Core Protection Calculator (CPC) — CE-Type Protection That Computes DNBR and LPD Directly from Three-Level Ex-Core Signals

Principle and mechanism

Five kinds of input

Calculation chain

1. Ex-core signal correction: the inverse of the shape annealing matrix (SAM) converts the three detector responses into equivalent core-periphery responses (lower, middle, upper), and each segment is multiplied by its CEA shadowing correction factor. The chain then splits in two. Summing the three segments and multiplying by the temperature shadowing factor and the thermal power calibration constant gives the calibrated neutron power; dividing by the sum normalizes the axial shape.
2. LPD calculation: the average linear power is multiplied by the axial shape, the planar peaking factor (Fxy) for the CEA configuration and the penalties, and the maximum gives the peak linear power (LPD).
3. DNBR calculation: the core minimum DNBR is calculated from power, axial shape, cold-leg temperature, pressure and flow. A fast cycle (UPDATE) and a detailed cycle (STATIC) run separately.
4. Dynamic compensation: static offsets and digital filters are applied to the measured cold-leg temperature and pressurizer pressure and to the calculated thermal power, neutron flux power and LPD, to make up for instrument lags. As a result the heat flux used by the CPC during a transient is higher than the actual value, and the calculated DNBR is conservative (APR1400 DC RAI response 15.04.02-1).
5. Comparison and output (TRIPSEQ): values are compared with the pretrip and trip setpoints and contact outputs are generated.

Two shadowing factors

• CEA shadowing factor: when a CEA is inserted at the core periphery, it depresses the flux nearby, so the ex-core detector response falls differently from the core average power. A correction multiplier for each segment, depending on CEA position (including partial insertion within a detector segment), brings the response back in line with the core average. It has the largest effect on the accuracy of the synthesized axial shape.
• Temperature shadowing factor: the coolant density in the downcomer between the core and the detectors changes with cold-leg temperature. When the inlet temperature falls, the water becomes denser and attenuates more, so the detector response falls at the same power. A factor proportional to the change in cold-leg temperature corrects this. It is unrelated to the peripheral power distribution.
• The two factors and the SAM are set each cycle from core design calculations and start-up tests; in normal operation the ex-core power is periodically calibrated to the secondary heat-balance power.

CEAC and penalties

The CEAC detects position deviations within a CEA subgroup (a dropped or misaligned CEA) and sends DNBR and LPD penalty factors to each CPC. It is the device that satisfies GDC 25 (SAFDLs maintained for any single malfunction of the reactivity control system). In early APR1400 design studies, a dropped high-worth 12-finger CEA could cause an immediate trip through a penalty of about 1.3, so an algorithm that actuates the reactor power cutback system (RPCS) and defers the penalty for up to 40 seconds was studied (conference paper, 2008).

What it means in a plant

• Output functions: (1) low-DNBR and high-LPD trips (PPS 2/4); (2) DNBR and LPD pretrip alarms; (3) CEA withdrawal prohibit (CWP: pretrip, subgroup deviation, CEA out of sequence); (4) display of DNBR and LPD margins on the operator module; (5) CEA position display; (6) auxiliary trips. The APR1400 US design certification (DC) documents explain that fast power increases are stopped by the CPCS variable overpower trip and slow increases by the DNBR trip.
• Setpoints: the low-DNBR and high-LPD trip setpoints vary by plant, cycle and DNB correlation (KCE-1 for APR1400 PLUS7 fuel), and the trip setpoints are not the safety-limit values themselves.
• Digitalization: the CPC of the analog era ran assembly-language programs on a minicomputer. Because the hardware went out of production, PLC-based CPCs were introduced in later units, and software verification and validation and protection against common-cause failure became regulatory issues.

COLSS: COLSS monitors, the CPC protects

The core operating limit supervisory system (COLSS) is a non-safety monitoring system that runs on the plant computer. Its algorithm has four steps.

1. Core thermal power: secondary heat balance first, with ΔT power and turbine first-stage pressure power as backups
2. Synthesis of the 3-D power distribution, ASI and azimuthal tilt from the fixed in-core detectors (rhodium detectors at five levels)
3. Calculation of the DNBR-based and LHR-based power operating limits (POL)
4. A margin alarm if the actual core power exceeds the POL

Under the APR1400 DC technical specifications, if COLSS is out of service the plant does not shut down; it monitors with the LPD and DNBR values of the operable CPC channels whether operation is within the COLR acceptable region (SR 3.2.1.1 and 3.2.4.1, every 2 hours). If outside the region, the trend is checked every 15 minutes, and the condition is restored within 1 hour if it is getting worse, or within 4 hours otherwise. If it cannot be restored, thermal power is reduced within 6 hours. CPC-based monitoring has larger uncertainty, so the acceptable region is narrower. For example, the ASI band at San Onofre 2 was ±0.28 with COLSS and ±0.20 with the CPC.

Regulatory and design criteria

For example, in the United States:

Easily confused pairs

Westinghouse-type plants do not calculate DNBR directly. They prevent DNB by reducing the OTΔT setpoint with Tavg, pressurizer pressure and the axial flux difference term f1(ΔI), and prevent excessive linear power by reducing the OPΔT setpoint with Tavg, its rate of change and f2(ΔI). CANDU uses dryout of the fuel bundles in the pressure tubes (critical channel power) instead of DNB. Shutdown systems SDS1 and SDS2 each generate regional overpower (ROP) trips from their own in-core detectors.

Key points at a glance

1. Definition: CE-type safety-class four-channel calculator; computes DNBR and LPD in real time → low-DNBR and high-LPD trips (SAFDL protection during AOOs).
2. Inputs: ex-core three levels, Th and Tc RTDs, pressurizer pressure, RCP speeds, CEA position (RSPT) and CEAC penalties.
3. Ex-core correction: SAM → CEA shadowing factor → temperature shadowing factor → thermal power calibration.
4. Calculation: synthesized axial shape × Fxy → LPD (kW/ft); DNBR by correlation; dynamic compensation (filters and offsets).
5. CEAC: subgroup deviation → DNBR and LPD penalties (GDC 25).
6. Outputs: trip (PPS 2/4), pretrip, CWP, margin display, CEA position display.
7. COLSS: non-safety monitoring (in-core detectors, POL, margin alarm) ↔ CPC protection.
8. COLSS out of service: monitor the COLR acceptable region with CPC channels; if outside, restore or reduce power.
9. Versus Westinghouse: variable OTΔT (DNB) and OPΔT (kW/ft) setpoints, no direct DNBR calculation.
10. Setpoints: plant-, cycle- and correlation-specific; trip setpoints are not the safety limits.