1. B. Rouben McMaster University EP 4P03/6P03 2016 Jan-Apr
CANDU ROP/NOP Systems
B. Rouben
McMaster University
EP 4P03/6P03
2016 Jan-Apr
2016 January

2. Neutronic Protection Systems
CANDU reactors are equipped with protection systems which detect an emergency situation and actuate the safety system(s).
There is a separate neutronic protection system for each SDS.
Each protection system is triplicated [has 3 separate “logic” (or “safety”) channels] and consists of out‑of‑core ion chambers and in‑core self‑powered detectors.
Logic channels are D, E, and F for SDS-1 and G, H, and J for SDS-2.
In each protection system, it suffices that 2 of 3 logic channels be “tripped” for the corresponding SDS to be actuated.
2016 January

3. Out-of-Core Ion Chambers
There are 3 ion chambers in each protection system, 1 per logic channel.
They are located at the outside surface of the calandria (see next Figure).
Each ion chamber trips its logic channel when the measured rate of change of the logarithm of the flux , i.e. the quantity d(ln )/dt, exceeds a pre‑determined setpoint (e.g. 10% per second, i.e., 0.10 s‑1, for SDS-1 in the CANDU 6).
2016 January

4. Ion-Chamber Locations (eg. in C-6)
2016 January

5. In-Core ROP (NOP) Detectors
There are also fast‑response (platinum or inconel) in‑core detectors in each protection system.
In the CANDU 9: 54 in-core detectors for SDS-1, in vertical assemblies, and 48 for SDS-2, in horizontal assemblies (see examples in figure in next slide).
The detectors are distributed among the various logic channels: channels D, E and F contain 11 or 12 detectors each, channels G, H, and J contain eight each.
The detectors trip the logic channels on high neutron flux: when the reading of any 1 detector reaches a pre‑determined setpoint, the logic channel to which it is connected is tripped.
The in-core-detector system is known as the Neutron‑Overpower‑Protection (NOP) or Regional-Overpower-Protection system (ROP).
The detector trip setpoints are determined by an extensive analysis of hypothetical loss‑of‑regulation accidents.
2016 January

6. Location of Some SDS-1 (Vertical) and SDS-2 (Horizontal) NOP Detectors in Bruce A
VFD16-R2D
VFD20-R5D
Assembly
6,16
9,13 17
8,12
4, 20
V F D 3 - R 1 F
VFD3-R1F
2016 January

7. ROP Detector Readings in LOR
Suppose there is a Loss of Regulation (LOR), with power rising.
As the reactor power increases in the LOR, so will the flux increase at detector locations.
The detector reading’s increase will depend on the detector’s location in core, relative to the flux peak, i.e., detectors may “see” the power increase to different degrees.
The design of the detector locations, channelization, and trip setpoints is such that, in the event of a global or local power increase from a wide set of anticipated flux shapes, the system logic initiates a reactor shutdown before Onset of Intermittent Dryout (OID) is reached in any fuel channel.
2016 January

8. Race Between Channel Powers and Detector Readings
For each ROP system, the objective is that 2 detectors in different safety channels reach their setpoint before any fuel channel reaches its critical channel power, taken here as the channel power at which fuel dryout is reached.
Critical Channel Detector
Power Trip Setpoint
Reactor
Power
Increasing
in a Loss of
Regulation
Channel Power Detector Reading
2016 January

9. The ROP design activity must determine:
ROP Design Objective
The ROP design activity must determine:
The number of detectors required (for each ROP system)
Their positions in the various available penetrations, to “see” a very wide range (hundreds) of anticipated flux/power shapes
The detector setpoints
The detector channelization
so that the core is protected against an LOR leading to OID from any of the anticipated flux shapes
2016 January

10. Triplicated Tripping Logic
The tripping logic of each triplicated protection system is as follows (see next Figure):
One ion chamber can trip its logic channel on high log rate, or any 1 detector in the logic channel can trip the channel on high flux.
Any 2 tripped channels will actuate the associated shutdown system.
The triplicated tripping logic reduces the chance of a spurious trip, and allows the testing of the system on-line.
2016 January

11. Triplicated Tripping Logic for SDS-1
2016 January

12. END
2016 January