Influence of nuclear safety requirements for CEGBgas cooled reactors on the design of their electrical

auxiliary systemsJ.R. Castle

Indexing terms: Power systems and plant, Reactor safety, Advanced gas cooled reactors, Power station auxiliaries

Abstract: The paper outlines the development of the design of the electrical auxiliary systems at the CEGBgas-cooled reactor nuclear power stations, in response to changes in their requirements with regard to nuclearsafety. The changes in system design that have taken place are illustrated by comparing the systems at theearlier Magnox stations with the Advanced Gas Cooled Reactor (AGR) station at Hartlepool. The vitalimportance of protection against fire is noted, and the stringent fire protection requirements laid downfor the later AGR stations are outlined. Further developments in the methods used for electrical auxiliarysystem design and evaluation, using quantitative analysis techniques, are discussed.

1 Introduction

The safety of the CEGB nuclear reactors depends primarily onthe prevention of an unacceptable release of radioactive fissionproducts from the fuel. Thus, the mechanical integrity of thefuel cans is most important. To ensure that this is maintained,an adequate means of heat removal from the fuel must be inoperation at all times.

A primary concern in the current design of CEGB nuclearpower stations is that nuclear safety must be adequatelysafeguarded in the event of interruptions to the external('off site') electrical supplies or the station connection to thesesupplies.

A supply of electrical power is essential in order to meetthese requirements, and thus the electrical auxiliary systemsinstalled at the CEGB nuclear power stations have a directnuclear-safety function.

Although the basic requirements have remained unaltered,the development of the CEGB gas-cooled reactors has resultedin changes to the capacity and performance required of theelectrical auxiliary systems. The two features of reactor designthat have had the most significant affect on electrical auxiliarysystem design are

(a) increase in reactor unit size(b) changes in core construction and gas flow paths.

The early Magnox stations have a capability for considerablenatural convective circulation of the coolant gas, owing to thephysical layout of the core with respect to the boilers, and tothe use of drum boilers, which provide a significant heat sinkfor some time after reactor shutdown, even if the boiler feed isnot present.

The later stations have used once-through boilers and aconcrete pressure vessel, as a result there is less naturalcirculation and, in the absence of boiler feed, the boilers donot provide such a large heat sink as the drum boilers.

Finally, the AGR stations have concrete pressure vessels,once-through boilers and a re-entrant flow path (necessitatedby the requirement to keep the graphite temperatures down).

The result of the above has been an increase in both thetotal load on the electrical auxiliary system and the size ofindividual plant items, together with a reduction in the timeavailable in which to restore auxiliary supplies before thedesign conditions are departed from.

Fig. 1A shows how the load imposed by the largestindividual plant items with an immediate safety function

Paper 1218C, presented at the IEE Colloquium, 9th April 1980, andrevised for publication 12th January 1981

Mr. Castle is with the CEGB, Health and Safety Department, CourtenayHouse, 18 Warwick Lane, London EC4P 4EB, England

connected to the electrical auxiliary systems has increased,from the early Magnox stations to the latest AGR stations.

Fig. IB shows the reduction in time available to restoreelectrical auxiliary supply, over the same period.

Table 1 shows the growth in station output and 'on site'electrical auxiliary system capacity.

The total 'essential' electrical auxiliary load has increasedwith the progress in reactor design. This increase has beenbrought about by the need to connect more of the auxiliaryplant to the 'essential' system, rather than by major changesto the overall auxiliary systems design (e.g. main gas circu-lators are an 'essential' load at AGR stations).

5.6

5.2

5.0-

z

1.8

1.6

1.2

1.0

0.8

IIt: >a a>x I

Fig. 1A Largest individual auxiliary plant item with an 'immediate'safety function

IEEPROC, Vol. 128, Pt. Q No. 2, MARCH 1981 0143-7046/81/02117 + 06 $01.50/0 117

Table 1 : Station output and 'on site' electrical auxiliary system capacity

Station

Bradweli(Magnox/steelPV)Oldbury(Magnoxconcrete PV)Hartlepool(AGR/concretePV)

Date

1962

1967

1980

Number ofreactors

2

2

2

Electricaloutput(gross)

MW

374

626

1320

'On site'prime movers/generators -output

MW

diesel engines3 X 0.45

gas turbines3 X .2.5

gas turbines4 X 17.5

100

90

80

70

60

c

^50

40

30

20

10

-

/ve

il

- om

-

-

-

_

_

-

-

Si_£•a<m

"O

InO

Poi

~

cX

a>d)cn

Dun

a>

N

3 JO

O a»

gen

c

ai

tagi

CO

9° <o

c >o -S

Q. ^

>* f)

— o-* aU CD

c -pX CD

1 x

Fig. 1B Time available to restore auxiliary supply

2 Off site supplies

The off site supply to all CEGB nuclear power stations isdrawn from the National-Grid system, by means of at leasttwo connections. These connections are, in most cases, madevia two different grid system switching stations. Theconnections are made at 132, 275, 400 kV, or a combinationof these voltages, according to the location of the nuclearstation with regard to the main-grid system.

The grid system in the UK is interconnected to such anextent that it has to be regarded as a single source of supply,regardless of the voltage at which connection to it is made.Therefore the grid connections can only be regarded asredundant (and to a certain extent geographically diverse)connections to a single source of power.

3 On site supplies

'On site' supplies are provided at all CEGB nuclear stationsfrom either diesel generators or gas-turbine generators.

As the load on the systems has increased, the trend hasbeen towards the use of gas-turbine generators.

Although one of the original reasons for gas-turbineinstallation was their (supposed) higher reliability, experiencehas shown that, in fact, diesel generators are more reliable.(The number of failures per start attempt for gas turbinesis approximately twice that for diesel generators).

The number of prime movers provided is based on theprinciple of the system performing its design functions if'one is out for maintenance and one fails to start'.

This has resulted in the provision of four prime movers,except at the very earliest stations, and at Oldbury-on-Severn,where increased reliability, sufficient to justify a three-enginesystem, was expected of gas-turbine generators. This hopethat has not been fulfilled in practice, and a supplementaryprime mover is now being installed there.

The major system-design change that has occurred as aresult of the change in requirements of the system has beenthe increase in' the voltage lever" at which the essential"electrical.supply, system-(defined as the system baeked-up by>'on site' supplies) is supplied.

This has risen from 415 V at Bradweli to l l k V atHartlepool and Heysham, and has been accompanied by twoother significant design changes viz.,

(a) The separation of 'no break' (i.e. backed up by abattery supply) and 'short break' (i.e. supply interruptionaccepted while alternative source is connected) loads. Earlierstations were all 'no break'.

(b) The elimination of a separate 'essential' electricalauxiliary system by the use of 'on site' prime movers whichfeed the whole electrical auxiliary system ('no break' and'short break' systems are still separated). (This design featurehas been closely connected with the use of large (17.5 MW)gas-turbine generators to provide the 'on site supply'. It maynot be perpetuated at future stations).Fig. 2, 3 and 4 show how the electrical auxiliary systems havedeveloped from that installed at Bradweli (Fig. 2) to thesystem at Hartlepool (Fig. 4).

Fig. 2 (Bradweli) shows the supply to the essential-electrical-supplies system derived from the 3.3 kV station switchboardsvia two 750 kVA - 3.3/0.433 kV transformers.

One essential-supplies switchboard is provided, divided intotwo main sections', each fed from a station switchboard by anessential-supplies transformer (providing the normal 'off-sitesupply' from the national grid). The normal supply from thenational grid is backed up by an 'on-site supply' provided bythree diesel generators — one connected to each essential-supplies switchboard main section, with a third, capable ofconnection to either of the essential-supplies switchboardmain sections, as a standby.

The system is operated normally with the two essential-supplies switchboard main sections isolated from each other.

One station battery provides the 'no-break' facility. Thisbattery feeds the essential-supplies switchboard via motor-generator sets - one connected to each switchboard mainsection — and is capable of supporting the full emergency loadfor approximately 75 minutes.

Fig. 3 (Oldbury) shows a similar basic arrangement ofessential-supply switchboards to that provided at Bradweli(Fig. 2). Each essential-supply board is fed via an essential-supply transformer from the station switchboards, to providethe 'off-site supply' from the national grid; backed up by an'on-site supply'. In this case, however, the 'on-site supply' isprovided by three gas-turbine generators — one connected toeach essential-supply switchboard, with a third as standby.

The voltage level at the essential-supply switchboardshas been increased to 3.3 kV, and at the station switchboardsto 11 kV.

In this system the 'no-break' and 'short-break' supplieshave been separated and the reactor DC essential-supplies

118 IEEPROC, Vol. 128, Pt. C, No. 2, MARCH 1981

switchboards provide the 'no-break' supply — fed bytransformer/rectifier sets, backed by batteries. The batteryvoltage (360/475 V) is similar to that at Bradwell, but in thiscase, three are provided; one per reactor and a standby.Their capacity is sufficient to maintain the emergency load for15-20 minutes.

The basic difference between the Oldbury and Bradwellessential-electrical-supply systems is the arrangement of the'no-break' supply system. Other differences, such as voltagelevels, plant ratings, and the use of gas turbines in place ofdiesel engines for the 'on-site' supply, reflect the need toprovide for a larger auxiliary load and the pursuit of bettersystem performance, rather than a radical reappraisal ofessential-electrical-supply-system design.

Fig. 4. (Hartlepool) represents a major change in systemdesign. In this system the whole of the station electricalauxiliary system is backed by 'on-site' gas-turbine generators,and the system is designed to provide an assured electricalsupply to all the station auxiliaries at all times (i.e. the gasturbines which provide the 'on-site' supply are of sufficientcapacity to meet the total electrical auxiliary system load).

It should be noted that this Figure, unlike Figs. 2 and 3,shows the whole station electrical system; there being noseparate essential-electrical-supply-system, as such, at

Hartlepool. The 'off-site' supply to the electrical auxiliarysystem is obtained via the unit transformers.

The system is designed to operate in two sections, eachassociated with one of the two reactor/turbo-generator units,and each section, in turn, is operated in two halves down tothe 3.3 kV level.

Each of the gas-turbine generators has sufficient capacityto supply the emergency load on the whole electrical auxiliarysystem (both halves), and the necessary interconnectionfacilities are provided to allow this to be done.

The 'no break' supplies are provided by transformer/rectifierunits backed by 440 V batteries (similar to those at Bradwelland Oldbury). However, 4 Battery Transformer/rectifier unitsare provided, two per unit, with facilities for interconnection.

In addition to meeting the performance requirements, theCEGB electrical auxiliary systems have to be designed insuch a manner that maintenance on plant items and switchgearcan be carried out with the reactors on load. Great care has,therefore, had to be taken to ensure that potentially conflictingdesign requirements are met without undue complication inthe system design.

4 Fire protection

The electrical auxiliary system has to be capable of performing

central electricity generating board

to 3.3kVstation board 2

to instrumentsupplies board 3 battery

3600 Ah410 V

to instrumentsupplies board 2

headquarters

to3.3kVstation board 1

instrument suppliesNo 2 generator11kVA110V

instrument suppliesNo 2 generator supplies11kVA110V

essentialsuppliesTI750kVA3.3/0-433kV

essentialsuppliesT2

diesel 3643BHP

generalservices B.D.I

generalservices B.D.2

generalservices B.D.I

main essentialsupplies board ••415 V AC,

main essentialsupplies board415 V AC.

reactor 1s(r\ auxiliaries boards

reactor 2auxiliaries boards2B

stationemergencyboard

100Aemergencysuppfy

reactor auxiliaryboards

a,-- reactor auxiliary

1250 kVA33/0433kVreactortrans

to turbine houseNo 2 switchboard ° n

100Aemergencysupply

to turbine house c —•="£••=No 1 switchboard SE^SiS

Fig. 2 Simplified diagram of essential electrical auxiliary supply system - Bradwell Nuclear Power Station

© Castell key interlocksAll boards 415 V ACWhere a 415 V switchboard can be supplied from one of two transformers an interlock prevents both switches from being closed at the same time.This prevents the 3.3 kV supplies being paralleled via the 415 V board

IEEPROC, Vol. 128, Pt. C, No. 2, MARCH 1981 119

No.1 gas turbinealternator2.5MW

3.3 kV essential supplyboard No.1

essentialsupplyT12.5MVA11/3.A3KV

turbine house A.C.essential board 1A

standby gas turbine No.2gasturbineralternator alternator2.5MW 2.5MW

A.C. essential suppliestransformers eachare rated:-1.25 MVA3.3/0.433kV

turbine house A Cessential board 1B

433 V

essential DC suppliestransformers andrectifiers rated3.3/0.342 kV

,No.1/ cstandby

527kW

reactor DC essentialsupplies board 1

-r___

r - ^ i No.1 batteryj I and portableL-—' charger

standby board

2 pole360/475V DC

( <£

turbine house A.C?essential board 2A

standby gas turbinefuse board

_[~ ~> standby~|~ r i battery! i I and portable

—j- L_T"J c n a r 9 e r

\

2 pole360/475V DC C

1A1B1C instrument' ' MGseU

safety MGsets

safety M.G. instrumentset 3 MGset3

• 2 pole360/475V DC

batteries-435kW1 360/475 V

r-x-lNo.2 batteryI | and portableL j J charger

reactor D.C. essentialy supplies board 2

instrument 2A2B2CMGset2 ' . ; ','

safety MGsets

Fig. 3 Simplified diagram, of essential electrical auxiliary supply'• system — Oldbury Nuclear Power Station (Magnox)

275 kV busbars

1B-

275kV busbars

generatortransformer 2735 MVA

generatortransformer 1735 MVA

52 MVA unit transformers

17.5 MWgas turbine generator

1A 11 kV unit boards

gas circular motors

12.5 MVA auxiliary transformers

1A 3.3 kV unit auxiliary boards 2A

gas circulator pony motors 415V short-breakgas^irculator boads

M) (Mgas circulator pony motors

415V no-break board 1

emergency boilerfeed pumps

short-breakgas circulator

f

0 Cno-break boards

no-break suppliesmotor/generator sets150 kW output

415V no-break board 2

Fig. 4 Simplified diagrams of electrical auxiliary systems. Hartlepool (A GR)

120 IEEPROC, Vol. 128, Pt. C, No. 2, MARCH 1981

its design function in the presence of hazards such as fire,flooding and adverse weather conditions. Of these hazards, fireis the one which poses the most complex problems.

Fire protection in power stations has been under activeconsideration within the CEGB for many years. Particularattention has been paid to the question of fires in cable ways.

The need to segregate cables associated with nominallyredundant functions, such as the channels of a reactor safetysystem, was recognised early on.

The increased amount of safety-related equipment whichadvances in reactor design have necessitated has required achange in approach to the measure adopted to meet therequirements with regard to fire protection, and at Hartlepooland Heysham the basic objective of the fire-protection systemis as follows.

'To ensure that a single locally started fire on a cable routedoes not prevent the adequate operation of services andsystems essential to reactor safety'.

The basic measures adopted to achieve the above objectare:

(a) The cable runs are divided into zones by fire barriers.Automatic fire detection, backed by appropriate fire-extinguishing systems, are provided which are designed tolimit the effect of a fire to the zone defined by the firebarriers. The cabling is so arranged that the loss of all cableswithin a zone enclosed by the fire barriers does not preventthe essential electrical auxiliary system from performingits nuclear safety function.

(b) Where it is not practicable to segregate cabling (e.g. inthe common cable flats under switchboards and the centralcontrol room), a fast fire protection system is installed, whichis designed to detect and extinguish a fire before it can spreadbeyond its immediate surroundings. This system is speciallydesigned to be of a very high integrity, and rapid in itsoperation.

5 Quantitative design analysis

In the past, the design of the electrical auxiliary systems forCEGB nuclear stations has been based on 'good engineeringjudgement', which could be defined as comprising equal partsof design appraisal, experience in similar fields, caution, andcommon sense.

Work is now actively in progress within the CEGB with theobject of quantifying the performance required of systems inrelation to the probability of occurence of the event againstwhich the system provides protection, and the consequencesof system failure. This results in the production of a targetreliability figure to which the system must be designed.

Qualitative judgements have still to be made when usingthis approach. For instance, the acceptable probabilities offailure, although related to specific consequences, such asthe magnitude of a release of radioactive fission products,are the result of a subjective judgement of what is acceptable(albeit based on scientific data).

The quantitative approach relies on the availability otadequate data of a known quality. This can be a problem,especially for larger plant items where the amount of dataavailable is not sufficiently large for statistical accuracy to beobtained.

In view of the very high standards of performance requiredof the electrical auxiliary systems at nuclear stations, commonmode failures have to be considered. This results in a limitingvalue being applied to the failure probability of any particularsystem. Current values are 10" 3 to 10"5 failures per demand,according to the system under consideration.

The quantitative approach is extremely valuable as a designtool and imposes a discipline on the designer. For instance,application of this technique means that safety-related plant

IEEPROC, Vol. 128, Pt. C, No. 2, MARCH 1981

has to be identified at an early stage in the design andallocated to an appropriate electrical supply system.

6 Conclusion

The designs of the electrical auxiliary systems used to date are,apparently, satisfactory, but in the field of nuclear power,unlike many other fields of technology, protective systemdesign is not based on the experience of past misfortunes, andadvances in design are a function of new requirements, eitheras a result of advances in reactor technology, through thereappraisal of existing systems against updated standards, or todeal with fault conditions not previously considered.

This has ensured that electrical-auxiliary-system design hasbeen a continuing process. The application of quantitative-analysis techniques in the design stage may well result inchanges to the 'traditional' system design, in order to producegreater safety and at the same time reduce the unnecessarilyexpensive complexity of design which is a feature of some ofthe present practice.

7 Acknowledgments

The author acknowledges with thanks the assistance given tohim by his colleagues in the Central Electricity GeneratingBoard in the preparation of this paper.

8 Bibliography

1 MEDICAL RESEARCH COUNCIL: 'Criteria for controlling radiationdoses to the public after accidental escape of radioactive material(HMSO, 1975)

-2 MATTHEWS, R.R., DALE, G.C., and TWEEDY, J.N.: 'UKexperience of safety requirements for thermal reactor stations,IAEA International Conference on Nuclear Power and its FuelCycle, Salsburg, 2-12 May 1977, IAEA-CN-36/72 (IV.l)

3 BESWICK, T.C.: 'Safety aspects of the Advanced Gas CooledReactor', BNES International Conference on Nuclear FuelPerformance, London, October 1973, Paper 81

4 HART, J.D.: 'A background to the AGR designs', I. Mech. E./BNESConference on the construction, commissioning and operation ofAdvanced Gas Cooled Reactors, London, 26-27 May 1977,PaperC 117/77.

5 SMITH, C: 'The electrical supplies to the Auxiliaries in a modernpower station, Stud. Q. J., 38, pp. 21-29, Sept. 1967

6 OLDFIELD, D.F.: 'Switchgear operating at voltages above 1000 Vin CEGB power stations'. IEE Conf. Publ. 83, Part 1, 1972, pp. 1-6

7 BUTTERWORTH, R.: 'Safety train concept for nuclear poweremergency systems',Electr. Rev, 1978, 202, pp. 25-29

8 GOTT, H.H., and TROTTER, R.D.: 'Control and safetyrequirements for the electrical engineering design of the CEGBnuclear power stations', Proc. IEE, 1963, 110, pp. 955-968

9 JOLLY, M.E., and WREATHALL, J.: 'Common-mode failures inreactor safety systems', Nuc. safety, 18, (5), S 1977

10 CASTLE, J.R.: Report of International Atomic Energy AgencySpecialist's Meeting on Power Supply Arrangements in NuclearPower Plants: Stockholm 5-8 September 1978, CEGB ReportNHS/R150/78-December 1978

John Castle was born in London in 1930and received his technical training at theNorthern and Northampton Polytechnicsin London.

After holding various positions in theelectrical and electronics manufacturingindustries, he joined the Nuclear PlantDesign Branch of the Central ElectricityGenerating Board's Design and Con-struction Department in 1960, to workon nuclear safety systems.

In 1966 he transferred to the Board's Health and SafetyDepartment - Nuclear Safety Branch, and is currently workingon the nuclear safety aspects of the Electrical, Control andInstrumentation and other Auxiliary Systems at the CEGB'sexisting Magnox Nuclear Power Stations and at the AGRStations under construction at Hartlepool, Heysham Stage 1and Dungeness 'B'.

121