EVOLUTION OF CORE DESIGN AND OPERATIONAL REQUIREMENTS IN GERMAN PWRS FROM A TECHNICAL EXPERT ORGANIZATION ́S POINT OF VIEW

In the last three decades, core design and operational requirements of German PWRs have evolved significantly in order to optimize plant operation and to react to changed market conditions. In the first phase, steady state operation was optimized to limit plant operation costs or increase availability and power output. The second phase of the evolution was triggered by the necessity of flexible plant operation in order to compensate fluctuating power generation by wind and solar power and by optimization of phase out cores. The changes of core design and operation parameters had among the direct, expected impacts on safety analyses and reactor physics also several indirect and unexpected ones. Examples for expected impacts are changes of reactivity coefficients or boron worth compared to safety analysis assumptions or changes of possible initial conditions of incidents. Unexpected impacts showed for example on rod bow, cladding corrosions or neutron noise. The tasks of TÜV NORD EnSys as technical expert organization is to identify all these impacts of core design and operational parameter evolution, evaluate whether these impacts compromise plant safety, evaluate models and correlations regarding unexpected effects, assess if intended countermeasures are effective and acceptable and evaluate whether the set and ranges of plant parameters used for core limitation and protection are still valid. The paper gives an overview over selected experiences and tasks performed by the Reactor Physics and Criticality Safety Group of TÜV NORD EnSys for the evolution of core designs and operational requirements in German PWRs.


INTRODUCTION
The evolution of the core design and the operational requirements of German PWRs in the last three decades can roughly be divided in two phases. The first phase, starting in the late 1980s was marked by the economical optimization of steady-state operation, which was the normal mode of operation in German NPPs. The optimization was enabled by the increasing operational experience and improvements in codes and computers. It was achieved e.g. by the increase of nominal plant power, more economical fuel utilization and implementation of new fuel designs. The second phase of the evolution was due to changing political and market conditions. It is marked by increases of operational flexibility in order to compensate increasing fluctuations of the power generation by wind and solar and by the preparation and design of phase out cores. This was achieved mainly by the adaptation of core design strategies, but also by introduction of automated systems to limit axial Xenon and power density redistributions due to load follow operation with minimum amount of manual actions. Figure 1 shows schematic views of the relative reactor power and of the insertion of the control rod cluster (4 CRA) used for reactor power control of a recent (cycle N) and an approximately 10 year old cycle (cycle N-10) of a German ~4000 MWth PWR. The thick line marks the zero power line of the y1axis and the insertion of 360 cm, which is full insertion of a control rod bank, on the y2-axis. This paper shows some of the consequences of these changes of the core operation.  The changes of the core design and plant operation have several effects on safety aspects of the plants. Direct effects may be possible margin reductions e.g. due to higher peak power because of higher total power, more heterogeneous power distributions or power density redistributions. Additionally, safety analyses can be affected by changes of key parameters such as boron worth and reactivity coefficients or the set of possible transient or accident initial conditions. In addition to these rather direct effects, the changed operational conditions can have indirect and unexpected effects like rod bow, increasing neutron noise or cladding corrosion. These indirect effects have to be determined and partly new models and correlations to directly observable plant parameters have to be implemented and verified in order to guarantee safe operation.
In the following, we will give an overview over direct and indirect impacts of the evolution of core design and operational requirements of German PWRs experienced by TÜV NORD EnSys.

REASONS AND MEASURES FOR THE EVOLUTION OF CORE DESIGN AND PLANT OPERATION IN GERMAN PWRs
The economical optimization of the reactor operation was mainly achieved by the uprate of the thermal reactor power the improvement of the fuel usage by x Increase of the fuel enrichment up to 4.95 wt-% U235 and target fuel assembly burnups up to 65 MWd/kgHM, x Implementation of U-Gd-, ERU-(enriched reprocessed uranium) and MOX-fuel, x Implementation of new fuel assembly designs (e.g. spacer grids) and materials x Modification of cycle lengths from 6 to 18 month cycles x Reduction of neutron leakage / systematic change of the core design strategy x Design of cores with little or no fresh fuel assemblies due to preparation of phase-out cores In the last two decades, the operational requirements of Nuclear Power Plants and thus PWRs in Germany have changed significantly due to changing political requirements and market conditions. Two main points are the nuclear phase out and the increasing amount of fluctuating power generation by wind and solar. Consequently, load flexibility has become more and more important and plant operation changed from stationary full power towards load follow operation. Core designs evolved either in order to enable these changes (e.g. cycle lengths, neutron leakage) or to adapt to the changes and keep key safety parameters within the ranges defined by safety analyses.

TASKS AND EXAMPLES OF EXPERIENCE OF TÜV NORD EnSys AS TECHNICAL EXPERT ORGANIZATION
The measures implemented in order to optimize the reactor operation and to adopt to changing operational requirements had potential impact on key safety parameters or the validity of safety analyses. Accordingly, a main goal of the evolution of the core design has been to identify and limit this impact on safe plant operation and safety parameters and to keep them within the valid range of the safety analyses. In some cases, this could be achieved quite easily, while in some cases, new or additional safety analyses, operational restrictions or even adaption of plant equipment were necessary. The tasks of TÜV NORD EnSys as technical expert organisation are to x Identify all possible negative impacts on plant safety, x Check whether all safety parameters remain within the range of safety analyses, x Check whether the methods and codes used for core design are still valid with the new plant parameters, x Assess whether the actions taken to limit the impact on plant safety are effective and acceptable, EPJ Web of Conferences 247, 11005 (2021) PHYSOR2020 https://doi.org/10.1051/epjconf/202124711005 x Evaluate whether the set of plant parameters used for core limitation and protection and their acceptable range are still sufficient. Operational experience shows that beside the rather obvious impacts, the evolution of the core design and operational requirements has also some indirect consequences that are more difficult to predict. This is sometimes also true for actions taken to limit negative direct impacts of the changes. A high level of understanding and knowledge of many fields like reactor physics, materials, I&C, assumptions and limitations of methods and codes etc. and their interactions is necessary to identify and assess the effects of the evolution. In the following, we will describe a selection of impacts of the evolution of core design and plant operation experienced in German PWRs.

Boron Worth
Due to the increased average core burnup, caused by the increase of the fuel assembly (FA) target burnup, and the introduction of MOX fuel the neutron energy spectrum inside the reactor shifted towards higher neutron energies. This reduces the reactivity worth of the thermal absorbers Ag-In-Cd in the control rods and of the boron dissolved in the coolant, which are used for reactivity control. The loss of reactivity worth of the CRs could be largely reduced by the core design so that the total CR worth remained within the range of the safety analyses. The reduction of the absolute value of the boron reactivity coefficient could however not be sufficiently limited to keep the value in the accepted range of the safety analyses. This has two consequences for plant safety. First, the rate of reactivity reduction by boron injection with maximum injection rate would be lower than the minimum rate assumed in the safety analyses. Secondly, the total amount of reactivity that can be compensated by the boric acid in the storage tanks can be lower than required by the safety analyses. The easiest way to solve this problem was the introduction of enriched boron with B10-abundances between 27 and 30 at-% instead of natural boron with approximately 19.8 at-% B10. This resulted in an increase of the boron reactivity coefficient by a factor 1.38 to 1.53. Figure 2 shows a typical evolution of the boron reactivity coefficient at Beginning of Cycle (BOC). The grade of the B10-enrichment is selected so that the boron reactivity coefficient of anticipated future cores remains sufficiently negative, while at the same time not getting too high (absolute value), because this would lead to an unacceptably fast reactivity increase in case of a dilution accident.

Neutron Flux Noise (NFN)
The signal of the prompt incore and excore neutron flux detectors, which are used in reactor safety limitation and protection systems for the determination of global reactor power and local power densities, has always shown signal noise. The highest amplitudes of this noise is in the low frequency range < 2 Hz. It is mainly caused by statistical effects and moderator density and temperature fluctuations. Between the years ~2000 and ~2015, the amplitude of the low frequency NFN has approximately doubled and has remained stable in the last approximately 5 years due to saturation effects and countermeasures. The tasks for TÜV NORD EnSys were to evaluate the identification of the causes of the increase of the low frequency NFN amplitudes and its impact on operation safety and to evaluate actions taken in order to limit either the NFN amplitude or its impact on plant safety. As the low frequency NFN is a thermal noise mainly caused by moderator temperature fluctuations, increasing amplitudes with higher core burnup and implementation of MOX fuel were expected due to the increase of the absolute value of the moderator temperature coefficient. Analysis of the observed effect and the moderator temperature coefficient however showed, that this could only partly explain the NFN amplitude growth.  Figure 3 shows the observed evolution of the averaged NFN peak-to-peak difference compared to prediction calculations based on the moderator density reactivity coefficient. For illustration, the spectral index, which is the ratio between fast and thermal flux, is also given in figure 3. As can be seen, the evolution of the low frequency NFN amplitude is in good accordance with the prediction based on the temperature until cycle n+8. Starting with cycle n+9, however, the observed amplitudes are greater than the ones that are caused by the moderator temperature coefficient. Accordingly, there had to be some additional effect that lead to increasing NFN amplitudes. Further analyses showed that the growth of the NFN amplitudes was linked to the implementation of fuel assemblies with modern thermal hydraulic designs and materials. A discussion of the theoretical background of the NFN given e.g in reference [1].Models suggest that changes of the stiffness of the fuel assemblies and of the thermal hydraulic parameters lead to unfavorable vibration characteristics. The growth of the NFN amplitude could be stopped and the amplitude could partly be reduced by further optimization of the fuel assembly properties.
The key parameters for the evaluation of a possible direct impact of the increased NFN amplitude on plant safety are the average fuel temperature, which is a measure for the stored enthalpy in the fuel, and the heat flux between fuel, cladding and coolant, which define fuel cooling and the thermal hydraulic conditions in the coolant (DNBR). The amplitude of the fuel temperature oscillation caused by a periodic oscillation of the fission power is damped by the fuel heat capacity with a reduction factor where W is the fuel temperature time constant and Q the oscillation frequency. Typical values are 3.5 s for the fuel temperature time constant and 1 -2 Hz for the oscillation frequency. Analyses show that even with the increased NFN amplitudes, the variations of the fuel temperature are 10 -15 K, which is in the acceptable range [2]. The increase of the NFN amplitudes has, however, also indirect impact on plant safety. Due to the statistical nature of the noise and possible superposition of different oscillation modes, individual peaks with significantly higher amplitudes than the averaged one are possible. Such peaks can trigger either the rod drop detection (LOLA) in case of a flux decrease or the reactor protections system (L-RELEB) in case of a flux increase. The actual operation has shown that in most cases these events triggered only the first actuation value of the reactor protection system, which has no direct impact on plant operation or plant safety, but only initiates passive measures. For example, the first actuation level of the L-RELEB locks all control rod withdrawal and dilution commands. However, also actuation of the second actuation value of the protection function resulting in a reactor trip have occurred in rare cases. The impact on plant safety, however, is not directly caused by the erroneous actuation of the protection functions or even reactor trip, but is a psychological one: The actuation of a protection function triggers a high priority notification to the plant operator's information system and should lead to investigations of the root cause of this actuation event. Frequent erroneous actuations of the L-RELEB with partially more than two events per day bear the danger that the cause of the event is not investigated but only accounted as NFN effect, so that different causes and a possible the development of potential "real" safety issues may be masked [2]. To avoid this, signal filters were installed in some plants with higher low frequency NFN noise already 25 years ago. In the course of the low frequency NFN amplitude growth, coefficients for existing filters were adapted and plants where no signal noise reduction was used in the past newly implemented signal filters. TÜV NORD EnSys assessed the adaptation and implementation of the filters of the signals that are used in core protection and supervised the correct installation in order to assure that the filters do not cause inacceptable delays of the actuation of core protection actions.

Cladding Corrosion
The integrity of the fuel rod cladding plays a major role for plant safety. The fuel rod cladding is not only used to encapsulate the fuel, but also to prevent nuclear fission products from leaking. Additionally, the fuel rod cladding material has a strong influence on the mechanical properties of the fuel assembly, fuel rod cooling and neutronics. Zirconium and its alloys exhibit a low thermal neutron absorption cross-section, good corrosion resistance in high-temperature and high-pressure steam or water, and adequate mechanical properties. These alloys are therefore widely used as cladding and guide tubes in pressure water reactors. During a long service period, the microstructure and properties of zirconium alloys change gradually in the harsh in-pile environment including water, stress, corrosion medium and intense neutron irradiation. Understanding the mechanisms of corrosion of zirconium alloys is an important issue because it is one of the parameters that affect the service life of fuel rods. It is well known that as long as the growing oxide layer remains protective, the diffusion of oxygen vacancies is the rate-limiting mechanism for zirconium oxidation. The oxide growth occurs at the metal-oxide interface and leads to a parabolic kinetic law. Several types of corrosion have been studied in order to represent the different oxidizing environments of the clad that lead to different mechanisms. Uniform waterside corrosion in reactor operating conditions is one of the most common mechanisms. For the compliance with the safety analyses, the oxide layer thickness has to remain below the analyses' limit for the maximum oxide layer thickness. For this reason, corrosion resistance is a basic condition in the development of new cladding materials and validated models have always been in use to predict the corrosion behavior per cycle in order to prevent core designs that would lead to unacceptably high corrosion. The oxide layer thickness of samples of fuel assemblies is measured during the core reloading in order to verify that oxide layer thicknesses remained in the acceptable range and to validate the prediction models. Experience showed good agreement between the prediction and the sample results. The leading corrosion mechanism is the thermal corrosion. Consequently, the maximum oxide layer thickness of this model is usually located at approximately 85 % of the core height, where the combination of moderator temperature and local power are most favorable for this corrosion mechanism. The corrosion occurs mainly in the 1 st and 2 nd irradiation period, because the power density and thus the cladding temperature are usually highest at this time. Additionally, the corrosion leads to the build-up of an oxide layer that inhibits the oxygen transport and thus reduces the oxidation rate. Due to the build-up of a protective oxide layer and the only small impact of the evolution of the core design and operation on local peak power density, the impact on cladding corrosion was rather small. The total oxide layer thicknesses could altogether be reduced in the last decades by the optimization of the core design, water chemistry and the implementation of new Low-Niobium Zirconium alloys as cladding material.
In the last few years, a new corrosion effect has been observed at some of the fuel assemblies of one cladding material that usually showed very low corrosion and good accordance with the corrosion prediction in the active core height. Figure 4 shows a schematic view of the measured oxide layer thickness of this corrosion around the 9 th spacer grid. As can be seen in this figure, this type of corrosion occurs in the region between the 8 th and the 9 th spacer grid and reaches its maximum above the upper end of the active zone. In this axial region, the fission power is zero or close to zero, wherefore the underlying corrosion effect cannot be thermal corrosion. Consequently, the established models and theories do not correctly predict the oxide layer growth. The investigation of the leading mechanism of this corrosion is still ongoing [3], [4]. Accordingly, there is at present no validated model for the prediction of this corrosion effect. The task for TÜV NORD EnSys as technical expert organization with respect to this type of corrosion is to assess models of the plant operator and the manufacturer, to identify possible key parameters linked to the corrosion and to evaluate possible operational restrictions in order to assure that the total maximum oxide layer thickness remains below the acceptable limit.
Restrictions for the corrosion limitation may be on core design such as maximum power densities of affected fuel assemblies, but also on plant operation, like restrictions on control rod movement (compare figure 1), control rod positions or peak power in the uppermost axial layer of the fuel assemblies. TÜV NORD EnSys has also to evaluate whether the set and actuation values of control parameters used for reactor control, limitation or protection is sufficient to automatically monitor or assure the compliance with the evaluated restrictions or whether further actions are required.

CONCLUSIONS
The core design and operational requirements of German PWRs have evolved significantly in the last three decades. This evolution was caused by technical improvements, economical optimization and changing political and market conditions. TÜV NORD EnSys as a technical expert organization has accompanied these changes for several decades as governmental contractor. Our tasks were to ensure safe plant operation by x Identification all possible negative impacts on plant safety, x Checking whether all safety parameters remain within the range of safety analyses, x Checking whether the methods and codes used for core design are still valid with the new plant parameters, x Assessment whether the actions taken to limit the impact on plant safety are effective and acceptable, x Evaluation whether the set of plant parameters used for core limitation and protection and their acceptable range are still sufficient. Experience shows that besides the rather direct and intuitive consequences of the evolution of the core design and plant operation, there are also several indirect impacts on plant safety. A high level of understanding and knowledge on reactor physics and every field of plant operation and the links between these fields is necessary to identify all the impacts of the evolution of the core design and operational requirements on plant safety.