The subassemblies rest on a support structure, often known as a “diagrid”, which also serves to distribute the coolant from the cir­culating pumps. A typical arrangement is shown in Figure 3.22: each subassembly terminates in a hollow spike that is located in a hole in the diagrid, and coolant enters the subassembly through slots in the spike. If the coolant is a liquid metal, when it is flowing the pressure inside the diagrid is some 200-400 kPa above the hydrostatic pressure of the coolant outside, and this causes a substantial lifting force on a subassembly, which can exceed its weight. To prevent it floating away a “hold-down” mechanism is required. In the case of sodium coolant this can be done by arranging for the spike to pass right through the diagrid, so that its lower end is exposed to coolant at low pressure.

Alternatively, for sodium, hold-down can be provided by a rigid structure above the core that prevents upward movement. In the case of lead coolant a hold-down structure above the core is

essential because otherwise the subassemblies would float away when the coolant flow-rate and the pressure in the diagrid are low. The hold­down structure has to make provision for the coolant flow to leave the subassemblies and for the control-rod drive mechanisms to operated through it, and also to allow for the subassemblies to be removed and replaced. Figure 3.23 shows, in diagrammatic form, how diagrid, subassemblies and hold-down are commonly arranged.

The wrappers contain high-pressure coolant from the diagrid but the space between the wrappers is open at the top to low-pressure coolant, so that there is a pressure difference across the wrappers of the order of 100 kPa. This induces stresses, and in the core region, where the neutron flux is significant so that irradiation creep takes place, the flat faces of the hexagonal wrappers bulge outwards. If this brings neighbouring wrappers into contact self-welding may occur and withdrawal of irradiated subassemblies may be difficult. The size of the gap between wrappers, which is determined by the thickness of the hard pads where contact between subassemblies is allowed, must be great enough to prevent contact occurring anywhere else. Typically a gap of 6-8 mm is required.

During the initiation phase the geometry of the core is reasonably intact. The prompt-critical excursion takes place so rapidly that there is no time for much movement. It is therefore relatively easy to calcu­late what happens by means of a code (much more complex that the simplified model described earlier) that couples transient neutronics with heat transfer and fluid mechanics, including melting and boiling, in multiple channels.

The subsequent “transition” phase is made more complicated by potential melting of the entire core structure. There are two major concerns: that the fuel might accumulate into a new super critical mass (“recriticality”), or that there might be a violent thermal interaction between the molten fuel and the coolant. The latter is of concern because, under circumstances that are very imperfectly understood, such an interaction might be explosive. (As explained in section 5.1.2, this is analogous to a “steam explosion” caused by contact between molten metal and water. It is often called a “vapour explosion” or a “molten fuel-coolant interaction”, MFCI.)

Transition phase calculations are very complicated because they involve transient three-dimensional multi-phase fluid mechanics and heat transfer coupled with transient neutronics, and the uncertainties in the results are large. In principle it is possible to surmount this difficulty in a safety argument by making pessimistic assumptions at every point of uncertainty in the calculation, but in practice this usually results in predicted releases of mechanical energy capable of breaching any reasonable containment.

It is of course impossible to validate a complete transition phase calculation code experimentally without destroying at least one, prob­ably several, complete reactors. Small-scale experiments can however be used to validate individual steps in the calculation. For example kilogram-scale MFCI tests show that sodium vapour explosions are rare and when they do occur they are mild. Similarly small-scale tests on the motion of molten fuel indicate that recriticality in the core is very unlikely.

Figure 5.14 illustrates some of the phenomena and the difficulties encountered in a transition-phase calculation for a Slow LOF accident in a large sodium-cooled core. It shows the state of the fuel, cladding and coolant as functions of axial position and time in one subassembly. As the coolant flow-rate decreases it gets hotter and eventually starts to boil at the core outlet level. The vapour ejects the liquid coolant from the subassembly, mainly upwards into the hot pool. Liquid from

the hot pool then falls back into the voided subassembly, boils and is ejected again, and this cycle may take place several times in a few seconds. The motion of the coolant is accompanied by large reactivity changes. When the liquid coolant is ejected the fuel is deprived of most of its cooling and within a second or so the cladding melts so that the fuel itself is free to move. If the fuel remains in the core it then melts after a further period of a few seconds.

The possibility of recriticality arises when the cladding melts. When this happens the fuel pellets or fragments of pellets are likely to be carried out of the core region by the coolant (either vapour or a two — phase boiling mixture) or by fission-product gas escaping from the plena in fuel pins, but there is a small probability that liquid reentering the core may carry fuel towards the core centre. If the fuel melts there is a possibility of an MFCI.

If the results of small-scale experiments are used in a “best estim­ate” (as opposed to “pessimistic”) transition-phase calculation the fuel is assumed to be swept out of the core and the resulting energy release is predicted to be mild and containable. Such a conclusion is usu­ally found satisfactory (by nuclear licensing authorities, for example) because the low frequency of the initiating event (the TOP or LOF), coupled with the low probability of failure of the protective system, is sufficient to demonstrate that the frequency of containment failure (and consequent release of radioactive material into the environment) is acceptably low.

If a control rod is inserted a distance x into the core, as shown in Figure 1.22, the change in reactivity (neglecting any effects other than neutron capture) is proportional to the integral of фф* over the length of the rod times the difference between the capture cross-section of

the material making up the rod and that of the material (presumably coolant) it displaces — i. e.

Ap a J ^<pg<pg( ^ ^ dx. (1.46)

The result is an S-shaped curve of reactivity against position as shown in Figure 1.22. The reactivity change on inserting a control rod fully into the core is usually called the “worth” of the rod.

This first-order perturbation theory estimate is not an accurate indication of the worth because the distributions of ф and ф* are altered by the presence of the rod. Figure 1.23 shows the axial variation of the total flux ф with control rods withdrawn and with all the control rods inserted a third of the way into the core. The presence of the rods in the top of the core pushes the flux towards the bottom.

Figure 1.24 gives an impression of the flux distribution around a single partially-inserted rod and indicates how the flux is depressed in its vicinity. The result is that the reactivity worth of one control rod

Control

Figure 1.24 Flux depression in the vicinity of a control rod.

depends on the position of all the others, and there are many control rods and shut-off rods in a large reactor. The worth of a rod is lower if the neighbouring rods are inserted and higher if they are not.

It is normal, however, to move the control rods together to keep flux distortion across the core to a minimum. If this were not done the power density might be higher on one side of the core than the other, causing greater non-uniformity of coolant outlet temperature and therefore more entropy gain due to mixing. There would also be variations of the fuel burnup rate.

On irradiation a series of annular zones are formed depending on the radial temperature distribution, as shown in Figure 2.22. There is an outer а-phase zone in the cool periphery with a p-phase zone inside it and, if the temperature is high enough, a у-phase zone inside that. The redistribution of the constituents of the fuel alloy is also shown in Figure 2.22. The solubility of zirconium is different in the different phases and as a result it tends to migrate out of the p-phase both outwards to the а-phase and inwards to the у-phase. Uranium is displaced in the opposite directions into the middle annular zone while

the plutonium remains largely undisturbed. If the central temperature is lower, however, the central region may be depleted in zirconium. Table 2.3 gives typical local concentrations of the alloy components, based on electron microprobe data, for an element with a high central temperature.

The simplest and most effective means of monitoring impurity levels is a plugging meter, which measures the temperature at which solids are precipitated. Figure 4.7 shows the principle of a plugging meter. Sodium flows through an orifice, the pressure difference across which is monitored. As the sodium temperature is reduced the pressure dif­ference rises when impurities are precipitated. A plugging meter is a valuable practical guide but gives little indication of what impurity is causing the blockage. It can tell the operator that an impurity is present, but not what it is.

Oxygen and hydrogen concentrations can be measured separately (Hans and Dumm, 1977). The oxygen concentration can be meas­ured by an electrolytic meter in which the electrolyte is a ceramic (ThO2 doped with YO2) that separates the sodium, which forms one electrode, from an air reference electrode. The potential generated depends on the oxygen concentration in the sodium. The main prob­lem is that the ceramic electrolyte is very brittle and susceptible to thermal shock, so the temperature of the sodium has to be controlled very carefully.

Hydrogen concentration can be measured by utilising its ability to diffuse through a nickel membrane into a carrier gas such as argon.

The concentration of hydrogen in the argon can then be measured by a katharometer, which depends for its operation on the marked effect of the hydrogen on the thermal conductivity of the mixture. Alternatively the membrane can be evacuated by a vacuum pump of known pumping speed. The hydrogen pressure upstream of the pump, which can be measured by an ionisation gauge, depends on the rate of diffusion through the membrane and therefore on the hydrogen concentration in the sodium.

1.1 INTRODUCTION

1.1.1 Physics and Design

Whether the purpose of a fast reactor is to generate power, to breed fissile material, to consume fissile material or to consume nuclear waste products, whether its chain reaction is to be critical and self-sustaining or subcritical and driven by an external source of neutrons, reactor physics — the understanding of the nuclear reactions that take place in it — is fundamental to its design in two ways. Firstly, criticality is a question of reactor physics. The designer of the reactor has to determine the size and composition needed to make the reactor critical or to achieve the required degree of subcriticality, to predict the effect on reactivity of movement of the control rods and the burnup of the fuel, and to estimate the reactivity changes that come about in the course of normal operation and under abnormal conditions. Secondly, he or she has to know the rate at which various nuclear reactions take place, for on these depend the power generated and its distribution within the reactor, the burnup of the fuel, the breeding or destruction of fissile material and nuclear waste, the alteration of the properties of the materials of which the reactor is constructed, the build-up of radioactivity, and the need for radiation shielding.

Reactor physics is not, however, the only important influence on design. Heat transfer, structural, metallurgical, and safety considera­tions are also important, and the design ultimately chosen is a com­promise. In reaching this compromise a designer’s overriding aim is that the reactor should be as effective as possible in achieving its objectives, provided that it is safe.

As the composition of the fuel changes with burnup the reactivity changes. If the power is to be kept constant equation 1.48 shows that either the source strength has to be changed by altering the accel­erator beam current, or the reactivity has to be adjusted by moving control rods. However one of the potential advantages of an ADR
over a critical reactor is the possibility of dispensing with control rods altogether. This reduces L, making more neutrons available for use (equation 1.49), and it also reduces the complexity and therefore the cost of the plant.

If the ADR has no control rods it has to remain subcritical, with a safety margin, at all times in the refuelling cycle, and this means that at the times in the cycle when the fuel is least reactive ke is significantly less than one. This has to be compensated for by increasing the beam current. If, for example, the reactivity changes by 3% during a run, with a 1% safety margin ke varies between 0.96 and 0.99, which requires the beam current to be changed by a factor of 4 to keep the power constant.

This imposes limitations on the design and cost of the accelerator, which has to be powerful enough to provide the high current needed when ke is low but is operating well below its capacity most of the time. To avoid this disadvantage, therefore, it may be preferable to accept the alternative disadvantage of installing control rods. It may then be possible to operate the plant close to critical — possibly with ke и 0.995 — at all times, with a steady beam current and steady power.

Two other important dimensions, the height of the core and the spa­cing between the fuel elements, are determined mainly, although not completely, by the coolant. The flow of coolant through the core is subject to limitations on temperature rise, pressure drop, and velocity, none of which can be too high.

If the height of the core is H, so that the power output from the highest rated fuel element is qmax fzH, then

qmax fzH = AvmaxPc^Tc^ (3.5)

where p and c are the density and specific heat capacity of the coolant, ATc is the temperature rise of the coolant as it passes through the core, and vmax is the mean velocity of the coolant associated with the highest rated element. A is the coolant flow area per fuel element and depends on the spacing of the fuel elements.

The temperature rise ATc is the difference between the coolant temperatures at the core outlet and inlet. The outlet temperature is fixed by the need for adequate strength and resistance to creep in the cladding and structural materials, whereas the inlet temperature is determined by the design of the steam plant and by the need for adequate resistance to thermal shock in the event of a sudden change such as a turbine trip (see section 4.2.4).

The maximum coolant velocity vmax is limited by considerations of erosion, vibration and pressure drop. For sodium it cannot exceed about 10 ms-1, partly because of the risk of erosion of steel cladding, and partly because vibration of fuel elements and structural compon­ents is much more difficult to control at higher velocities. For lead, with its much higher density, the limit is much lower and is usually set at 3 ms-1 or less.

As explained later (section 3.4.1) it is normal to restrict the coolant flow to less highly rated fuel elements so that the temperature rise is uniform across the core. The pressure drop is therefore determined by the most highly rated fuel. It is convenient to think of it as being given by an expression of the form

APc = C (1/2Pviax) (4H/Dh), (3.6)

where Dh is the hydraulic diameter of the coolant channels (which depends on the separation of the fuel elements) and C is a constant with the nature of a friction factor. Equation 3.6 is useful as an illus­tration but in reality the situation is not so simple because the value of C depends on the details of the design of the coolant channels and especially on the nature of the fuel element supports.

If the radius of the fuel elements is fixed then A in equation 3.5 and Dh in equation 3.6 are determined by the fuel element spacing. Consequently these two equations can be used to determine vmax and APc as functions of H and the spacing. Typical results for a 1 m high

core (H = 1) cooled with sodium are shown in Figure 3.1. The fuel elements are taken to be arranged in a triangular array the shape of which is determined by the ratio of pitch to diameter P/D, and the power is taken to be 2500 MW (heat). P/D determines the coolant flow area associated with each fuel element and, because the total number of fuel elements is fixed by the total power output and the linear rating, the overall diameter of the core.

The choices open to the designer can now be seen. If for example APc is required to be no greater than 0.3 MPa, P/D must be greater than about 1.3 and the core diameter something more than 2 m. If the core is lower (H > 1m) the pressure drop and coolant velocity are lower so P/ D can be reduced, but at the cost of making the core diameter greater. This is undesirable becauseit forces the entire reactor structure to be larger and increases the capital cost of the plant. Higher

values of APc are possible, but if it exceeds about 700 kPa cavitation and the generation of noise may be important.

Figures 3.2 and 3.3 illustrate the choices available with different coolants. If lead is used its high density requires a much higher pressure drop, and this and the more stringent limitation on velocity to avoid damaging erosion force a considerably larger value of PID, typically at least 1.5, and with it a larger core diameter. Velocities are much greater if the coolant is a gas, of course, and even with the relatively high density of supercritical CO2 at a pressure of 20 MPa, to which Figure 3.3 refers, they are of the order of 50 ms-1, but the pressure drop is not unduly high and PID < 1.4 is possible.

There are many other choices to be made because other paramet­ers, such as the maximum linear rating and the core temperature rise, can be varied. The ultimate choice depends on the criteria used for optimisation, including safety (see Chapter 5) and economics.

The features described in section 5.1 are present whatever the details of the design. Protection is also given by systems designed deliberately to prevent accidents or to prevent them from causing damage. Very often protective systems serve the dual function of preventing injury to people (plant operating staff and the general public) by stopping the release of radioactivity, and of minimising damage to the reactor itself.

“Active” protective systems depend on detecting that something is wrong and then taking automatic protective action, which is usu­ally to shut down the reactor. The output from a sensor, such as a thermocouple or a neutron monitor, is amplified and compared with a reference, or “trip”, level. If the trip level is exceeded the protective action is taken.

If the trip system is to offer real protection a “fail-safe” system must be employed. This means that if the sensor itself fails the dangerous condition should be indicated. Thus if a thermocouple circuit is broken or short-circuited the amplifier must give an output above the trip level. If the high voltage supply to a neutron detector fails so that it gives zero output the trip circuit must be activated.

It is of course essential to avoid tripping the reactor unnecessarily, and it must certainly not be tripped every time a thermocouple fails. This implies that a “two-out-of-three” system or a variant of it has to be used. Each of the sensors needed for protective action is triplicated. If one indicates danger an alarm is sounded but no other action is taken. If two or more indicate danger the reactor is tripped. This reduces the frequency of spurious trips due to sensor failures because they happen only if two fail at the same time. Introduction of a fourth sensor allows maintenance of one instrument while the reactor is operating without compromising the two-out-of-three reliability. A detailed statistical discussion of the reliability of multiple protective systems is given by Lewis (1977), pp. 103-126.

Different sensors monitor the various reactor parameters that indicate it is operating safely (see section 5.2.2). The output from each two-out-of-three sensor channel feeds in to two or more “guard lines”. These are electrical circuits that, when energised, effect the reactor trip — usually by inserting the control rods. The design logic of guard lines is described by Aitken (1977).

To maximise the reliability of the guard lines they are normally redundant, independent and diverse. Redundancy is achieved by providing at least two independent guard lines, either of which is capable of shutting the reactor down. Independence is achieved by ensuring that they are separate, both physically (the components and cables are in different places remote from each other) and electrically (they are supplied from different sources). Diversity is achieved by ensuring that they operate by different principles. For example one guard line may be based on computer software, whereas another may utilise mechanical relays and switches.

The principal action taken automatically when the reactor is tripped is to insert the neutron-absorbing rods — both control rods and shut-off rods — into the core. It is essential that this insertion should be as reliable as possible. A typical arrangement is for the neutron absorber to be connected to the actuator, by which it is moved in nor­mal operation, by an electromagnet. When the reactor is tripped the action of the guard lines is to interrupt the current to the magnet so that the rod falls into the core under gravity.