ML20112J172
| ML20112J172 | |
| Person / Time | |
|---|---|
| Site: | MIT Nuclear Research Reactor |
| Issue date: | 06/25/1984 |
| From: | Bernard J MASSACHUSETTS INSTITUTE OF TECHNOLOGY, CAMBRIDGE |
| To: | |
| Shared Package | |
| ML20112J166 | List: |
| References | |
| SR#--84-11, SR#-0-84-11, NUDOCS 8501180195 | |
| Download: ML20112J172 (62) | |
Text
f 1
e)
Safety Review #0-84-11 Closed-Loop Control of Reactor Power Using a Shim Blade b7 John A. Bernard, Superintendent MIT Reactor O
Approved:
P. Menadier, Shift Supervisor and Electronics Engineer K. Kwok, Assistant Superintendent L. Clark, Director of Reactor Operations D. Lanning, Professor.." Nucicar Engineering 8501180195 850111 gDRADOCK 05000020 PDR
r Closed-Loop Control of Reactor Power Using a Shim Blade 1.
Description of Change 2.
Documentation 3.
Safety Considerations 4.
Safety Issues 4.1 Shim Blade Control System 4.1.1 Technical Specifications 4.1.2 Extent of Proposed Change 4.2 Determination of An "Unreviewed Safety Question" 4.3 MITRSC Opinion - Dec. 83 4.4 Summary of Safety Issues 5.
Description of the Closed-Loop Controller 5.1 Theory 5.2 Experimental Evaluation 5.3 ' Extension to Other Control Strategies 5.4 Implementation of the Controller 6.
Design Features Relevant to Safety Issues 6.1 Non-Existence of Challenges to the Nuclear Safety System l,
6.2 Non-Existence of Continuous Blade Withdrawals 6.3 Non-Existence of Excessive Positive Reactivity Insertion Rates 6.4 Justification for Class B Experiments I
i rl0 l
S R#-0-84-11 JUN 25 1984 k
()
7.
Safety Evaluation 7.1 Factors Relevant to Class A and B Experiments A.
Controller Design B.
Operator Supervision C.
Relation to Safety System D.
Capability of Nuclear Safety System E.
Surveillance Requirements
~
7.2 Factors Related to Class B Experiments 7.3 Conclusions 8.
Implementa tion Appendix A List of Publications Appendix B Se,lected Publications O
P 1 -
SR#-0-84-11 JLW 25 1984
,3, L
Safety Review #0-84-11
.V Closed-Loop Control of Reactor Power Using a Shim Blade 1.
Description of Change: The MIT Nuclear Reactor Laboratory, the MIT Department of Nuclear Engineering, and the Charles Stark
]
Draper Laboratory have been engaged in a joint experimental effort to develop, demonstrate, and apply advanced computer-based i
technology to the operational problems of nuclear power plants.
One component of this program has been to deduce and experimen-
,l tally prove methods for the closed-loop (automatic) control of reactor power. This effort has resulted in a general method that guarantees that no action initiated by an automatic control system will ever result in a challenge to the existing nuclear safety system. This is accomplished by restricting the net l
reactivity so that it is always possible to make the reactor period infinite whenever required. The merits of this approach are that it recognizes that reactor dynamics are non-linear, that the rate of change of reactor power depends on both the net reac-tivity and the rate of change of reactivity, that the reactivity is dependent on the reactor power through vorious feedback mech-
)
anisms, and that. control mechanisms have finite speeds as well as position-dependent, non-linear worths.
The experimental portion of the program has thus far been strictly limited to what could be accomplished within the exist-ing confines of the MIT Reactor's 'SAR and Technical Specifica-tions. This has meant that experiments have been limited to the closed-loop control of reactor power using the regulating rod.
(Refer to Technical Specification #3.9-5) The integral and maxi-m n differential (rate) worths of the regulating rod are typi-cally 0.17% AK/K and 1.67 10-3% AK/K per second respectively.
It is now desired to study experimentally the closed-loop control of reactor power using a shim blade. The experiments performed with the regulating rod will be repeated and extended.
The pro-posed change is to install the capability to use one of the shim blades for the absorber in an automatic control system. Neither the hardware nor the software of this new closed-loop controller i
will be significantly different from that which is now used in conjunction with the regulating rod. That is, the control rela-tionships, the form of the control laws, and equipment similar to that tested with the regulating rod will be utilized.
(Note:
Certain changes are necessary. For example, data on blade worths must be substituted for that on the regulating rod and blade position used in lieu of rod position.) The advantages of per-forming experiments with a shim blade are that the blade has larger integral and dif ferential worths and that the shape of the blade worth curves are more typical of those of a pressurized water reactor than are those of the regulating rod. A blade typically has integ'ral and maximum differential (rate) worths of O
t ' ^x'x a 8 to x^x'x e r a-SR#-0-84-11 JUN.25 1984
This safety review provides information on and an assessment of the safety of the proposed experijnental program.
2.
Documenta tion:
The basic document that details the results of the experimental program that was conducted using the regulating rod is a Ph.D Thesis entitled, " Development and Experimental Demonstration of Digital Closed-Loop Control Strategies for Nuclear Reactors" which was written by J. Bernard under the direction of Professor David D. Lanning.
(No te pp 167-226, and 315-429 are relevant to this safety review.) Nine publications that have resulted from the research are listed in Appendix 'A to this safety review. These publications have all been presented at quality conferences (ANS, IEEE, CDC, MIT). The concepts developed at MIT for use in the closed-loop control of reactor power have now been in the scientific literature for 6-12 months. The scientific community has therefore had ample oppor-tunity to criticize the approach if such criticism ~were warranted. Much positive, but no negative, feedback has been received. Three additional publications are planned.
3.
Safety Considera tions The legal authority to use an absorber as part of an auto-matic control system, including a closed-loop transient system, is contained in technical specification #3.9-5.
The reasons for permitting the regulating rod to be part of such a system ares O
(1) The closed-loop controller is carefully designed, well-built, and properly maintained. This is documented in
' quality assurance files.
(2) The reactor is at all times under the supervision and control of a trained, licensed operator. This operator can either manipulate the controls directly or monitor the performance of a closed-loop controller.
Either way, the licensed operator is in charge.
(3) The control system and the nuclear safety system are separate entities.
(4) The nuclear safety system is capable of stopping any transient that might result from a malfunction of the automatic control system prior to there being any fuel damage.
(5) The inherent shutdown capability of the MITR core by means of temperature and voids would more than offset the effect of complete withdrawal of the regulating rod.
(6) The worth of the regulating rod is less than 0.7% AK/K and hence its complete withdrawal could not result in a prompt criticality.
SR#-0-84-11 JUN 25 1984
(7) Calculations have shown that the integrity of the fuel will
(')
be maintained during reactivity transients up to and includ-ing a step insertion of 1.8% AK/K.
(Refer to Technical Specification #3.2.)
Use of a shim blade absorber rather than that or the regulating rod means that considerations #5 and #6 might not apply under all circumstances. Specifically, if the shim bank height of the reactor were sufficiently low, then a continuous withdrawal of a single shim blade from that bank height could insert more than 0.7% AK/K.
4.
Safety Issues This review of safety issues is divided into three sections. First, the existing system for the control of shim blades is reviewed and the technical specifications that govern the use of the shim blades are enumerated. Second, a determina-tion is made of what aspects, if any, of the proposed change might constitute an "unreviewed safety question".
Third, the opinion of the MIT Committee on Reactor Safeguards is outlined.
This review provides necessary background material for the actual safety evaluation.
4.1 Shim Blade Control System:
The reactor control system provides the means of controlling the insertion and withdrawal of six shim blades and one regulat-ing. rod. The system consists of seven individual absorber insert-withdraw circuits, their associated withdraw permit inter-locks, automatic and manual insertion circuits, and an automatic control system. The latter has, to date, only been'used to move the regulating rod.
The reactor control system is the principal means of nuclear control of the MIT Research Reactor.
It is a distinct system, separate from the nuclear safety system.
The control system permits the insertion of either positive or negative reactivity.
Negative reactivity may also be inserted via action of the nuclear safety system or by the dumping of the heavy water reficctor that surrounds the reactor core.
Initial blade motion is obtained by satisfying all withdraw permit interlocks. The withdraw permit circuit is primarily a startup interlock which consi'sts of a string of relay contacts in series, all of which must be closed in order to provide a path for current flow.
In this way the withdraw permit circuit re-quires that the various process and instrumentation systems be in the proper condition before the control blades can be withdrawn.
Until this circuit is in its permit condition, control blade mag-nets cannot be energized and control blade drive mechanisms cannot be moved. The startup checklist, performed before operat-(]
\\-
ing the reactor, outlines in an efficient and orderly manner the SRe-0-84-11 JUN,25 1984
actions necessary to satisfy the requirements of 'the withdraw
(~'g permit interlock.
LJ Once there requirements have been met, the " reactor start" pushbutton is depressed to energize further relays which fully enable blade motion.
Certain requirements of the withdraw permit interlock are automatically bypassed by this action. For example, the requirement that all blades to be fully inserted is bypassed. The nuclear safety system is, of course, active at this time and should any relay in the withdraw permit circuit trip, the magnets that couple the shim blades to the drives will deenergize causing the absorbers, if elevated, to drop into the' core.thereby, scramming the reactor.
The blade control circuits are designed to meet the follow-ing functional requirements:
(1) Only one shim blade can be withdrawn at a time.
(2) The shim blade absorbers may be dropped from the drives at any ponition of tra sel.
(3) Any shim blade may be run in at its normal velocity without interrupting the magnet currents.
(4) The fine control regulating rod operates independently of the shim blades.
(~s The regulating rod can now be moved to any position of travel. However, shim blade withdrawal motion is limited to four inches by the sub-critical position interlock circuit. The sub-critical interlock is incorporated into the shim blade control circuit for the following reasons:
(1) To maintain the shim bir.de bank programmed at a uniform height during final approach to criticality.
(2) To establish a level, below the critical height, to which the shim blades can be individually withdrawn in one step.
(3) To provide a convenient reference point at which the operator can halt while making a complete instrument check before bringing the reactor to criticality.
The suberitical interlock physically consists of six two-section limit switches, one switch associated with each of the six shim blades. One section of each switch, normally closed below the subcritical interlock, opens when the drive rack reaches sub-critical, interrupting current to the individual mechanism drive motor.
The other section of the switch, normally open below suberitical, closes when the drive mechanism reaches suberitical forming a series circuit with the other five similar 7s
(,)
sections and the normally-open " manual contro!" pushbutton.
Depressing this pushbutton energizes relays whose contacts then S R#-0-84-11 JUN 25 1984
~
e bypass the open sections of the limit switches in the control circuit of the mechanism drive motors. Therefore, once all shim blades have been withdrawn to the suberitical position, the operator must. depress the " manual control" pushbutton to continue withdrawing any given blade.
Beyond the subcritical position the operator is required by operating procedures to keep all six shim blade heights within two inches of the average bank height. This prevents the occurrence of an unbalanced power distribution.
The reactor may be operated in either of two modes. Manual control by the operator or automatic control of the regulating rod by the closed-loop control system. The reactor can not be transferred to the automatic mode of operation unless (1) the operator physically depresses the " automatic control" pushbutton and (2) all protective monitoring circuits associated with the automatic control system are satisfied. Any change in any of these protective circuits will shift control back to manual and sound an alarm.
Currently, the use of the automatic control system is limited to the regulating rod. Movement of the shim blades is accomplished by the operator. Only one blade may be withdrawn at a time. Blade selection is accomplished through the action of a six position shin selector switch. Once selected, a blade is
. moved by turning and holding the shim blade control switch in either the "in" or "out" position. Permitting this spring-return switch to revert to " neutral" halt's the blade's motion.
The scram circuits directly affect all seven absorber cont' ol circuits, overriding all other automatic at d operator r
actions.
In addition to the scrams, there are two insertion circuits, the "all-absorbers-in" circuit and the " automatic rundown" circuit.
The "all-absorbers-in" circuit is normally used wher.ever it is required to shut the reactor down completely and scram action is not warranted.,The operator can, by depressing the "all-absorbers-in" pushbutton simultaneously run all blades into the core at their normal speed.
The " automatic rundown" circuit is primarily a safety circuit and is activated only during operation of the automatic control system.
It is intended for use while at steady power.
If during automatic operation the regulating rod should be driven to the near-in position by an increasing reactivity transient such as menon burnout or decreasing coolant temperature, the automatic control circuit soon would no longer be able to keep reactor power at the set power level. Power would increase until a +1.5% power deviation switched control back to the manual mode. As a further safety measure, the automatic run-down circuit provides a visual alarm when the regulating rod reaches O
it
-t itt
' 2 6 i ch
- 4. i' **
t i-overlooked for 30 seconds, transfers reactor control to the manual mode and drives in the selected shim blade before the 1.5%
JUN' 25 1984 S R#-0-84-ll
-8
s 1.
deviation has been exceeded. The. operator can correct the condition during the 30 second delay by depressing the " rundown reset" button and reshimming.
A reshim for this type of
. transient means moving the shim blades in while moving the regulating rod out, so as to hold the reactor power level fixed.
There are six run-down relay drop-out circuits. Each e
consists of a current sensitive relay and one is placed in series with each individual shim blade magnet.
If during operation any one of the six magnet current amplifiers should fail or if magnet I
current is interrupted in any other way, the absorber section j
will' fall and the mechanism of the affected shim will drive in automatically which assures that the absorber is fully inserted.
Proximity switches are activated by permanent magnets on each shim blade assembly when the blade is +80% inserted. These 3
switches energize the " blade-in" lights on the control console.
The seven absorber drive motors are 120 voit AC, single phase, gear-reduced, reversible notors with brakes. These motors drive gear boxes, which contain gear trains for driving coarse and fine synchro transmitters, the receivers of which give absorber position indication at the control console. The gear boxes for. the shim blade drives also contain the in-limit, out-limit, and suberitical position interlock switches which are used to operate lights on the control console. The gear box for the regulating rod differs in that it contains the near-in and near-out light switches, as well as in and out-limit light switches.
The ' haf ts of the gear boxes drive the six magnet lead screws and s
the regulating rod lead screw by means of bevel gears.(Note: A variable speed motor may also be used for the regulating rod.)
Two proximity switches are located in a tube near each shim blade guide. These are activated by a permanent magnet mounted on the shim blade upper assembly. The lower switch operates a
" blade-in light" on the position indicator in the control room.
The other switch activates a drop-timer for use in calibration tests.
4.1.1 Technical Specifications:
The MITR control system is governed by neveral technical specifications. These are!
(1) The reactivity worth of the regulating rod connected to the automatic control system is less than 0.7% AK/4.
(#3.9-5) morethan510grolledrateofreactivityadditionisno (2)
The maximum con g
AK/K per second.
(#3.9-6)
O V
j i
JtTN 25 1984 S M-0-84-11
_9
~
(3) The reactor shall not'be operated in excess of 100 Kw unless at least five oper~able shim blades are within 2.0 inches of a banked (average shim blade. height) position and any inoperable blade is at the average height or above except that greater imbalance may exist when one or more shim blades are being inserted to make the reactor suberitical.,
(#3.11-2(e)).
4.1.2 Extent of Proposed Change: The principal change is to install-the capability to use one of the MIT Reactor's six shim blades for the absorber in an automatic control system. That is, the existing automatic control systems (digital and analog) that are used for the regulating rod will be retained and a second system, capable of controlling a shim blade absorber, will be installed.
(Note: The shim blade controller will not be used simultaneously with the regulating rod controller without first submitting a separate safety review to the MITRSC.) The new system may eventu-ally be compatible with each of the six shim blade drives.
However, it will move only one shim blade at a time.
(Note:
Initially, only one of the six blade drives will be modified so that it is compatible with the automatic control system.) Hence, the change consists principally in.the strength of the absorber being used as part of the control system. All of the interlocks and protective features associated with the existing control system (as described in 4.1) will be retained. A second proposed change is that variable speed motors may be substituted for the 120 volt AC motors now used to drive the blades.
O It is important that the basis for requesting this change be understood. Approval to use the regulating rod in conjunction with a closed-loop control system has always been based on the physical characteristics of that rod.
Its reactivity worth is such that a controller malfunction would not have significant consequences. Hence, there are limits in the technical specifi-cations on the rod's characteristics but not on the controller's design. The situation with respect to a shim blade is quite different. Shim blade worths are several times that of the regu-lating rod. Hence, the design of the controller, as well as the blade characteristics, become important to safety.
4.2 Determination of An "Unreviewed Safety Question" An unreviewed safety question is deemed to exist if any of the following three criteria are met by a proposed change (1) The probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased.
(2) The possibility for an accident or malfunction of a differ-ent type than any evaluated previously in the safety analysis report may be created.
(3) The margin of safety as defined in the basis for any technical specification is reduced.
JUN'20 1984 S R#-0-84-11
-10
The MITR Staff reviewed the proposed change and the possible
- _)
types of accidents in terna of the. above definition and concluded that:
(a) Use of a shim blade in an automatic control system might change the probability of the occurrence of a continuous blade withdrawal.
Previously, the only way for this to occur was by operator error.
None has ever occurred. This should be examined.
(b) Automatic control of a shim' blade would not increase the probability of a blade being inadvertently operated outside of the allowed 2.0 inch band around the shim bank. Current-ly, the only protection against this type of occurrence is operator knowledge of the requirement. The new system would retain that approach and also add, through software, a limit of 2.0" on a blade's allowed range of travel from the bank position. The probability of this type of occurrence will therefore be decreased.
(c) The existence of automatic control systems for both a shim blade and the regulating rod would not change the probabil-icy of the occurrence of an insertion of positive reactivity at a rate in excess of 5 10-4 AK/K per second. This type of accident is not possible under either manual or automatic control because only one blade can be moved at a time under
)
cither system and no blade has ever had a differential worth of more than 1 10-4 AK/K per second. Furthermore, the
" maximum combined differential worths of both a blade and the regulating rod is only 1.167 10-4 AK/K.
(d) The use of a variabic speed motor to drive a shim blade might increase the probability of the occurrence of an insertion of positive reactivity at a rate in excess of 5*10-4 AK/K per second. This could happen if the motor control failed resulting in a more rapid than desired speed. This should be examined.
(e) The proposed change would not alter the consequences of an accident or malfunction. The possible accidents were con-tinuous blade withdrawal, operation of a blade not within 2.0" of the bank average, and insertion of positive reacti-vity at a rate in excess of 5 10-4 AK/K per second.
Changing either the mode of control or the type of motor will not alter the possible consequences of these possible accidents.
(f) The proposed change will not introduce any type of accident different from those previously evaluated.
(g) The proposed change will reduce the margin of safety as
('. ')
defined in the basis for technical specification #3.9-5 if the reactivity that the blade can insert exceeds 0.7% AK/K.
This should be examined.
JtlN 25 1984 S R P-0 11 3g.
+
c So, in summary, the proposed change would constitute an
(
"unreviewed safety question" if it (1) caused the probability of a continuous blade withdrawal to increase or (2) caused, by the installation of a variable speed motor, the probability of insertion of positive reactivity at a rate in excess of 5 10-4 AK/K per second to increase, or (3) resulted in an absorber capable of inserting reactivity of more than 0.7% AK/K being attached to the closed-loop controller.
4.3 MITRSC Opinion - Dec. 83 The MITR Staf f requested the opinion of the MIT Reactor Safeguards Cosssittee (MITRSC) on the proposed change in December 1983. The MITRSC dia.cussion centered on technical specification
- 3.9-5 which states that "the reactivity worth of the regulating rod connected to the automatic control system must be less than 0.7 AK/K".
It was noted that, strictly speaking, this specifica-tion pertained only to the regulating rod. However, it was the opinion of the MITRSC that the intent of the specification was that no control mechanism, regardless of what it happens to be called, should be connected to the-automatic control system if operation of' that mechanism could result in the insertion of reactivity in excess of 0.7% AK/K. The MITRSC also noted that movement of the most reactive blade from its full-in to its full-out position could add 1.7% AK/K. The MITRSC therefore recom-mended that the proposed experiments on the closed-loop control of reactor power via a shim blade'be split into two sections.
These were:
(a) Experiments in which the shim bank height is such that a
continuous withdrawal of a single blade from that bank can not result in the addition of more than 0.7% AK/K.
(Note:
~
The bank height would have to be such that this criteria was satisfied at the start of the experiment and remained satisfied during the experiment.)
(b) Experiments that did not meet the criteria stated in (a) above.
The MITRSC also reviewed the degree to which the proposed change might affect the probability of a continuous blade withdrawal.
The MITRSC concurred with the MITR staf f's evaluation that the proposed system would not, in all likelihood, cause any such withdrawals. The MITRSC then voted to approve the following statement "The MITRSC has reviewed the use of a shim blade in conjunction with closed-loop digital control in a mode where the blade's available worth is equal to or less than 0.7% AK/K and found that such control, either steady-state or transient, is consistent with h,
the MITR Technical Specifications and does not con-stitute an unreviewed safety question." JUN 25 1984 S R0-0-64-11
4.4 Summary of Safety Issues:
The proposed experiments have been A
subdivided into two classes. These are:
\\J (1) Class A Experiments in which the shim bank height is such that a continuous withdrawal of a single blade from that bank can not result in the addition of more than 0.7%
AK/K.
(2) Class B Experiments that do not meet the class A criteria.
It must be shown for both classes of experiments that (1) the proposed closed-loop control system is designed so that it can be expected tha't no automatic control action will result in a challenge to the existing, separate nuclear safety system, (2) that there will be no increased possibility and, in all likeli-hood, no possibility of a continuous blade withdrawal, and (3) that no increased possibility and, in all likelihood, no possi-bility of a positive reactivity insertion in excess of 5 10-4 AK/K per second will result from the use of a variable speed motor.
In addition, a justification for the authorization of class B experiments must be made.
Class A experiments are con-sistent with'the MITR Technical Specifications. Class B experi-ments require an addition to those specifications.
5.
Description of the Closed-Loop Controller p
'v' What follows is a brief description of the closed-loop controller that has been developed by MIT and the Charles Stark Draper Laboratory (CSDL) and tested using the MIT Reactor's regulating rod. This is the controller that is being proposed for use with a shim blade. This controller is referred to both in this review and in the published literature as the MIT-CSDL Non-Linear Digital Controller or NLDC. Additional information is given in the documents described in Section 2 of this review.
5.1 Theory
Reactors such as the MIT Research Reactor (MITR-II) have close-coupled cores and may therefore be accurately described by the point kinetics equations. These equations are cumbersome to use for control purposes because they are written in terms of neutron and precursor concentrations neither of which is readily measurable. Accordingly, it is more useful to combine these equations and obtain the dynamic period equations which describe the reactor kinetics in terms of power, period, and reactivity.
The " exact" form of these equations is:
T(t) =
(5.1-1)
I (t)
(n) p(t)+((t)p(t) g (I-p(t))
+
e S R(/-0-84-11 13 JUN 25 1984
b A( t) =
do/t(o)
(5.1-2) o P( t) = P, e^
(5.1-3) where T(t) is the reacter period, 3
is the effective delayed neutron fraction, p(t) is the reactivity, p (t) is the rate of change of reactivity, A,(t) is the effective, one-group decay constant, A,(t) is the rate of change of the effective, one group decay constant, P(t) is the time-dependent reactor power, P,
is the initial reactor power.
p' The derivation of (5.1-1) from the point kinetics equations requires that the prompt-jump approximation be made. This means that the time-derivative of the neutron population is neglected.
This is completely justifiable because (1) the reactivities being studied are substantially less than the delayed neutron fraction and (2) the rate of insertion of reactivity is sufficiently slow so that no appreciable change occurs over the prompt neutron lifetime. The effective, one-group decay constant is treated as being time-dependent and is therefore defined in terms of precursor concentrations rather than precursor yields.
Specifically, I A C (t) gg f r i = 1, N (5.1-4)
A,(t) =
t c (t) g where N is the number of delayed neutron groupe.
Simulation s tudies have shown that, for the reactivity transients typical of MITR shim blades, solving the exact form of the dynamic period equation is as accurate as solving the point kinetics equations provided that the Ae(t) and A*e(t) terms can be determined. These terms can not be obtained in real-time with complete accuracy using present-generation micro-computers.
Accordingly, it is useful to simplify equation (5.1-1) and obtain:
O
- ~#(*
(5.1-5)
T ( t) =,(t) + A ( t)p ( t) p SRW-0-64-11 JUN 251984
+
1 Equation (5.1-5) is the " approximate" form of the dynamic period equa tion.
(Note: If A,(t) were written as a constant, equation
('T (5.1-5) would be in the form tha,t is occasionally used in the
,N /
literature on reactor dynamics.)
Obtaining (5.1-5) from (5.1-1) required dropping the third term in the denominator of (5.1-1).
The justification for this assumption is that equation (5.1-5) is to be used to predict when the direction of control rod motion should be changed rather than to precalculate the dynamic response.
Neglecting the third term in the denominator is justified because it changes sign almost immediately following a change in the direction of the control rod.
Hence, it need not be considered in a decision on when to change that direction.
One further assumption is necessary. The term A,(t) can not be readily evaluated.
It is therefore approximated by. A'(t) which is the value of the effective, one-group decay constant when the reactor is on an asymptotic period. Al(t) is easily calculated if the net reactivity is known. This substitution is justified because approximating A,(t) by Al(t) results in a conservative decision for power increases.
Also, the difference between the two terms is, for the transients of interest, quite, small.
So, we have in equation (5.1-5) a means of rolating the reactor period to the reactivity and the rate of change of reactivity The next consideration is to recognize that the rate at which reactivity can be removed from a reactor is, under non-
/~S scram conditions, limited to the speed of the control blades.
\\'-)
Civen that the rate of change of reactor power is dependent on both the reactivity and its rate of change, the fact that the rate of removal of Teactivity is finite means that the process of removing the excess reactivity must be begun in advance of attaining the desired power. O therwis e, there will be a power overshoot.
This observation is the basis for defining a reactor together with a designated control mechanism as being feasible to control if it is possible to transfer the system from a given power level and period to a desired, steady-state power level without overshoot. Hence, not all states are allowable intermediates through which the system may pass.
Excluded are states representing actual overshoots and states from which overshoots could not be averted by manipulation of the designated control mechanism. These concepts can be quantified by use of the dynamic period equation (approximate form). That equation shcws that control will be feasible only if the reactivity is restricted so that it is possible to terminate a power transient by reversing the direction of control rod motion and thereby making the period infinite.
Control is feasible throughout the entire transient if the absolute reactivity constraint is satisfied.
- Namely, ON p
(5.1-6)
< 1, p p
max max SR#-0-84-11 JUN 25 1984
. ~
~
-_- -.- - _ _ =
-. _ _. -. -.. =.
wherethequantityl$6,Nedesignatedcontrolrodtobemoved.
is the maximum availabl~e rate of reactivity change were t j' ',
Control is said to be feasible at 'the desired termination point of a transient if the sufficient reactivity constraint is satisfied. Namely, for power increases,
[p - 5 /A,]/
3 i ri n(P /P )
(5.1-7) i i
p i 4
where Py and Pi are the desired and current power levels respectively, b
is the maximum available rate of change of j
reactivity, and ri is the shorter of either the observed or the j
asymptotic period. The term on the lef t is the time required to reduce whatever reactivity is present to the amount allowed by the absolute constraint. The term on the right is the time remaining to attain the desired power.
(Note: In both (5.1-6) and (5.1-7), all quantities are time-dependent and A*,(t) is substituted for A,(t)).
i These reactivity constraints and the concept of feasibility of control were developed by MIT. The sufficient constraint is l
the basis for the MIT-CSDL Non-Linear Digital Controller. The point to realize is that if that constraint is observed, control
^
will' always be feasible at the desired power level. Hence, by merely reversing the direction of travel of the designated con-trol mechanism, the period can be made rapidly intinite and the i
i power transient halted without overshoot. Note that it has not been necessary to linearize either the equations of reactor i
dynamics or the control rod reactivity worth curves. The system is intended for use in.non-linear environments.
5.2 Experimental Evaluation Figure 5.2-1 illustrates the relation between the two constraints. Control is' guaranteed to be continuously feasible if the reactivity is within the bounds of the absolute con-straint.
(These bounds are not synssetric because the value of the effective, one group decay constant depends on whether power 4
is being raised or lowered.) Once the value of the. reactivity exceeds these bounds, control is only guaranteed to be feasible at the desired power. level.
i A controller, constructed on the basis of these reactivity constraints, has been the subject of a year-long evaluation. The results are that:
4 (1) The controller is capable of both raising and lowering power in a safe, efficient asnner while using a control rod of varying differential worth.
(2) The reactivity constraints are a necessary condition for the automatic control of reactor power. The same could not be shown experimentally for period restrictions.
8 g)
(3).The use of controllers based on the sufficient reactivity l
constraint can prevent overshoots either due to attempts to JtIN 25 1984 SR#-0-84-11 -
O O
O J
Q.
Note!
Lower llorizontal Axis Reactivity y
Upper Horizenral Axis Elapsed Time'
?
Vertical Axis - Time 8
I U
Available Time W
I Initiation of Power Decrease e
Required Time N Available Time 3
i l
C Elapsed Time
-1 k Initiation of Power increase Sufficient Ab :olo t'e Sufficient Control feasible only at Y
Control feasible only at
-lb!
l#
lbl Desired Termination Point Desired Termination Point A
I A
e e
4 Control Continuously Feasibic g
0 Figure 5.2-h Relation Between Absolute and Sufficient Constraint i
g
?
control a transient with a control rod at a' position such
(~s that its differential worth is insufficient or due to
\\
failure to properly estimate ihen to commence rod insertion.
Figure 5.2-2 depicts aa experimental run in which reactor power was raised from 1 to 3 MW using the sufficient constraint. The upper figure shows the power and reactivity. Note that there was no overshoot and that the dynamic effect of rod insertion permitted power to be leveled despite the presence of positive reactivity.
The lower figure compares the left and right sides of the constraint.
Initially, the reactivity is zero and, given that there is some rate of change of reactivity available, the left side of the constraint is negative. The right side of the constraint is infinite since the period is infinite.
Once the transient commences, the reactivity becomes positive. The left side of the constraint becomes less negative, passes through zero, and then becomes positive indicating that some finite interval of time is now required before the transient can be halted. The right side of the constraint tends towards zero because the period is becoming shorter and the power is rising.
Once the time required to restore continuous feasibility of control equal's the time remaining to attain full power, continued rod withdrawal is prohibited and rod insertion is begun. The left side of the constraint is continuously bounded by the right side indicating that the control rod is being more or less con-
/'T stantly inserted. The left side of the constraint becomes zero
\\J after 153 seconds indicating that control is again continuously feasible. Note that the power levels off at 3 MW at the same time.
The relation represented by the suf ficient constraint must be evaluated frequently if it is to be effective. A sampling interval of one second was used for all experimental runs.
5.3 Extension to Other Control Strategies The controller described in the preceding section is referred to as the MIT-CSDL Non-Linear Digital Controller (NLDC).
Given that it guarantees feasibility of control and that it was shown experimentally to perform as expected, it is possible to use this controller to supervise the experimental evaluation of other control strategies. Both the NLDC and a control law based on the alternate strategy are run simultaneously.
The NLDC is programmed to intervene if, for example, the actual power were i'
projected to exceed 90% of rated power. The controller based on the alternate strategy is set for 80% of rated power. The con-I troller based on the alternate, strategy has control of the reactor subject of course to the licensed operator and, in the case of' transients, a senior operator as well. The NLDC is used l'
in a - supervisory role only.
It will not interfere unless power could exceed 90% of rated.
The reactor's heat removal capability is set for the full normal operating power (100%).
(Note: The s
80% and 90% figures cited are an example. The actual values used may vary.)
S R#-0-84-11 JUN 25 1984 e
C'i
- 3. 0
^
0 60 Reactivity h
r 45 m
B c)
Power %
[
[
~
D E
2.0 30 w
v Dynamic Effect of 3
u U>
rod insertion per-S mits power to be j
leveled despite
--- 15 positive reactivity.
I I
I I"
0, 1.0 120 150 180 a
6 0
.30 60 90 Time ( seconds) 90
~-
-~
.k )
- ~ -
80
~
70
/
Rod Insertion Commenced Available /
Time 60 l
l 50 i
c:
O E
40 Required m
Time E
30 Control Continuousiv
~
20 Feasible l
\\
l 10 t
o I
I I
I 0
30 60 90 120 156 180 10, Elapsed Time-(seconds) 1
')
Figure 5'. 2-2 Function of Suf ficient Reactivity Constraint i
JUN 25 1984 SR#-0-84-11 -
r This procedure was successfully used to evaluate a decision analysis controller used for steady-state control and a predic-
[
I :
tive controller used for transient control. The latter required that the response of the reactor conform to a certain transfer function.
Figure 5.3-1 is a schematic diagram showing the internal structure of the NLDC, its relation to other control laws, and its relation to the existing nuclear safety system and to the licensed. operator. The significant point to realize is that the i
control law being tested need not be subject to a rigorous evaluation provided that its decisions are always subject to
" review" by the NLDC's reactivity constraint. The NLDC is guaranteeing that there will be no challenge to the nuclear j
safety system.
5.4 Implementation of the controller A number of special safety circuits have been devised and installed. Their purpose is to monitor the overall system (soft-ware, computer, hardware, and interface with the blade drive) for malfunctions. The exact circuits used depend on the neture of the experiment since, for example, the protective needs of tran-sient and steady-state controllers may differ. What follows is a i
description of one of these circuits.
(Note: This description of the circuit is given only as an example. Approval of the circuit by the MIT Reactor Safeguards Comunittee is not being I-requested. Hardvtre safety featu'res have been described by previous safety reviews and require only MITR Staff approval.)
One of the goals of the experimental program was that no nev l
failure modes would be created as the result of malfunctions of l
the computer hardware. Accordingly a special circuit, designated as the " computer-interlock" circuit, was installed to monitor l-both the digital-to-analog (D/A) converter and the computer pro-cessor for hardware malfunctions.
If both units are functioning properly, the output of the D/A converter should be a signal that varies between -10.0 and +10.0 volts. Advantage was taken of the fact that the least significant bit that comprises this signal could be used to monitor for proper operation of the system.
Accordingly, the sof tware was programmed to change the state of that bit at a specified frequency. The " computer-interlock" circuit uses the state of that bit as one input to a retrigger-l
. able monostable multivibrator (RMM) which is progransned to time out if it is not periodically retriggered. The output of the RMM drives a relay which is linked to the " auto-control permit" circuit. The RMM has a second input which is the output of an internal:run/ halt circuit built into the computer by the manu-facturer. The overall-circuit provides protection against ten possible failures. These are:
(1) Hardware failure of the D/A converter.
O l
V (2) Hardware failure of the computer processor SR#-0-84-11 JUN 25 1984 l'
O O.
O i.e qe
' s. j i
f,
- d. s -
v>
w g
4 h
o k
E b
\\.
l O
POWER INVERSE POWER ItISTORY KINETICS y
'r SENSOR *
. REACTOR POWER PERIOD DEMAND FLOW VAllDAIlON p
? REACTIVITY ANALYTIC TEMPERATURE A
DALA11CE REACTIVITY VALIDATED.
REACTOR INTEGRAL REACTIVITY.i MODEL WORTil h
b s
y' R0D llElGitT T'IME REQUIRid.TO 4
I DIFFERENTIAL
-REDUCE EXCESS EFFECTIVE TlMs REMAINillG i
wop 7,i REACTIVITY TO DECAY TO ATTAIN
+
CONTROLLABLE CONSTANT FULL POWER SAFETY AMOUllT AUTOHATIC
~
SYSTEM (p-p/A)/p T In(Pg/Pg )
m SittlTDOWN n
1 M.l.T.
SillM SAEETY DECISIOff BLADES REACTOR (5 MWT)
CONTlHUED R0D WITilDRAWAL n
CESSATION OF ROD MOTION 3
ROD INSERTION-LICENS'ED m
O @g -
CONTROL LAWS BASED _Dil
- OPERATING PROCEDURES OPERATOR CONTROL u
ROD V."
- DECISION ANALYSIS
- PREDICTIVE METil0DS U
Figure. 5.3-1 Schematic of Non-Linear Digital Controller s
r s
[
nt;
~.
g
.e l.
iT.;,f...lT'
(3) Failure of the software to execute sequentially, thereby
-O atterieS the c te er the die t the cerrect tres e c7-(4) Loading of the wrong program, or at least the loading of one not progransned to be compatible with this interlock.
(5)
Interruption of the appearance of data on the' video screen.
(6) Failure of the time clock.
(7) Loss of either AC or DC power.
(8) Operator initiation of a break signal, thereby interrupting the program.
~
(9) Generation bf a halt state which is a condition under which
~
the program's execution is stopped.
(10) A " divide check" error signal (i.e., if the program tried to' divide by zero).
Hence, if a hardware malfunction is detected, the computer interlock circuit trips, thereby opening a relay in the auto-
@e.i:is$kh
. control permit. circuit.which' automatically transfers reactor,.,
o
%MyP Esontrol to manual and 's6 dads an alare.
T
.h 6.
Design Features Relevant to Safety Issues Section 4.4 of this review summarized the areas that the MITR Staff felt should be examined in detail. The issues raised
>:eax.ytnG were:
' k-J D
'=
the proposed control system never result in any control (1) That action's challenging the nuclear safety system.
~"
(2) That there be no increased probability of a continuous blade withdrawal.
(3) That there be no increased probability of an excessive positive reactivity insertion.
~
(4) That.a justification be made for the authorization of Class B experiments.
The MITR Staff had concluded that items (2) and (3) might involve an unreviewed safety question and that item (4) did involve an unreviewed safety question.
The following section of this review presents factors relevant-to these issues.
7 f%
Q ).
JUN 25 1984 S R#-0-84-11 -.
i l
~
6.1 Non-Existence of Challenges to the Nuclear Safety System Section 5 of this review, the' publications listed in I
Appendix A, and the two papers included as Appendix B present the theoretical basis for the controller and the results of its experimental evaluation. This material, which covers eighteen months of testing, shows that use of the MIT-CSDL Non-Linear Digital Controller (NLDC) for the transient, closed-loop control of the regulating rod will preclude there being any challenge to the existing nuclear safety system. The restriction on the net reactivity in accordance with the sufficient reactivity constraint (5.1-7) is the basis of the NLDC. Adherence to that restriction. guarantees that it will always be possible to halt a power transi.ent at the time that the desired power is attained by merely reversing the direction of travel of the absorber.
The experimental work presented thus far has concerned the regulating rod. :It is necessary to show that the sufficient reactivity constraint can be used with equally satisfactory results for the transient, -closed-loop control of a shim blade absorber. Naturtily such a judgment can not be conclusive until the actual experiments are performe'd. However, it has been shown
.that.the application of the sufficient reactivity constraint to an absorber having the integral and differential reactivity
.d5 worths of -an MITR; shim bladenhould be' viable. Specifically 6 y simulation s'tudies have' been performed in which the NLDC using blade worth curves changed the power on a computer model of the
~ ' O-MIT Reactor. The codes used for these studies were the same ones that were used and documented prior to commencing the experiments with the regulating rod. Figures 6.1-1 and 6.1-2 depict two of these studies.. Power was raised from 1 to 4 MW in both studies.
The initial shim ~ bank' height was 8.0". 'This meant that the blade used to initiate, control, and terminate the transient was at or
,~
close to _ its maximum differential (rate) reactivity worth during the simulation. This is also a region where the blade's worth is non-linear with position. Hence, the simulation studies assumed
. worst-case conditions. The study shown in Figure 6.1-1 used a controller that restricted the reactor period (either dynamic or
~
steady) to 50 seconds. The study shown in Figure 6.1-2 used a similaf controller but ~ restricted the dynamic period to 30 i.
seconds and the steady one to 50 seconds.
Both studies subjected.
all control 'lant decisions to review by the sufficient constraint and in both ' cases that constraint icitiated blade insertion-before the control law would have dene so.
Note that no overshoots occurred.
-6.2 Non-Existence of Continuous Blade Withdrawals A continuous blade withdrawal is one form of a " loss of
~
regulation". That term.is considered to cover those types of '
. malfunctions 'in which -the; controller sof tware is functioning
. properly but the wrong action is taken. For example, power is -
3 increasing, the controller signals for rod insertion, but the rod is withdrawn. Difficulties such as this can occur as a result of JUN 25 1984 SR#-0-84-il !
Ot e o o
+
.c
^
'*t m
.r
'c' g
y4 -
s 15 0
/.7
'i mi'
/*
,/-
e
( '.
e Power Leveled Despite Positive Reactivity Due
^
~
I to Dynamic Effect of 10 0 N
e Blade Insertion (D
4 O
2 o
v
-.e-
^'
- P6ver L
Q)
G g
h Reactivity N
e e
3_
m 5'
O 2
- 50 CT
.(
(D o
/e E
o Figure 6.1-1
- Simulation Study (#446)
,[
rower increase 1-4 Mw using MIT-cSot nLoc
/*/
l u
8 O
I O 20 40 60 80 10 0 I20 14 0 16 0 n*
l ?!
Time (seconds)
M$QO3,S** ~3_EUD+b C-0 0
0 5
0 5
O 1
1 0
6 a
1 e
e 0
e eu e
I 41 f
t D o
ipy n
t st o
c ei i
D v et f
i r
f d t e
f*,
ecE s l a n
c ee I
i vR m
0 e
e a
Le d
e I
2 n a C
v
/a 1
ri yl
)
D D
B 3
L et
/
wi o 5
N os 5
Pot L
P
(
D
./
S y
C d
u T
t I
S M
00 I
n g
1
/
i i
o n
t s
a U
)
l s
u W
d
.x.
i i
, n v
m M
.a 1h; 3-S 4
o 1
c 0
O e
e I
s 8
2 a
s e
(
r 1
c 6
n e
I m
e
}'-
r r
i u
e g
w T
i o
F P
0 I
6 r
e w
o P
e 0
I 4
y t
iv i
e tc a
e R
0 e
o I
2
_ nu o
e f
O I.
4 3
2 gE ua3o1
'o+ o O)qZ
" g mu, =
)
mpg 2b
malfunctions in-the intierface between the computer and the blade O
drive-rais tree er eredlem was see earerull7 studied-oe potential problem area has been identified.
Specifically, the motors used to drive the MITR-II's regulating rod and blades are 120 volt AC, single phase, reversible, induction motors. Such motors must come to a complete stop before they can reverse direction. This requirement presents no problem when control is on either manual or analog automatic since the signals initiated under those modes of control have fairly slow repetition rates.
However, a computerized, digital system can respond so rapidly that the motor does not have time to come to a halt and reverse direction.
So, in cases where the controller changes signals froni 'out' to 'in' or vice versa without first requesting a
' halt', the motor may continue rotation in the original direction. This would compound the error in reactor power, thereby keeping the controller's signal constant and causing a continuous, erroneous rod motion.
Special test sessions were
~
conducted and it has been shown that this type of problem can occur. Three possible solutions, all equally effective, have been devised.
The first solution is to add an additional check to the instruction section of the subroutines that raise and lower power 44
..-in the.NLDC. These instructions compare the. current decision-of
.... "M"
' t he4 controller with~ its preceding decision. 'If a reversal of' rod t
~
direction is required, the current decision is changed to a
, ~-
' halt'.
This action guaranteec that the motor has at least one
) ~
sampling interval in which to come to a complete stop before reversing its direction of travel. The second solution is to replace the single phase motor with a variable speed motor that 4 ;g 1 was designed to'. accept sudden: reversals of direction. The third solution is to modify the software so that the current response of the reactor is verified against the control action specified in the previous time step.
If the response is not as desired, the drive is given a ' halt' signal on the assumption that it has been locked into the wrong direction of travel. The correct control signal is then applied.
While using these approaches, no " loss of regulation" t
j' dif ficulties were experienced. Which of the three approaches is used depends on the specific experiment.. Both the first and p
it third approaches will be used for the initial testing of the controller for the shim blade.
6.3 Non-Existence of Excessive Positive Reactivity Insertion Rates Insertion of positive reactivity at a rate in excess of 5 10-4 AK/K per second is not a possible occurrence if the motors used to drive the shim blades are the 120 volt AC, single-phase units that are now installed. Such motors are in effect " locked" to the 60 Hz frequency of the electric power grid l]
and can not overspeed. Therefore, such an occurrence is not possible under manual control because no shim blade has ever had I
JUN 25 1984 SR#-0-84-11 _-
a differential worth of more than 1 10-4 AK/K per second and 2
O e tr e=e $t de c 6e evea c
't e-Si it rtr. ech -
occurrence would not be possible under auto.natic control because, while the automatic controller will eventually be compatible with any of the six shim blades, it will be capable of moving only one blade at a time. Furthermore, assuming that both the regulating rod and a shim blade were withdrawn simultaneously, the maximum differential reactivity rate could not exceed 1.167 10-4 AK/K per second.
If a blade absorber is to be driven with a variable speed motor, the possibility of an excessive rate of insertion of positive reactivity requires additional study since such motors are not " locked" to the grid frequency. Accordingly, the possibility of such a motor's overspeeding was examined using an out-of-core mockup of the motor, a blade drive, and a weight equivalent to a shim blade absorber.
It was found that the motor stalled at a speed of four times the MIT Rector's normal shim t
blade speed. Positive reactivity insertion at a rate of four times normal would, even at the point of maximum differential worth, still be 20% below the limit of 5 10-4 AK/K per secono.
(Note:
The term " stall" means that the motor was incapable of producing enough torque to move the absorber.) Accordingly, no possibility of an excessive, positive reactiv.ity insertion is believed to exist.' Nevertheless, two additional -safety features will be installed whenever a variable speed motor is in use in conjunction with a shim blade. Tliese are:
(a) A shaft angle encoder will be installed on the bla'de's drive 4
l motor shaft. It will provide information on the direction of rotation -and. speed of the shaf t.
This information will be compared to the signal being applied to the variable l.
speed motor. Any significant discrepancy in the comparison i
will result in an audible alarm and a trip to-manual con-trol.
(Note:
This protective circuit will be independent of the process computer used for digital control.)
(b) A blade position signal will be generated by a potentio-meter driven from the gear train associated with the blade drive and used, through software, to determine the speed of the blade's absorber.
If an excessive speed is detected, blade motion will be stopped.
p 6.4 Justification for Class B Experiments This is discussed in section 7.2 of this safety review.
I' 7.
Safety Evaluation This safety evaluation is divided into two sections.. First, l..
those factors that pertain to both class A and class B experiments are presented. Second, those factors that are required for class B experiments alone are outlined.
JtW 25 1984 SR#-0-84-ll
. i.-..
~.
s 7.1 Factors Relevant to Clu.s A and B Experiments These factors are listed as they relate to the safety con-siderations enumerated in section 3 of this report.
The object is to summarize the evidence that (1) the controller will not result in a challenge to the nuclear safety system, (2) that no continuous blade withdrawals or blade drive overspeeds will occur and- (3) that a " defense-in-depth" coverage of the reactor exists.
A.
Controller Design - ' Evidence that the MIT-CSDL Non-Linear Digial Controller (NLDC) is capable of fulfilling its intended function is that:
(a) The MIT-CSDL Non-Linear Digital Controller has been experimentally tested using the regulating rod for a 4
period of approximately eighteen months.
(The initial 2
test date was 4 Feb. 83). All tests were successful and there was never any need for intervention by the nuclear safety system.
(b)
The controller theory and the experimental results have been carefully documented and extensively published in the scientific literature. No negative criticism has
~
M*?
NGe: L-been made of-the approach.+ 4-(c)
Simulation studies have-been performed in which the
- {" v NLDC using blade worth curves has changed the power on a computer model of the MIT Reactor. These studies showed that the NLDC's capabilities were ~ as expected.
?
'(d) A careful investigation was made of the " loss of regulation" problem as it might relate to continuous
'"4 blade withdrawals. Three methods of precluding the occurrence of such withdrawals have been identified, tested, and implemented. No incipient continuous l
withdrawals occurred during the course of the 18 month l
test period while using these measures, l'
(e) A full scale mockap has been built of the blade drive to test both the position-indicator system and the.
(
speed control.
The results show that excessive l
positive reactivity insertions are not possible.
l-l~
(f) The data required by the controller is periodically updated.
Integral and differential blade worth infor-mation is needed. This data is required to be measured by internal procedures whenever there is a change in t
core configuration that could alter the power distribu-l.
tion or annually, whichever is the more conservative.
L Special measurements were made before commencing the "N
closed-loop experiments with the regulating rod.
l_
Special measurements will be made prior to initiating the closed-loop experiments with a shim blade.
~
SR#-0-84-11 1 n
(g) The controller is set up so that all exieting
~
interlocks and safety circuits will function normally.
,,(j Details are as follows:
(1) All blades, including the one connected to the automa tic control system, drop on receipt of a scram signal.
(2)
If the circuits monitoring the computer, the interface, or the sof tware sense a fault, control reverts to manual and an alarm sounds.
(3)
If the operator wishes to take control, he or she need only move the handle of the shim blade con-trol switch from " neutral" to "in" or "out",
as appropriate. This action switches control to manual, gives the operator direct control of the selected blade, and keeps control on manual until the operator intentionally resets the various interlocks required for automatic control.
(4) Only one shim blade ~ will be withdrawn by the closed-loop controller at a time.
Currently, the operator must physically select that designated
^
blade with the shim selector switch.
(Note: Any change in this arrangement will be the subject of a separate safety review.)
b-(5) The automatic rundown circuit will not be affected. However, its availability is irrelevant because no extended steady-s tate, automatic con-
'^*
trol with a shim blade is intended.
(6) An auxiliary period trip, set at some value longer than the MIT Reactor's period scram (10-11 seconds) will be functional.
It will cause a trip to manual and sound an alarm.
(7) Simultaneous manual and automatic control is not possible.
If the system is in manual, the auto-matic system will have no effect because of the open "aute control / manual switch".
This switch must be manually shif ted from manual to automatic before closed-loop control is possible.
If the system is on automatic, any attempt to move any shim blade manually will trip the system to manual and give the licensed operator direct control of whatever blade is selected.
O SR#-0-84-11 JUN 25 1984
s I
(8)
Simult'aneous movement of two or more blades is not j) possible because all control signals, either manual or automatic, pass through the shim selector switch and that switch can be manually positioned to only one blade at a time.
(h) The position-indicator system and the sof tware that res tricts the blade's travel to a 2.0" band about the I
bank height will be tested on-line as well as by the mockup.
(The mockup can tes t the indicator.) Simula-l tion studias show that the sot tware performs as expected.
(1) A sampling interval of one second will be used for the initial testing.
This interval has been shown to be effective.
(Note:
It will probably be retained for y
all tests.)
I (j) If a variable speed motor is used, then a special hardware circuit and a sof tware check will be installed to-verify that the blade speed is not excessive.
(k) The computer system is totally contained at the NRL
- site and is c.ontinuously within the viewing area of the.
s s
3 sharing. There are no modems. The system is dedicated
- ( )'
exclusively to - the MIT Reactor.
No outside group can.
access the system.
The MIT Reactor is under the direct 4-B.
Operator Supervision supervision of a -lic_ensed operator at all times.
In addi-
" ~
43hy.
tion, - internal procedures require that a licensed senior operator (a shif t supervisor) be present for power increases in excess of 10%. Internal procedures also specify that at least one of several individuals who hold an SRO license and who are intimately familiar with the closed-loop controller be present in the control room during test sessions of the closed-loop controller.
C.
Rela tion to Safety System - The control system is and will remain completely separate from the nuclear safety system.
The nuclear safety D.
Capability of Nuclear Safety System system will not be changed by the closed-loop controller because they are separate systems. Hence, its capability to protect the core from fuel damage due to excess reactivity transients is unchanged.
Preliminary surveillance of E.
Surveillance Requirements the shim blade computer control system's components will be w3
().
documented as part of the preoperational checks of the r+"
system.
Once that testing is complete, surveillance of the following items will be performed, at least initially, at the frequency shown.
, JUN 25 1984 SR#-0-84-11 r
-,e-+
v
- r---
ww-+--y,
,-w.-%
.-w---
--e..r-v r.--.-
-,--...--,m
..=,,---.v-c
.w
.~
Item Frequency Differential and integral Annual or whenever a major
().
blade worth change in core power distri-bution occurs Auxiliary period trip Weekly prior to use if scheduled for use 4
4 Blade position indicator Annual to computer Speed limiter on variable Quarterly speed motor, if used 7.2 Factors Related to Class B Experinents Class B experiments involve closed-loop control tests using a shim blade in which the bank height is initially low enough so that a continuous blade withdrawal could insert more than 0.7%
A K/K. Experiments such as these will not jeopardize the safety of the MIT Reactor because:
i (a) The controller i designed so that continuous blade withdrawals will not occur.
!~
(b) The licensed operator could readily intervene should such a withdrawal begin.
(c) The nuclear safety system is separate from the closed-loop controller.
(d) The maximum safe step reactivity addition for the MIT
" " ~ _.
Reactor is, as shown in section 15.2 of the SAR and as i
s tated by Technical Specification 3.2,1.8% AK/K.
The maximum measured worth of the most reactive blade is 1.77%
I full-in to its full-out position. However, such would never be the case because the reactor would never be critical with all blades fully inserted. The minimum allowed critical L
shim bank height is 4.0".
A more realistic figure is 7.5".
l No blade may be more than 2.0" below the bank height while critical per Technical Specification #3.ll-2c.
Therefore, the most reactivity that could be inserted by a continuous withdrawal would be 1.63% AK/K which is.the reactivity associated with noving a blade from 2.0" to the full-out l-position (21.0").
A more realistic figure is 1.1%
l-(7.5"-21").-
Furthermore, were such a withdrawal to occur, l
the effect of the resulting power transient would be to heat i
the primary coolant thereby inserting negative reactivity.
i Measurements show that this effect would be a negative 0.17%
A K/K.
So, assuming a totally unrealistic, worst-case situation, the continuous withdrawal of the most reactive blade would insert 1.46% AK/K in the form of a ramp. A more
()
realistic figure, but nevertheless one which could only occur at the very beginning of an MITR fuel cycle when the cold', xenon-f ree bank height is 7.5", would be 0.93% AK/K.
SR#-0-84-11 EUN 25 1984
_ _ _ _ _ _., _. _. _ _, _ _. _ _ _ _ - _ _. - _.. _ _ _ _ _ _ _ _ _ _. _. _. _. _ _ _.. ~. _. -.. _
..= __.
Furthermore, given that the nuclear safety system is inde-pendent of any controller,'it would halt any transient resulting from a controller malfunction. The maximum reac-tivity that could be inserted would not exceed 0.32% AK/K.
(No te :
This figure corresponds to the 10 second period scram.) No fuel damage would result.
7.3 Conclusions It is submitted that the. evidence cited above supports the following conclusions:
s (1)
The MIT-CSDL Non-Linear Digital Controller will function as expected. No challenge to a safety system is likely to, occur.
7, (2)
Examination of the loss of regulation issue has shown that continuous blade withdrawals are not likely to occur.
Hence, the proposed change will not increase the probability 2
of such an event and that issue does not involve an unreviewed safety question.'
(3)
Examination of the use of a variable speed motor has shown that insertions of positive reactivity in excess of 5+10-4 AK/K'per second are not likely to occur. 'Hence, the proposed change will not increase the probability of such an O.'
event and that issue does not involve an unreviewed safety question.
t (4)
Class B experiments will involve the use of absorbers _ d2a t
- p, can insert more than 0.7% AK/K and therefore do involve an
~~
unreviewed safety question because a margin of safety cited in the basis for Technical Specification f 3.9-5 is reduced.
~~
However, such experiments are well within the bounds of Technical Specification #3.2.
Viewed in that sense, there is no unreviewed safety question.
(Nevertheless, NRC approval is required to modify the basis of TS #3.9-5.)
8.
Implemen ta tion l
This safety review has been submitted to and approved by the MITR Staff (2 SR0s and the Director of Operations), the Standing Subcommittee of the MIT Reactor Safeguards Committee, and the MIT i
Reactor Safeguards Committee (MITRSC).
Class A experiments may therefore be performed. subject to the details of specific experi-l-
- mental protocols and material related to quality assurance being prepared and filed as necessary.
t A separate safety review (#0-84-12) which Jists the techni-i cal specification changes necessary for the performance of Class l.
B exper8aents has also been approved by the MITR Staff, the l
g ~)
Standing Subcommittee, and the full MITRSC.
It will be submitted L
(,,
l to the NRC for approval.
If approved by the NRC, Class B experi-ments will be performed.
SR#-0-84-11 JUN 25 1984 l
~_
^
Appendix A List of Publications
.O (1)
J. A. Bernard, A. Ray, and D.D. Lanning, " Digital Computer Control of a Nuclear Reactor," Transactions of the American Nuclear Socie ty, Vol. 44, Suppl. 1, p 64, Aug. 1983.
(2)
J.A. Bernard', A. Ray, and D.D. Lanning, " Digital Control of Power Transients in a Nuclear Reactor," IEEE Transactions on Nuclear Science, NS-31, Vol. 1, pp 701-706, Feb. 1984.
(3)
J. A. Bernard, D.D. Lanning, K. Kwok, and A. Ray, " Demons tra tion of Decision Analysis Techniques for Steady-State Reactor Control," Transactions of the American Nuclear Society, Vol. 45, pp 661-662, Nev. 1983.
(4)
J. A. Bernard, A. Ray, and D.D. Lanning, " Development and Demonstration of Digital Computer Control of Nuclear Reactors,"
International Sympesiur on the Use and Development of Low and i
Medium Flux Research Reactors, Cambridge, MA, Oct. 1983.
(5)
P. Menadier, J. A. Bernard, and A. Ray, " Circuitry Design for the Installation of a Direct Digital Computer Control System on the MIT Research Reactor," International Symposium on the Use and Development of Low and Medium Flux Research Reactors, Cambridge, MA, Oct. 1983.
(6)
J.A. Bernard, and A. Ray, " Experimental Evalua tion of Digital Control Schemes for Nuclear Reactors," 22nd IEEE Control and j
0-.
Decision' Conference, San Antonio, Texas, Dec. 1983.
(7)
J. A. Bernard and D.D. Lanning, " Reactivity Constraints and the Automatic Control of Reactor Power", ANS/ ENS International Conference, Washington, D.C., Nov. 1984.
(8)
J. A. ' Bernard, D.D. Lanning, and A. Ray, "Use of Reactivity.
Constraints.for the Automatic Ccutrol of Reactor Power", IEEE -
Nuclear Science Symposium, Orlando, Florida, Nov. 1984.
(9)
J. A. Bernard, D.D. Lanning, and A. Ray, " Experimental Evaluation j
of Reactivity Constraints for the Closed-Loop Control of Reactor j
Power", Symposium on New Technologies in Nuclear Power Instrumentation and Control, Washington, D.C., Nov. 1984.
Nster Copies of (2), (8), and (9) are enclosed as appendix B.
i e.
= = - -
ewe-:
--p,,.m,,,.y-.-.,,y,,.
,%--w-m,,--,,.,,rwwy..--,,---,.v-y,,---y,,w,-%,v..ewy-3,,.,,,,
,m-,ry.r-
.r--,,,re-v=ww nev e-*9--mWe-'-'-ra'as-r-* m e weie wr *--
Appendix B i
1 l
Selected Publications 4
l e r : *i s-.M6
- y
[s s.w.i s
-H-,--
m.-
-v-wm-
--e
,-wa-_
.,.m_m,,n,__
wemm,,,a..
y,--ow,,,,,
,m,4 vv-g,,yy.-
m--~
1EEE Tr:nsactions en Nuclear science, V 1. NS-31, No.1. Februtry 19 1 701
~
DIGITAL COCROL OF FORER TFESIENTS IN A NUCLElk RIACTOR D
John A. 5 err.ard and David O. 1.anning Asck Ray Nuclear Reacter Laboratory
- be Charles Stark Draper Laboratory Massachusetts institute cf Tecnnolow 333 Tecnnelogy Square 136 Albany Street Ca:b ricge, Mas sachusett.t 02139 Ca= bridge, Massachusetts 0:139
,Ab s t ra ct An integrated, closed-loop, control systen for on-
. standard P-1-D logic have shown that the latter any re-line operations in nuclear power plants has been devel-sult in substantial overshoots while the NLDC exhibits oped and demonstrated with an LSI-il/23 micro-processor little or no overshoot, on the $ We fission reactor OCTR-II) that is operated by the Eassachusetts Institute of Technology. This con-The objectives of this paper are to (1) review the trol systen has inherent capabilities to perform on-reactor physics consideratiots relevant to the design line fault diagnosis, information display, sensor cali-of the NLDC, (2) describe the NLDC reactivity restric-bration, and measurement estimation. Recently, its tion, and (3) report the results of initial experimental scope has been extended to include the direct digital testing of the NLDC..
control of power changes ranging from 20-80! of the reactor's licensed limit. This controller differs from Reactor Physics Considerations most of those discussed in theoretical and simlation studies by recognizing the non-linearity of reactor dy-Beactors such as the MITR-II, which have close-na=ics, calculating reac'ivity on-line, and enntrolling coupled cores, man be described by the srace-indepen-the rate of changw c f power by resttacting both period ' dent point kinetics equat ons [5). Thase are:
and reactivity. The controller functions accurately using rods of non-linear worth in the presence of non-de(c) * (c(t) I)*
i g(t)
W linear feedback ef fects.
C dt i
i=1 Introduction dC (t)
I' g
g The direct digi:al control of nuclea power planta
= ; n(t) - A C (t) for i = 1. N (2) p*
gg
[
has been the subject of many theoretical and simulation i
\\
studies but little emerimental work. Many such studies h ch to h & mn pm linearize the equaticas that describe the reactor s transient response and then apply advanced concepts, p(t) is the reactivity, i
such as optimal control using state estimators, to the I
is the ef fective delayed neutron fraction,
. linearized system. This study differs by recognizing,
'fron the outset, that reactor dynamics are non-linear.
l is the decay constant for the ig precur-g
%The controller, designed to be applicable over the ser group, reactor's power range, allows for the following:
C (t) is the concentration of the ilh, precursor g
gr up normalized to the initial power, (1) The rate of change of reactor power is, among i
other things, proportional tc the product cf i
is a measure of the prom:pt neutron life-reactivity and power.
time.
is the effective fractional yield of the (2) Tne reactivity is dependent on the reactor i
Ib II'"E
- d*1'I'd **"E#'"
power through various power-dependent feed-back. mechants:s suhh as fission product N
is the nunber of groups ef delayed neutrons.
i pcisons (xer.on). ;rt=.ary cociant temperature.
fuel depletioc, etc.
Power increases are accomplished by inserting post-( 3) Control mechanisms have finite speeds as well tive reactivity until a specified steady reactor period as position-cepencent, non-linear worths.
is attained. Power is then allowed te increase expe-nentially on this steady period with reactivity being Tne contrclle r nas four tri1que f e at ure s. First. it changed as necessary te con:pensate for snort-tern feed-utilites validated cata f ro: sultiple sensors and in-back ef fect s, princtpally te=perature. Once a certain cer; orates sensor f ault det ection and identification percent cf full power is achieved, the excess reactivi-(fiU techniques 11-4).
Second, it determines reacti-ty is gradvally reduced so that the power levels of f vit on-line via either a balance or inverse kinetics.
without overshoot. Figure 1 depicts a computer simule-Tr:tre, it incorporates reactivity feedback. Tourt h,
tion in which the reactor was modelled using the six-oversnoots are prevented by restricting reactivity so group point kinetics equations with a time step of
. that reactor period can always be ande, infinite by re-0.0001 second. A rod of linear differential worth was
- versing the direction of control rod action. This is a withdrawn for 20 seconds so as to add reactivity at the j'S vtt.1 safety feat ure since finite rod speeds and post-rate of 5 mbeta/second (0.004 fJdK per second), held
()
tien-oepunocra rod wortns may otnervise make it impos-const ant for 40 seconds, inserted for 40 seconds at a:Ge te ts r anatt a power t ransient without over-or half-speed thereby renoving reactivity at the rate of
- as cor:t roller is designated as the W.I-2.5 mbeta/second, and tnen held constant. Teedback uncerancet.
C*ii :a-Lir.ur Digit e Cont roller (NLDC). Expe rinen-ef fects were omitted in order not to cbscure the basic 14.. r;. r t wr.. of tio 'a C's perf ore.ance with snat of relat ionship between the rod action and the reactor
.r
. m t r.c rsh oC cr. pe riod nurasurepuent s ar d power. The fig ur e shows the reactivity, startup rate WIMJvy M (vsc.fcolWL(si 19sJ IEEE
'SUK),'and p!wsr as functicas of time. (Pt9: Sr$rt-up tn reactivity control machinisms.. Ris can be quznti-rete, which squals (26.06/pirisd) and is asesursd 'in fled by rewriting equttions (1) tnd (2) for stsady-state dscadts-per-ninute (OPM), is a measure of the inverse-of while noting that I *.y and recalling that the produc-the reacter period.
It, like ths concept of period, g
applies not c.ly to reactor startups but.to power tran-sients and steady-state operation as well. It is shown M'#****
g
-cecause its steady-state value is zere, not infinity.) '
0 c(t)n(t) - I [? n(t)-I'l C (t))
(3)
( }
Note the following:
i ii g
v (1) The SUR initially increases alnest as a ste' 0 = E n(t) - i i C (t) for i = 1, E (4) and then rises snocchly. The reacter power 1
i.
rtses snoothly at an ever-increasing rate.
where the superscript denotes the equilibrium value.
(2) When the reactivity insertion is halted at 20 Substituting (4) into (3) yields:
seconds, the SUR remains positive but drops, almost discontinuously, and then remains
~
,g D C N - 1 C (t)]
(5) nearly cor.stant. The reactor power continues ii ii I"1 to increase but there is a sharp decrease in slope corresponding to the decrease in SUR.
Equation (5) shows that, as a result of the' mismatch be-Power then rises almost exponentially. The' tween the equilibrium and the actual precursor concen-SUR (or period) present when the reactivity trations that exists during a power changa, the reactor was being changed is taferred to as ' dynamic' power can only be kept constant by a time-dependent ad-while that which exists when the reactivity justaant of the reactivity.
is constant is called ' steady'.
Controller Desian
. ) 4-(3) When the reactivity decrease is started at 60
"~I seconds, the SUR drops sharply and then con-The fact that.the reactor period is a function of tinues to decrease, eventually becoming nega-both the rate of change of the reactivity and the value tive. The reactor power continues to increase of the reactivity present places couplex requirements but at an ever-lessening rate until the SUR on the control system since power changes aust be accom-goes negative indicating a decreasing power.
ylightd vir.beut overshoot. Given the data shorn in yig-Note that this occurs when there is still pos-ures 1 and 2, it is evtdant that, even with the direc-icive reactivity in the core. This demon-
- tion of control mechanism motion reversed, reactor power strates the decoupling between the observed could still increase if sufficient positive reactivity SUR (or period) and the actual reactivity due were present. Hence, some restrictions must be placed to the delayed neutron effect.
on reactivity in order to assure that control is always -
feasible with the specified control anchanism. The (4) Reactivity removal stops at 100 seconds when first step in the controller design was to obtain a re-the reactivity is zero. The SUR increases i
lation between the reactivity, its rate of change, e
rapidly and then approaches zero. The reactor period, and power. Assuming both the prompt-jump power curve again exhibits a discontinuous approxiastion and a one-group delayed neutron model to change of slope and the power levels off.
be viable, these relations are given by the dynamic period equations which are:
yigure 2 shows a~ portion of the power trace recorded
._. M during an experiaantal run on the MITR-II in which re-T - o(e) b - Aa activity was raised f rom 0.0 to 69 abeta in 12.2 seconds, TIC)
- dp(t)/dt + A (t)p(t)
N g' held essentially constant for 83 seconds and then re-w duced to 0.0 abeta in 16.3 seconds. Shown is the dis-t A(t) =
de/t(c)
(7) continuous change in slope of the power increase when
'the reactivity decrease starts. Also, this ' figure dra-O e (*}
(8) r.stically shows that the power increase continues even P(t) = P0 though a reactivity reduction has been started, that the rate of power change somentarily goes to zero while where t(t) is the reactor period, there is still positive reactivity present, and that the power can substantially overshoot the intended steady-P, is the initial reactor power, state value due to the reactivity present.
P(t) is the instantaneous reactor power.
These curves, simulated and experimental, demon-Other symbols are as previously defined. The ef f e ctive estrate that the rate of change of reactor power is a one-group decay constant is defined as:
i function of both the rate of change of reactivity and A C II) the value cf the reactivity present. As noted earlier, gg ICT 1
- 1* E (I) e(E) * ;, c (gy d
this phenomenon is the result of the ef fect of delayed i
neutrons on the reactor dynanics. It occurs because the proda::1cn of precurscrs, being an integral part of the he ef f ective one-grou; decay constant is time-dependent.
fisston ;rocess, is in eqclibriun vich the transient because the ratio cf short to long-lived precursors reacter power while, given that procursors have a finite varies with the shcrt-lived ones dozinating during a lifeti.,e, ssen is not the case with their decay. For power increase and long-lived ones during a decrease.
exa.41e, consicering a power increase, the precursor Hence, the use of the tern "one-group approximation" ccncentration will always t>e less than what its equill*
dif fers f rom its standard meaning which taplies that the ibriu= value would be at the transient power. Hence, the decay constant is fixed at some value typical of the
< contribution of the delayed neutrons will always be less transients being studied. ~ A derivation of equation (6) than what it would be if the precursors were at equili-is given in the Appendix.
oriun and ths ccatributter. of the prompt neutrons will
]
% errus;oncin;1y greatst. Thus, whenever the res:t c r Having established the dynamic period equations, is rat.at s tw acy-s t at s. the non-equilibriun condition the condition (s) under vnich it is feasible to transfer i
I cf tw cdaws no strens will cause a delayed time re-a reactor using a specified control nechanisc from a
- ;~ n w that eut be recer.1:ed and balanted ey ust of given power hval anc period to a specified power level L.
703 2200 -
g i
I
~
y 1900 ~
c!f.
l t
wo I
4 (N.e-). O y M OO-l ct
[
j l
- SUR O I
I I
I e r. co COO I
I I
a eP>O 0.6 i
i
- I(P)<0 4
g
^
O.4 1
I I
I I
I O.2 I
I a:
I I
I "3
I I
Q l
y) 0.0
-0.2 i
i 10 0 i
t g
E I
I I
i l
50 1
I
.-I l
I
/
i I
e
/
,l o
i e
t e
t 0
0 o
20 30 40 50 60 70 80 90 10 0 11 0 Time (seconds)
~
Tigure Ones Reacter Power Transi nt - Computer Simulation
]
s
~
ed.
1
-('
w-Tigure Two:
2.65 Raaetor Power Transient
\\
- !.xpe riment al Lata
'Y W*.
2.60
/
.ft%.ed.o s
,2 2.55
. sum o 1
U 50 -
I t,
m.
. reto d 2.50-
- C 1
7 40
. $(A*O l
3 2 45 I
.E 30 -
l
,E, 45 e 20-e_s i
E
.o u i:
g2 so 10-7
- w 3--
7" O
2 3
4 5 **M i
52 Reactor Power (MW) 9 b
1 9,
uc 2C
- 3 *, e4 ; ISO 86 ;
Tigure Three E f f e ct cf F.eactivitv nestriction Time (SeC) er. r Dt Pe rf ormance
41
~
withrut ev3rshoot can be dttartined. First, nate thtt 61gnals superceds all others. Separate subroutinas ex-thi rsecter period rust bs cada anc held infinite if a ist fer raising and lovsring pow 2r.
transisnt is te be tereinsted and power kept at steady-state. Secenc. safety cictates that G-t) be kept posi-S ubs eq uen t te e f f-line t esting via cot.puter sici.la-tive (i.e., : less than prc=pt critica;). Hence, fer tien and ceterminatien tnat it could centrcl tn real e
the per cc te be infinite, the expression-(dt/et + ' c) time, the EX was tested on-line in closed-loc; f ern en 9
must be zerc. Net all the parameters in this expressief.
- [s* 're*Naung rod vnien has intepal and
[V rc. t a.
are subject te sanipulation since once a control mechan; ave rage dif f erential vertas of C.14. 1K /K a:.s *'. *' "" 2 '-*
is: is sele:ted, tne axi=u pcssible rate of change cf
....^E'
'****# respectively.
A detai. d description ci
.e reattivity (c: dt) is fixed by the reacter's design and N'
I* I' * 'I'
,'S[s pertcc restrictions are limiting at safety cc'ns t ca ra t:,cns.
Secen'd, the ef fective one-greu; o-^
the cut-decay' const ant (i ), being a physical paramater, is net e
set of a transient while the one on reactivity controls subject to direct control. Theref era, the only way that the transient's ter=ination. Use of the EDC ner ally period can be rapidly = ace infinite is if the total re-results in the movement of the selected control rod un-activity, both that added directly by the control mech-til the period limit is attained. The rod's position is anis =s and that present indirectly f rom feedback effects.
then kept constant while the power continues tu change.
is maintained less than the u.aximum available rate cf Once the reactivity ccustraint is ne lenger. met, rod in-change of reactivity divided by the ef fective one-group sertion is best= and continued in a mere-or-les s step-decay constant. Inst is:
vise canner until the rod is returned to its critical position. Figure 3 shows tus experimental runs in which
'dt -< 1 c' < N (10) power was lowered from 4 to 1 W, held constant for dE
- let several minutes, and then returned to 4 W. First, the e
vbere 1, and c are the actual existing system para-response of a controller designed without the reactivity constraint is depicted. There is an undershoot at 1 W meters and do/dt is the atximum possible rate of reacti-and a substantial overshoot at 4 W.
Second, the re-vity change that could be obtained were the selected
.,.here is neither an under-sponse of the E DC is shown.
control mechanis= to be moved. Physically, if the reac-nor ove rshoot. Subsequently, tests were conducted in tivity is so constrained, ther., by reversal of the di-which the K.DC was directed to raise and lower power rection of motion of the control mechanism, it is possi-in steps of approximately 15 The resulting control ble ta negate the effect o' ene reactivity present and was both exuellent and re,,e stal le.
taxe the period infinite. A contrcl sequence fashioned en this relation vould be needlessly conservative since Having established that the M.DC was capable of power could be leveled at anv time when all that is preventing autc=ated control actions fro: challenging -
necessary is that it be possible te level power at the the existing reactor safety system, it became possible desired ter ination point. Recognizing this, the con-to test other contrc, strategies on the MIT Reactor.
- trol objective can be achieved by constructing an algo-These studies have so far included controllers that sin-ritu that. vnile onotonically approaching the desired ulate operator 1' structions, heuristic progradg in-n power, constrains reactivity according to the relation: cluding both acaptive and learning theory routines, and predictive methods. The experimental results of these
/
l6l tin (P/P (11) tests are described in [6).
Min (P/P
< p<
+
f
-- A f
A e
a "1 "" "
. tore physical insight can be had by writing (11) f or pouer increases and decreases respectively ast A reactivity constraint that prevents power over-g.
- A***##'I'~
(6-lb] / A )/ @ < 'in(P /P) tion of reacter power, period, and reactivity that az-N.-
e f
(12) ists during a power t ransient. A closed-loop contrcl (p+l6l/A)/lhl> tin (P/P)
I algorithm that incorperates this constraint was designet.
e f
and successfully tested en the 5 mt MIT Research
..nese ecp.atiens cc= pare the time resa.,ning to attain the g
g gg g
final power (P ) with tne time required to el1=inate the are that it reduces the possibility of power overshoots, f
additional rea:tivity present beyond the centrcllable provides early detection cf rod withdrawal or reactivity value given by equation (10).
insertien accidents, and permits the safety aspects of a reactivity change to be deter =ined on-line in real time.
e Wlerentation ef a centroller based en (12) is it is hoped that, as ; art of this research progra.. the cent ir. gen t upen moth reasarang the reactivity and calcu-safety anc acvantages ci the direct digital centrel ap-lating tne ef fective one-group decay constant. The for-proach can be realized by first demonstrating them on mer is normally derived f rom a reactivity balance but the !CT Research Reactor.
sy dsc be cttained vie tnverse kineti:s. The latter is apprcx::atec in real time using tne relation derivec Aten:vleceements in section A.: o f t he Appe ndix. Finall). it should be noted snat, as a p recaution against any petential cen-The centributiens cf *.r.
Paul T henadier, who de-trol.nstf;intaes that cculd arise if the oowe r we re t e signed the hardware, anc cf Mr. Kwan Kwok, whc super-se.enov ove rshoct. an :nstruttion is includ, d in the in-vised reactor cperatien, are greatly appreciated.
Flerenting algerithn that sets the right sir.,e of (12) te Re fe rences ze rc s.cmid sucn a sit ation occur.
Enerimental Evaluation 1.
A. Kay, J. A. Bernard and D.D. Lanning, Computer Control of Power in a Euclear Reactor, lEEE Trans-
~
actions en !suelear Science, Vol. NS-30, No.1, The NLi>C is an algoriths which incorporates the re-1 attive cen,t ra;nts f ;D as well as enes on power and Feb.19E2 g.100-E:1.
m
[O par;t;.
't :antains M erate safety are inst ructacn l
". :e rs ; enr res t hat the const raint. are 2.
/.. kav ar.4.. A. Estnarc. "Da gital Ccntroller f cr a
%.t;,ns.
1;tu r ccrrslates preceterr nut cont rA
- . : lear Leact er.' T rgrants c f American Ccattol i
%. t. u a e.
- o. : w. x.n evaluated of f-line ter safttv.
un f e rer.cc. San Trsn:isce, CA, June 19E3.
e t. c.t. v;.
.r...
itrs.- a.c perica. safety u :tten v
L
705
.t.
A. Aay and M. Mssi, " Calibration end Estinstion i..
CoJputer simulation shows that this typrocch, with a Multiply Rsduncant Messuranent Systsas," Preprints 1.0 second time step, is as accurate as a six-group of American Centrcl Conference San Trencisco, CA, peint kinetics solution using a 0.0001 second sine step June 1952.
for the transients being studied. tnfertunately, there is no facile =mthod to evaluate the ef fective one-group 4
A. Ray, J.A. Bernard and D.D. ' anning, "On-Line decay constant and its derivative, however, given that Sig.al validation and Teedback Control in a the objective in deriving (A-6) was to deterr.ine when Nuclear Reacter," 5th Power Plant Dynan.ics Confer-rod withdrawal should be halted and when rod insertion ecce. Knoxu lle, tee.,. March 1983, should be initiated, several simplifying assuwtions are possible. These are:
f,.
A.T. Eenry, Nuclear Reacter Analysis, (Canbridge:
Mn, 1974), pp. 290-331.
(1) The value of 1,(t) is taken as 1,(t), the equili-6.
J. A. Bernard and A. Ray, " Experimental Evaluation brium value of the ef fective one-group constant, of Digital Control Schemes for Nuclear Reactors.
This is a valid assuwtion since it is reasonably accurate for t e re ve y a transients being lEEE 22nd Control and Decision Conference, San st udie d.
Also, it asults in a conservatiw con-Antonio 7TI, Dec.1983.
trol action since 1 (t) exceeds 1 (t) for power increases and the larger the valu of the decay constant the e restrictiw th hd on the Lerivation of Dynamic period Ecuation (A.1) allowed reactivity as shown by equation (11) of Given that the prompt neutron lifetime is brief compared to the time domain of interest for light-water (2) The third term in the denominator of (A-8) is sin-reactor control, it is viable to assume that the neu-ply dropped. This appears non-conservative since tron population is in immediate equilibrium with the all three denonisator terms are of the same magni-precursor population. Mathematically, this asans ne-tude. However, for the transients being studied, glecting the time-derivative of the neutron population this tern's sign changes within 1-2 seconds of a in the first kinetics equation. Applying this assump-sign change in the rate of change of reactivity tion, the prospt-jug approximation, together with the and it then contributes to the lengthening of the one-group approximation, modified to allow for a time-reactor period. Menet neglectiag at 14 justifi-dependent decay constant, and defining symbols as be-able. Additional work is being conducted on the fore, the point kinetics equations become:
evaluation of this ters.
k (o(t) - I)n(t) + 1*1,(t)C(t)
(A-1)
Applying these two simplifications to (A-8) yields:
O C(t) = (T/i*)n(t) - 1 (t)C(t)
(A-2)
T-of t) f(t) =,
(A-9) e o
DI*)
- e (*)N*) '
~
11 C (t) x 3g 1,(t) =
gg The restrictions imposed on the use of (A-9) by the f or i = 1, E.
(A-3) s prompt-jusp approximation should b s noted. The approx-Dif ferentiating (A-1) with respect to times ination's validity depends on the reactor's period be-ing large relative to the prompt routron lifetias, st 40 = p(t)n(t) +(o(t) - 8)i(t) + 11,(t)C(t)
This iglies that (1) the reactivity must be substan-tially less than the.ef fective delsyed neutron fraction
,,mg
+ 1 1,(t)C(t)
(A-4) and'that (2) the rate of insertion of reactivity must be slow enough so that no appreciable change in reacti-
$4stituting (A-2) into (A-4) to eliminate 6(t) yields:
vity occurs over the prompt neutron lifetime. Simula-tion studies show that both the reactivities and reacti-0 = c(t)n(t) + (o(t) - 3)n,(t) + 11 (t)C(t) vity rates being used in this research are well within.
acceptable limits.
+ 1 1 (t) (18/1 )n(t) - 1 (t)C(t))
(A-5)
Estination of One-Croup Locay Constant (A.2)
Substituting ( A-1) into ( A-5). to eliminate C(t) yields :
The steady reacter period is related to reactivity C
- M t)n(t) * (t(t) - I)c,(t) + 1 (t)o(t)n(t) oy the In-nour equatics:
e
+ L 5,(t) ((I-o(t))/1 )n(t) /1,(t))
(A-6)
(A-10) p(t) =
+
Consolicating terms and dividing through by n(t) yields:
nevriting it using the one-group and progt-jump approx-0 = d(t) + 1 (t)o(t)) + (o(t) - 8)n(t)/n(t) isations yields:
+ (1 (t)/A (t))(f-o(t))
( A-7)
Civen the period, equation (A-10) can be used to solve
!,ubstituting the definition of reactor period ( I n/n) for the reactivity. Using the period and reactivity, Ante (A-h :
equation (A-11) can be solved for the equilibrium one-group decay constant. A short computer code was written
_6-ot t) to accoglish this and the results fitted to an eapo-1(t) =
(A-8) nantial curve. The relation, for the MITR's effective d' * ? " # "* "I #
( St))
o(t) + a (t)c(t)
+
- (t) e r
o 1,(t) = 0.0802 W EXP(2.364459ap(t))
lf the v.d wm of (t) and (t) are accurately known, aan W ?
- u. tor.j uhCtion with equations (7) and (6) of with M t) ir. units of M./L
- ts t/J ' h xt f4y bw used tc predict Tretter power.
l L
i i984' IEEE Nucicar Science Symposium O
USE OF REACTIVITY CONSTRAINTS FOR THE AUTOMATIC CONTROL OF REACTOR POWER John A. Bernard, David D. lanning, and Asok Ray Nuclear Reactor Laboratory Massachusetts lastitute of Technology 138 Albany Street j
Cambridge, Massachusetts 02139 I
Abstract Design philosophy i
A theoretical fradevork for h automatic control The major design goal adopted by the MIT CSDL to-sf reacter power has been developed and experimentally search toes was tha t. the closed-loop control systes evaluated on the 3 MWt Research Reactor that is oper-should never present a challenge to W reactor's ex-i
' atsd by the Massachusetts Institute of Technology. The isting safety system.
There were two possible ap-
[
eestroller functices by restricting the set reactivity preaches whereby this goal could be a ttained.
The es that it is always possible to make the reactor peri-first was to perform a thorough off-line safe ty sealy-
. sd infinite at the desired. termination point of a tran-sis of the behavior of a given controller acting within siest by reversing the direction of setion of whatever the envelope of the boundary conditions established by castrel mechaatse is associated with the controller.
a particular plant under both normal and abnormal oper-This capability is formally designated as " feasibility sting conditions.
Aside free being plant-specific, i
sf control".
It has been shown experisestally tha t this approach eight be defittent la that there could be t
epistenance of feasibility of control is a sufficient some unforeseen combination of unusual conditions that esadition for the autoestic centrol of reactor power.
were not f acluded in the analysis. The second approach This. research should be of value in the design of was to build into the controller the capability to sisted-loop costrollers, in the creation of reactivity evalua te the safety of its own actions on-line and in
- displays, in the prevision of guidance to operators re-rea l-ties. The MIT-CSDL philosophy has bees' to pursue gsrding the timing of reactivity changes, and as an ex-the second of these two approaches since it should lead stimental envelope within which alterna te control to a universally useful controller of safe design.
j jtrategies can be evaluated.
Introduction A reacter together, with a specified control mech-
"The Massachusetts Institute of Technology and the saise is defined as constituting a system that is " fee-Charles Stark Draper Laboratory have undertaken a sys-sible te control" if the system can be transferred from i
. toes tic - progree of, theore tical and experimental a given power level and rate of change of power (i.e.,
l research regarding the application of advanced control period) to a desired s teady-s ta te power level withovt i
and instrumen*ation te nuclear rearters. One objective overshoot (or conversely, undershoot) beyond specified ef this program has been the develepoemt of closed-leep toleresco bands, if any.
This coecept has two imper-i eestrel. sys tems.
It is believed that the use of such tant attributes.. First, it applies to a reacter and to -
systems would improve safety and ef ficiency by enabling the specific control mechanise desigasted for use in lisessed operators to monitor a plast without having to acceeplishing a given treestest.
Seceed, not all.
simultaneously assipela te it.
The design objectives states are allowable intermediates threvsh which ' the sd:pted for this controller were that its actions system any pass while tressittag free sees tattial to i
shield never result in a challesse to the reactor's some final power. Excluded are both these states that
. safety systes, tha t it should be separate free the represent actual overshoots and those from which over-s2fety systee, and that its performance sheeld be at sheets could not be averted by annipulattee of the ape-least comparable to that attainable by licensed opera-cified control mechanise. It should be recognised that t
tors.
Accoop11shoest. of these objectives was contin-the concept of " feasibility of. control" is dis tinc t geot upon designing the cen tro11e r to reccgnize tha t from the more general property of " controllability".
reac tor dynamics are non-linear, to allow for the That ters has a specialised seening in that a systes is -
effect of verloos powe r-de penden t feedback sechanises said to be controllable if "any initial s ta te can be (e.g., toeperature, seson, fuel depletten), and to rec-transf erred to any final state in a finite time by seee
.satise tha t control mechaatsas have both finite speeds control sequence" [1].. This definition does not place
. tad nee-linear worths. A controller that fulfills these any restrictions on intermediate states.
sbjectives has been designed and deseestrated on the
- MIT Research Reetter.. Designated as the MIT-CSDL Non-The necessity f or introducing the concept of " fee-l Linear Digital Ceetroller or NLDC, it has been shown to ' sibility of control" warrants review.
power changes be capable of both raising eed lowering the reactor pe-are accomplished by inserting and reseving reactivity.
r wer is se efficient osoner while using a red of see-Adjusteents in reactivity can be leesely thought of as i
11 seer differential worth to the presence of non-linear being propertional te veristiees is the ra te of the feedback effects. The NLDC has thus far been used over fractional change in the neutron popula tion per weit the range of 95% of the reactor's rated power.
time. That population consists of both prompt neutrons which are produced directly free fission and delayed
' The objectives of this paper. ore to (1) review the neutrons which are produced f ollowing the decay by beta theoretical relations that form the basis. of the MIT-particle emission of cer tain fission ped ucts (i.e.,
j C$DL' Neo-Linear Digital Controller and (2) report the precursors).
Delayed neutrons are of extrece topor-rescita of experimental tests germane to those theoret*
tance because, owing to the deley in their produc tion, ical rela tions.
they lengthen the basic neutron life cycle so that it
. bscoass fossib'le to instrussst and monitor changss in Absolute Reactivity Constraint rese tst pcver.
However, that stee dalay alas coop 11-cates re a c tor control.
Specifically, given tha t pre-The a pproxima te form of the dynsaic pe riod squa-cursors have finite lif e tine s, the delayed neu tron pop-tien can be used to establish quantitative criteria utstion will tag its equilibrium value during power in-that permit eva lua tion' of the state of a reactor in Q cases and lead it during decreases.
As a result, terms of the definition of "fessibility of control".
U scatches exist be twe e n the equilibrium and the the The,first such criterion, the "a bsolute reactivity con-straint", ca n be derived directly free equation (2).
actus1 delayed neutron populations during power changes and, owin g to these misma tches, the reac tor power can First, note that the reactor period must be made and only Se brought to and kept at s teady-s ta te bv making held infinite if a transient is to be t e rmina t ed and time-dependent adju s tments in the reactivity.
A fur-power lept at steady-state.
Second, sa f e ty dictates that complica tion is that the rate at which reactivity tha t (8 - 0 ) be kept positive (i.e., p less than prompt can be removed from a reactor is, under non-scram con-cri tica l).
Hence, for the pe riod to be infinite, the ditions, finite.
Hence, even wi th the direction of expressien (do/dt + 1, 0 ) must be sero.
This can be centrol mechanism motion reversed, reactor power could accomplished if the product of the ef f ective, one-group still rise if sufficient positise rea c tivity had been decay cons tant and the net reactivity, both that added initially present. This explains why it is possible to directly by the control mechanisms and that present in-havs a s ta te in which the reactor's power is currently directly f rom feedback effects, is maintained less than bslew the allowable but from which an overshoot can not the ma ximum available rate of change of reactivity.
be averted using a given control mechanism. Additional That ist inf ormation is given in [2].
.h l f 1,(t)p(t) f, l0 l (3)
Dynamic Period Equa tien Reactors which have close-coupled cores may be de-where Ae(t) is the effective one-group decay con-scribed by the point kinetics equations. Subsequent to
- stant, making the promp t-j ump approxima tion, the se equa tions p ( t) is the net reactivity, both that added ccy be combined (2) to obtains deliberately by the control mechanisms and that present indirectly free feed-
_8 -o /t)
(g) back e'fecta, and g,_
{ g)
- 4 g ( -o ( t))
%l b
W en available e of I
5 ( t) + 1,( t)o ( t) +
3 change of reactivity that could be ob-tained at a given rod height were the where:
- (t) is the Teactor period, designated control rod to be moved.
I is the effective delayed neutron frac-so cons trained, then, by reversal If the reactivity is f
of' the direction of motion of the specified control
- tion, p(t) is the reactivity, mechanism, it will be possible to negate the effect of the reactivity present and rapidly make the period in.
p ( t) is the rate of change of reactivity, finite at any time during the transient.
- (t) is the ef f ec tive one-group decay con-1 Suffteient Re a c tivi ty Constraint s tan t, and I,(t) is the rate of change of the effective The absolute rea c tivi ty constraint is needlessly one-group decsy constant
- conse rva tive since it stipulates t ha t it be pos sible to level reactor power at any time during a transient when l
The ef f ec tive, one-group decay constant is time depen-all tha t is required is tha t it be possible to level dsnt because the relative concentra tions of the various Power at the terminatica point. A less stringent and therefore more efficient condition can be written which i
dslayed-neutron precursor groups change depending on wh3ther power is being increased or decreased. Eq ua -
Permits the presence of additional reac tivi ty beyond tien (1) is ref erred to here as the " exact" form of the the amount specified by the absolute constraint. This dyr.aeic period equa tion.
- he objective is to use (1) less stringent condition specifies that there be suf fi.
to obtain guidance on when to initia te changes in the cient time available te eliminate wha teve r reactivity I
signal to the reactor control mechanism. Accordingly, is present beyond the amount tha t can be immediately the third ters in the denoeinator can be neglected be-negated by reversal of direction of the control mecha-I cause, for the transients being studied, that term is nism before the desired power level is attained.
This signal reversal is required.
condition, the "suf ficient reactivity cons traint", is:
sma ll a t the time tha t a Also, it changes sign almost immediately following a c' age in the direction of travel of the control mecha-Q hlgg{p jpy
,,,,, y hl g,(p jpg nise and theref ore need not be considered in a decision 4p g i
y 1
i F
1 on when to change that direction. The result, which is dasignated here as the " approximate" form of the dy.
i azeic period equa tion, ist The functional dependencies of the variables have been i
i( t).
(2) omitted. The symbols are as previously defined except that Py and P are the desired and current reactor po-o(t) + 1 (t)p(t) wer respectively and t is either the observed reactor
)The quantity h(t) is normally a pproxima ted by the period or the asymptotic period that corresponds to the i
,/ value tha t it a pproa che s when the reactor is on an net reactivity, whichever results in a more conserva-asyvptotic period, 1,(t).
This substitution is desir.
tive decision, oble because l', ( t) can be readily calculated if the Available and Recuired Tiees l
net re a c tivi ty is known.
It is warranted because it results in conserva tive decisions f or power increase s.
Also, the d!!ference be tween the two terms is, for the loua tloc (4) may be rewritten f or power increases and decreases respectively es transients of interest, sma ll.
60 3.0 r
h
_ Reoctivity i
n sm
- 45 3 m
.8 3:
[
E Power 30 2.0 -
Oynomic eff ect of rod y
m 3
}
[
~
Insertior, permits power to u
be leveled despite positive 15 0
0' reactivity.
03/12/04 W
a-M l
l l
1 I
i l
1
!r-1 O
L l.O a
O 30 60 90 12 0 ISO ISO 60 -
"'d I?**"U" C'***'**d
_ 50 sn "O 40 Required c
O Time g 30 v
Control Continuously V
20 -
Feasible e
d'onsition From Absolute E
10 To Suf ficient Constroint l
i i
i I
i i
i i
i, 30 60 90 12 0 15 0 180 Elapsed Time (seconds)
-iO,
Figure One: Function of Sufficient Reactivity Constraint rth places a res tric tion on the range of rod heights w
(p lol/le)/[ol
- tin (P /P)
(5(a))
over which the reactivity constraints can be used. For l
l I
]
F e xample, in order to helt a power increase, the speci-
"**O'
-(a +151/1e)/ 51 - rin(P /P)
($(b))
l 1 i 1 F
the rod is positioned so that as soon as the inward no-l tion starts, it will be traveling from a region of high Eqmtion ($) compares two times. The term on the left differential worth to one of low differential worth is the time required to reduce the reac tivity present then use of tha t rod may not be justified since, while the amount a;1oved by the absolute condition. It is the maximum available rate of change of reactivity will th:2 time necessary to establish feasibility of control drop rapidly, there may actually be very little corre-t2 cid is referred to as the " req ui re d time" or ATg, sponding decrease in the reactivity.
Noting tha t the Th2 time on the, right is tha t remaining to attain the maximum rod speed is fixed and assuming that the effec-dsstred power.
It is referred to as the "available tive one-group decay constant does not vary during rod time" or AT. When the actual power equals the de-insertion, this restriction becomest A
sir:d power. the sufficient constraint reduces to the one.
(Note: If the power were to somehow do(t)/dt 1 (1/1,)[d o/dt )
(6(a))
f 'isolu te
' u v2rshoot, the implementing algoriths should set the The corresponding expression for power decreases ist right side of ( $) to zero as a precaution against con.
trol instabilities.)
Pacee of he Peactivity Constraints The terse on the left in (6) are the rates of change of The non -11c ea r na ture of the differential rod the net reactivin present.
Included are feedback ef-
i Upo:r Bound of Tolerance Bond
/_N j
So 7
/
Sufficient Constraint
+
Absolute Constroint J
I a
~
~I vee constr'omt i
l.
1 3
~
72C--
i i- :p t
2 2.C i
N i
e Power increase i
1 1 03/12/84 lt t i 1 y
L2 2
3 4
o power (Ww) 1.o T
I I
I l
l t
I f
I l
f i
i f
l l
8 1
3 s'
o too 2co 300 40o Time (seconds)
Figure 'Iwo: Effect of Absolute and Sufficient Constroints on Power O
60 -
Sufficient Constroint Power increase 50 03/12/84 l
Power levelled using Sufficient Constroint.
o 40 -
Dynamic effect of rod insertion counters
[
j positive reactivity. Control continuously feasible.
J
=
3 30 -
x Absolute Constroint 5
4 e e e o_
f f
] 20-a l
o o
o o o c:
o 10 -
i
.l l
I t
t i
I i
i I
I i
i i
t i
f 0 20 40 60 80 10 0 200 300 400 g
Time (seconds) l l
Figure Three: Effect of Absolute and Sufficient Constroints on Reoctivity
.fecta es wall as changes in resctivity inducsd directly tise.
As ths reactor power asttles cut, the available by th2 centrol rede. This contrasts wi th ths tercs on time remains sero. Tha required time bsconis negative, the right which pertain only to the reactivity associ-eventually. resuming its original value of (-1/ A,).
strd wi th the designated control mechanism.
(Note:
two power increases of 1.2 Assuting negative coefficients, feedback effects will Figure Two contrasts
[ Dast the net reactivity.) Another restricton is that 3.0 MV.
One was accomplisheo with the sufficient con-Va reactivity associated with stevin g the control rod straint while the other was subject to the absolute from its position when the decision is made to commence constraint.
Figure Three contrasts the corresponding halting the transient to the limit of the range of rod reactivity insertions.
As expected, the controlle r halghts permitted by (6) must exceed the net rea c tivity tha t is limited by the absolute constraint requires praesnt. It should be recognized tha t these range re-much,more time to acconplish the power change.
Vhen strictions are not unique to closed-loop control. They using the absolute constraint, the NLDC withdraws the raprssent limits on the u tility of any control mecha-control rod until reactivity equal to (hl /A.) has been nisa regardless of whether the control is manual or au-inserted since this is the amount that can be immedi-trna tic.
However, they may be of special concern to a stely negated by reversal of the direction of rod trav-clsesd-loop system if either tha t system lacks access el.
Note tha t the reac tivi ty allowed by the absolute to all available control mechanisms or if it is not constraint decreases slightly during the transient be -
l prsgrammed to shif t fron one control mechanism to an-cause the value of the effective one-group decay con-stant is increasing as a result of the short-lived pre-l oth2r when appropriate.
cursors being favored during the power increase.
l Reactivity Cons traints and' Reac tor Control The results of many other experimental te s ts of A controller based on the sufficient reactivity the MIT-CSDL Non-Linear Digital Controller are given in coastraint and on a control law tha t simula ted operator
[3] and [4].
Conclusions ins tructions was designed and tested.
This algorithm, the MIT-CSDL Non-Linear Digital Controller (NLDC), uses th2 reactivity constraint to monitor and, if necessary.
The major contribution of this research is the svarride the decision of the control law.
As f ar as enumeration and experimental demonstration of a set of the experiments described here are concerned, the con-general principles for the closed-loop control of reac-trol law was delibe ra tely chosen so tha t the con-tot power.
Foremost among these is the idea of re-straints would be limiting [3,4].
Reactivity was cal-stricting the net tea t tivi ty so that a pos er transient culated via a balance. The cons traints were evaluated can be rapidly halted by merely reversing the direction of travel of the associated control mechanism. Follow-at a frequency of one second, ing from this principle are the concepts of feasibility Control is continuously feasible if the reactivity of control, the absolute and sufficient reactivity con-is within the bounds of the absolute constraint. These s train ts, and the required and available times.
The bounds are not symme tric about the origin because the function of the reactivity constraints is to review the decision of whatever control law is being used to regu-pgnitude of the e f f ec tive, one-group decay cons ta n t on whe the r power is being raised or lowered,
late the reactor power and, if necessary, override tha t U puds Ones the reactivity exceeds these bounds, control is decision. The value of this approach is that it pro-only gua ranteed to be feasible at the desired power vides assurance tha t no automatic controller will ever 1ml.
Figure One de pic ts the available and required challenge the reactor saf e ty system tegardless of the times as a function of the elapsed time for a power in.
control law being employed.
crease. The correspending power and reactivity changes Acknowledeements era shown for comparison. Initially, the reactivity is ssro and, given that there is some rate of change of c setivitf available were the designa ted control rod to The contr* >utions of Mr Pau! T. Menadier, who de-be moved, the required time is ne ga tive and equal to signed the hardware, and of Mr. Kwan Kwok, who super-vised reactor operation, are greatly appreciated. This
(-1/le) or -12.2 seconds.
This indicates tha t con-tral is stready continuously feasible.
The available ma terial is based upon work that is now supported by time is initially zero because the desired power equals the National Science Foundation under Grant No.
the actual power.
Once the change is made in the CPE-8317878.
Original funding was from the Charles i
d;manded power, the available time becomes infinite be-Stark Draper laboratory and the Massachusetts Institute esuse the period in the previously steady-s tate reactor of Technology.
l was infinite. Control mechanisc motion then commences azd the reactivity becomes positive. The required time References l
hscomes less negative, passes through zero, and then j
b'aceaes positive indica ting tha t some finite interval (1) Schul tz and Melse. " State Functions and Linear l
tust now elapse. before the transient can be ha lte d.
Control systems," New York:
McGraw-hill, 1% 7.
Ths transition from the absolute to the sufficient con-straint occurs when the required time is zero.
The (2) Bernard, J.A., Ray, A.,
and Lanning, D.D., " Digi-available time tends towards sero because the period is ta l Control of Power Transients in a Nuclear baccring shorter and the power is rising.
Once the Reactor," IEEE Transactions on Nuclear Science, tias required to restore continuous feasibility of con-Vol. NS-31, No. 1, Feb. 1964., pp 701-705.
~
trol equals the time reestning to a t ta in full power, esstinued control me cha nism wi thd rawa l is prohibited (3) Bernard, J.A.
and Ray, A.,
" Experimental Evalua-cid insertion is begun. The required time is continu-tion of Digital Control Schemes' for Nuclear essly bounded by the available time indica ting tha t the Reactors," Proceedines of the 22nd IEEE Control teatrol mechanism is being more or less cons tan tly in-and Decision Conference, San Antonio, Texa s. Dec.
/ N erted.
The required and available times eventually 1983.
aero.
Vhen this occurs, the reactor power Qoth beceme can be leveled since control is again within the range (4) Bernard, J.A., 1,anning, D.D., and Ray, A., "Exper-of the absolute constraint.
There is still positive imental Eva lua ti on of R e a c tivi ty Con s tr a in ts for rsectivity pre sent in the core at this time and the dy-the Closed-Loop Centrol of Reactor Powe r," Pre-nsaic effect of control nechanism insertion is required ceedings of the Serpostur on New Techneioeies in to countet this positive reactivity.
Henca, the con-Nuclear Power In s trumen ta tion and Control, bash-trol mechanis cust be driven in continuously at this
- ington, D.C.,
Nov. 1984
NE-N symposaum on Wew Technologies in Nuclear Power Plant Inst rumentation and Control Published by Instrument Society i
of.A= erica O
\\.J EXPERIMENTAL EVALUATION OF REACTIVITT CONSTRAINTS FOR THE CLOSED-LOOP CONTRCL CF REACTOR POWER John A. Bernard, David D. Lanning, and Asok Ray Nuclear Reac tor Labora tory Massachusetts Institute of Technology 138 Albany Street Cambridge, Mass. 02139 Abstreet been the ne'ed 'for digital computer systems and, in particular, the availability of fault tolerant Ceneral principles for the closed-loop, digi-mini-or nicro-processors.
Computer systems such these have only recently become available, tal control of reactor power have been identified, as quantita tively enusarated, and experimentally demonstrated en the 5 MVt MIT Research Reactor, The MIT-CSDL program itself has several compo-MITR-II.
The basic concept is to restrict the ne t cents. These include fault detection using redun-reactivity so that it is a lways possible to make dant. sensors and analy tic evalua tion of process the reactor period infinite at, the desired termina-variables, on-line sensor calibration and informa-tion point of a transient by reversing the direc-tion display, component mode ling, informa tion pri-tion of motion of whatever control mechanism is as-oritization, the provision of safety parameter dis-sociated with the controller.
This capability is plays to the licensed operator, improvt.sent of the formally referred to as " feasibility of control".
man-nachine in te rf a ce, and closed-loop applica-A series of ten expe rimen ts have been conducted tions. Details of some of this work have been pre-over a period of eighteen sonths to demonstrate the -
viously rrported [1-4].
This paper, one of a se-y ef ficacy of this property f or the automa tic control.
ries, pre sents some of the experimenta l results from the closed-loop control studies that have been of reactor power.
It has been shown tha t a con-troller which possesses this property is capable of undertaken 9n the MIT Research Reactor.
bo th raising and lowering power in. a safe, effi-cient manner while using a control rod of varying The studies presented in this paper have, for dif ferential worth, tha t the reactivity constraints the most part, involved tests of the MIT-CSDL Non-are a sufficient condition for the automatic con-Linear Digital Controller or NLDC.
The NLDC com.
trol of reactor power, and that the usa of a con-bines a con trol law based on typical operator in-troller based on resetivity constraints can prevent s truc tiots. wi th a supervisory component that re-overshoots either due to setempts to control a s tricts the net reactivity so that control is fea-transient with a control rod of insufficient dif-sible whenever required.
Previous publications f erential worth or due to failure to properly esti-
[5-7) have reviewed the dynamics of reactor tran-mate when to commence rod insertion.
sients, the theoretical concep ts that form the basis of a control strategy based on feasibility of De tails of several of the more significant control, and several alternate control techniques.
testa are presented toge ther with a discussion of The MIT-CSDL research ef fort in this area has thus the ra tienale for the developnent of closed-loop far teen concerned with the au toma tic control of control in large commercial power systems. Specif-power in reactors that can be described by the ic consideration is given to the motiva tion for de-point (space-independent) kinetics equations.
How-signing a controller based on feasibility of con-ever, the extension of this work to the spa tially trol and the associated licensing issues.
dependent case is in progress. The ultinate objec.
tive of this portion of the MIT-CSDL program is the Introduction closed-loop control of large ligh t-wa ter reactors including the power, pressure, tempe ra ture, and
'The Massachusetts Institute of Technology and rates of heat production and removal.
the Charles Stark Draper Laboratory have undertaken systenatic program of theoretical and experimen-The objectives of this paper are to (1) review atal research regarding the application of advanced the to donale f or the closed-loop control of reac-control and instrumentation sys tems to nuclear re-tor pow e r, (2) discuss the motiva tion for develop-The progran's strategy stems from the f a c t ing a closed-loop controller based on the concept actors.
tha t, based on aerospace developments and applica-of feasibility of control, (3) discuss some of the tions, the technology now exists that can enhance issues involved in both extending this technology the in s t rumen ta tion and' control of fission nuclear to large, ligh t-wa t e r reactors and licensing it,
~
plants or, for tha t ma tter, f os s11 plants and other
,H (4) present some of the experimental results proven systems. One of the principal technical le-tained in testieg the supervisory component of pedinents to the transfer of this technology has the MIT-CSDL Non-Linear Digital Controller.
Ra tionale for Closed-Loop Reactor Control (3) Assuming that nuclear plants will be used O
in a load-following mode, closed-loop h
The control of nuclear power plants, either control would predict and preclude the cpen or closed-loop, has been studied extensively skewed power profilas tha t could result since the inception of the commercial nuclear in-from spa tial renon oscillations.
(Notet dus try in the early 1950s. Nevertheless, there has At least one utility (13] expe cts to op-been little substantive discussion of the possible erate a nuclear plant in a loadofollowing merits of closed-loop, computer control of either mode in the near future and is developing the reactor power or of the plant as a whole.
computer sof tware that will advise the licensed operators on the proper sequence '
Oakes [8] argued tha t the contribution of the of control mechanism manipulations.)
Licensed operator to reactor saf e ty would be in-crsesed subs tantially if automa tion were ma ximit ed (4) Closed-loop con trol sight decrease the in nuclear plants, thereby f reeing the operator to number of plant disturbances and spurious concentrate on overall system behavior. Hagen and shutdowns by using multivariable and Kerlin [9), in a reriev of 1AEA sponsored sympos-fault-tolerant control to detect and damp luas on nuclear power plant control, concluded that out local fluc tua tions before they pro-there was a broad realization among meeting partic-paga te through the entire plant. This is ipants that computers would be assigned an increas-the argument posed by Hagen (10].
ing role in nuclear plan ts and that thr uses of cutoma ted digital controls could be beneficial.
(5) Continuous fine adj us tment of control However, there was no consensus on the proper func-mechanisms alght optimize the core power tions of compu ters and no perceived need for distribution and fuel utilization. This closed-loop control.
Tha t opinion, although ex-argument, while one of the most f requent-pressed in 1974, remains valid as of this writing.
ly voiced, is perhaps the most develop-Hagen [10] concluded that "an optimized dynamic re-men tal since it requires the a bility to actor control system could maintain control over a determine the in-core power distribution
. vider range of process variables with a f a s ter with more accura cy than is currently speed of response than is now being experienced."
available in real time.
The issue here Such a systes should damp out disturbances more ef-concerns the availability of sensors and ficiently than an operator, thereby reducing the analytic models more than the use that is demand for intervention by a protective safety sys-to be made of the information once it is tea.
Frogner and Rao [11] published an excellent obtained.
p survey paper on the control of nuclear power plants g"/ in 1978.
That report combined with the self-scru- -
(6) Direct digital control systems can be tiny imposed by the nuclear indus try since the TM1 modified easily to accommodate future de-accident in 1979 has led to the publication of many sign improvements.
Expensive retrofit-acudies on the utilization of computers in reactor ting of hardware might be avoided.
e pe ra tion.
The majority of these reports concern open-loop a pplica tion s.
H owe ve r, discussions of (7) Ca lcula tion, display, and control of the feasibility and desirability of closed-loop parameters tha t are not directly measur-control are becoming more f requen t.
For example, a able should be possible. Process coeput-era are currently used in boiling wacer paper b) Tylee anJ Hon [12) addressed this issue.
reactors to determine such variables as Summarized below are some of the arguments the average planar linear heat generation supporting *he application of closed-loop con trol rate from in-core detectors.
A closed-to nuclear power plants:
loop con troller could be programmed to maintain this, and other quantitles such (1) A single multiva riable control law might as subcooling margins and net positive impr'ove the response of exis ting, highly-suction heads, within specified toler-interacting, individual control loops, ances.
For example, allovence could be made for l
the interaction be twe en the now separate (8) Closed-loop control would provide added controllers used for main taining feed capability to monitor and strictly limit purp discharge pressure and steam genera-excess reactivity.
This could be of tor level.
pa rticula r importance when a reactor is critical but at such a low power that it (2) Use of a multivariable control law in is "below the point of adding heat" and combina tion with fault de tec tion, sensor the magnitudes of the usual negative ca libra tion, and measurement es tima tion feedback mechanisms, temperature and void capabilities would increase the robust-effects, are not yet physically signifi-ness of the control systen re la tive to cant.
sensor and a c tua tor failures.
Frogner and Rao (11] point out tha t this could be (9) The effect of control rod movement is, in done by switching control laws immediate-gene ra l, non-linear since rod worth is fm ly following the failure.
For example, roughly proportional to the square of the
(
)
control of feed puep discharge pressure.
normalized power profile.
Also, the rod A'
could be automatically switched from nor-worth eay be affected by coacentrations mal automa tic to preset in the event of a of short-lived fission product poisons ma lf unc tion.
such as menon-135. A closed-loop control
system might prevent the use of rods fired power gene ra tion'.
The failure of the conner-whose worths were temporarily abnormally cial nuclear industry to keep pace is due to sever-(j3
(
high.
This could be of use in hot-scram
- 1. factors. These include the historic role of nu-recoveries of BWs where, as a result of clear plants as base-loaded units, the traditional xenon-induced changes in the power dis-emphasis on the design of protective as opposed to tribution, the inadvertent withdrawal of control systems, the fact that most plants operat-peripherally-located rods of normally low ing or under construction today were oesigned well before the start of the now decade-old revolution worth can cause excessively short periods and/or local power peaking.
in digital technology, the lack of design criteria for control strategies [11], concerns regarding anomalous reactivity (14), issues rela tive to sof t-(10) Da ta from infrequently performed opera-tions such as hea tups /cooldowns could be were verification and hardware reliability, and the stored and, through pattern reccgnition possibility of non-licensed personnel (e.g.,
load techniques, used to determine the mo s t d.ispatchers) being able to alter reactivity.
efficient operational sequences for vary.
The comme rcial nuclear industry, in spite of Ing initial conditions.
these difficulties, should examine the closed-loop (11) A digital controller could be used to control option. Other industries have done so and ha ve benefited from the. results.
More importan t,
maintain plant temperatures and pressures within specified tolerances thereby in-as computers become ever lesa expensive and ever proving the efficiency and safety of more powerful, they will be used in increasing num-startups.
This could be of pa rticular bets in nuclear plants for "non-control" functions value during PW opera tion when transi t-such as da ta-logging, procedure ref erral, alarm so-ing the narrow region defined by consid-quencing, and the calcula tion of hea t genera tion erations based on the ductile-brittle limits. Licensed operators are increasingly depen-dent on computer-processed inf o rma tion.
This ex-transition tempe ra ture, coolant pump op.
erstion, and the pressure requireme js Fanding computer role raises interesting ouestions.
during startup or transient conditions.
Is it not possible tha t using computer sof tware to assist an operator who controls the plant could cause tha t ope ra tor to become so dependent on the (12) Computers can be programmed to accurately schedule and perform many of the rou tine informa tion displayed by the computer that its checks and procedures now done by 11-sof tware is, in fact, being used to run the plant?
censed operators. These checks, because Vould it not be better if computer-based technology introduced in a planned, systematic manner for they are normally simple, repe titive were n
both inf orma tion and control purposes?
ta sks, can be easily forgetten or over,
f,"}
looked by the operator.
Design Motiva tion (13) Simple algorithms can be used to s ca n,
eva lua te, and compare thousands of sig-The research described in this paper is part nals thereby identifying potential prob.
of an initial effort to develop and demonstrate a
+
les areas in real time.
An operator can reliable, thorough and practical approach to the not assimilate the same amount of infor-closed-loop control of ~ power in nuclear reactors, nation in the same time frame. The oper.
The major desirn objectives adopted by the MIT-CSDL ator's skills would be put to better use research team were tha t no automatic control action in diagnosing the ramifications of prob.
should ever result in a challenge to the reactor less identified by the algorithm.
safety systes, tha t the performance of the automat.
ic controller should be at least comparable to tha t (14) Closed-loop control could enable the 11-a ttainable by licensed operators, and tha t the au-censed operator to monitor the plant tomatic control sys tem should be sepa ra te from the wi thou t having to simultaneously manipu-safety system.
Accomplishmen t of these objectives la te it.
This is perhaps the most impor-meant that the controller should recognize tha t re-tant argument for the use of closed-loop actor dynamics are non-linear, tha t there are many control. Licensed reactor operators are power-dependent feedback mechanisse, and that con-highly trained professionals who are re-trol mechanisms have finite speeds as well as post-quired to understand the physical pro-tion-dependent non-linear worths.
It was recog-cesses involved in power produc tion as nized early in the program that these obj ec tive s well as the systems that they ope ra te.
could not be achieved solely by using conventional it makes little sense to require an oper-control approaches such as transfer functions, a tor to focus a ttention on manipula ting a s tate analysis, or op timal control because each of control mechanism in response to one or these techniques assumes tha t a certain, of ten lin-two ins trument signals when an automa tic eerised, reactor model or a certain set of initial controller, using the same inf o rma tion,
conditions exists.
The reliability of the tech-would make the same decision. The opera-nique re s ts on the validity of th t model or the tor's knowle dge would be pu t to be tter exis tence of those conditions.
If they change, use in having him or her survey the plant there is no guarantee that the resulting control as a whole.
action will be as anticipated. Accordingly, it was decided to build into the MIT-CSDL controller the V
Advanced control and ins trumen ta tion tech-capability of eva lua ting the safety of its own n!que: are now applied in najor industries such as a c tions on line and in real-time.
It is this fea-aerospace, chemical proces sing. and cod e rn fossil-ture, and the fact tha t the work includes an exper-
leental component, tha t distinguishes the MIT-CSDL De scription of the MIT-CSDL Contro11er O studies from those of other researchers in this V field.
The following is a brief summary of the rele-vant reactor physics considera tions and the theo-The MIT-CSDL power-level controller has a retical relations that f orm the basis of the super-thre e - tie re d structure.
The first component is a visory component of the MIT-CSDL Non-Linear Digital supervisory, non-linear program tha t measures the Controller or NLDC.
Additional information is reactivity, period, and power in real-time and then given in [5,6,15].
determines when the core's reactivity must be to Reactors which have closed-coupled cores may-changed in order to preclude possible challenges the sa f e ty system.
For example, it monitors power be described by the point (space independent) ki-increases and, if necessary, either ve toes contin-notics equations. Cuidance on when changes in the ued rod withdrawal or initiates rod insertion. The signal to the reactor control mechanise must be in-second component is a decision analysis program itiated may be ob tained by combining these equa-that selec ts the means of control. The third com-tions thereby deriving a relation be tween the reac-ponent, which is still being refined, provides a tor period, the reactivity, and the ra te of change predictive ca pability for control s tra tegy deci-of reactivity.
The result, which is de signa ted sions.
It permits the power level and rea c tivi ty here as the " approximate" form of the dynamic to be precalculated as functions of time for any period equation, ist proposed control action and initiates the power gg g
change. The actual power level and reactivity can r ( t) =
then be compared to those predicted and any devia-p(t) + 1 (t)o(t) tions brought to the a t ten tion of the opera tcr.
All inf orma tion tha t is sent to the controller is wheres f ( t) is the reactor period, first subject to f ault detection and sensor valida-tion routines.
Also, the sof tware and, ultimately I
is the effective delayed neutron the hardware, are intended to be fault-tolerant.
- fraction, The first and third components of this controller are complementary. The supervisory program's con-p(t) is the reactivity, tribu tion is tha t it reviews the decision of the predictive component in teres of current reactor p(t) is the rate of change of reactivity, conditions and intervenes as necessary. Its defi-and ciencies are that it lacks both the ability to pro-ject values of power and reactivity forward in time -
1,(t) is the effective, one-group decay
. j tad the capability to cause the shape of the trana con s tan t.
sient power curve t3 conform to a particular set of con-The effective, one-group decay cons tant is time-s pe cifica tions. The predictive portion of the troller, which might, for example, be based on dependent because the rela tive concentrations of state analysis, can provide those functions in the various delayed-neutron precursor groups change which the supervisory program is deficient.
How-depending on whether power is being increased or ever, it can not guarantee the sa f e ty of i ts own decreased.
It is normally approxima ted by the actions unless the reactor is operating within the value that it approaches when the reactor is oc an envelope of conditions fot which 1: was designed.
asymptatic period.
Both components are necessary.
The ultima te goal is to design a system tha t l
Most controllers tha t have been described in guarantees that no action initiated by an automatic the li te ra ture or tha t now exist in practice have controller will ever result in a challenge to the only a predictive component.
As a result, the nuclear safety system. Tha t is, the re mu s t no t be question invariably arises as to how such a con-any power overshoots. This requirement can only be troller would perform should it be required to fulfilled if it is possible to make the reactor function ou tside of its norma l ope ra ting range.
period infinite whenever required. This can be ac-This is pe rhaps the major obs ta cle to the accep-complished if two factors are recognized.
- First, tance of au toma ted controllers for nuclear power as shown by equa tion (1), the reactor period de-plan ts since it means that a sa f e ty ana lysis must pends on both the not reac tivi ty and the rate of be perferned on the controller's response during change of reactivity.
Second, the rate at which each and every possible contingency.
The concern reactivity can be removed from a reactor is, under na turally exists that such analyses might not be non-scram conditions, limited to the speed of the exhaustive. The existence of a non-linear control-control mechanisms.
Together, the se two factors ler capable of evaluating the sa f ety of its own ac-mean that the process of removing any excess rese-tions on-line and in real time should obviate this tivity must be s ta r ted in advance of attaining the concern. Another benefit to having such a control-desired power.
Otherwise, there will be a power let is that its structure would not be plant spect.
overshoot.
This observation is the basis for de-fic.
Given tha t all plants operate on the same fining a reactor together with a designated control physical principles, the controller would be of a mechanism as being " feasible to control" if it is universal design and could be used on plants of possible to transf er the system from a given power A
varying layouts thereby both furthering ef f orts at level and rate of change of power (i.e., period) to i
J standart stion and facilitating industry-wide a desired, s teady-s ta te power level without over-V training on control system technology. Finally, it shoot (or conversely, undershoot) beyond specified is believed that such a controller would be capable tolerance bands, if any.
This concept has two im-of being licensed.
portant attributes. First, it applies to a reactor
snd to the specific. control mechanism designated These reactivity constraints and the concept for use in accomplishing a given transient.
Sec-of feasibility of control are the basis of the su-p/ cnd, not all states (i.e.
y combina tions of reactivi-pervisory component of the MIT-CSDL Non-Linear ty and power) are a llowa ble intermediates through Digital Controller.
If the sufficient constraint which the system may pass while transiting from is observed, control will always be feasible when some initial to sore final power.
Excluded are required.
Hence, by merely reversing the direction s ta te s representing actual overshoots and s ta te s of travel of the designa ted control mechanism, the from which overshoots could not be averted by ma-period can be made infinite and the power transient nipula tion of the designated control mechanism.
halted.
Note tha t the equa tions of reactor dynam-Eq ua tion (1) shows that the rec e tor period can be ics were not linearized and that no assumptions made rapidly infinite only if the product of th*
were made about the shape of the integral or dif-ef fective, one-group decay cons tant and the net re-ferential worth of the control mechanism. The ap-cetivity, both tha t added directly by the control proach is intended for use with control elements of sechanisms and that present indirectly from feed-non-linear worth, back effects, is maintained less than the maximum available rate of change of reactivity.
Physical.
Controller coera tion ly, if the reac tivity is so constrained, then, by reversal of the direction of motion of the speci*
The sufficient reactivity constraint is used fled control mechanism, it will be possible to ne-to evaluate the decision of an associated control ga te the effect of the reactivity present and make law and to verify that no challenge will be made to the period infinite at any time during the tran*
the sa f e ty system as a result of implementing tha t s ien t.
This requirement, the " absolute reactivity decision. This arrangement permits changes in the constraint", is written as:
demanded power to be readily and safely accom-plished. For example, suppose the control law were 5 l 11,(t) p(t) 1 l5l (2) simply to move the control mechanism at a fixed speed should the deviation between the desired and where le(t) is the effective, one-group decay actual power exceed a specified band.
A power in-cons tan t, crease is desired.
Ini tia lly, the reac tor is at s teady-s ta te with the con trol law main taining the p ( t) is the het rea c tivi ty, both tha t power within the allowed deadband. Once the power added delibe ra tely by the con trol setpoint is changed, the control law signals for mechanisms and that present in*
withdrawal of the control rod. The reactivity con-directly from feedback effects, and straint is initially satisfied and the withdrawal is. permitted. It continues until the constraint is A)
{5 l 1s the maximum available ra te of -
no longer fulfilled. Once this occurs, rod with-(#
change of reactivity tha t could be drawal is halted even if the control law is signal obtained were the designated control ing for its continua tion.
The reactor period then mechanism to be activated.
lengthens from its dynamic to its asymptotic value.
The constraint is again sa tis fied and further rod.
This constraint is overly restrictive since it per-withdrawal is possible.
This continues until the zits power to be leveled at any time during a tran*
cons train t can not be satisfied by a cessation of sient when all that is required is that it be pos*
rod withdrawal.
Rod insertion then begins.
The sible to level power at the desired te rmina ti;n period leng thets, the cons tt aint is uet, and the point.
Accordingly, a less stringent cons traint rod insertion is halted until maintenance of the may be written tha t specifies tha t there be suffi-cons train t again requires it.
The net effect is cient time available to eliminate wha tever reacti-tha t the rod is initially withdrawn continuously, l
vity is present beyond the amount tha t can be in*
then held more or less cons tan t, and finally in-mediately negated by reversal of the direction of serted in a stepwise fashion.
Figure One is a l
mo tion of the de signa ted control mechanism be fore schenatic of the supervisory component of the MIT-l the derited power level is attained. This require-cstL yen. Linear Digital Controller showing its re-eent, the " sufficient re a c tivi ty constraint". may lation to the signal valida tion sys tem, the reactor be written for power increases and decreases as:
sa f e ty system, and to other control strategies which could serve as the predictive component.
- l5 l/1e]/l5l<rIn(P/P)
(Ja) i; I
Licensing Issue s and Cereercial Reac tor Apolica tion 8Y
- E*"*""
-[:, + c l/1e ]/ l51l<' In(P /P)
(3b)
F Non-1,1re a r Digital Controller controller could be e
in its present s ta te submitted for license revi l
where PF and P are the desired and current power for the control of reactors that are describable by l
1evels re s pec tive ly, r is the current period, and the point kinetics equa tions.
This includes re-the quantity jij is, as in equa tion (2), the ma xi-search and test reactors, small graphite-moderated I
sua available rete of change of reactivity were the rea c tor s, reactors for spacecraft, and small com-de signa ted control mechanism to be ac tiva ted.
A mercial reactors.
I cote explicit definition of t and a phy sica l l
interpreta tion of the left and right sides of the t!se of this technology for the control of i
) sufficient cons traint, which are referred to as the -
large, light-water reactors requires further re.
"evsilable and required times", are given in the search, in tha t the rea c tivi ty con s tra in t concept secoce cf the experiments discussed in the sec tion must be extended to the spatially-dependent case.
of this paper on experimen tal ev'alua tion.
It is recognized tha t spa tial eff ec ts with thermal-l l
l
1 O
power INVERSE pggg MISTORY-KINETICS y u I 8 REACTOR POW ER Flow VALIDATION y
PERIOD DEMAND TEMPERATURE REACTIVITY ANALYTIC BALANCE R EACTIVI TY VALIDATED REACTOR e,
INTEGRAL REACTIVITY MODEL WORTH f
ROD HEIGAT DIFFERENTIAL TIME REQUIRED TO wnoTu REDUCE EXCESS EFFECTIVE TIME REMAINING REACTIVITY TO DECAY TO ATTAIN CONTROLLABLE CONSTANT FULL power SAFETY A"^"NT AUTUG TIC SYSTEM (o-bA)/h r in(Pg/P )
SHUTDOWN
~
t o
'I
0/
- 00 30Ga M
4( O [ t t t Elooses 7'une f.econds) O 100 200 300 400 -40. Time (secondel F'9ure Seven. Effect of suf ficient con,, rent on mod me;gnes Fi9m E4at-Evoluotion of Sufficient Constreint:t 4ww r ......r. 20 ..-i p i y. 2 0._ s.,,..,,u,... I IM, t .i.i c.,,.,,,,!.*,,',*".T 200 - io -I I i i e i 1I ..e. . t. i I, I l,t I, i i I _j j o 1 i ,ii ii p i p i c'80 . 2 0- C.a.,,... 0...... i E l l 2% uae.rsh.s* h l f go ~ f > %ss 0..,s, fii j 0.,0.,.. I t. 4 0 f-o . ~. l l l l t t I t t 's o/ 100 200 300 400 0 s 2 3 4 5 h) Reecto' P.-er tuw) Eleases tirae (seconcil (_ F.g.re Nae.v oloten of $witicient Constre.nt; i.4 pw F gure Ten. Recording of Po.r Trensients a kept below the out-limit so tha t its differential tions. (Note: Civen that a subs tantial overshoot worth was non-tero. When the NLDC was deprived of was projected, it was decided to lower the ta r ge t Os the reactivity cons traint, it permitted the rod to power to 3 MV. Once again the reactor's hea t re-be fully withdrawn. The dif f erential worth of the moval capability was set for 5.0 MW since it was re gula ting rod is essentially sero at the out-expected tha t the power would overshoot the ta r-lirit.
- he cause of the overshoot is now apparent.
geted level of 3.0 MV. The reactor was at all "tven that the dif f erential worth of the regulating times operated con s e rva tive ly since actual power rod is quite low for all heights above ten inches, was neither expected to not actually did exceed the the difference in the position of the regulating hea t removal sys tem's capacity.) tod during the two transients did not measurably affect the net reactivity addition. The overshoot Figure Eleven shows the power and rea c tivi ty occurred because, when the NLDC was deprived of the values recorded while using the NLDC to raise power reactivity constraint, the algorithe no longer had from 1-3 MV. All components of the NLDC were fully cny capability of planning for upcoming changes. operational. The power rose rapidly and leveled The reactor period was longer than 100 seconds so off without overshoot. Figure Twelve shows the so attempt was made to halt or slow the power in-same transient except tha t the reactivity con-crease until the actual power was within a few per-straint was deleted from the supervisory section of cent of the ta rge ted value. The controller then the NLDC. The power overshot by almost a full drove the regula ting rod in conticuously. Unf or tu-megawatt, then undershot by 0.25 MV, and then over-nately, that action had no effect because the rod shot once more before settling out. Wha t ca used speed is fixed at 4.25 inches per minute and the this overshoot? In the low dif ferential rod worth rod had to be driven several inches before its dif-experiment, both transients inserted approxima tely ferential worth would again be appreciable. As a the same amount of reactivity for the same length result, its insertion did not create an appreciable of time. The power overshot in tha t case because dynamic ef fect and therefore did not off set the ef-of a failure to keep the control rod at a height f act of the reactivity present in the core. Con-where it could have an appreciable dynamic effect. trast this with the situation when the cons traint The reason for the cvershoot in the uormal dif fer-ese active. Virtually the same amount of reactivi-ential rod worth experiment was entirely dif f erent. ty was present but the rod was at a lower height The control rod did not reach its out-timit in (- 13") when the desired power level was ap-either of the two runs. What happened is shown in proached. Hence, the action of inserting the rod Figure Thirteen which compares the two reactivity created a sufficient dynamic effect to offset the insertions. It is apparent that when the control-resetivity, drive the period to infinity, and halt ler was f unc tioning without the constraint, it per-f- the power rise. The reason for the overshoot was mitted the reactivity to remain in the core for a ( tha t loss of the sufficient fora of the reactivity, sub s tan tia lly longer interval than it did when it constraint prevented the controller from main tain-was functioning with the constraint. (Note: The ing the designated control mechanism at a position f ac t tha t the reactivi*y was added as a f aster rate where it would be effective. Figure Eight is an in one case than in the other was due ta slightly evaluation of the reactivity constraint for the different initial rod heights and not to any dif-case when power was raised using the full NLDC. ference in the controllers.) The cau se of this The constraint was satisfied throughout almost all overshoot was that the deletion of the sufficient of the transient. Firure Nine depicts the viola-reactivity constraint prevented the controller from tion of th a reactivity cons traat.t for the case whe a properly determining wher. to consence removal of power was raised without the constraint being ef-the excess reactivity. Figures Fourteen and Fif-fective. (Note Comparison of this figure with teen are evaluations of the reactivity constraints. Figure Seven shove that reac tivity was being re-When the NLDC was lacking the reactivity con-soved prior to the coneencemect of rod insertion. straint, a gross and sus ta ined viois tion of tha t That removal was due to the MIT Reactor's negative constraint occurred. Figure Sixteen is the linear toepera ture coef ficient.) Figure Ten is the linear neutron channel's strip chart. The upper portion reactor power trace made during the two transients. shows the substantial overshoot tha t occurred due
- he lower !!gure is the run in which the NLDC was to the dele tion of the sufficient constraint. The deprived of the reactivity constraint.
Note the lower portion of the figure is the transient per-13: overshoot followed by the 2% undershoot. The f ormed with the complete N1.DC. Hence when the NLDC 'Jpper run is of the same transient but with the was fully operational, the constraint was continu-constraint active. There is a small overshoot of ously satisfied and no overshoot occurred. 1.6% which is almost entirely explainable in terms of the 1.3% tolerance band allowed by the control Conclusions law. The major contribution of this research is the Norsal Ottferential Red Vorth Experiment enumeration and experimental demonstra tion of a set of general principles for the closed-loop control The previous experteent clearly established the of reactor power. Foremost among these is the idea ability of the sufficient form of the reactivity of a c>ntrtoller structure that includes both so-constraint to prevent substantial power overshoots. pervisory and predictive tiers with the supervisory Movever, the value of the expe r teen t is limited in component restricting the net reactivity so that a that it pertained only to the special case in which power transient can be rapidly halted by merely re- ) the differential rod worth was quite low. Accord-versing the direction of travel of the as socia ted ingly, the experiment was repea ted with the regua control eechanism. Following from this principle is tin; tod at a lower position. This insured tha t are the concepts of f easibility of control, the ab. Its wo r th was typical of normal operating condi-solute and sufficient constraints, and the required i s ( ) NORMAL DIFFERENTIAL ROD WORTH EXPERIMENT U +o-
- 5.,,,c. e.,
) roie,e e ae-se coat"e=' v'a'ee -o j> d'*% 34-nee......, t s 5 -w -w_ _ X_ _ _ _ _ -. m , z. ..s _3.o---- u ..\\ y -Ij -30 : I 3 D'** ' -*' ao.e.
- neec,
- z, -
s m = e /. 30 3 J \\ o j g 2.0-f LS-oyaeni.c eHect e, g,,, essn e eeectivits I - 20 3 -to $ 'es meer+iea effse'st O g e glo \\. - lo 1,0 1.0 \\ lo No t F t i e o So soo 150 0 10 0 200 300 Time (seconds) Time (secones ) Figure Eleven. Power increase 1 3 MW with Sufficsont Fiture ?sWwe. Power increase 1-3 MW witheet Constroint Setfielent Ceasere6at Go - N.N toor So-6 a.t \\. I / m .co(- j j eo _ so. L i Crastreme active = 3o I ! 40. p woe f t to- ~ Coaswe.nt ceieiese e 20*- 'i ? / I 1 i i / eo soo eso o So too iso 300 f Eiseses Time (seeenest T6ene (secones) -2 0 - Agure Therteen. Comparison of Roset6,6ty insertions:l-3Mw Fiore Feve'es*
- E eustian of Suf ficwas Coasne.at* t. 3Mw 200(
} a...see.. t eie eso - \\ ,120 - f.ni, ev.n.cn see ! eo= - N
- "'*'"**'8 w
N no e cos'vaeases. meev.e e 25 I i I. Teme j
- Ceasles M Delette
- t. e se.no j 20 3 3 yo,,,,,,,,
-f 'OP
- N.N...e, - s a.
[ I a,,
- a!
ec'o o 7 4 So 200 $ go Constre at actese Eleeted Tene (setendal g n .eo - e. S 03/0S/0e = f Ql [ o e 2 3 e i ' 8 0-Re ac tor Power (Mwl F*gute Fif teen.Veenetien of Suf ficient Con st rein t' i. ) Me Fegvee $esteen. Aecereing et Pe ee teensione 3. Ra y, A. and De sai, M., "A Calibra tion and Es-and available times. The reactivity constraints may or may not be used to directly regulate the re-tisa tion Filter for Multiply Redundant Maa-(g) ector power. However, they should always be used surement Sys tems," Journal of Dynamie Sy s tems, V to review the decision of whatever control law is Measurement, and Con trol, Vol. 106, June 1984, being used to regula te the reactor powe r, and, if pP 149-156. necessary, override that decision. The value of this approach is tha t it provides assurance tha t 4
- Jow, H.N.,
"P rio ri tiz a tion of Nuclear Power Plant Variables for Opera tor Assis tance during the automatic controller will not challenge the re. cetor safety system regardless of the effect of Transients", C.S. Draper Report PCSDL-T-843, changing conditions on the capabilities of the con. May 1984, trol law being employed. 5. Be rna rd, J.A.,
- Ray, A.,
and Lanning, D.D., The experimental program to evaluate the MIT- " Digital Control of Power Transients in a Nu-clear Reactor," IEEE Transactions on Nuclear CSDL Non-Linear Digi tal Con trolle r has been ex-tremely successful. It has been shown that the Science, Vol. Ns 31, No. 1 Feb. 198=, pp sufficient reactivity constraint, which forms the 701-705. basis of the controller's supervisory tier, is a tuf ficient condition for the closed-loop control of 6. Be rna rd, J.A., I.anning, D.D., and Ra y, A., reactor power and that, through the use of this "Use of Reactivity Constraints for the Au to= constraint, power transients can be initiated, con-satic Control of Reactor," IEEE Symposium on Nuclear Science, Vaahington, D.C., Nov. 1984. ducted, and terminated in a safe, efficient manner thile using a control rod of non-linear reactivity to rth. In addition to the material presanted, such 7. Bernard, J.A. and Ray, A., " Experimental Eval. is being learned about signal validation, interf ace untion of Digital Control Schemes for Nuclear cffects of digital computers and reactor mechanical Reactors," Proc eeding s of the 22nd IEEE Con-f erence on Decision and Control, Vol. 2 Dec. systems, the measurement of reactivity, and the de-s Lred form of a reactar's transient response. Ex. 1983, pp 746-751. periments are planned on the MIT Reactor in which the NLDC will alter the reactor power while using 8.
- Oakes, L.C.,
" Automation of Reactor Control control mechanisms with integral and dif f erentia l and Safety Systems at ORNL," Nuc l e a r Sa f e ty, worths that are significantly greater than those Vol.11, Mar-Apr 1970, pp 115-118. of the regula ting rod. In addition, work is in pro-gress to extend the reac tivity constraint concept 9.
- Hagen, E.V.,
and Karlin, T.V., "IAEA Interna-to large reactors tha t must be described by the tional Symposivas on Nuclear Power Plant Con. trol and In s trume n ta tion," Nuclear Safety, O spatially-dependent kinetics equations. Vol. 15 Jan. 1974, pp 15-29. V Acknowledgements 10.
- Magen, E.V., " Anticipated Transients Vi thout The authors wish to acknowledge the benefits Scram: Sta tus Quo," Nuclear saf e ty, Vol. 17, of discussions with Prof essor John Meyer of MIT's Jan. 1976, pp 43-55.
- epartment of Nuclear Engineering.
The contribu-tions of Mr. Kwan Kwok who both operated the coe. 11. Frogner, S. and Rao, H., " Control of Nuclear puters and supervised reacto? opera tion during th Power Plants," IEEE Transac tions on Automa tie, testing, of Mr. Paul T. Menadier who designed and control, Vol. AC-23, No. 3, June 1978, pp fabricated much of the ha rdwa re, and of Mr. Ara 40$=416. Sanents who assisted with manuscript prepa ra tion, a re greatly appreciated. Thanks are also due to
- 12. Tylee, J.L., and Hon, A.L., "New Concep ts in Mr. Leonard Andexler, Mr. Villiam McDermott, Mr.
Nuclear Powet Plant Instrumentation and Con. Mark Anderson, Ms. Georgia Voodsworth, Mr. Lincoln trol," Proceedings of the 22nd IEEE Conference Clark, and Dr. Otto Harling of the MITR Staf f, as on Deelston and control, Vol. 2. Dec. 1983, pp 740-143. well as to Dr. John Hopps and Dr. John Deyst of the Draper Staf f. The work was supported by the inter-
- 13. V11 der.
D.V., " Computer Program for Power nal sponsored research funds of MIT, the IR&D funds i of the Cha rle s S ta rk traper Labora tory, and other Changes and Load-Fo!!owing," Transac tion s of the American Nuclear Soc ie ty, Vol. 43, Nov. l priva te sources. Furtner work in this field is now I being supported by the Na tional Science Foundation 1983, pp 662-663. under Crant No. CPE 831-7878. 14
- Epler, E.P.
and Cakes, L.C., " Obstacles to References Comple te Au toma tion of Reac tor Control," Nu-elear Safety, Vol. 14 Mar-Apr 1973, 3 1.
- Ray, A.,
- Desai, M.
and Deyst, J., "Tsult De= 93*103, tection and Isolation in a Nuclea r Reac tor," Journal of Enerry, Jan Teb 1983, pp 79 85. 15.
- Bernard, J.A.,
" Development and Expe rimen ta l i Demonstration of Digita l Closed Loop control Stra tegies for Nuclear Reactors," Ph.D Thesis, 2.
- Ray, A.,
Be rna rd, J.A., and Lanning, D.D., "On Line Signal Validation and Feedback Con-MIT, May 1984 /9 trol in a Nuclear Iteactor," Proceediers of the i f V Pffth Power Plant 1Nv n s
- 1 c s, Control and Test.
16.
- Nakat, H.,
et al., "Au t oma tic Plant Startup int svepestue, Anoxville, TI.., narch 1983. System for BVRs," 1EI! Symposium on Nuclear ( Science, Wa shington, D.C., Nov. 1984 l L Safety Review #0-84-12 -m I ) v Closed-Loop Control of Reactor Power Using a Shim Blade ~ Technical Specification Changes 1.
Background:
Safety review #0-84-11 reviewed in detail the f actors involved in the automatic control of a shim blade. The evaluation documented by SR #0-84-11 concluded that revisions to the ftITR Technical Specifications would be necessary for certain of the desired experiments.
The purpose of this safety review (0-84-12) is to document those changes and to provide correspond-ing revisions to the SAR.
2.
Extent of Change:
Two changes are proposed.
The first is to modify existing specification #3.9.
The second is to add a new specification (#6.4) to the section of the Technical Specifications applicable to experiments.
3.
Description of Change a)
Modification of Specification #3.9:
Srecification 3.9-5 now stipulates that the worth of the regulating rod connected to the automatic control system be less than 0.7% AK/K. The (s) assumption was that a malfunction might occur in the controller. Therefore, the worth of its associated absorber would be limited so that its complete withdrawal could not make the reactor prompt critical. The reason for selecting this limit was not that there was anything special about the reactivity associated with prompt criticality. There is not, for example, a discontinuity in the reactor period while transiting from reactivities slightly below to reactivities slightly above this point. The reason that specification 3.9-5 was written in terms of that limit was that "this limit is well within the inherent shutdown capability of the core bv the negative reactivity effects of temperature and voids".
The 0.7% AK/K limit is unnecessarily restrictive. As is shown in specification #3.2 and in section 15.2 of the SAR, the maximum safe step reactivity addition is 1.8% AK/K.
This means that "a step insertion of 1.8% AK/K will not cause damage to the fuel integrity by the resulting power transient".
Reactivity insertions due to a malfunction of an automatic controller would be in the form of ramps.
Given that the nuclear safety system is separate from any automatic controller, that safety system would stop any transient resulting from a ramp long before the results would be as severe as a 1.8% AK/K step insertion.
ey I
/
Four changes to specification 3.9 are therefore s -
proposed.
These are:
sa e o.a 412 JUL 161984
(1)
Specification 3.9 is revised so that subspecification
()
- 5 applies to any control element or elements, not merely the regulating rod.
A new subspecification (#8) is added to make this revision explicit.
It should be noted that, while one or more shim blades and/or the regulating rod may be connected to the controller at a time, only one shim blade may be withdrawn at a time.
(2) The reactivity that could be inserted due to full withdrawal beyond the critical position of the control elements connected to 'an automatic controller is limited to 1.8% AK/K, rather than 0.7% AK/K.
(3) The reactivity limit is written in terms of the total available positive reactivity associated with the control elements connected to an automatic control system, rather than their net reactivity worth.
A new definition (#4) is added to make this wording explicit.
(4) The nuclear safety system is to be separate from any automatic controller. A new definition (#5) is added to define the word " separate".
It should be noted that the original specification (#3.9) is intended to be used in conjunction with the existing MITR analog controller that has been in use for two decades as well as with a
.()
variety of digital controllers of proven design.
(t) Addition of Specification #6.4: A new specification is added to those comprising the experiment section of the MITR Technical Specifications.
Both this new specification and
- 3.9 have the same objective.
However, they differ as to the means of accomplishment.
Specifica tion #3.9 provides assurance of safety by limiting the reactivity associated with the control elements connected to an automatic con-troller.
No restrictions are placed on the design of the controller.
Specification #6.4 takes the opposite approach.
Safety is assured by requiring that the closed loop controller provide " feasibility of control" at the desired termination point of a transient or at the maximum allowed operating power. No restriction is placed on reactivity, although one is placed on period.
Both specifi-cations stipulate that only one shim blade may be withdrawn a t a time.
Specification 6.4 contains five provisions. These ares (1)
Authorizatior. to connect shim blades and/or the regulating rod to a closed-loop controller provided tha t the controller is designed so that control of reactor power will always be feasible at either the
()
desired termination point of any transient or at the sae o.ac 12 JUL 101934
_ 3_ -
~
gS caximum allowed opera ting power.
This provision places
\\m /
no limit on the availhble reactivity of the connected control elements.
However, only one shim blade may be moved at a time.
(2) A requirement that each proposed controller receive a documented safety analysis and approval by the MIT Reactor Safeguards Committee (MITRSC) or, if authorized by the MITRSC, by its Standing Subcommittee.
(3) The nuclear safety system is to be separate from any closed-loop controller.
(4) A period trip set at or longer than 20 seconds will be operable. This trip will transfer control to manual and sound an alarm. The existence of this trip in effect limits the positive reactivity that could be inserted by a closed-loop controller to approximately 0.22% AK/K.
(5) A requirement to verify the operability of the period trip prior to use of the closed-loop controller in any week that it will be used.
It should be noted that the reactivity that could be (S
inserted before reaching the period trip is about 0.22%
(_/
A K/K. Hence, this specificatims is more restrictive than
- 3.9.
However, because specification #6.4 contains no explicit limit on reactivity, any number of control elements may be connected to a closed-loop controller. This will permit experimental study of some sophisticated control s tra tegie s.
In addition to experiments using multiple control elements, experiments of the type described in section 5.3 of MITR safety review #0-84-11 would be performed under the provisions of this specification.
For these experiments, a controller using a new control strategy would be allowed to control the reactor power at some percent of full power.
The decisions of that controller would be reviewed by a closed-loop controller having the property of feasibility of control.
This second controller would intervene if a decision of the first one could result in the attainment of a power level in excess of the allowed operating power.
4 '.
Safe ty Evalua tion s (a)
Specifica tion 3.9:
The safety aspects of the proposed revision to specification #3.9 are already covered by specification #3.2, " Maximum Safe Step Reactivity Addition".
O v
3 R O O-9/.-12 JUL 161384
(b) Specification 6.'4:
The safety aspects of a closed-loop
/~T controller based on the concept of feasibility of control are discussed at length in MITR Safety Review #0-84-11, 5.
Scope of Control Studies:
Safety review #0-84-11 discussed the performance of class A and class B experiments in closed-loop control.
Class A experiments involve the use of control elements that could insert less than 0.7% AK/K and have therefore been-judged by both the MITR Staff and the MIT Reactor Safeguards Committee (MITRSC) to be within the existing scope of the MITR Technical Specifications. Class B experiments do not meet the class A criteria and approval of the amendment to the Technical Specifications contained in this safety review is necessary before they can be performed.
Contingent upon receipt of this approval from the USNRC, the MITRSC has approved the performance of class B experiments that involve control of a shim blade with an available worth of more than 0.7% AK/K.
These experiments could be performed under either the modified specification #3.9 or the new specification #6.4 Following evaluation of experimental tests with a single blade, permission will be requested of the MITRSC to perform experimental control studies with multiple control elements (e.g., shim blade and regulating rod, multiple shim blades etc. within the above restriction regarding withdrawal of only one shim blade at a time.)
6.
Wording of Change Appendix A contains the proposed wording of
['T Technical Specification #3.9 as'well as the proposed wording of Technical Specification #6.4 The proposed SAR changes are listed in Appendix B.
7.
Relation to Safety Review #0-84-11:
Safety review #0,84-11 contains the background material and safety analysis on which the above amendments to the Technical Specifications are based.
O
? ?. c o 34-12 JUL 161934
Appendix.A Proposed Technical Specification Changes 1.
Attached are copies of the proposed technical specification with changes denoted.
O O
e a c. o.e o -12 JUL 16 i E4