieved with simple detection techniques. transducers, giving a total of 36. Extrapolation of the bounds on Fig. 9 indicates that for certain detection, a signal-to-noise ratio of - 17 dB would be EFR design proposal for the USTM system obtained, demanding the techniques being explored by the A possible arrangement based on immersed transducers IAEA research programme described earlier, is shown in Fig. 12. This arrangement has six penetrations Location of a sodium water leak. In the previous discussion in the reactor roof. In general, from each penetration a group examples have been given of source location by a hyperbolic of five tubes (40 mm in diameter) provide guidance for the method. For ALD, however, better and faster methods will transducers. The guide tubes are curved to position the be needed. Fig. 10 is an example of the use of time domain transducers in the appropriate location to achieve coverage beam forming techniques to locate the source of an impulsive of all second-row breeder subassemblies. sound when using transducers applied to the outside of a trial The transducers provide a very narrow angle beam. Each water model vessel. With currently available electronics the USTM system examines one straight row of breeder location takes about 5 s and research is under way to improve subassemblies. The single-comer subassemblies below the on this. ACS shell are covered by a separate USTM unit. Therefore, core there are Application of acoustic instrumentation to the for each 60* sector of the EFR (a) four USTM guide tubes for across flat subassemblies The European Fast Reactor design company, EFRA, is and preparing the design of EFR on behalf of the EFRUG. This (b) one USTM guide tube for each corner subassembly. 36 ACOUSTIC INSTRUMENTATION IN LMFBRS

S < -0**-0--.X * Lower cylinder

ri r.

x 2 OStIndnoe0200 0 e zn fe /

0 Cor zoe34u5 a *aa breedersc)

giving~~~~toa of9 a rndues rp ABND transducer guide tubes wh i real Core zone fuel SrA c a 12 posshdenoted* ets i n 270oi Cor the 2 fuel SIA C)Core zone 3 fuel SIA

*Radial breeders Fig. sI. Plan showing ABND tube locations. 140 mm above core level

A total of 30 masts would be needed and, to meet the 2/3 outputs from the processing units and decide as to voting requirement, each mast would have three transducers, whether the particular sub-system should register a giving a total of 90 transducerso trip. Instrumentation concepts This arrangement is shown schematically in Fig. 13.

ABND. The basic requirement of the signal processing Potentially quite complex data processing may be required system is that it digitizes and processes the analogue data on large amounts of data. Essentially a result will be required from the 36 transducers and produces a trip signal within in real time from an equivalent continuous data rate. The about I s of the onset of 'significant boiling' in a singlereata enc t i is ahcri subassembly. The electrical and physical arrangement of the Fig. 14. Commercial high speed digital signal processors system would be such as to satisfy a 2/3 voting criterion, (DSP) can achieve the necessary data processing rate. be functionally arranged as three The achievement of a reliable, licensable instrumentation twelve-channeli.e. the electronics subsystems, would with each subsystem physically system is a key design objective. Preliminary strategies for of the digital software and hardware are searaterlythexe a follwse ck proethe beingdevelopment established. It should be noted that there is no relevant (a) an analogue signal conditioning, amplification, hardware or software currently licensed in the United filtering and cable system Kingdom for nuclear reactors, and hence that this is a critical (b) data acquisition and processing elements which would aspect of the system. digitize and approximately process the analogue data LISM. This is an active system with transducers fed to them, producing a trip signal if required, while performing a dual transmit/receive function. The basic regularly executing a self-checking procedure, and requirement of the USTM system is that, if required, it (c) a voting/logic interface which would monitor the mechanically aligns the transmitters and receivers and then,

37 LENNOX ET AL ACS lower cyhnder profile I

IRc FC hru

Ultrasonic udetubes subassemblies

Ultrasonic waves tubes on periphery Fig. 12. Plan of SRP showing distribution of ultrasonic guide tubes as part of the trip system itself, sequences their operation, Each of the three sub-systems would consist, in essence, of digitizes and processes the analogue data from the 90 (a) an alignment system that would allow the transducer receiving transducers and produces a trip signal within, for orientation to be adjusted remotely as required (but example, one second of the subassembly outlet temperature not as part of the trip system) exceeding a defined limit. The electrical and physical (b) an analogue drive, signal conditioning, amplification arrangement of the system would be such as to satisfy a 2/3 and cable system voting criterion, i.e. the electronics would be functionally (c) a hardwired logic unit that would control the sub- arranged as three 30-channel sub-systems, with each sub- system sequencing, start-up, shut-down and load- system physically separate from the others. following behaviour of the processing units, and monitor their general operation Vote/logic (d) data acquisition and processing elements which would system digitize and appropriately process the analogue data Sal n - fed to them from the signal conditioning amplifiers, elmesn producing a trip signal if required, while regularly Tra r executing a self-checking procedure, and (e) a voting/logic interface which would monitor the 0 outputs from the processing units and decide as to To guardline whether the particular sub-system should register a trip. This arrangement is shown schematically in Fig. 15. A similar signal processing system to that proposed for ABND (Fig. 14) is under consideration. Each group of one- third of the total of 90 transducers would be linked via the appropriate number of DSP units to 'logic units' (one per group, a total of three), that would produce trip signals to (One sub-system of three) be fed forward to the guard line interfaces. Fig. 13. Trip system The USTM system is an 'active' one, injecting bursts of

38 ACOUSTIC INSTRUMENTATION IN LMFBRS

r-the additional complexity of transducer sequencing and O Rtransmit/receive switching.

Status of the EFR system + ADC DSP #1 The EFR systems for ABND and USTM are recognized development items with demonstration of engineered systems in-reactor being a key objective. NNC and the United Kingdom Atomic Energy Authority are working closely - ]together, within the context of the EFR project, to establish Hai , Trip the required engineering and development programmes. - -uSal Hardfir __ Demonstration of both systems in the PFR at Dounreay is transducerInput from | ft snas !"l -L- i beingen considered.osdrd

Conclusion ------It has been shown that acoustic monitoring systems can Ibe of value to fast reactors in both primary and secondary I circuits. A method for monitoring subassembly outlet temperatures remotely has been developed, with a sensitivity of about ±i2*C at operating temperatures of 550 0C. Installed anomaly or vibration detectors can be used for routine examinations or safety monitoring in both circuits, unusual Fig. 14. Arrangement of signal processor events calling for attention while also being automatically recorded for subsequent analysis. In the primary circuit the energy into the sodium. Although each of the potential 90 concept gives rise to the acoustic boiling noise detector, a channels could, in principle, operate simultaneously at device which is expected to have significant safety different frequencies, the filtering difficulties and cross-talk applications. In the secondary circuit, acoustic leak detection would almost certainly cause problems. Therefore, it is likely is already required as part of the reactor trip system. that any practical system will have to have individual channels In both safety applications, advanced signal processing, operating in isolation, on a rota basis, activated by the such as is currently being examined through an IAEA hardwired logic sequencer. programme, seems necessary. Again, both systems can The software and hardware development and licensability benefit from location analysis which identifies the area of issues are the same as those discussed for ABND above with the plant causing concern. With modern technology these

Seals

Algnet Receiver/ Processing system transmitterIelectronics elements

(Not part of trip system) I'l" _

-[ Logic unit

Transducers i

in reactor OuW to guardlines Fig. 15. General arrangement of USTM trip system

39 LENNOX ET AL.

advanced functions can already be effected within a few subassembly outlet temperatures by ultrasonics - preliminary results seconds. of a feasibility study. Proc. UMET '88, Avignon, France. Soci6te Fram,aise d'Energie Atomique, Paris, 1988. For the European Fast Reactor, acoustic instruments are 9. BROWN C.J. and HUGHES G. Remote measurement of LMFBR seen as a potential requirement to fulfil safety functions and subassembly outlet temperatures by ultrasonics. Nucl. Energy, 1992, details of their application in the primary circuit have been 31, No. 4, 261-276. Acoustic 10. THOMAS P.J., McKNIGHTJ.A.. ROWLEYR. and TAYLORC. described. surveillance of fast reactor primary circuits - experience with the Dounreay PFR monitor. Proc. SMORN VI, Symp. Nucl. Reactor Surteillance and Diagnostics, Gatlinburg, USA, May 1991. Acknowledgements It. MCKNIGHTJ.A.. ROWLEY R. and BEESLEY M.J. Acoustic surveillance The Authors acknowledge the permission of AEA techniques for SGU leak monitoring. Proc. IWGFR/79 specialists' Technology and NNC Ltd to publish this Paper. The sterling meetng on acousie/ultrasonic detection ofsodium atter leaks on steam generators (Girard J. Ph. ed.). JAEA, Vienna, Oct. 1990. efforts of their colleagues are gratefully acknowledged. The 12. ARKHIPOV V. et al. Signal processing techniques for boiling noise work of AEA Technology was funded by the Department detection. Prot% IWGFR/68 IAEA, Vienna, 1989. 13. RoWLEY R. and AIREYJ. Analysis of acoustic data from the PFR SGU of Trade and Industry. condition monitor. Proc. IWGFR/79 specialists, meeting on acoustic/ultrsonic detection of sodium water leaks on steam generators (Girard J. Ph. ed.). IAEA, Vienna, Oct. 1990. References 14. GAURATZ D.C. et al. On-line low and high frequency acoustic leak I. DUNCOMBE E.. ROACH P. and SEED G. Continuous monitoring of detection and location for an automated steam generator protection LMFBR structures. Liquid metal engineering and technology. BNES, system. Proc. IWGFR/79 specialists' meeting on acoustic/uitrasonic London, 1984. pp. 411-417. detection of sodium water leaks on steam generators (Girard J. Ph, 2. McKNIGHTJ.A. et al. The technology of under-sodium inspection in ed.). IAEA, Vienna, Oct. 1990. LMFBRs with particular reference to experimental measurements of 15. FLETCHER F. et al. Status of US evaluations of acoustic detection of the PFR core. UKAEA report ND-R-I 197(R). May 1985. in-sodium water leaks. Proc. IWGFRi79 specialists' meeting on 3. MCKNIGHT J.A., BARRETT L.M., BERTON JL., BLAsjus D. and acoustic/ultrasonic detection of sodium water leaks on steam generators DAUK J. The use of ultrasound for monitoring the internal structure (Girard J. Ph. ed.) IAEA, Vienna, Oct. 1990. of a LMFBR. Proc. LIMET '88, Avignon, France, Sociit Franaise 16. ROWLEY R., McKNIGHT J.A. and AiREY J. Analysis of acoustic data d'Energie Atomique, Paris, 1988, pp. 106-I-106-10. from UK sodium/water reaction test facilities. Proc. IWGFR/79 4. JOURNEAU CH. D1tection acoustique active de gaz dans une enceinte specialists' meeting on acoustic/ultrasonic detection of sodium water mdtallique. Proc. 2eme Congris FranVaise d'Acoustique. Socidt6 leaks on steam generators (Girard J. Ph. ed.). IAEA, Vienna, Oct. FraK;aise d'Acoustique, Arcachon, 14-17 April 1992. 1990. 5, McKNWTr.A. and BARRMT L.M. The development of under sodium 17. ROWLEY R. and AtEY J. Acoustic transmission in SGUs: plant and ultrasonics for the under sodium inspection of liquid metal fast breeder laboratory measurements. Proc. IWGFRI79 specialists' meeting on reactors. Proc. Annual Conf Brit. Inst. of NDT Oct. 1985. acoustichdutsomc detection of sodiwn water leaks on steam generators 6. BARREtt L.M. and WAYWELL S.J. High temperature ulthronic (Girard 1. Ph. ed.). IAEA, Vienna, Oct. 1990. probes, AEA Reactor Services report AEA-RS-1 44, June 1992. 18. HECKL M. Sound propagation in the steam generator - a theoretical 7. BURTON E.J., MACLEOD I.D. and MCKNIGHT J.A. UK patent GB approach. Proc. IWGFR/79specitlists'meeting on acoustic/ultrasonic 2153999. Aug. 1985. detection of sodiumn water leaks on steam generators (Girard J. Ph. 8. MACLEOD I.D. et al. Remote measurement of LMFBR fuel ed.) IAEA, Vienna, Oct. 1990.

40 Developments in digital instrumentation for Nuclear Electric's (UK) power plant

G. Hughes* D. B. Boettchert

The introduction of improved safety-related instnimenta- is being developed for generic application. There is also a tion control and protection systems on Nuclear Electric's continuing programme of improvements to the data (NE) existing and future nuclear power plants is a con- processing and control systems. tinuous nd evolving process. For the older plant, the main Looking to the future, the pressurized water reactor (PWR) objectives have been to provide improved systems to be station under construction at Sizewell makes extensive use consistent with modemn safety sadlards, to enable extended of computer-based systems both for normal operational and plant operation, to cope with equipment obsolescence and for protection functions, because of the constructional and to permit increased output. This Paper reviews the status operational benefits that such systems bring. The overall and potential of developments in a number of important configuration of the computer systems, together with the areas: C&I improvements resulting from long-term safety provision of secondary (back-up) protection, instrumentation reviews; new systems for AGR stations; the Westinghouse and controls using more conventional technology are out- PWR under construction at Sizewell. One result of this lined. The benefits to be obtained from the use of computer evolution is that computers are now used for the full range systems are described, together with the steps that are of safety and safety-related applications, as exemplified in required to demonstrate that the computer software is fit for the new PWR plant. The apach being developed in NE the purpose. This protection system development highlights for the safety justification of these systems is outlined, the generic requirement to provide safety justification of computer systems. The approach currently being adopted by NE is outlined, including the development of guidelines for Long-term safety reviews (LTSRs) have been performed for the design and procurement of future systems of new design. UK's Magnox reactors (see, for example, the Nuclear Inspectorate's findings on the Bradwell review'), to confirm the acceptability of continued operation to a 30 year operating LTSR Improvements identified a life and to identify improvements which are reasonably The LTSRs performed for Magnox plant practicable. Resulting from this process are the measures number of improvements which are being implemented, inspection of described to provide diversity of protection and shut-down including diverse feed systems and enhanced 2 the improved together with emergency indication centres. A number of steel components. In the present context only indication the generic issues that were being addressed were recognized protection and shut-down systems and emergency as being equally applicable to the older AGR stations and centres are described. a similar review and enhancement process has been initiated. 2 Improved shut-down protection In addition to the work resulting from the LTSR, The five steel pressure vessel Magnox stations (Bradwell, improvements to the AGR protection systems have been or Hinkley *A', Trawsfynydd, Dungeness 'A'and Sizewell 'A') from the are being developed. A single channel trip system (SCTS) already incorporate a shut-down mechanism diverse on channel gas outlet temperature has been installed on normal control rods, namely the boron ball shut-down Dungeness 'B'and a gaseous activity monitor (GAM) trip devices (BBSDs). These comprise of a number of hopper units suspended within the pressure vessel, just above the reactor core, filled with boron steel balls which can be discharged into thimbles within the core. The principal * Nuclear Electric Technology Division, Barnwood, Gloucester, UK. improvement, following the LTSRs, has been the addition t Nuclear Electric PWR Project Group, Booth's Hall, Knotsford, Cheshire. of new and diverse guardlines (DGLs) to provide automatic Nud Energy, 1993, 32, No. 1, Feb., 41-52 41 HUGHES AND BOETTCHER

actuation of the BBSDs, and thus augment the reliability of (d) circulator speeds the existing primary control rod based shut-down system and (e) boiler feed-water flows give fast acting shut-down over a wide range of faults. The WI) boiler drum levels new systems incorporate the following features (g) status of essential electrical supplies. (a) DGL monitoring of a sub-set of parameters, chosen The principal hazards which could make the MCR on a station-specific basis to provide diversity of unavailable, i.e. fire. earthquake, steam and hot gas releases tripping for frequent faults as far as is reasonably or missile damage, have been addressed in the design of the practicable EIC systems. Protected cable routes have been provided, (b) Automatic operation of the existing BBSD units segregated from those associated with the MCR to minimize subject to the following two factors to aid plant damage resulting from seismic activity. The protection covers availability constraints both fire and hot gas releases. The EICs are sited outside the danger zone resulting from missiles generated by, for tion of the BBSDs when the normal control example, the disintegration of the main turbines and the and shut-offrods have successfully tripped. CO storage tanks. Simple This is necessary for commercial reasons, as indications2 of the key parametersbut arereliable provided, direct supported wired

following the trip there is an extensive period by data logging of parameters of secondary importance using commercially available digital technology. The EIC instru- required for recovery of the balls mentation is such that it does not corrupt signals used for (ii) introduction of a low power inhibit to prevent plant protection and it is supplied from an interruptible power power level to prevent spurious tripping when supply, backed up for at least two hours by dedicated batteries. The new systems have been designed on the basis valid flux signals are unavailable of reasonable practicability of implementation, safety benefit (c) Control rod tripping from the DGL. and a short timescale for introduction. The origia main guardline in the primary shut-down system andWork facilities at Bradwell at all other and Magnox Hinkley are 'A' planned has been for completioncompleted used relay technology and represented the main limit to shut- down reliability at 10- 4 failures per demand (f/d). The this year. DGL has been implemented with Laddic magnetic logic During the Magnox LTSR work it was recognized that a elements supplied by GEC Systems. The intrinsic unreli- number of the generic issues that were being addressed were ability of the DGL is 10- 5 fVd. A detailed probabilistic equally applicable to the older AGR stations and a similar safety assessment has been performed, incorporating a review process has been initiated. Potential improvements treatment of common cause failures (including external are being approached on a station specific basis because of hazards and operator error) to demonstrate a shutdown the significant variations in protection system design. unreliability of 10- 7 f/d for the new combined system. This work has been completed for Bradwell and Hinkley New AGR systems A', and that for the other stations will follow within a year. In addition to the work resulting from the LTSR, new specific improvements to the AGR protection, control and Emergency/alternative indication centres monitoring systems have been or are being developed, as The Magnox reactor design was such that information indicated by the next three examples. considered necessary for safe and economical operation of Individual fuel channel protection the plant was displayed in the main control room (MCR) Dungenassfue1channelimiteton and/or locally on the plant. The LTSR recommended that Dungeness "B'was limited to operate at reduced power emereyindication centres ( Cs) be introduced to provide (64%) by an imposed limit emergency iof of 580 *C - c.f. a design value 675 *C on channel gas outlet temperature (T2) to ensure a single location from which essential safety parameters may that in the event of gag shaft failure, a suitable period for be monitored in the event of the MCR being unavailable for any reason. In these circumstances the reactors will be shut- operator action is available to aipthe reactor manually. In order to maintain an acceptable radial T2 distribution, each down, and the necessary and sufficient requirement for the AGR fuel assembly is fitted with an inlet gag positioned and EIC instrumentation is that it shall permit the monitoring of the trip, shut-down and post-trip cooling of the reactors. This supported by a shaft which is used to adjust is to be achieved by monitoring the following sub-set of key flow. The design and manufacture of the shaftthe iscoolant such thatgas parameters whilst there is only a low probability of shaft failure, it is in the case of the Dungeness 'B' still conceivable that it could (a) neutron flux fail. Spurious gag closure could also produce the same (b) coolant pressure coolant flow reduction, though over a much longer time-scale (c) coolant inlet and outlet temperatures (=20 rin.); hence the consequences are bounded by shaft 42 DIGITAL INSTRUMENTATION FOR NUCLEAR ELECTRIC S (UK) POWER PLANT failure. Following a thorough review of these faults and Coolant gas activity trip system means of protection it was decided to install an automatic A gaseous activity monitor (GAM) trip is being developed reactor trip based on a single channel trip system (SCTS) for generic application on the AGR plant, although the operating on channel gas outlet temperature. This is provided cost/benefit of the GAM system still has to be demonstrated to limit peak clad temperature to a level significantly below before implementation. Its function is to detect the release clad melt following the most severe gag fault from full reactor of fission products from the fuel, however this may arise. power. Hence it will monitor a fundamental safety parameter, i.e. The system design and manufacture was performed by the breaching of a barrier against the release of activity, and AEA Technology, Winfrith, based on the individual sub- will thus provide protection against unforeseen faults or fuel assembly temperature (ISAT) computer-based monitoring failure mechanisms. In addition, GAM will constitute a new system developed as part of the UK fast reactor pro- diverse protection parameter, providing additional defence 3 gramme The novel and important feature of ISAT is the against common cause failure mechanisms, including introduction of test signals that drive the system into a trip hazards. Recent work has demonstrated significant margins state. The test signals are interleaved between the plant between loss of pin integrity and release of activity from the signals to produce an output which switches between a tripped pressure vessel, and GAM could be claimed as a line of and healthy state. The output state pattern produced by this protection against frequent faults. dynamic operation is checked for normality with a hard-wired The GAM is being developed by Siemens-Plessey pattern recognition logic (PRL) circuit to detect any abnormal Controls, under contract to Nuclear Electric, based on the pattern and initiate a channel trip. The concepts are illustrated use of sodium iodide detectors to detect 88Kr released from in Fig. 1.On Dungeness 'B'two thermocouples are used the fuel. The energy distribution of the line spectra associated on each of 408 fuel channels and each thermocouple is used with each gamma emitter is broadened, as illustrated in Fig. as an input to two of the four-fold redundant ISAT electronic 2, and the resolution of the 8Kr lines (from the other major channels which are voted on a 2 out of 4 basis to give a gamma emitters, including 16N and 41Ar) is consequently reactor trip. This represents 1 out of 2 tripping on the reduced. The process can be seen as the convolution of the thermocouple inputs from each fuel channel. line spectrum 4lof an emitter with the detector energy At the time or writing, Safety Committee approval has been efficiency matrix E, producing an observed spectral energy given for connection into the trip system, following a period distribution C. The instrument being developed will provide of passive use. It is intended to increase T, to 650 OC at first deconvolution of the observed spectra to derive 4 using the and 675 'C later. equation: 4 = Ix C, where I = E-' is the inverse of the

Trip parameter Multiplexers sensors Analogue Trip Vote Pulse A 1 to digital algorithm algorithm to DC

signals MX recognition A logicl

I To 10 shutdown a actuator

16-"

Fig. 1. "ISAT"dynamic logic technique used for AGR single channel tnip

43 HUGHES AND BOETTCHER

SYSTEM INPUT ' This provides the possibility of a fully deterministic hardware (GAMMA FLUX) design which can be verified using both functional and fault simulation testing.

BACKSCATTER SIt is believed that the protection system will enable the ABSORPTPOM LOSS reactor to be tripped reliably from failure of a few pins whilst

SCATTER COLLIMATOR 0 GAMMA ENERGY 6MeV maintaining an acceptably low spurious trip rate. The

GAMMA PHOTON SCINTILLATOR SYSTEMS OUTP:UTI prototype reactor installation and test programme commenced LOSS (SPECTRUM) in October 1992. ELECTRON LOSS PHOTOMULTIPLIER-L. : AGR data processing system (DPS) refurbishments There have been continuous modifications and improvements in the data processing and control systems of Magnox CHANNELS 4096°0 and early AGR stations. These have been necessary to cope Fig. 2. GAM system functional schematic diagram with equipment obsolescence and to provide improvements to the operator interface. In some cases particular measures have been used to cope with specific problems, for example Ian emulator based on a modern Ferranti Argus 700 computer has been designed to replace the original but now obsolete Argus 500 unit, involving no change to the original applica- has been performed THEnC tion software. The majority of the work THEoEE ST THEORIAL u CTRU with the SWEPSPEED and CUTLASS system software M packages developed by the CEGB, the predecessor company INVERSE-M L IEL S of NE, for general power station use . 4 5 However, a new

.11. (C 1 (0. generic design for monitoring and control is now being 121 .... I,12,n C2 02 developed, based on the Ada programming language, such 13, . 13. X C 03 1./3 / ° that it can be used to refurbish the control and instrumentation . In systems at up to four of the first generation of AGR power ) [U,.I Ifl 11) LCfl L stations (Dungeness, Hinkley Point, Heysham I and Hartlepool) if necessary. The Ada language has been specified to take advantage of the major investment associated Lwith its development for defence purposes, where it is now f'I~~ ~ ~ ~ ~1OUPUT mltr nfloigN a S-20mA the military standard. In following this course, NE has TRP indicated an intention to abandon the in-house developments J: PULSERE& "-E IP app,iof SWEPSPEEDon and CUTLASS for future long-term II ASSMBL ALYEll FILE aplications. The design is being developed for generic application by NE Operational Projects, Generation Division, involving Ferranti International plc. The design will provide monitoring, automatic control, information transfer and CAUAR support facilities. Applications will be configured as database written in Fig. 3. Deconvolution of the observed energy spectrum elements which will be interpreted by programs Ada. The applications will be implemented on a VME based platform utilizing the Motorola 88000 family of RISC efficiency matrix, as detailed in Fig. 3. (Reduced Instruction Set Computer) components, giving both This basic method has been in use for a long time. flexibility and performance. 6 Both active and standby However, the proposed method of implementation as a redundancy will be used to achieve high levels of availability reactor protection system is of interest. The observed energy and reliability. spectrum from a pulse height analyser is processed by a The AGR real-time software is being implemented so that digital filter which uses coefficients of the matrix I stored the Ada code interfaces directly to the underlying hardware in EEPROM. This provides up/down outputs to a digital without the need for an operating system. It will use the ratemeter/counter which in turn derives an updated estimate input/output (I/O) and tasking features of the Ada language of the 88Kr activity. The matrix coefficients are derived directly to control processor resources, I/O systems, using a c alibration computer, however, the protection system memory, interrupts and other functions. This configuration utilizes an application-specific inegrated circuit (ASIC) and is known as a bare machine Ada system. 7 Real time does not use any on-line, real-time software in operation. response, code execution speed, application code space and

44 DIGITAL INSTRUMENTATION FOR NUCLEAR ELECTRIC'S (UK) POWER PLANT

SIGNALS FOR SSTEM LEVEL reliability should all be improved by the removal of the OPERATION operating system. The Ada language was specifically designed for large-scale real-time applications. The structure of the language Ress SF PLANT Re.ACTUATION encourages and enforces good software engineering MEASUMENTS 2LOC 2/ L principles and the resulting software product is easy to T E understand and modify. The compiler performs rigorous checks on the program and will expose faults, e.g. data type TRP mismatches before the testing phase. In execution, an Ada program performs additional checks, including: addressing CONTROL ROD outside the normal span of an array, variables out of range PRIMARY DRIVE SYSTEM and stack overflows. If errors are detected, execution is COMPUTER PROTECTIONSYSTEM RCITBAKS passed to an exception handler. The speed and capacity of the new hardware systems will allow the use of all Ada language constraints and diagnostic facilities to ensure high SECONDARY CONTACTORS reliability. LASC OTECTO The approach gives high performance, reliability and SULSURCE availability with a low maintenance burden. Compactness and a high degree of flexibility also result in the design which

'E, SYSTEM LEVEL has a sound basis for safety justification. The current status OPERATION of the project is that a generic development programme has SIGNALS been underway for one year and the timescales for its application to each AGR station will be reviewed over this PLANT I SP.S. coming year. Proven software and hardware components will MESU RE S ---- 214 LOGIC in 1993. be completed Fig. 4. Overall Sizewell 'B' protection and control systems PWR protection and safety related I&C systems The PWR under construction at Sizewell 'B', which is due for a variety of applications, including protection. to raise power in 1994, makes extensive use of computers The HICS provides the majority of the safety-related man- for both protection and safety-related control and instru- machine interface functions. It acquires manual control mentation functions, in addition to their use for many non- demands from switches on the control room panels, sending safety functions. The primary protection system (PPS) this data over the data network to output cards in cubicles provides reactor trip and engineered safety features actuation near to the controlled devices. It also acquires data from plant for all faults that require automatic response, and the high- items or transducers, or other safety-related systems such integrity control system (HICS) provides safety related as the PPS and SPS, and uses this data to drive conventional monitoring and control functions. The systems are outlined discrete panel instruments and lamps in the control rooms. in Fig. 4. The HICS also displays safety-related data on four seismic- In order to meet stringent UK safety standards, the PPS ally qualified plasma display units in the main control room. is backed up for all but some of the lowest frequency faults Finally, the HICS also passes data to the station data pro- (i.e. those with a frequency of less than one in a thousand cessing system for processing, logging, and display on the years) by a Laddic-based secondary protection system (SPS), VDUs situated at strategic positions around the control and the HICS is similarly backed up by a set of conventional rooms. analogue and hard-wired instrumentation and controls. These The HICS is sub-divided into four separate networks, each back-up provisions are entirely conventional, and are not of which comprizes numerous autonomous distributed data discussed further in this Paper. acquisition and processing units linked together by a local The PPS is a computer-based system using multiple area network. It is a principle of the system that processing microprocessors to process the information received from is performed as close as possible to the place where either plant sensors, to derive trip states from that information and the data is acquired or a control action is needed, in order to perform voting on those trip states. The PPS employs four- to reduce the traffic on the network data highways. This has fold redundancy, with fibre optics being used to convey been found by experience to be an important consideration. information on trip states between the four channels, and two The division into networks follows the subdivision of the from four coincidence voting on those trip states, to ensure station's essential electrical systems into four separation adequate system availability and reliability. The PPS has been groups, each group being electrically independent from, and, developed by Westinghouse, and systems using the same for safety requirements, redundant to, the others. The HICS technology are being supplied as backfits to existing plants gathers data from plant and the control room panels. Input 45 HUGHES AND BOETTCHER data is converted into packets of digital information in than is required for the older style systems. Automatic testing processors local to the items being monitored. These packets is done comprehensively and reliably, individual tests or steps of information are then broadcast on the local area network. are not omitted, and mistakes by the operators do not cause Other subscribers on the network receive and process the spurious trips. Continuous on-line calibration can be used information, combining it with their data, and perform to compensate for the effects of drift in the analogue portions control actions on items of plant or control room instruments, of the system, and re-calibrations to account for changes in the reactor as the fuel is burned up can be done using Benefits of using computer-based systems enhanced man-machine interfaces on computer visual display The use of distributed computer systems brings major units, with ranges automatically chacked to prevent out of benefits in terms of reduced capital cost because the equip- range conditions being set, and the results being printed out ment is much more compact than relay-based equipment, for checking, and keeping as permanent records. reducing the space needed to incorporate the hardware and In addition, the use of microprocessors instead of analogue cables. Other considerable benefits are the significantly electronics means that more sophisticated functions providing reduced site assembly and cable pulling effort, and reduction increased safety margins can be programmed into the in the quantities of combustible materials installed on the protection system. Accuracy is also better than for analogue station. equipment, which increases the margins between the actual The use of multiplexing data highways significantly setpoint and those assumed in the safety analysis, without reduces the quantities of cables required when compared to increasing the likelihood of spurious trips. a conventional C&I scheme. This results in major reductions The HICS uses similar technology to that of the PPS, and in the number of cables to be pulled (installed) at the site. some of the software modules are the same as thos employed For Sizewell 'B', there are four HICS data networks to be in the PPS. Because of this, demonstration of the installed, requiring the pulling of a few dozen fibre optic data dependability of the software of the PPS is also important network cables. These cables replace the hundreds of in demonstrating an adequately low probability of common multicore cables which would bave been required if mode failure of the HICS. multiplexing techniques were not being used. The duties of the PPS and the HICS are quite dissimilar, The reduced quantity of cabling significantly reduces the with the hardware and software being subjected to different amount of cable insulating material installed on the station, input data and being required to perform different functions This brings benefits in reducing the potential for fires to be at any given moment. They are therefore functionally caused or spread by combustion of the insulating material. diverse, and it is most unlikely that a common mode failure For instance, the elimination of large quantities of C&I cables would affect both systems simultaneously. However, this is to and from the main control room has resulted in a very difficult to prove, and in addition to a careful considerable improvement in the safety of the cable spreading consideration of the potential for such a common mode failure rooms above and below the control room, which in a and the employment of defensive measures to reduce the traditionally designed PWR plant are very heavily loaded likelihood of their occurrence, a safety case analysis has been with cables. performed, pessimistically assuming that common mode The use of multiplexing data highways to communicate failure of the HICS and the PPS could occur, albeit rarely, data around the plant brings significant benefits to safety with the HICS failure potentially causing spurious plant because of the resistance of the system to the effects of actuations, and the PPS subsequently failing to initiate the hazards. A well-designed and implemented distributed necessary mitigation. This analysis has demonstrated that the computer system like the SDN employs redundant messages, SPS, together with the analogue instruments and hard-wired or packets of information, with checksums, parity checking controls provide adequate protection to mitigate such faults. and redundancy checking at various stages of message Similar software is used in all four channels of the PPS, ttansmission and receipt. These measures ensure that errors and its dependability therefore represents a key factor in introduced into the data stream by hazards, such as fires or demonstrating an acceptably low common mode failure radio frequency interference, will be detected and rejected probability for the system. The PPS and HICS software is without giving rise to spurious signals or control actions. developed by a team of Westinghouse engineers, and Although the possibility still exists that hazards can affect subjected to verification and validation by a separate team individual subscribers, or cause the network to stop under a different manager within Westinghouse. In addition operating, the possibility of spurious control signals causing to this, the PPS software is subjected to the additional complex and difficult-to-mitigate plant faults is much analyses and assesments that are described below in order reduced, i.e. it is easier to design such a system to be to confirm that it is fit for purpose. fail-safe. The use of microprocessor systems means that testing can Assessment and safety justification of computer- be performed automatically by the system itself, under the based systems direction and control of the operating staff, in much less time Computer-based systems can and do improve plant safety,

46 DIGITAL INSTRUMENTATION FOR NUCLEAR ELECTRIC'S (UK) POWER PLANT

with the potential for higher reliability, increased procedures, and the application of IEC 880 standard functionality, improved information formats and reduced for the software componentio operator involvement in testing and maintenance, compared (b) independent assessments including extensive static to conventional electronic or electro-mechanical systems. analysis of the code using MALPAS to show Unfortunately, at present it is difficult to provide justification compliance between function and specification" of such systems for safety use, where quantification of (c) a challenging dynamic test (analogous to that per- reliability is the norm. There are a number of reasons for formed on the Darlington safety computers), and a this problem. one-year trial of the full system before operation. Firstly, digital systems embody a very large number of discrete states, any of which could be incorrect. The Nuclear Electric is actively involved in the latter two traditional assessment methods applied to analogue systems activities for the Dungeness 'B' SCTS and Sizewell 'B' PPS. rely on validation for a limited number of states and the The elements involved in an NE assessment procedure are legitimate assumption of correctness at intermediate states. shown in Fig. 5. Starting from the specifications of require- Digital computer systems are not represented by such ments (SOR) of the system, hardware and software com- continuous function mathematics and need to be validated ponents, an overall requirements assessment has been for all states possible during operation. Software is fixed performed. This is being12 followed by detailed software and (assuming no updating) and any errors in its functioning are hardware assessments, embodied at the time of writing or specification. Observed failures of the software appear to be stochastic because it Software assessment responds to a highly variable and multi-dimensional input. When assessing software it is important that manual Particular regions of the parameter space will invoke checking should be augmented by a more formal approach. particular paths through the software. If some of these paths This is currently particularly important because software contain errors, the software will fail from time to time in being pres ented for mt will have been initiated some an apparently random fashion. Because of the large number years ago when usage of formal specification and design of input and internal states, it is essential to develop a detailed methods was not widespread. In the two protection system understanding of the environment of the computer system applications static analysis has been applied for the following and its internal failure modes so that a representative set of reasons. states can be identified and the system exercised accordingly. (a) To check the code against a formal statement of the However, as verification and testing must often be completed requirement and to confirm that the code performed before actual operation, justification must be an essential part all the functions specified in the requirement of the design and development process. documentation and that it did not embody any extra Secondly, the systematic (common mode) failures resulting functions which were not contained in the require- from software (design) errors restricts the use of redundant ment. Static analysis examines every path within the functional elements, invoked with an appropriate hardware code and makes a statement about what the outputs configuration, which has been used traditionally to mitigate would be for the full input domain; thus it can be against random component failures. deduced that the code is safe, in terms of its function, Finally, the potential benefits to be derived from using apart from the temporal constraints. diverse components (hardware and software) are not yet (b) To give diversity from other assessments, notably the established. verification and validation applied by the developer. These fundamental problems are often exacerbated by the use of readily available 'off-the-shelf devices, such as It is possible to perform some static analysis by hand programmable logic controllers (PLCs). These often (indeed this has been done by Ontario Hydro in the incorporate embedded software, which can be inaccessible assessment of the Darlington shut-down system software) but and which has often been produced using non-standard for a significant quantity of code some automation is languages and procedures. necessary. In recent assessments, MALPAS has been used In the UK, the responsibility for demonstrating safety rests to analyse most aspects of a language as it is not restricted with the operator (NE), and, for example, whilst the use of to a subset. The work on the Sizewell 'B' PPS is ongoing. the Sizewell B PPS has been accepted in principle by the For Dungeness SCTS (performed with Rolls-Royce and licensing authority, great care is being taken in the Associates as sub-contractor) the quantity of code was small verification and validation of the system at all stages.8.9 and this analysis is now complete. It is of interest that Three main elements will be used to demonstrate the quality MALPAS analysis of the Dungeness 'B' SCTS pinpointed of the system one problem which was not found until final testing of the system and also revealed two minor shortcomings in the code (a) the competence of the design and production which were shown not to constitute a threat and will be processes, invoking extensive quality assurance corrected in a later release of the code. It also revealed some

47 HUGHES AND BOETTCHER SRS/W SOURCE OBJECT EEUALE S/W SR MODULE COD SPECS FILES FILES (NPROMS)}

MALPAS COMPARATOR DYNAMIC

KEY: = SYSTEM REQUIREMENTS SOR SPECIFICATION OF REQUIREMENTS H/W-S/W SOR ASSESSMENT H/W- HARDWARE NTEGRATION *MS/W - SOFTWARE

ASSESSMENT

H/W SOR MODULE MODULE H/V UNITS SPECS DESIGN

Fig. 5. Independent assessment tasks extra functions not contained in the requirement; it could be dangerous code could be patched into the binary code with demonstrated that these were not dangerous. malicious intent (admittedly unlikely, but still possible). Static analysis can be used to verify the source code of In the case of the Sizewell 'B' PPS code it is intended to a system but does not guarantee that the binary code contained fill this gap in the assessment process by implementing and in the final PROMs is an accurate representation of the applying a source/code comparator which represents the verified source. Testing exercises the binary code, although algorithms both of the source code and of the final binary it is of interest that test tools employing source code code in the same intermediate language, which is then instrumentation may actually change the code under test compared using the MALPAS analysers. This will be done 3 (inclusion of extra statements affects the way in which an using an automatic comparator tool developed by NE. It optimizing compiler performs code generation). As noted is believed that in many cases agreement will be total while above, testing cannot be depended upon to exercise all code in others the analyst will be presented with a small number paths. Therefore we are bound to rely on the correctness of of discrepancies for further investigation by hand and eye; compilers, assemblers, linkers and loaders. Optimizing it is unlikely that the tool will ever be totally automatic. An compilers in particular are complex pieces of software. Their outline of the data sets and transformations is shown in Fig. 6. use is widespread because of their obvious advantages in A similar activity was undertaken in the case of the enabling the production of flexible control software Dungeness 'B3 SCTS code. This problem was quicker and employing complex algorithms which must run within tight easier to solve because the quantity of code was relatively time limits; high-level languages also reduce the human small and written in assembler, which meant that the mapping errors which occur in writing large assembly-language between source statement and binary code was very simple programs. At the present time, no large commercial compiler (one-to-one in most cases). has been rigorously proved correct, and the usual argument for object code correctness is the fact that the development Hardware assessment tools have been exercised extensively on a range of projects. The hardware in a PES is designed around microprocessors An additional danger is the possibility of a wrong version and their derivatives, together with their families of support of the object code being incorporated in a PROM (e.g. a new devices. The functional density and flexibility of modern version containing an error correction may be statically devices creates a number of problems for safety assessment. analysed but not recompiled and the old version without the The reliability of a safety system is of prime importance. correction is picked up at the link stage). Worse still, Numerically it is calculated from component failure rates,

48 DIGITAL INSTRUMENTATION FOR NUCLEAR ELECTRIC'S (UK) POWER PLANT

CompilellinkAlocate taking into account redundancy, the effects of common mode Prom tape ----- 4--- PLM sOurce failures and the proportion of failures that are unsafe. This latter aspect is very important and needs to be supported by a detailed failure analysis. Object reconstitutor For conventional systems a failure modes and effects analysis (FMEA) can be performed which postulates the failure of components in each of a few modes, to determine Disassembler Table generator the effects of each failure mode on the operation of the circuit and ultimately the system. Microprocessors and other complex devices are not amenable to such an approach ASMN preprocessor PLM86 PreProcessor because of the unknown effects of failures, which are Name table I dependent on the execution of the software. To mitigate

ASM86-IL translator PLM86-IL translator against this problem NE have utilized and developed failure analysis based on partitioning of the system into functional blocks and defining block failure modes. Known as functional IL(A) preprocessor 1L(P) preprocessor block analysis (FBA) it starts by delineating sub-systems down to functional blocks. Postulated failure modes are thus correlated with component failure rates and embedded MALPAS (semantic) ]ZMALPAS (semantic)] methods of fault detection to arrive at dangerous failure rates for the block. Compl. preprocessor To illustrate the FBA process, an example of a real-time microprocessor-based system is shown in Fig. 7, which is then split into functional blocks in Fig. 8. Functional failure MALPAS (compliance) modes are tabulated for each block together with the detection coverage. Where coverage is inadequate, then that functional block is itself split into smaller blocks. If necessary, this Result] process can continue until individual complex integrated differences circuits are treated as blocks. A failure rate for a functional failure mode is derived from the failure rates of components Fig. 6. Source/code comparator whose failure produce dangerous (unrevealed) functional failures. The derived overall percentage of dangerous faults

Motor control

Analogue interface ~Processor

A D C BDa ta lin k P a al e

Analogue Analogue interface interface Remote Remote 2ContactAcul sens ilays inputsdispp

Fig. 7. Functional block analysis - example

49 HUGHES AND BOETTCHER ,, Furnctional I

Analogue input Analogue Serial Parallel function output 1/0 t/0 function function function

Compensate CalibrateTogeMi range reference CRC latch convert shift fitter utoA A to D

ApiyAmplify Inject Inject shift ~shiftorr ureadback readback

Readback

Isolate ~Isolate Cniinn

tevel

Fig. 8. Functional block analysis - split must be less than that used in the reliability calculation and system function, will be performed on one set of guardline not greater than 10% for fail-safe claims to be acceptable. equipment incorporating final version software, using input There are arguments against using these essential data which simulates normal and fault plant conditions. embedded self-tests in PES software, in that it increases Similar procedures were followed in a less formal way in software complexity. It is possible to use dedicated hard- the development of ISAT to simulate the operational wired checking in systems where a variety of sub-function environment of the system. The basic concept is that by checks are not needed to reveal dangerous failures; the restricting the input test data to the subset that will be seen Dungeness 'B' SCTS is a good example. However, at present in operation and, in principle, by simulating normal and fault such approaches are not widely used, and have the expected data the probability of failure on demand can be quantified. problems associated with demonstrating adequate fault The proposed test system will provide generation of input coverage with few diagnostics. It is possible that in the future test data from base fault transients and normal plant operation a dedicated ASIC could provide comprehensive diagnostics which is input to both the PPS and a model or oracle of PPS without increasing the PES software complexity. function and the outputs compared. An analysis of the ASIC technology (as used in the GAM design) is now expected versus the actual output data is used to indicate a mature, there is adequate history of their use, and libraries potential failure. If during the test a fault in the PPS software of well-used circuit elements (cells) are available. Design is confirmed then it will be necessary to correct it and repeat tools offer repetitive and closely controlled development with the entire test procedure. simulators giving coverage of a wide range of faults. They offer the promise of almost total fault coverage in end-of- Developing standards and research production line tests (up to 99% of stuck-at faults already It is accepted NE policy to follow IAEA and IEC Guidance achieved). Designed-in self checks can provide good and Standards for the design of safety-related systems. coverage of in-service faults. However, this is a rapidly developing area and the long timescales associated with the production of international Dynamic statistical testing standards has meant that relevant standards, covering all Hardware and software development testing and system categories of safety application are not available. commissioning only exercises a sub-set of the system Consequently and looking ahead, for application to future functionality and cannot stress the system in a way which new systems of new design, NE has issued Draft Guidelines realistically mimics long-term operation. For the Sizewell for using programmable electronic systems (PESs) in safety *B' PPS a final dynamic test, to challenge the complete and safety-related applications 14 for trial use within the

50 DIGITAL INSTRUMENTATION FOR NUCLEAR ELECTRIC'S (UK) POWER PLANT

Table 1, New NE PES guidelines - categorization of systems methods and in addition to a significant generic nuclear safety System unreliability (probability of failure to PES level programmeinvolved in acontrolled number of by collaborative HSE, Nuclear research Electric activities is directly on perform its design function on demand or designation sowe iability. of c ularte are t cts continuously over a 10 000 hour period) software reliability. Of particular note, are two projects

- 5 - within the new DTI SafeIT programme on safety critical Greater than or equal to 10 and less than 10 4 P4 software. 15 This is a part of a UK Government initiative to - 4 Greater than or equal to 10 and less than 10- 3 P3 Greater than or equal to 10- 3 and less than 10-2 P2 promote the safety of computer-controlled systems. The first, - Greater than or equal to 10 2 and less than 10-' PI FASGEP, will attempt to develop a system for the quantified fault analysis of the software development processes, together with their related procedures and practices, so that the company. The guidelines call for reasoned arguments of probability of faults can be established. The second, fitness-for-purpose based on analyses of the design, its CONTESSE, will seek to develop a common framework for implementation and the development process. In addition, the dynamic testing of software, based on models of the long established use can contribute an important element of operational environment. In addition, there is continued justification. The basic philosophy that has been adopted is participation in the Esprit II project on diverse and reliable to provide justification of the complete system (hardware and trip systems (DARTS). Finally NE is currently directly software) reliability, based on analytic and empirical funding research being performed by the AEA on specific evidence. The justified quality of the software elements is applications and is a partner in the Halden research such that they do not degrade the system reliability for each programme. category of safety usage. The categories, defined in terms of PES reliability are given in Table 1. Conclusions Four categories of system are defined (PI -P4) on the basis Improvements to the control and instrumentation systems of the degree of unreliability that can be tolerated in different used in safety-related applications in NE's nuclear power safety and safety-related applications, plant are enabling significant economic benefits to be The guidelines define important safety objectives and achieved. Computer systems are now being used in applica- associated sub-objectives for the PES design and provide tions covering all safety categories. The software component guidance on how they can be achieved for each safety in these (often redundant) systems is recognized as being an category. An example, based on the safety objective of the important potential source of common mode failure, and specification of requirements, is shown in Table 2. considerable attention has been given to the definition of It is recognized that there is still considerable scope for procedures necessary for each safety ingegrity category. A the improvement of software production and assessment cautious approach has been adopted and currently the

Table 2. New NE PES guidelines - objectives and guidance: Example objective - adequate specification of safety requirements

Guidance PES category

P1 P2 P3 P4

An agreed formal method (eg. VDM, Z, HOL or LOTOS Reference X 19) should be used which is also suitable for the design process (see A2) or is compatible with another formal method used for the design. Consistency of the specification should be demonstrated by mathematical argument.

An animation of the application functional requirements specification X should be produced and interrogated to confirm its correctness and completeness,

A formal specification notation should be used to define the application X functional requirements

A prescriptive structured requirements analysis method should be used X to identify and document the application functional and non-functional requirements.

The application functional and non-functional requirements should be set X out, in a structured fashion, using natural language.

Note: The guidance given to achieve adequate specification is given in the left-hand column, the X in one of the right-hand columns indicting that the guidance should he followed for the PES category and all higher categories, unless a superior and non-compatible technique is employed. The guidelines were issued within NE in November 1991 for a period of trial use.

51 HUGHES AND BOETrCHER claimable unreliability of a computer-based protection system 5. CU7LM - Overview, CEGB Report 1056, March 1984. is limited to 10- 4 probability of failure on demand. For 6. RCH V.F. Parallel Ada for Symmetrical Multiprocessors Proc. Sym. diverse conventional protection on Distributed Ada, University of Southampton, ! 1-12 December, higher integrity levels, 1989. systems are necessary to provide the totality of plant 7. RicH V.F. A Multiprocessor Bare machine Ada System for Flight protection. The rapid improvement in computer hardware Simulators, 9th I/SC Confreence, Washington D.C. 1987. . HUNNs D.M. and WAtNWRtGtiT N. Software-based protection for used for the more traditional functions of control and data Sizewell B: the Regulator's Perspective, Nuc. Eng. International, processing is allowing the incorporation of enhanced safety September 1991. features into the software design. 9. HALL R.S. and HUGHES G. Implementation of Safety Related Computer Systems, Associated Research and the Development of Standards CANDU Owners Group ComputerConference, Markham, Acknowledgements Ontario, 11-13 November, 1990. The aspects of developments in digital C&I systems 10. Softwarefr Compue rs in the Safety Systems of NuclearPower Plants, IEC 880, International Electro-technical Commission, 1986. outlined in this Paper are associated with the current work I1. Royal Signals and Radar Establishment, MALPAS-Ma wn: Programme programmes being undertaken by staff in the Divisions of Analysis Suite, TA Consultants. UK. and Planning & Construction within 12. HuGmt G., HoLTG.P. and WiNSOORRow L.A. Recent Activities on Operations, Technology PES Assessment and Development in Nuclear Electric, SRD Annual Nuclear Electric. This Paper is published with the permission Technical Symposium on the Reliabilityof ProgrammableElectronic of Nuclear Electric plc. Systems, Risley 18 March 1992. 13. PAVEY D. J. and WiNsaoRRow L.A. Demonstrating Equivalence of Source Code and PROM Contents, Fourth Fur. Workshop on References Dependable pang (EWDC-4), Prague, April 1992. I. HALL R.S. et al., The safety of UK graphite moderated reactors 14. HtHFs G., Nuclear Electric's Guidelines for Using Programmable following Chernobyl, Nucl. energy, 1991 30, No. 6, Dec. Electronic Systems in Safety and Safety RelatedApplications, Nuclear 2. HUGHES G. and HALL R.S. Recent Developments in Protection and Electric, Technology Division Report, TD/STBIREP/0381, Nov. 1991. Safety Related Systems for Nuclear Electric's (UK) Power Plant, L4EA 15. BLOOMRIELD R., (ed.) SaferT, The Safety of ProgrammableElectronic Symp. on NPP Control and Instrumentation, Tokyo. May, 1992. Systems: a government consultationdocument on activities to promote 3. ORME S., EVANS N.J. and WEY B.O. ISAT, A fail-safe micro- the safety of computer-controlled systems, ICSE (SRS)(20), DTI processor protection system using low-level multiplexed sensor signals, London, June 1990. J. Phys. E. Sci. Instr., Vol. 18, 1985. 4. BOSLEY M.J. SWEPSPEED - User's Guide, CEGB Report 1053, July 1985.

52 A new development in personnel monitoring

R.J. Fletcher*

Introduction Personal dosimetry services, approved by their national value, this latter data being accessible with an external authorities for category 'A' classified workers, invariably reading unit. The dose rate ranges which can be displayed use passive dosemeters incorporating photographic film or for Hp(10) and Hs(0.07) are 1-9999 -.Sv/h and 0-01-99,9 thermoluminescent detectors. However, for several years the mSv/h, respectively. National Radiological Protection Board (NRPB) has felt that For photons and 3-rays the dosemeter can cover the energy the next major development in personal dosimetry should ranges 20 keV to 7 MeV and 250 deV to 1 .5 MeV (mean be an electronic dosemeter which would read out directly, energies), respectively. Over the more important regions of to improve control of exposures and achieve a reduction in these ranges the response has less than 30% variation, and individual doses. This became a possibility when an the variation of response with angle of incidence is contained arrangement of solid-state detectors and filters was developed within these limits. at the NRPB which was suitable for the measurement of the Audible and visual alarms are provided, the setting up of individual photon dose equivalent, which is restricted to authorized persons. The wearer, using Since then, further development has taken place at the buttons provided on the unit, can cause the dose rate, the NRPB for the measurement of the individual dose equivalent accumulated dose, the alarm settings or his personal unique superficial for 0-radiation. The measurements are made in identifier to be displayed. This facility may, however, be the quantities Hp(10) and Hs(0 -07), as recommended by the inhibited by the local health physicist or the approved ICRU for individual monitoring. dosimetry service if required. Warning signals, such as Thus, the basic detector system for the development of an battery low or calibration required, are automatically electronic dosemeter has been established. However, the displayed. Another important feature is that if for some successful development and production of an electronic reason the wearer is doubtful of the operation of the unit (if dosemeter requires expertise in the design, manufacture and it has been dropped), the keypad can be used to carry out marketing of electronic devices. To this end, the NRPB and a comprehensive test routine. Stored data will be maintained Siemens Plessey Controls have agreed to develop jointly the even if the battery is discharged, removed, or if the unit is device which is now being manufactured and marketed by damaged, provided the relevant memory device is intact. Siemens Plessey. In designing for reliability, the device uses semiconductor detectors and state-of-the-art highly integrated custom Dosemeter specification electronics. To maintain stability, a single chip contains the It is intended that the device be suitable for use as a legal input amplifiers, and the special lithium battery has a life dosemeter which in the UK could be the basis of a dosimetry of at least 1 year under normal conditions. Each dosemeter service approved by the Health & Safety Executive (HSE) has a unique identity number, and authorized stations (i.e. for 'classified' workers. In order to achieve this, the HSE approved dosimetry services in the UK) will be able to read was consulted in depth during the development. Information and reset the stores for Hp(l 0) and Hs(0 .07) before re-issue was also obtained on the necessary requirements in other to a different person. countries, in particular on any performance tests the dosemeter would need to pass to obtain official acceptance. Electronic personal dosimetry system (EPDS) The dosemeter will measure Hp(10) and Hs(0.07) for The electronic personal dosemeter based system is much photons and beta-rays both as the accumulated dose or less complicated than those based on passive dosemeters. instantaneous dose rate and the wearer is free to choose at Other than the dosemeters themselves, a reader is required, any time which of these is displayed. The dose range which which is only a data interface unit that enables information can be displayed for Hp(10) and Hs(0.07) is luSv to to pass to and from the dosemeters by optical means. The 999- 9mSv, and the dosemeter will store up to 10 times this reader is linked to a personal computer to form the issue and receipt station. This can be linked to a further computer in * Siemens Plessey Controls Ltd, Poole, UK. which the dose records are stored.

Nuc. Energy, 1993, 32, No. 1, Feb., 53-55 53 FLETCHER

An important feature is that data are stored in the dosemeter four months will be wearer trials, will also be undertaken at two levels. Access is permitted, via the reader, to the to support the application for approval. operational dose record store to allow approved persons such as local health physicists to exercise day-to-day control within Type-testing dosemeter their area. These persons are able to clear and reset the The dosemeter is being type-tested in order to demonstrate operational dose store, but only to read the information in its overall performance characteristics. Central to these tests the legal store. On the other hand, free access to the legal is an investigation into the way its response varies with or deep store is available to the approved dosimetry service radiation type and energy and with the angle of incidence (ADS). The ADS is able to read information in the legal of the radiation. The tests are being carried out with ISO store, commit it to the individual's legal dose record, and reference radiations with energies between 17.4 keV and clear and reset the store prior to re-issuing the dosemeter 7 MeV for photons, and with 3 particle spectra from thallium to either the same or a different worker. 204, strontium/yttrium 90 and rhodium 106. In all cases the The operational concept is that the dosemeter will be issued dosemeters will be exposed at angles of incidence 0, 20, 40, to a given worker for a period of one year. During the year and 600. The dosemeters are being exposed on the phantom the dosemeter is read at appropriate intervals (monthly in recommended by the ICRU for this type of test, namely a the majority of cases) and the dose is registered in the slab of dimensions 30 cm x 30 cm x 15 cm. Approximate worker's legal dose record. conversion coefficients, recommended by the ICRU, are used At the end of the year the dosemeter is returned to the to convert the air kerma intensity in the radiation beam to ADS, which reads the total dose for the year and checks that Hp(10) and Hs(0,07) in the phantom, i.e. the quantities this agrees with the sum of the individual doses read against which the reading of the dosemeter is compared. throughout the year. If they agree, the legal store in the In addition, the type test will include an investigation of dosemeter is cleared prior to re-issue; if not, the matter is the effects of temperature and humidity; interfering radiations investigated. The ADS will also fit a new battery and check (neutrons and radon); electromagnetic and electrostatic fields; that the dosemeter, and in particular each individual detector, shock, vibration and immersion in water; ease of radioactive is functioning correctly and that the calibration still applies, decontamination, and the stability of the dosemeter with time. In some cases the ADS will serve only staff within its own Independent testing is in progress at other international establishment so that workers have ready access to the ADS laboratories including Battelle Pacific Northwest Labs (PNL) read station. However, some services, such as that to be in the USA, and Chalk River Laboratory in Canada. Initial operated by the NRPB, will serve external customers. In results have been excellent, and the data will be published these cases remote stations are envisaged, with readers, of as soon as possible. the AbS type, operating by a direct interactive link with the ADS. Alternatively, this could be achieved by down-loading EPDS in operation the dose information via the reader on to some computer- Although the electronic personal dosimetry service is not compatible medium which could be used to forward the dose yet in operation, a number of substantial differences between information to the ADS for entry into the dose record-keeping its operation and that of a typical passive dosemeter service system. In all cases adequate back-up facilities would be can be anticipated. From a radiological protection point of necessary to ensure no loss of dose information, view, the instant-read facility will allow the wearer and his supervisors to control his exposure to radiation more efficiently, and hence keep it to a minimum. The increased Approval of electronic personal dosimetry service sensitivity will also allow low doses to be measured more in the UK accurately with the EPDS. This feature will have increased The NRPB will establish an electronic personal dosimetry importance when lower dose limits are introduced. service, initially for its own staff, and subsequently on From an organizational point of view, a number of general offer within the UK. To do this the service must be important advantages will accrue. The dosemeters will be approved by the Health & Safety Executive. This approval issued for a whole year, and this will substantially reduce involves the consideration and inspection of the whole the effort and/or the investment in expensive issue stations service, including the qualifications and experience of staff which are necessary with passive dosemeters. Probably the and the overall facilities. Detailed information on the most important factor is that no processing equipment is performance of the dosemeter must be available and the necessary since the dosimetric information, in its final form, dosemeter must have passed the appropriate HSE exists within the dosemeter and it is only necessary for the performance test. In addition, a laboratory statement must reader to extract this information. This will substantially be provided which gives details of the uses for which the improve the reliability and accuracy of the service, since a dosemeter is intended and on the way the service will be great deal of care and attention to detail is required in the operated. Since this is the first time an electronic device has processing of passive dosemeters to maintain good dosimetric been used as a legal dosemeter, a six month trial, of which standards. The processing equipment used with passive

54 NEW DEVELOPMENT IN PERSONNEL MONITORING dosemeters also requires a considerable amount of mainten- computer programs and storage facilities will ever permit ance so that the use of a simple reader as in the EPDS will this type of operation to be applied to the legal dose recording lead to a further reduction of effort to run the service. These process. factors could be of overriding importance for developing countries. Summary The electronic dosemeter will be more expensive than a An electronic personal dosimetry service has been typical passive dosemeter. The dosemeter is also larger and described, together with the procedure which is being adopted heavier than the passive types but it can nevertheless be worn to gain approval in the UK for monitoring the exposure of conveniently. These factors are not prohibitive, however, classified workers. The NRPB considers this to be the next in view of the advantages in protection. Moreover, they are logical development in personal dosimetry, and it has been not relevant for those who currently wear an electronic shown that the device offers a number of advantages for this dosemeter as well as the legal passive type. In such cases purpose. the wearer is no longer obliged to wear two dosemeters and Considerable progress has been made in the introduction the local health physicist does not need to operate a separate into the global market, and there is a very significant level database for day-to-day control. of optimism that the new dosemeter will provide better Thus, the EPD is also suitable for use in the manner quality results to aid the overall aims of personal and conventional to nuclear processing plants in which it is issued collective dose reduction in line with recommendations such only as required on entry to a radiation controlled area. In as ICRP60. this case, dose management systems will be implemented on computer networks. The dosemeters are not allocated to Reference individuals, but are held in a pool, which can reduce overall I. MARSHALL T.O. et al. An apprnvedpersonaldosimenv service based costs. It remains to be seen whether the acceptance of oil an electronic doseineter. NRPB. Chilton, UK, 1991.

Total process surveillance (TOPS)

J.H.P. Millar*

Understandingtecurentoperating beaurofaproess There has been a growing awareness in the process and or power plant i the key to maximizing the efficiecy and power industries throughout the world of the potential safety of operation and the quality of the product. Early benefits of an operator aid which serves to assist in this data detection of plant component or sensor degradation and interpretation process. A better understanding of plant failure improves operating auety, product quality and plat behaviour can lead to improved safety and economy of availability. This Paper describes the design ard develop- operation, with improved quality of the product. Early ment of a Total Process Surveillance system which detection of anomalous operation can lead to more effective assimilates all the sensor information available on a plant remedial control action, thereby minimizing or eliminating to provide the operators with a succinct report on the status damage to plant, personnel and the environment. of the plant behaviour. The heart of the system is a robust The Instrumentation and Surveillance Techniques model-based observer which can estimate internal plant Department of AEA Technology Reactor Services has been states, and provides a residual signal with powerful fault working on the development of such an operator aid under detection and isolation features. Several results are our Total Process Surveillance (TOPS) project. The TOPS presented which illustrate the performance of the system project has as its objectives the maximization of the available in detecting and isolating multiple fault scenrios in a finformation on the behaviour of a plant and the provision ractor plant. A structure for the ptical of timely detection and diagnosis of fault situations. This of the system is described, and comments are given on its Paper describes the techniques adopted within the TOPS contribution to the final experimental work planned for project and presents a selection of results illustrating the AEA Technology's Prototype Fast Reactor (PFR). power of its capabilities.

Introduction Condition monitoring for EFR Within the overall design specification for the European In order to operate any industrial plant safely and Fast Reactor (EFR) there is a basic requirement to monitor economically, the operator requires a complete knowledge the core and primary circuit under all operating conditions. of the plant's operating state. The only means by which the This operating regime envelope encompasses not only normal operator can obtain information on his plant is through the but also off-normal operation, and includes fully developed available instrumentation. Typical plant instrumentation as well as incipient or slowly developing fault conditions. provides relatively limited information by virtue of the finite Although the development of the TOPS project has been number of transducers measuring only those key process targeted at providing condition monitoring for the EFR core parameters which are accessible and which can be physically and primary circuit, its potential in other power and process measured. It is then the responsibility of the operator to systems has become increasingly clear. assimilate and interpret this raw measurement data to achieve The operating conditions wich the instrumentation will a wider understanding of the behaviour of the process. encounter within the primary vessel of the EFR represent To assist in his interpretation, the operator may use a a particularly harsh environment. Typical conditions will be relatively simple mental model of the process and will most liquid sodium at 545*C, flowing at 18935 kg/s, with a peak certainly use his experience of similar plant conditions. neutron flux of 1-9 x 169 n/cm-2/s. As part of the EFR During off-normal situations the data interpretation task research and development programme, AEA Technology in becomes more demanding, especially if the process enters conjunction with its French and German partners, is currently an uncharted operating regime, or if seemingly conflicting involved in the development of specialized core data is being presented by the instrumentation. The many instrumentation, including ful-range neutron flux monitors, reports and analyses of the Three Mile Island incident serve ultrasonic temperature measurement, acoustic diagnosis of to illustrate this latter point. coolant boiling and component vibration and failed fuel * AEAdetection systems. * AEA Technology Reactor Services, Instrumentation and Surveillance ee hasheric Techniques Department, Risley, UK. These harsh operating conditions and the compact nature

Nuc. Energy, 1993, 32, No. 1, Feb., 57-63 57 MILLAR

Monitor Diagnosis Inference engine

Plant states Incipient Full fault Post fault Post fault fault detection and status behaviour detection identification prediction Fig. 1. TOPS functional structure

Operat interface of a fast reactor core dictate that this novel instrumentation, together with conventional thermocouple temperature measurement and flow measurement transducers, are placed Fig. 2. Basic expert system structure around the periphery of the core, predominantly in the above- core structure (ACS). Thus, no direct in-core measurements are made; the conditions therein are inferred from the ACS robustness to operating point changes and normal plant instrumentation, disturbances. Recognizing the constraints of monitoring the core of the Three categories exist, which encompass the current main EFR, the following structure was derived for the TOPS approaches to condition monitoring system (Fig. 1) Its monitor component is responsible for providing additional information on the conditions within the (a) expert systems core, while its diagnosis component provides the fault (b) neural networks detection and subsequent fault isolation features. It is (c) model-based algorithms. important in any off-normal situation to be able to continue It is instructive to consider each of these to illustrate the to monitor the plant even when outside its normal operating choice of technique for the TOPS system. envelope, and thus the diagnosis component will provide status information in the post-fault situation, and a prediction Expert systems of future plant behaviour. Expert systems have received much attention in condition monitoring applications, mainly because of the Alvey Techniques for condition monitoring research programme, and because of the easily compre- Researchers have taken many approaches to process plant hensible approach which they use. The commercial products condition monitoring, but they all share the same basic noted above are all based upon expert system technology. concept of providing a reference representing the normal The basic structure of an expert system is shown in Fig. operating regime of the plant and then comparing the actual 2. The knowledge base contains a description of the process, plant performance with this reference. The differences which can take several forms but is essentially a series of between each approach may be grouped into the following facts and cause-effect relationships. These relationships or categories rules are typically of the form 'if cause then effect'. The qualitative, but quantitative informa- (a) how the normal operating reference is generated and descriptions tend to be defining threshold conditions; for in what form it exists tion is also included when greater then 258*C then (b) how the comparison between reference and actual example, 'if boiler temperature is condition exists'. plant performance is achieved over temperature planthperfrmesuls cthied The inference engine is what interrogates the knowledge inhwtheress obase and generates a hypothesis on the state of the plant. interpreted. When plant conditions change one or more rules fire, i.e. The technology involved is still largely in its development a match exists with the cause component. The inference phase, although some commercial products such as COGSIS, engine processes all the fired rules through a chain of PROMASS, G2 and VIOLET have started to appear. reasoning until a final diagnosis is reached such as 'valve Implementation has always been a key issue, with the stuck open' or 'pump stopped'. requirement for many applications to run in real time a An operator interface exists to allow the knowledge base significant constraint despite the increasing power of to be constructed and operator information to be displayed. computing platforms. However, perhaps the real difficulty An attractive feature of expert systems is their inherent has been coping with the vagaries of plant operation and the ability for adaptation. As operating experience of a plant is stochastic nature of process signals. This defines the gained the knowledge base may be modified and expanded compromise between sensitivity to incipient faults and the to encompass a more complete description of the process.

58 TOTAL PROCESS SURVEILLANCE (TOPS)

inputs ControlPlIant signalssensor Plant

X Y Output error

S residual

W, V k Reference model Model output Input Hidden output estimates layer i layer I layer k Fig. 4. Basic structure of model-based fault detection Fig, 3. Simple three-layer neural network

Several disadvantages of expert systems exist, the main ones Their main disadvantages are that they are very difficult to being that validate since their internal transfer function is a complex mathematical function and they need large example sets of (a) a large amount of effort is required to build the rule training data base both for normal and fault conditions. With nuclear plants, example data of fault (b) large rule bases can significantly slow the inference of good engineering design, very situationsrare, thus are, leaving by virtue a engine, thereby precluding real-time operation dependence upon simulations to provide the fault-training (c) v)aprole(problems istexist withwthe checkingecge consistencyss ty aand data. There can be no guarantee that the simulated fault conditions will match those actually found in practice. Expert system are particularly good at handling abstract data and qualitative plant performance descriptions; they are less Model-based algorithms efficient at processing raw numerical data. The model-based approach to condition monitoring, or fault detection and isolation (FDI) as it is known in the Neural networks literature, has to date resided primarily in the academic Neural networks were developed to study the workings domain. This has been largely due to the highly mathematical of the human brain using a mathematical simulation of the nature of the algorithms and the requirement for a interconnections between individual brain cells. Input stimuli mathematical model of the process. are related to output parameters via interconnected nodes or The approach exploits the analytical redundancy inherent neurons arranged in layers, (Fig. 3). Each node in a layer in dynamic process systems. Analytical redundancy describes is (usually) connected to all nodes in the immediate and the ability to infer the value of one process variable from preceding and succeeding layers. Nonlinear mathematical a combination of other variables using the underlying physical operators at each node pass a weighted function of the relationships. An example is the determination of the level preceding layer node outputs to the succeeding layer node of liquid in a tank by measuring the flow in and flow out, inputs. and knowing the shape and dimensions of the tank. A network is *trained' by applying plant measurement The model serves as the plant reference and is driven by signals as input stimuli and adjusting the node function and the same input signals as the plant (Fig. 4). Under normal weighting constants until the network outputs match a set operating conditions the model should estimate the same of specified criteria. These criteria could be simply 'Normal outputs as measured by the plant instrumentation, and thus operation' or 'Abnormal operation'. Large training sets the output error vector or residual vector will be zero. Under representing examples of different plant operating conditions off-normal conditions the model outputs will not match the are used to train the network. The final set of network weights measured outputs and the residual will become non-zero. This defines an optimal description of the process transfer is the basis of fault detection. The isolation of the fault source function. If data are available for example fault situations, or sources is derived from an interpretation of the elements a network can be taught to recognize these conditions. of the residual vector. When running as a diagnostic system, the network A key problem with any attempt to model mathematically processes the current plant signals using the network weights. a physical process is the inevitable errors created by an The network's diagnosis is generally based upon the incomplete description of the processes. Recent advances in percentage confidence values of its outputs. model-based diagnostic algorithms have developed methods Properly trained networks are particularly good at dealing for quantifying these errors and compensating for them, thus with nonlinear plants and noisy or incomplete input data. making the algorithms robust.

59 MILLAR

conrol profiles inside the subassemblies. Typical control inputs are in" u[ Process Y Process the primary pump speed, the control rod height and the measurements secondary circuit energy dissipation. The process + 7measurements are the subassembly outlet temperatures, the K. bulk core inlet temperature, and the bulk neutron flux. Residual The process model within the observer structure is + configured in a feedback path such that the model state estimate vector is modified according to a weighted difference mo tMasure estimaes between the model's current output estimates and the plant measurement signals. The feedback gain matrix Ko is chosen to ensure that the model state estimates always ------j converge towards the true plant state. This ability to track State the plant automatically is especially important, even under eimates normal operating conditions when the process may move Fig. 5. Observer structure through several operating points. In mathematical notation If a mathematical model is available for a plant then robust the observer structure is described by the following equations model-based algorithms are generally considered to be the ilk+ 1) = (A-Ko C) i(k) + Ou(k) + Koy(k) (3) best approach to FDI. Because they use mathematical x C;(k)x() + Du(k (4) calculations they can process raw data very quickly and accurately, unlike the expert systems, and their explicit nature where x is the state estimate vector, y is the output estimate facilitates rigorous validation, vector, and K0 is the observer gain matrix. The physical transducer measurements comprising the Choice for TOPS plant outputs y may be considered as giving the symptoms The functional structure defined for the TOPS system (Fig. of the behaviour of the plant. Through the state estimation 1)requires the provision of additional information on the process which calculates x, the observer effectively dissects process in addition to a fault diagnostic capability. In order the plant to give a surgeon's eye view of the internal plant to achieve these two requirements and to provide timely states. This is the basis of the plant monitor function of the information, which necessitates running in real time, a robust TOPS system, which provides additional information on the model-based approach has been chosen. The mathematical internal behaviour of the plant. model can be derived such that it estimates not only the plant The observer structure provides several extremely output signals but also internal process values which are not, powerful facilities for fault detection and diagnosis. The or cannot be, measured. These virtual transducers provide simplest fault detection route is to use the state estimates as the additional plant information. By incorporating the model virtual instruments. These may be processed with conven- into an appropriate robust algorithm, a residual signal may tional fixed or adaptive alarm thresholds. A more powerful be generated, which forms the basis of the fault detection technique is to analyse the behaviour of the observer output and isolation function. error signal e. Faults occurring in the plant control actuators, the plant components and the measurement instrumentation TOPS algorithms change the actual plant output signals but do not affect the The model-based algorithm which has been developed for model. This residual signal thus contains a signature of the the TOPS system is based upon a robust observer (Fig. 5). fault or faults. The process model is a state space representation of the The TOPS algorithm treats the residual signal as a vector. differential equations describing the process dynamics. In Under normal operating conditions the norm or magnitude discrete time this has the form of the residual is zero. When a fault occurs one or more elements of the residual vector become non-zero. Thus, a x(k+l) = Ax(k) + Bu(k) (2) change in the residual norm is used to detect a fault condition. y(k) = Cx(k) + Du(k) (2) The design of the TOPS algorithm is such that different where x(k) is the system state variable vector, u(k) is the plant faults, irrespective of their magnitude, affect the vector of control input signals, y(k) is the vector of direction of the residual in different ways. Fig. 6 illustrates measurement signals, A is the system matrix, B is the control the effect of two different faults on the direction of a 3rd- input distribution matrix, C is the state output matrix, and order residual signal. For each possible fault source the D is a feedforward output matrix, residual direction may be calculated explicitly; there is no The states comprising the state vector x are chosen such need to use example fault data or run simulations for each that they represent internal physical variables in the process. fault condition. To perform fault isolation requires a In our fast reactor example the elements of x can represent comparison of the residual direction with the reference fault coolant and fuel temperatures and coolant flow and flux directions. This is known as residual direction interpretation.

60 TOTAL PROCESS SURVEILLANCE (TOPS)

Intermediate heat Ri: exchanger En

t Steam Turbine Altemator Neutron generator flux Fig, 7. TOPS reference simulation schematic

primary coolant flow rate (flow), the core reactivity inserted by the control rods (Ri), and the energy removed by the secondary circuit (Jsg)- The available plant meaurements Fig. 6, Principle of residual direction interpretation scnaycrutQg.Teaalbepatmaueet were the bulk coolant temperature at the outlet of the core (T), the bulk coolant core inlet temperature as determined The choice of the observer gain K0 is the key to the at the diagrid (Tdia), and the average core neutron flux design of the robust observer. Not only does Ko impart the (flux). Although not available in practice, the PMSP required dynamics to the observer, but it also facilitates the simulation fuel temperature variable (Tf) was used to check decoupling of the modelling error between the linear observer the correct TOPS algorithm state estimation. model and the plant. Unlike many other approaches to model- Figure 8 gives the results of the simulation of a fault in based fault detection, the robust TOPS algorithm measures the steam generators with the plant operating at nominally this model error using actual plant data to ensure efficient full power. Fig. 8(a) gives the response of the plant error decoupling. measurement signals to the control and fault inputs given in K0 also determines the sensitivity of the algorithm to the Fig. 8(b). A legal control input change is applied at 4.5 s. magnitude of different fault sources and how easily they can This represents a 10% increase in the energy removed by be isolated. Thus an optimization procedure is used to choose the steam generators. No change is made to the system the K0 which minimizes a cost function derived from each reactivity input or primary coolant flow. A steam generator of these design criteria. fault occurs at 1-0 s, this being a ramp increase in energy to the steam generators which develops over 3 s, reaching Results 10% of the initial ,, value. An experienced plant operator During the development of the TOPS algorithms the basic would recognize the plant response to the control input ideas have been tested by using a simulation of the Prototype change, but would have more difficulty in determining the Fast Reactor (PFR) at Dounreay, Scotland. reason for the changing instrument readings as the fault The plant simulation was based upon the PFR training developed. simulator model, and it comprised an 11th-order nonlinear The behaviours of the four elements of the TOPS algorithm description of the core and primary circuit neutronics and residual vector are given in Fig. 8(c). During the first second thermalhydraulics. This simulation was written using the of normal operation the residual signals are zero. There is PMSP (plant modelling system program) language with a clear change in each signal as the fault develops, with the facilities for implementing various fault scenarios, change persisting throughout the life of the fault. Note that The process model implemented in the TOPS algorithms the effective change in operating point of the plant due to was a numerically reduced linear 5th-order version of the the legal control change at 4-5 s has no effect on the PMSP model. The linearization was performed for full- residuals. This illustrates the robustness of the algorithm by power operating conditions. As expected, there was a effectively decoupling the model nonlinearity error. significant error between the nonlinear plant reference and The normalization of the residual amplitudes in Fig. 8(c) the reduced-order linear model. This difference was has masked the relative amplitude changes which exist calculated and incorporated into the TOPS algorithm design. between each signal. The different amplitude changes reflect The TOPS algorithms were designed and implemented using the change in direction of the residual vector due to the tsg the Matlab matrix manipulation program. fault. Fig. 8(d) shows the results of comparing the direction Figure 7 shows the simulated plant indicating the subset of the residual vector with the reference directions for each of reference simulation variables which were used to drive possible fault source as determined a priori from the TOPS the TOPS algorithm. The available control inputs were the algorithm design. A positive match is found with the steam 61 MILLAR

Plant liesuremmets Plant easerweets o n e ...... -

40 ...... *Go* ...... i...... i.....! .....i .... -...

2884 ...... , ...... ---- ...... 24 0...... i...... i ...... , 1 ... .! . .

ift 200 388 4"g 50 6"l M8 am0 ion180 Z96 30 48 Still fift 708 008 SM0 100 It" x 661- Time x 681s

•• ~~~~Contruland Fault Input. oto e FutIpt Pontrel n l YP eiua iel 'OaRldal ,, . .- . ...

lime x 6.613 Pas a w F =.~~~~~~...... IItsamiti. ..:u ...... l o nt;;;l ...."a !

166 266 366 466 S6e fin 70 666 6" 1606 16 zoo 306 46 5ee 66 ?6 o 966 ima Tine x 6.618 Tine x 8.118 ms m t ) tops Residual Si4s m u e; TOPS ResiAdal Sinals

= 6 ilt ;] tt &xlPlum (faults

a sea7 - 4 no

3 3~R3

,. 6......

IM 26 366 4660 a a6n76 966 1"$ 16 2668 366 466 S666W 766 666 908 1666 Time x 06le Tie x 6.61s TOPS Residual Direction sivergence signals s TOPS Residual Direction Divergence Signals holdsouot tt fTdia.fauts n t t TOFult j sTef4miwult o i s otinglt fm fault ru4mc--iFluxfafatlt

4 4 ------

o whenult St."t "a fauto atial e fault a2I 2

Time x Cole Times x 0.6m

Fig. 8. TOPS simulation results for single fault: (a) plant Fig. 9. TOPS simulation results for multiple faults: (a) plant measurements; (b) control and fault inputs; (c) TOPS residual measurements; (b) control and fault inputs; (c) TOPS residual signals; (d) TOPS residual direction divergence signals signals; (d) TOPS residual direction divergence signals u lowtsant, esrmn.Algcnro nu hnehs svrlowault aeocurd generatorTCotemgnenrfutro faultPDA directionfal at approximately -2i" s,th and nry this poie Therecant is oaIeuto clearefultdansso change in the hplant altsucs(i.9d) measurement signals holds throughout the period of the fault. No false alarms are owing to the faults and the control change, but again an egleo zoostea 3he Seeaodeeopn as a 91ram los The stea 488rtois8588l 78fetlNOlaead TODDlu caused by the legal control change at 45 s. hot wouldwerator find the interpretation task simple. The The residual direction interpretation technique can not only elements of the residual vector (Fig. 9(c)) provide a clearer isolate single faults but can also multiply occurring faults. indication that something is awry, but, considering the Fig. 9 shows the results of simulating a steam generator fault, magnitude change alone, it is not clear whether this is due a fault on the neutron flux measurement and a fault on the to a single fault with a complicated envelope or whether bulk coolant measurement. A legal control input change has several faults have occurred. also been included. The reactor is nominally at full power. Applying the residual direction interpretation technique The steam generator fault is a 10% reduction in the energy provides a powerful diagnosis of the fault sources (Fig. 9(d)). removed by the steam generators developing as a I s ramp The steam generator fault is perfectly isolated and the flux at 4.5 s. The neutron flux measurement fault is a 30 MW fault is evident for most of its period. This particular non- bias (neutron flux is taken as a measure of reactor power) optimal design indicates that a fault has occurred on the developing at 0.5 s and clearing at 3-5 s. The coolant coolant transducer but does not follow the full period of the temperature fault is a I 00 C bias developing over I s at 2.-0 s fault. and remaining throughout the simulation period. The legal In an actual control room environment an operator would control input is a 10% increase in steam generator energy have other information sources available against which to rising between 1 .0 and 4-0 s. check unexpected changes in plant measurement signals.

62 TOTAL PROCESS SURVEILLANCE (TOPS)

DA.- activity levels, pump vibration signals and hydrogen detector &M- E)Ss-w levels. ... The development of the TOPS system has this hierarchical structure in mind. Current work is concentrating upon the EVW SsWa A validation of the algorithms using the recorded plant data available from PFR. A key objective is to validate the ME& DSJE& DSJ.&. qJE& D robustness of the state estimates when faced with a distributed plant and noisy data with relatively long sample intervals.

D.S. OS. Os . O DThe diagnostic capabilities will be assessed using the few 1bwmftsignificant events that have occurred. A key feature of the PTOPS algorithm design is that example fault conditions are P1Wta l P Wt Am 2 PwAa P,t not required in order to design for isolation of specific faults. This is very important from design considerations as it not Fig 10. TOPS hierarchicalstructure always possible, and certainly not desirable, to induce system faults deliberately to obtain data on the plant's response. However cross-checking takes time, is done sequentially, A proposal has been submitted to implement the TOPS assumes the reference measurements are correct, and still algorithms in hardware as part of the final series of PFR requires interpretation of the comparison information. The experiments. The PROFIM (PFR real-time observation of results presented here give an indication of the power of the fuel integrity margins) project will concentrate on the monitor TOPS algorithms to provide timely and succinct diagnostic aspect of the TOPS algorithms to give a real-time estimate information to an operator, thereby assisting him to react of the linear power rating of the core fuel elements. The quickly and correctly to take the required remedial action. unusual operating conditions associated with these experiments will represent an ideal validation environment for the Plant implementation TOPS algorithms, and the additional information provided The mathematical nature of the TOPS algorithms makes on the behaviour within the core will provide valuable input them ideally suited to dealing directly with raw plant data. into the other experiments. The linear structure of the algorithm requires no computing intensive integration calculations, thereby enabling real-time Conclusions operation to be easily achieved. An automated condition monitoring system provides Power and process plants operate complex processes, and valuable assistance to an operator to maximize the safety, it would be unrealistic to attempt to apply a single TOPS efficiency and quality of the operation of his plant. The TOPS algorithm to provide additional information and diagnostics system can provide, in real time, additional process on the whole plant. Breaking the plant down into self- information from a limited number of raw measurement contained but interconnected functional modules makes the signals through the use of a robust model-based observer to diagnosis of the whole process more manageable. generate estimates of the process's internal states. The TOPS This leads to the concept of a hierarchical vertical structure algorithm's residual signal provides sensitive detection of (Fig. 10), where local diagnostic hypotheses are collated fault situations, and by the application of the powerful together at successively higher levels in order to formulate residual direction interpretation technique, fault isolation can an overall process diagnostic hypothesis at the top level. The be achieved. The robustness of the TOPS algorithms to model mathematical nature of the TOPS algorithms make them errors and their ability to predict fault sensitivity and ideally suited to processing the raw plant data at the first isolability a priori are important design features. level. As the hierarchy is ascended the nature of the local TOPS represents a major step forward'in the practical diagnostic information becomes more abstract, and this is application of this technology. Together with the concept of where the inference processing of an expert system can be a hierarchical diagnostic system, TOPS may represent the best utilized. The expert system at the top level also provides way forward to providing plant owners and operators the the interface to the operator. means by which to improve the safety and efficiency of Adopting this type of hierarchy also enables more esoteric operation, and the quality of the product in the ever- information sources to be utilized. Typical examples are increasingly environment-conscious and competitive process acoustic signals, delayed neutron detection signals, covergas and power industry markets.

63 Notes on the preparation of papers for Nuclear Energy A number of academic disciplines are of direct relevance to nuclear Tables should be numbered consecutively and mentioned in the energy. The range covers all the branches of engineering and also text. They should be typed on separate sheets at the end of the metallurgy, physics, chemistry, e!ectronics, economics, health manuscript. They should not duplicate information already given physics, etc., all represented among the Society's membership. in the text nor contain material which would be better presented The Editorial Board welcomes papers of professional standard graphically. Tabular matter should be as simple as possible with in all these areas provided that they have some relevance to nuclear brief column headings and a minimum number of columns. energy. This includes papers covering specific aspects of reactor Mathematical expressions should be typewritten and presented systems - economics, safety, fuel cycles, operation - and papers in a clear simple form eily read by non-mathematicians. on more general nuclear energy topics, e.g. enrichment, social aspects, waste disposal and health physics. Also the Society Equations should be typed on a separate line and be numbered encourages the publication of academic studies provided that the consecutively. Greek characters should be identified in the margin broad relevance of the work to the nuclear field is identified - when they first occur. A notation should be provided on a separate for example, a basic corrosion paper in which the application to sheet. Matrix and vector quantities and symbols should be identified reactor corrosion is assessed. in the notation. Papers are expected to present original work in the context of Units should be SI units. the state of the art, or to review a broad field in an authoritative manner. Papers relating to commercial products will be considered Chemical names occurring in the text should be written out in full. provided that they have an adequate scientific, engineering or Illustrations. Only those drawings ard photographs that are essen- technological content. The Society also encourages reviews of tial to an understanding of the text should be included. specialist workshops and meetings. Other than in exceptional Colour is not used - therefore all illustrations must be suitable circumstances, papers will not be accepted for Nuclear Energy if for reproduction in black and white. All illustrations should be men- they have been published elsewhere; all papers will be subject to tioned in the text and listed on a separate sheet in the order in which the usual refereeing procedure. Publication time is normally around they appear. All figures must be identified with the Author's name six months, and there are no page charges. and the figure number. The Editorial Board also encourages short notes or technical letters, which will be published as quickly as possible, and also Drawings and Graphs. A set of unlettered tracings should be sub- comment on papers or suggestions on the content of Nuclear Energy. mitted together with a duplicate set showing the lettering required. in Indian ink on paper or tracing paper. Draw- be original contributions and should be submitted to .Tracings should be Papers must such as Permatrace are unsuitable complete form, accompanied by all references, tables ings on the underside of materials ardthe Siustrtins.Society in ofor reproduction. Drawings should be not less than 165 mm wide, and illustrations. and not more than 700 mm wide. They should not usually exceed 5000 words, excluding tables and Wo.-king drawings are not required. but rather simplified illustra- illustrations, and should be accompanied by a synopis of not more tions or diagrams with a minimum of measurements and description. than 200 words. Manuscripts should be typewritten on one side of the paper only, whole-platePhotographs size must (216 be mm glossy x 165 black-and-white mm) and not lessprints, than preferablyhalf-plate size (165 mm x 108 mm). with double-line spacing and wide margins, that they are not damaged by writing on Three copies are required including the top copy. The top sheet Care should be taken the thebcor b pape clip e. of the manuscript should include the full title of the paper and their qualifications full name(s) and addresses of the Author(s) and Proofs will be sent to one Author only. No new material may be and positions held. inserted in the text at the time of proof reading. by consecutive superior References should be indicated in the text numerals. The accuracy of the references is the responsibility of Authors are requested to supply photographs (with captions) related the Author(s). They should be listed on a separate sheet in numerical to their papers, but not discussed therein, to be considered for use order in the following style: on the front cover of the Journal. for articles from periodicals: Copyright. The attention of Authors is drawn to the following. Author's surname and initials. Title of article. FULL title of Every paper, map, plan, drawing or model, presented to the Society periodical (which the editor will abbreviate according to World shall be considered the property thereof, unless there shall have been List), year, volume (month or part), first and last page numbers. some previous arrangement to the contrary, and ihe Board may publish e.g. 1. HEYMAN J. Westminster Hall Roof. Proceedings of the same in any way and at any time they may think proper. No person the Institution of Civil Engineers, 1967, 37, May, shall publish, or give his consent for the publication of any communica- 137-162. tion presented and belonging to the Society, without the previous consent for books: of the Board. Author's surname and initials. Title of book, Publisher, place and year of publication, page numbers. Authors are responsible for obtaining permission from the e.g. 2. GREGORY M.S. Linear framed structures. Longmans, owners of the copyright when reproducing in their Papers London, 1966, 20-35. material which has been published elsewhere.

Correspondence including papers offered for publication in the Journal or presentation to the Society, should be sent to the Executive Secretary, British Nuclear Energy Societ, 1-7 Great George Street, London SWIP 3AA. from the BritishNuclear Energy Society

W ater chemistry of nuclear understanding of the mechanismsthat determine the chemistry of the water system at high temperatures and reactor systems 6 pressures. Abstracts of poster presentations appear in the volume where work in progress is reviewed. This book isa British Nuclear Energy Society state-of-the-art review of the best international The success of the five International Conferences on experience. Water Chemistry of Nuclear Systems held in Bournemouth Brief contents since 1977 has shown worldwide interest in obtaining a PWR- Primary circuit chemistry experience * Underlying scientific understanding of the chemistry that determines studies in PWR radiation field control o BWR Operational the operational behaviour of nuclear power stations. experience in radiation field control * BWR Chemistry: Inthis, the sixth report, particular emphasis isgiven to the underlying science * Decontamination e Secondaryside discussion of the chemical factors important to the cleaning of PWR steam generators &Water reactor operation of water power reactors and their experience chemical analytical methods * Control of PWR secondary of load following, operation with minimum radiation side chemistry * Material corrosion of water treatments. dose to operators and mini mum effluent discharge. Supporting papers consider theoretical and design 1992 Paperbound 297 x 210mm 228pp + 340pp aspects of nuclear reactors and draw on experience of ISBN: 0 7277 1697 2 (soldasset) operating power reactors. This gives greater £120.00 UK £124.00 overseas byair (set)

M Available from: Sales Department, Thomas Telford Services Limited, a, I hao Thomas Telford House, 1Heron Quay, London E14 4JD. Tel: 071-987 6999 (9.30am-5.00pm). Fax: 071-538 4101. Telex: 298105 Civils G, m-t. n l7homias Telford orthe Thomas Telford Bookshop at the Institution of Civil Engineers, 1-7 Great George Street, London SWi P3AA.