Power control

The reactor regulating system at Darlington runs on a pair of digital control computers, known as DCC-X and DCC-Y, one in control and the other in hot standby ready to take over without a bump. Andrea shows Hana the programs on a development system in the Meridian Nuclear Engineering lab. “This is where it all comes together,” she says. “Demand power, measured power from the ion chambers and the in-core detectors, the zone levels, the adjusters, the absorbers, the stepbacks and setbacks. Every second the computer decides how much reactivity it wants and which device should deliver it.”

This lesson explains how reactor power is controlled in CANDU and pressurized water reactors, how power control is coordinated with the turbine and steam system, how plants change load, and how automatic power reductions, called stepbacks and setbacks in CANDU plants and runbacks in light-water plants, protect the plant from transients without a reactor trip.

What is being controlled

Reactor power cannot be measured directly. It is inferred from neutron flux, which responds instantly but needs calibration and is affected by flux shape and detector burnup, and from thermal power, calculated from coolant flow and temperature rise or from steam and feedwater flows, which is accurate but slow. Power control systems use neutron signals for speed and calibrate them continuously against thermal power. In a CANDU reactor, out-of-core ion chambers give a fast, accurate bulk signal at low power, and in-core platinum and vanadium self-powered detectors give the zone powers at higher power; in a PWR, out-of-core ion chambers give power range flux, and coolant temperature gives the slower measure that rod control acts on.

The CANDU reactor regulating system

The CANDU reactor regulating system performs four main functions: it sets reactor power to the demand, holds the flux shape near its reference by controlling the power in fourteen zones, moves the devices in the right sequence, and reduces power automatically when plant conditions call for it. The demand power routine produces a setpoint, which may change at an operator-selected rate within limits. The power error, demand minus measured, combined with the rate of change of power, drives a bulk control signal that raises or lowers the average liquid zone level. A spatial control signal adds a correction to each zone's level based on the difference between that zone's measured power and its share of the total. Since the zones act in the light-water absorber compartments, they can change reactivity smoothly and quickly within their range.

When the average zone level drifts toward the top or bottom of its range, the zones can no longer provide reactivity in one direction, so the regulating system calls on the other devices. If the zones are nearly empty and more positive reactivity is needed, for example as xenon builds up, adjuster banks are withdrawn in sequence. If the zones are nearly full and more negative reactivity is needed, the mechanical control absorbers are driven in. Each device change shifts the zone level back toward the middle of its range, where it is most effective. The day-to-day reactivity of burnup is handled by on-power fuelling, which the fuelling engineers plan by channel to keep zone levels and the flux shape on target.

Coordinating reactor and turbine

In the normal reactor-leading mode, the operator sets reactor power and the boiler pressure control program adjusts the turbine governor valves to hold steam generator pressure constant; any surplus steam is sent to the condenser through condenser steam discharge valves or to atmosphere. In the alternate mode, used when the reactor is not under full automatic control or after certain upsets, the turbine load is set and the regulating system adjusts reactor power to hold boiler pressure. The choice of constant boiler pressure, rather than a sliding pressure, simplifies the heat transport system and gives stable boiler levels, at some cost in turbine efficiency at part load.

Load following

Most nuclear units in North America run at full power as base load, but many can follow load, reducing power at night or on weekends and responding to the grid. Load following is limited mainly by the fuel and by xenon. Fuel pellets expand and press on the cladding when power rises, so ramp rates and the size of power increases are restricted after a period at lower power to avoid pellet-clad interaction failures. Xenon builds up after a reduction and burns out after an increase, so the controller must find extra reactivity at the worst moment, usually some hours after a reduction when the plant is asked to return to full power.

CANDU stations in Ontario have provided some load following, mostly by reducing reactor power to about 60 percent or by bypassing steam to the condenser while the reactor stays at high power, which avoids xenon and fuel concerns at some cost in efficiency. The adjuster rods give enough positive reactivity for limited xenon override after a reduction, and the ion chamber and in-core detector signals allow smooth tracking.

# PI power control: point kinetics, temperature feedback and a rate-limited controller follow a load ramp.
beta, lam, Lam = 0.0065, 0.08, 1.0e-4
alpha, K_heat, tau_f = -1.0e-5, 300.0, 5.0
kp, ki = 0.004, 0.0015                 # controller gains (reactivity per unit power error)
rate_lim = 0.0001                      # device speed limit: 0.1 mk per second
dt, t_end = 2.0e-4, 900.0
n = 1.0; C = beta / (Lam * lam); dT = 0.0; rho_dev = 0.0; integ = 0.0
def demand(t):                          # 100% -> 60% at 1% per 10 s, hold, then back
    if t < 100: return 1.0
    if t < 500: return max(0.6, 1.0 - (t - 100) / 1000)
    return min(1.0, 0.6 + (t - 500) / 1000)
worst = 0.0
print(f"{'t (s)':>6s}{'demand':>8s}{'power':>8s}{'device rho (mk)':>17s}")
for k in range(int(t_end / dt) + 1):
    t = k * dt
    e = demand(t) - n
    integ += e * dt
    target = kp * e + ki * integ
    step = max(-rate_lim * dt, min(rate_lim * dt, target - rho_dev))
    rho_dev += step
    rho = rho_dev + alpha * dT
    n += ((rho - beta) / Lam * n + lam * C) * dt
    C += (beta / Lam * n - lam * C) * dt
    dT += (K_heat * (n - 0.6) - dT) / tau_f * dt
    if t > 20: worst = max(worst, abs(e))
    if k % int(100 / dt) == 0:
        print(f"{t:6.0f}{demand(t):8.3f}{n:8.3f}{rho_dev * 1000:17.2f}")
print(f"largest tracking error after start-up: {worst * 100:.2f}% of full power")

 t (s)  demand   power  device rho (mk)
     0   1.000   1.000             0.00
   100   1.000   1.000             1.20
   200   0.900   0.902             0.83
   300   0.800   0.802             0.52
   400   0.700   0.702             0.21
   500   0.600   0.602            -0.11
   600   0.700   0.698             0.40
   700   0.800   0.798             0.68
   800   0.900   0.898             0.97
   900   1.000   0.998             1.26
largest tracking error after start-up: 1.88% of full power

The output shows power tracking the ramp closely, with the largest error under 2 percent of full power, while the device reactivity moves by about 1.3 mk to offset the temperature feedback as power falls and rises. Two features of a real controller appear in the code: the integral term, which holds power on demand despite the feedback, and the rate limit, which represents the maximum speed of the zones or rods. If the ramp is made faster than the device can follow, the error grows and the controller saturates, so real systems limit the operator's demanded ramp rate as well.

Stepbacks and setbacks

A stepback is a fast, automatic power reduction made by dropping or driving in the mechanical control absorbers, triggered by plant upsets that would otherwise lead to a trip: for example a turbine trip, the loss of a heat transport pump, high zone power, or high rate of change of power. A stepback reduces power within seconds to a level the plant can sustain. A setback is a slower ramp-down at a preset rate to a preset level, triggered by conditions such as low deaerator level, high boiler level or loss of a feedwater pump, and stops when the triggering condition clears. Stepbacks and setbacks belong to the control system, not to the shutdown systems; they are designed to avoid unnecessary trips by keeping the plant inside the envelope where the shutdown systems need not act. The shutdown systems still watch independently and trip the reactor if the control action is not enough.

Testing and commissioning a power controller

Power control software and tuning are verified on simulators long before they reach the plant, and then tested in stages: at low power, where feedback is weak and the reactor is close to an integrator, then at intermediate and full power. Tests include setpoint steps, ramps, device sequencing, simulated detector failures and the full set of automatic power reductions. Engineers compare the plant's response with the predictions, adjust gains where needed, and record the final settings in controlled documents. Any later change to tuning or logic is treated as a design change, reviewed for its effect on the safety analysis, which assumes certain controller behaviour in events such as loss of regulation.

Failures of power control

A power control system can fail in several ways, and the plant must be safe in all of them. The controller can lose its input, for example if a detector or temperature channel fails; it can lose its output, if a drive or valve sticks; or its logic can misbehave and drive devices the wrong way. Designers defend against these with redundant inputs and signal validation, which compares several measurements and rejects one that disagrees; with dual or triple controllers and automatic transfer on failure; with limits on device speed and range; and finally with protection systems that do not depend on the controller at all.

At Darlington each digital control computer checks its own health and that of its partner. If the controlling computer fails, the standby takes over within a fraction of a second; if both fail, the devices freeze in place or move to a safe state, and the reactor either holds power or is stepped back. The safety report analyses loss of regulation, in which the regulating system withdraws reactivity at the maximum device rate, and shows that both shutdown systems trip the reactor before fuel limits are reached.

Who decides how much power

Power control is not only an engineering question. The operator sets the demand within limits set by the licensing basis, the station's operating policies and the grid operator's instructions. Each change of power is planned and recorded, and some changes, such as raising power after a long period at low power, follow conditioning rules set by the fuel designers. Andrea stresses that the best control system is one that makes the operator's intended action easy and safe, and makes unintended action difficult: confirmations before large changes, rate limits on demand, and clear indication of which mode the controller is in.

Hana notes that the ideas of lesson 1 appear everywhere in the power controller: integral action to hold power on demand, rate limits to avoid windup, feedforward from load signals, gain scheduling with power and separate protection. The specific devices and conventions differ between CANDU and light-water plants, but the loop is the same.

There is also an economic side. A unit that trips loses hours or days of production and stresses its equipment with a thermal cycle; a unit that rides through an upset on an automatic power reduction keeps generating. Utilities therefore track trips per year as a key performance indicator, and much of the effort spent on tuning and testing power control is justified by the trips it avoids. The regulator watches the same indicator for a different reason: frequent unplanned trips challenge the safety systems and can signal weaknesses in equipment or operations.

Power controllers also hand over between modes during start-up. At very low power the operator raises power manually in small steps, watching the log rate; as power reaches the range where the controller's measurements are accurate, control is transferred to automatic, and at higher powers the measurement source changes from ion chambers or intermediate range channels to power range or in-core signals. Each transfer is a point where a mismatch between signals could cause a bump, so the logic checks that the incoming signal agrees with the outgoing one before it accepts the transfer.