Core thermal design limits

Rohan's group delivers its results to the utility as margins: how far the hottest fuel is from each limit, and what eats into that distance. For Darlington, the pressing question is ageing. As the pressure tubes in each unit creep under heat, pressure and fast neutron flux, their diameter slowly grows, coolant bypasses the bundles, and the critical channel power falls. "The fuel has not changed," Rohan says, "but the channel around it has. Our job is to show how much margin is left and how the plant should operate to keep it."

What the limits protect

Thermal design limits exist to keep the fuel intact and the coolant system able to cool it, in normal operation and in anticipated operational occurrences, the transients expected to happen once or more in a plant's life, such as a loss of one pump or an inadvertent control rod withdrawal. Each limit protects against a particular failure mechanism.

Hot channel factors

Lesson 1 introduced the nuclear peaking factors, which describe the calculated power distribution. Real fuel also differs slightly from its drawings. Pellets vary in density and enrichment within tolerances, rods vary in diameter, the pitch between rods varies, and pellets sit off-centre in the sheath. Each deviation can make some local heat flux, enthalpy rise or temperature slightly worse than the nominal calculation predicts. These are handled with engineering hot channel factors.

The nuclear factor \(F_q^{N}\) comes from the physics calculation, measured and confirmed in operation, with its own measurement uncertainty. The engineering factor \(F_q^{E}\) combines the manufacturing deviations. Historically, all factors were multiplied together, as if every deviation were at its worst at the same place at the same time. That is conservative, often very conservative.

Deterministic versus statistical combination

Statistical methods recognise that independent random deviations rarely all reach their extremes together. If each engineering factor is written as \(1 + \delta_i\), where \(\delta_i\) is a deviation at the same confidence level, a root-sum-square combination gives

which is smaller than the product \(\prod (1 + \delta_i)\). Modern design methods go further and combine uncertainties in power, flow, pressure, inlet temperature, correlation and manufacturing statistically, often by Monte Carlo propagation, to set a single statistically based design limit. Regulators accept these methods when the input uncertainties are well characterised and independent, and when the method has been reviewed.

The margin stack

Analysts often explain margin as a stack. At the bottom is the physical phenomenon, such as the true CHF. Above it is the safety limit, set with allowance for correlation uncertainty, for example the 95/95 DNBR limit. Above that is the analysis value, which includes allowances for instrument uncertainties, transient overshoot and modelling assumptions in the safety analysis. Above that again is the operating point, the predicted or measured value in normal operation. The gap between operating point and analysis value is operating margin; the gap between analysis value and safety limit is analytical margin; and the gap between the safety limit and the real phenomenon is the confidence built into the limit itself.

An uprate, a fuel design change, an instrument change or an ageing mechanism moves one or more of these levels. Good margin management shows each move explicitly, so that the plant's owner and the regulator can see what is being used up and why. Rohan insists that every result his group sends out includes such a table.

# Hot-channel factors and thermal margins: deterministic product vs statistical combination.
import math
nuclear = {'F_q (local peaking)': 2.30, 'F_dH (enthalpy rise)': 1.55}
engineering = {'pellet density and enrichment': 1.02, 'rod diameter and pitch': 1.015, 'clad eccentricity': 1.01}
F_E = math.prod(engineering.values())
print(f"engineering factor, product = {F_E:.3f}")
# Statistical combination: treat each as a 2-sigma bound on a normal deviation
dev = [v - 1 for v in engineering.values()]
F_stat = 1 + math.sqrt(sum(d * d for d in dev))
print(f"engineering factor, root-sum-square = {F_stat:.3f}")
q_avg = 17.8   # kW/m
for name, F in (('deterministic', nuclear['F_q (local peaking)'] * F_E), ('statistical', nuclear['F_q (local peaking)'] * F_stat)):
    print(f"{name:13s}: peak linear heat rate = {q_avg*F:5.1f} kW/m")
# Margin stack for a minimum DNBR limit (illustrative numbers)
limit, analysis, measured = 1.30, 1.55, 2.05
print(f"DNBR: safety limit {limit}, analysis value {analysis}, best estimate {measured}")
print(f"  analytical margin {100*(analysis/limit-1):4.1f} %, operating margin {100*(measured/analysis-1):4.1f} %")
# CANDU ageing: diametral creep lets coolant bypass the bundle, lowering critical channel power
for creep in (0.0, 2.0, 4.0, 5.1):
    ccp = 8.3 * (1 - 0.018 * creep)        # illustrative 1.8 % CCP loss per % diametral creep
    print(f"pressure tube creep {creep:3.1f} % -> critical channel power ~ {ccp:4.2f} MW")

engineering factor, product = 1.046
engineering factor, root-sum-square = 1.027
deterministic: peak linear heat rate =  42.8 kW/m
statistical  : peak linear heat rate =  42.0 kW/m
DNBR: safety limit 1.3, analysis value 1.55, best estimate 2.05
  analytical margin 19.2 %, operating margin 32.3 %
pressure tube creep 0.0 % -> critical channel power ~ 8.30 MW
pressure tube creep 2.0 % -> critical channel power ~ 8.00 MW
pressure tube creep 4.0 % -> critical channel power ~ 7.70 MW
pressure tube creep 5.1 % -> critical channel power ~ 7.54 MW

Limits in operation

In a CANDU reactor, thermal limits are enforced in operation by the regional overpower protection (ROP) systems, called neutron overpower protection in some plants. Both independent shutdown systems have sets of in-core flux detectors distributed through the core. Each detector trips its channel of the shutdown system if its reading exceeds a setpoint. The setpoints are calculated, for a wide range of possible flux shapes, so that the trip occurs before any fuel channel reaches dryout. As pressure tubes age and critical channel power falls, the setpoints must be lowered, or the plant must be operated with less margin to the trip. Some plants have adjusted operation, for example by lowering reactor inlet header temperature or adjusting heat transport pressure, to recover margin as their tubes aged.

Ageing and margin

Margins change through a plant's life. Fuel is redesigned, operating practices change, and components age. Some examples:

Rohan's ageing model is simple to state. For each percent of pressure tube diametral creep, the critical channel power of the affected channels falls by a percent or two, the exact amount depending on the bundle and channel. Darlington's refurbishment replaced pressure tubes and feeders in each unit, resetting creep to zero for the new tubes, but the margin trend begins again from the day each unit returns to service.

Limits during transients

Anticipated transients must also meet the thermal limits. A loss of flow, for example from a pump trip, lowers DNBR quickly as the flow coasts down while power drops only after the reactor trips. An uncontrolled withdrawal of a control rod bank raises local power. A drop in feedwater temperature raises reactivity in a BWR and power in the core. Safety analyses calculate the minimum DNBR or minimum critical power ratio reached during each transient, with conservative assumptions, and show that it stays above the limit, which is why the analysis value in the margin stack sits above the safety limit. Lesson 11 returns to these transients and to accidents where the limits may be exceeded briefly but other acceptance criteria apply.

Hana's draft report for the week has one table with six rows and three columns: limit, analysis value, operating value. "That," Rohan says, tapping the table, "is what the plant manager reads. Everything else is how we got there."

Uncertainty sources in a thermal limit

A useful exercise is to list everything uncertain in a minimum DNBR calculation and decide how each is handled. The list is long, and it explains why thermal design is as much statistics as heat transfer.

Some of these are random and independent, such as pellet density in different rods; some are systematic and affect every channel the same way, such as a bias in the core power measurement. Statistical methods treat random uncertainties by combination and systematic ones by bounding. A common error in student work is to combine systematic uncertainties by root-sum-square as if they were random; another is to count the same uncertainty twice, once in an input and again in a limit. Rohan's group keeps a single uncertainty register for each analysis, with every item tagged as random or systematic and as already included or not.

Power uprates in practice

Power uprates fall into three broad classes. A measurement uncertainty recapture uprate, typically up to about 1.7 percent, uses more accurate feedwater flow instruments to reduce the power measurement allowance; the physical margins are unchanged, but less of them is reserved for measurement error. Stretch uprates of a few percent use existing margins in the design with little or no equipment change. Extended uprates of up to about 20 percent need major equipment changes such as high-pressure turbine replacement, larger pumps or new steam generators, and usually new fuel designs with higher CHF. Each class needs the thermal limits to be shown to remain satisfied, along with many other analyses outside this course, such as structural and containment analyses.

CANDU stations rarely seek uprates in the same way, because their channel powers are already limited by dryout margin and ROP setpoints, and the main concern through life is preserving margin as pressure tubes age. Refurbishment, by replacing the pressure tubes, restores much of the original margin.