In terms of its physical properties, carbon dioxide is the best available gaseous coolant, and consequently it was chosen for the large U. K. Magnox and AGR power stations. In the Magnox reactors, the graphite moderator has a maximum temperature of only about 350°C. At these temperatures C02 is unreactive with graphite, nor does it react with the canning material, the circuit steels, or the fuel (uranium metal). When the temperature is increased, difficulties arise be­cause of the chemical reaction:

C02 + C ^ 2CO

Here, the C (carbon) represents the moderator graphite blocks, and the reaction slowly removes the moderator from the reactor, decreasing the strength of the graphite core. The above reaction is induced not only by higher temperatures but also by increasing nuclear radiation.

The occurrence of the carbon dioxide-graphite reaction is a potentially very serious limitation since the structure of the core, including the alignment of the fuel channel, is dependent on the physical strength of the graphite blocks. In the case of the advanced gas-cooled reactor, there have been two approaches to solving this problem:

1. The inlet (relatively cold) carbon dioxide is fed through the moderator struc­ture to the entrance of the fuel channels, thus keeping the moderator at a lower temperature.

2. Carbon monoxide and methane are added to the carbon dioxide to inhibit the above chemical reaction. The mechanisms by which this inhibition is achieved are complex. One mechanism is that the additives produce a thin layer of carbon on the graphite, and this carbon layer reacts sacrificially with the coolant, preventing attack on the bulk structural graphite. A difficulty here is that the carbon may, under certain circumstances, be deposited on the fuel elements themselves. As we saw in the preceding section, heat trans­fer from the fuel elements is critically dependent on small isolated rib rough­nesses on the surface of the cladding. Smoothing out of these roughnesses by carbon deposition would negate their enhancement of heat transfer and lead to a rise in the fuel element temperature. Very precise chemical control is therefore required in AGRs.

The worst accident in the United States happened in March 1979 at the No. 2 re­actor at the Three Mile Island nuclear plant near Harrisburg, Pennsylvania. The plant consists of two Babcock & Wilcox pressurized-water reactors, each having an electrical capacity of 961 MW(e).

At about 4 a. m. on March 28, 1979, a condensate pump moving water from the condensers in the turbine building stopped. This led to tripping of the main steam generator feedwater pumps (which would otheiwise have been starved of water), which in turn led to the turbine’s being tripped. As we saw in Chap­ter 4, this is a normal upset condition, and the incident should have proceeded benignly according to the design. To see why this did not happen, it is helpful to examine each phase of the accident in turn.

Phase 1. Turbine Trip (^-6 nun). This phase is illustrated in Figure 5.1. The valves that allow steam to be dumped to the condenser opened as de­signed and the auxiliary feedwater pumps started. The interaction of the flow of feedwater to the steam generators caused a reduction in heat removal from the primary system. The reactor coolant system responded to the turbine trip in the expected manner. The reactor coolant pumps continued to operate and to

maintain coolant flow through the core. The reactor coolant system pressure started to rise because the heat generated by the core—which was still operat­ing—was not being removed from the system at the required rate by the steam generators. This rise in system pressure caused the power-operated relief valve (PORV) on top of the pressurizer (1 in Figure 5.1) to operate to relieve the pres­sure. However, the opening of this valve was insufficient to reduce the pressure immediately, and the pressure continued to increase. The operation of the valve occurred between 3 and 6 s after the turbine trip, and the pressurization con­tinued until 8 s after the start of the incident, when the primary circuit pressure reached 162 bars. At this point the control rods were automatically driven into the core as a result of a protection system signal’s detecting the overpressuriza­tion. This immediately stopped the fission reaction. At this early stage all the au­tomatic protection features had operated as designed, and the reactor had been shut down. However, as we explained in previous chapters (and as indicated in Table 2.2), the decay heat remains significant. Under normal circumstances this can be dealt with straightforwardly by the various coolant systems.

At 13 s the now-decreasing coolant pressure reached the set point for auto­matic closure of the PORV. The valve failed to close, and this first departure from the expected response changed the incident from an upset into an emergency event, as defined in Chapter 4. The sequence that started at this stage was very similar to the small-break accident described in Section 4.3.4. Coolant circuit water was being lost through the stuck-open PORV. In the secondary circuit, all three auxiliary feedwater pumps were running, yet the water level in the steam generators was continuing to fall and they were drying out. The reason for this was that no water was actually being injected into the steam generators because of closed valves between the auxiliary pumps and the steam generators. The valves had been closed some time before the incident (probably at least 42 h earlier) for routine testing and had apparently been inadvertently left in that po­sition. The warning lights indicating the valve closure had been obscured by tags on the control board.

Thus, during this first crucial period, the reactor coolant circuit was deprived of an effective means of heat removal and could only dispose of the energy by blowing off water and steam. As we saw in Chapter 4, this was an inadequate heat removal method. One minute after the incident, the difference in tempera­ture between the hot and cold legs of the primary circuit was rapidly reaching zero, indicating that the steam generators were drying out. The reactor circuit pressure was also dropping. At about this time the liquid level in the pressurizer began to rise rapidly. At 2 min 4s the reactor circuit pressure had dropped to 110 bars, and the emergency core cooling system (ECCS) triggered automati­cally, feeding cold borated water into the primary coolant system. The liquid level in the pressurizer was continuing to rise. Concern was expressed that the HPIS was increasing the water inventory in the primary circuit and that the steam above the water level in the pressurizer would be lost, preventing effi­cient pressure control. In effect, the system would then be full of water. Subse­quent analysis has shown that, initially, expansion of the water as it heated up and, later, boiling in parts of the circuit displaced water into the pressurizer, causing the increase in pressurizer level. Because of their concern about the pressurizer level and their belief that the HPIS system was filling it, the opera­tors tripped (shut ofO one of the HPIS pumps at 4 min 38 s; the other pumps continued to be operated in a partly closed condition.

Phase 2: Loss of Coolant (6-20 ^min). At 6 min the pressurizer was com­pletely filled with water. The reactor drain tank (item 7 in Figure 5.2) started to pressurize rapidly, and at 7 43 s the reactor building sump pump switched on

to transfer water from the sump to the various wastewater tanks located in the auxiliary building. Thus, slightly radioactive water was being transferred out of the containment into the auxiliary building.

In the Babcock & Wilcox TMI design, the automatic closure of valves linking the containment to the auxiliary building was not initiated unless the reactor building pressure exceeded 270 millibars. In reactors supplied by other ven­dors, control systems close off these connecting lines automatically when the ECCS system is actuated.

After 8 min the operators found that the steam generators were dry. Checks showed that the auxiliary feed pumps were running but that the valves were shut. The operator opened the valves, allowing feedwater to pass into the steam generators, and the reactor circuit water temperature started to drop as a result. “Hammering” and “crackling” were heard from the steam generators, confirming that the auxiliary feed pumps were now delivering water to them. The closed valves in the auxiliary feedwater circuit received a great deal of pub­licity immediately after the accident. It now seems likely that the unavailability of the auxiliary feedwater for the first 8 min of the accident did not, in the event, significantly affect the future course of the accident, which was largely determined by the stuck-open PORV

At 10 min 24 s, a second HPIS pump (item 6, Figure 5.2) tripped out, was restarted, but tripped out again, to be eventually restarted at 11 min 24 s, but in a throttled condition. The balance between the flow of water into the reactor from the HPIS and the flow out of the reactor from the PORV was such riu:

there was a net outflow from the primary cooling system. At about 11 min, the pressurizer level indication was back on scale and the level was decreasing. At 15 min, the reactor coolant drain tank bursting disk (item 7, Figure 5.2) ruptured and hot water flashed into the containment building, giving a rise of pressure within that building. The coolant was now being discharged from the primary circuit, was emptying into the containment, and was passing from the containment sump, through the sump pump that continued to operate, into the auxiliary building.

At 18 min, there was a sharp increase in activity measured by the ventilation system monitors. This activity arose from the discharge of the slightly radioactive primary coolant into the containment and not from any fuel failures at this stage. At this point, the reactor circuit pressure was only about 83 bars and falling.

Up to this stage, the events at TMI-2 were veiy similar to a feedwater tran­sient experienced at the Davis-Besse plant at Oak Harbor, Ohio, in September 1977. At Oak Harbor, however, the operators recognized after 21 min that the PORV had stuck open, and they closed its associated block valve, thus ending the incident. The block valve is in series with the PORV and can be manually operated to seal this line.

Phase 3: Continued Depressurization (20 ^min-2 h). Between 20 min and 1 h, the system parameters were stabilized at the saturation condition, about 70 bars and 290°C. At 38 min the reactor building sump pumps were turned off after approximately 30 m3 of water had been pumped into the auxil­iary building. The amount of radioactivity transferred was relatively small, since the transfer was stopped before any significant failure of fuel occurred.

At 1 h 14 min, the main reactor coolant pumps in loop B (one of two loops in the reactor—each loop has two coolant pumps) were tripped because of in­dications of high vibration, low system pressure, and low coolant flow. The op­erators would normally be expected to take such action to prevent serious damage to the pumps and associated pipework. However, turning off the pumps in loop B allowed the steam and water phases in that circuit to separate, effectively preventing further circulation in that loop.

At 1 h 40 min, the reactor coolant pumps in loop A were tripped for the same reasons (see item 8 in Figure 5.3). One concern was that a pump seal fail­ure could occur. The operating staff expected natural circulation of the coolant, but because of the separated steam voids in both loops, this did not take place. Subsequent analysis showed that about two-thirds of the water inventory in the

primary circuit had been discharged by this stage and that when the main coolant pumps were switched off, the water level in the reactor vessel settled out about 30 cm above the top of the core. The decay heat from the core rapidly evaporated the water and brought the level down inside the core, and the core began to heat up. This overheating was the precursor of core damage.

P^^ 4: The Heat-Up Transient (^2- h). At 2 h 18 min into the incident, the PORV block valve (item 9 in Figure 5.4) was closed by the operators. The indica­tions of the position of the PORV were ambiguous to the operators. The control panel light indicated the actuation of a solenoid that should have closed the valve; there was no direct indication of the valve stem position. However, it must be said that failure to recognize that there had been a massive loss of reactor coolant as a result of the stuck-open PORV was the significant feature of the acci­dent. Even at this point, however, a repressurization of the reactor coolant circuit using the HPIS would probably have successfully terminated the incident.

Following closure of the block valve, the reactor circuit pressure began to rise. At 2 h 55 min, a site emergency was declared after high radiation fields were measured in the line connecting the reactor coolant circuit to the purifica-

tion system. By this time a substantial fraction of the reactor core was uncov­ered and had sustained high temperatures. This condition resulted in fuel dam­age, release of volatile fission products, and generation of hydrogen as a result of the interaction between the Zircaloy fuel cans and steam at high temperature.

Attempts were made to start the main reactor coolant pumps around this time. One pump in loop B did operate for 19 min but tripped out due to cavi­tation and vibration. The peak fuel temperature (in excess of 2000°C) was reached shortly after 3 h into the incident. At 3 h 20 min, reactivation of the HPIS effectively terminated the initial heat-up transient, both quenching the fuel and recovering the core.

A general emergency was declared about 3 h 30 min after the start of the in­cident as a result of rapidly increasing radiation levels in the reactor building, the auxiliary building, and the fuel handling building. Detectors inside the con­tainment indicated very high levels of radiation.

Over the period from 4 h 30 min to 7 h into the incident, attempts were made to collapse the steam voids in the two loops by increasing the steam pres­sure and by sustained HPIS operation. These attempts to reestablish heat re­moval through the steam generators were unsuccessful and, moreover,

involved significant use of the PORV block valve. This course of action was therefore abandoned.

Subsequent calculations of the likely course of events in the reactor over the first 3 h of the incident are illustrated in Figure 5.5 Calculated peak fuel tem­peratures and calculated core liquid levels (and two-phase mixture levels) are shown. The events referred to in the above description are also indicated. Fig­ure 5.5 c shows the temperature calculated at several different levels in the core, level 1 being at the bottom of the core and level 5 near the top.

Phase 5: Extended Depressurization (6-11 h). Over the next 4 h the op­erators reduced the pressure in the reactor circuit in an attempt to activate the accumulators and the LPIS components of the ECCS system. This action was ini­tiated at 7 h 38 min by opening the PORV block valve (item 10 in Figure 5.6). At 8 h 41 min, the reactor circuit reached a pressure of 41 bars and the accu­mulators (item 11, Figure 5.6) were activated. However, only a small amount of water was injected into the vessel.

During the depressurization, a considerable volume of hydrogen was vented from the coolant circuit to the reactor building. At 9 h 50 min a pressure pulse was recorded in the reactor building, and in response the building spray pumps (item 12, Figure 5.6) came on within 6 s and were shut off after 6 min. This pressure pulse was due to ignition of a hydrogen-air mixture in part of the re­actor building.

The extended attempt at depressurization was unsuccessful in that the low­est pressure achieved was 30 bars. Nothing that was attempted could drive the pressure lower, and it obstinately remained above the maximum pressure at which the LPIS system of the ECCS could be brought into operation (28 bars).

With the operators unable to further depressurize the reactor circuit, the block valve to the PORV was closed at 11 h 8 min. Over the next 2-h period there was no effective mechanism for removing the decay heat. The block valve was kept closed during this time except for two short periods. Injection via the HPIS was at a low rate and was almost balanced by the outflow through the line to the water purification system; both steam generators were effectively isolated.

Phase 6: Repressurization and Ultimate Establishment of a Stable Cool­ing Mode (13-16 h). At 13 h 30 min into the incident, the PORV block valve (item 13 in Figure 57) was reclosed, and sustained high-pressure injection via the HPIS was initiated in order to repressurize the circuit and allow the circuit

Elapsed time ( min )

Figure 5.6: TMI-2 phase 5: extended depressurization.

pumps (item 14, Figure 5.7) to be restarted. At 15 h 51 min a circulating pump in loop A was restarted and flow through the steam generators was reestab­lished, giving a stable heat rejection mode by that means.

Phase 7: Removal of the Hydrogen Bubble (day ^day 8). As a result of the zirconium-steam reaction, nearly a ton (1000 kg) of hydrogen was pro­duced, and a great deal of this was trapped in the upper region of the reactor pressure vessel, above the core. This “hydrogen bubble” (item 16, Figure 5.8) was eliminated by two methods.

The first method employed the normal purification system used for the pri­mary system. The method worked as follows. The gas in the bubble was being absorbed in the water by the primary system, which was at approximately 70 bars. Some of this water was bled into a “letdown” tank kept at essentially at­mospheric pressure, where the absorbed hydrogen gas fizzed out as when a champagne bottle is opened. The gas was passed through a system that de­layed its release for 30 days. It was then passed through filters and vented out of the off-gas stack to the atmosphere.

In the second method, heaters in the pressurizer were turned on, forcing the dissolved gas out of the primary system water in the bottom of the pressurizer

and into the gas space at the top. The block valve at the top of the pressurizer (item 17 in Figure 5.8) was then opened to permit the gas to escape. The gas bubble was eliminated by these two methods, and on April 28, a month after the accident, cooling by natural circulation was achieved and the reactor coolant pumps were switched off. Switching these pumps off was helpful since the frictional heating of the water by the pumps was at that stage greater than the decay heat being emitted by the reactor core.

Postmortem. Analysis and examination of the damaged core and compo­nents have continued in the period since the accident. It is now possible to de­scribe with some confidence the sequence of events that occurred.

Over the first 100 or so minutes with at least some of the main reactor coolant pumps running—albeit circulating a two-phase coolant—the core was adequately cooled (Figure 5.5). Tripping the last coolant pump allowed the steam and water to separate, effectively preventing further circulation through the loops. Gradually, the water in the reactor vessel boiled off exposing fuel 10-15 minutes later (Figure 5.5). However, some decay heat was being re­moved by steam being released through the open PORV (Section 4.3.2, Figures 4.11 and 4.12). At around 140 minutes the operators closed the PORV block valve, effectively terminating this cooling. The core temperatures rose rapidly above 1800 K. As can be seen from Table 4.2, the cladding would first be oxi­dized and perforated and, as the temperature increased, a Zircaloy-steam reac­tion would lead to the formation of hydrogen. Ultimately all the Zircaloy in the affected region would react, and the support given to the fuel pellets would dis­appear. An estimate of the hydrogen inventory after the accident suggested that about one-third of all the Zircaloy had reacted and almost all the fuel had failed.

The exothermic chemical reaction between Zircaloy and steam increased temperatures still further, taking them above 2400 K. At this temperature Zircaloy is molten and begins to interact with the UO fuel (Figure 5.9a). At 174 minutes one of the reactor coolant pumps in loop B was started and operated briefly. The large quantity of water entering the reactor vessel caused the very hot cladding and fuel in the upper part of the core to fragment and collapse (Figure 5.9b), leaving an upper crust with a void below. This water achieved some temporary cooling, but the heat-up continued in the lower and central re­gions of the core. It may be that resolidified material formed a solid crust that acted as a crucible to hold the molten fuel (see Figure 6.1).

At 200 minutes the activation of the HPIS recovered the core and refilled the

(a) Hypothesized Core Damage

Configuration ( 175-180 Minutes)
(b) Hypothesized Core Damage Configuration (224 Minutes)

(d) Hypothesized End-State

Condition of theTMI-2 Reactor Core

reactor vessel. However, quenching was slow because the water could not reach the seriously damaged areas of the core.

Around 224 minutes it is now known that a major redistribution and reconfig­uration of the fuel material took place. The upper crust, left following the forma­tion of the initial void at 174 minutes, now collapsed. Its weight caused molten fuel to be extruded out to one edge of the core where it flowed down over the core support assembly into the bottom head of the reactor vessel. It is estimated that some 20 tons of material ended up in this location (Figures 5.9c and 5.9d). Continued operation of the HPIS finally quenched the core. The slumping of the fuel material increased the resistance of flow through the core, and the flow re­sistance of the damaged core was estimated at between 200 and 400 times its nor­mal value. At least 70% of the fuel was damaged and 30—40% actually melted.

An international investigation (TMI-VIP) was mounted to examine the extent of the damage to the lower vessel structure and the margin to failure of the re­actor pressure vessel. As a result of this analysis it is clear that effective cooling had occurred by penetration of water through cracks in the debris and between the debris and the vessel wall. The molten fuel is also less aggressive to steel than previously feared.

The very high levels of radioactivity in the containment building after the acci­dent were mainly due to the presence of radioactive krypton and xenon. Apart from krypton-85 (which has a 10-year half-life), most of the radioactive isotopes of krypton and xenon are short-lived. With the exception of approximately 10,000 curies of krypton-85, which were vented from the containment about 1 year after the accident, all the radioactive gases escaped in the first few days after the acci­dent, and this led to a measurable increase in activity above the normal back­ground level in the area surrounding the plant. However, very little (only 16 curies) of the iodine released from the fuel escaped from the containment. Evac­uation of the area immediately surrounding the site 2 days after the accident in­volved about 50,000 households. However, exposure of the public to radio­activity was very small indeed, and the consequences in terms of additional can­cer deaths are calculated to be undetectable in the surrounding population. Using the estimated total collective dose of 33 man-Sv, it is calculated that there will be less than 1 additional cancer death due to the accident in a total of 325,000 such deaths in the surrounding population over the next 30 years.

A Presidential (Kemeny) Commission investigating the causes of the accident found that operator error was the direct cause. Contributing factors were oper­ator training, control room design, and the attitude toward safety within the U. S. nuclear industry. The Kemeny Commission was also very’ critical ol the Nude u

Regulatory Commission. The U. S. industry subsequently responded by setting up the Institute of Nuclear Power Operations (INPO) to improve the quality and operational safety of all U. S. nuclear power plants.

The recovery operations for TMI-2 took 10 years and cost about $1 billion. First it was necessary to decontaminate the auxiliary buildings and vent the con­tainment building to allow entry (July 1981). Then the large amounts of conta­minated water in the basement of the containment building had to be treated (complete by August 1984). Finally, the reactor vessel had to be opened and defueling undertaken—this took five years (complete by 1990). TMI-2 will be mothballed and dismantled along with TMI-1 around the year 2010.

In terms of the classification of operating states presented in Chapter 4 the in­cident began as a classical upset transient and then developed (because of the stuck-open PORV) into an emergency condition of the classical small-break type. This should have been easily contained by activation of the engineered safety fea­tures, but operator action specifically prevented this from happening. The situa­tion was therefore escalated into an accident beyond the limiting fault condition, that is, beyond the design basis. Nevertheless, the defense-in-depth philosophy of a reactor plant (i. e., the concept of multiple barriers) prevented any significant harm to the public or the operators. Many lessons learned from the TMI accident have been incorporated in newer nuclear plants, albeit at considerable extra cost.

The complete cycle for nuclear reactor fuel (the fuel cycle) is illustrated in Fig­ure 7.6. As will be seen, storage and transport of irradiated fuel play an impor­tant role in this cycle.

As we saw earlier, nuclear reactor fuel continues to emit heat even after the fission reaction ceases, due to fission product decay heating. Figure 7.7 shows the heat release rate as a function of time for spent fuel from the various types of reactors. Clearly, the more highly rated the reactor (e. g., the fast reactor), the higher the heat release rate and the longer it takes for it to decay to a low value.

Figure 7.7 shows that the fission product heat release is most intense immedi­ately after discharge. This is why it is common practice to store the fuel in a cool­ing pond for a period of time to allow both the radioactivity and the heat release to decay before removing the fuel from the immediate environment of the reac­tor. It is usual to store the fuel at the reactor site in a pool of water (though not, obviously, for the fast reactor fuel), although some air-cooled and gas-cooled (carbon dioxide) stores have been designed and operated. Water pools are well suited for fuel designed for water-cooled reactors, but they present a difficulty for the storage of fuel whose cladding has been designed for satisfactory perfor­mance in a gas environment. For example, the immersion of Magnox fuel for long periods in water ponds allows a slow chemical reaction to occur between the magnesium alloy cladding and the water, and this leads to the generation < J

Tr^ansportof solidified heat ^generating iwaste. after cooling, to disposal

hydrogen and the formation of a potentially troublesome silt of radioactive mag­nesium hydroxide. If the can is severely corroded, fission products may escape from the fuel into the pond, giving environmental control difficulties. However, with good management of the ponds (including special encapsulation of fuel that is known to be damaged), these effects can be minimized.

As with all other aspects of nuclear power, consideration must be given to the safety of the operation of spent fuel storage ponds. This can be illustrated by considering P^WR fuel assemblies, which are unloaded from the reactor and may he stored in water ponds for many years. The decay heat levels of P^WR fuel assemblies are such that if the water is completely drained from the pool,

the fuel that has been out of the reactor for fewer than 150 days will melt. Loss of water from the pool could occur if the pool developed a leak or if the pool cooling system were turned off, leading to water evaporation. Both of these events are extremely unlikely. However, the defense-in-depth strategy is con­tinued at the storage stage by either placing the store within the reactor con­tainment (as is done in the German PWR designs) or by providing it with its own containment, including ventilation and filtration systems (the U. S. ap­proach). The pond water is cooled by passing it through heat exchangers, and failure of this cooling system is perhaps the most likely failure mechanism for the ponds. However, it is unlikely that the operators would not notice a gradual fall in the water level in the ponds over a period of about 2 weeks, which would be required to uncover the fuel by evaporation due to the heat input from the fuel itself. Thus, loss-of-coolant accidents in fuel ponds are considered minor contributors to the overall risks of nuclear power.

In designing storage ponds for nuclear reactor spend fuel, consideration must be given to the problem of criticality, that is, the possibility that the pond itself would act as a nuclear reactor. With natural uranium fuel (Magnox and CANDU) there is no criticality problem in storing the fuel under water since the natural uranium-light water system does not become critical. For PWR, BWR, and AGR spent fuel, it is hypothetically possible to have a nuclear reaction, with

the fuel placed in a water pool. Thus, the pools must be designed with suffi­cient distance between the fuel elements to guarantee that no reaction occurs. The distance between the fuel elements in the store can be reduced if neutron­absorbing material is interspersed between the individual subassembly chan­nels, allowing a much higher packing density in a pool.

From a typical 1000-MW(e) PWR, about 25 tons of fuel are discharged every year, contained in about 60 fuel assemblies. About 8000 tons of spent fuel are removed from power reactors each year in OECD countries and some 150,000 tons of spent fuel are currently in storage ponds. With this rate of discharge, it is obvious that after a number of years the storage facilities at reactor sites will become full and fuel will have to be transported either to an alternative storage site or to a reprocessing plant.

Spent nuclear fuel is transported by placing one or more fuel assemblies in a transport flask, in which a large number of assemblies are transferred in a water-filled basket. A typical transport flask (or cask in U. S. terminology) for water reactor fuel is illustrated in Figure 7.8. Figure 7.9 illustrates the spent fuel flask used for Magnox fuel; the fuel is contained in a water-filled box (skip) sur-

rounded by the flask shielding. The fuel is placed in a steel basket inside the flask, which is then sealed with a cover as shown. The flask wall has a series of layers as illustrated in Figure 7.8 with a 12-l4-in.-thick outer steel layer and inner layers of depleted uranium and/or lead to absorb the gamma radiation and of water to act as a neutron shield. A flask for road transport might weigh about 20 tons and contain one or two elements, whereas a flask for rail trans­port might be much bigger, weighing up to 100 tons and able to carry 10-20 fuel assemblies.

During transport, heat must be dissipated from the outside surface of the cask. Typical heat dissipation rates would be about 10 kW for a road transport cask and 50-100 kW for the large rail transport cask. There are two main steps in this heat transfer process. First, heat is transferred from the fuel to a fluid within the flask (usually water), which circulates by natural convection around the fuel. The heat is then taken from the water into the flask wall and out to the atmosphere. The flasks normally have steel fins on the outside to assist the heat — dissipation to the air.

A variety of accidents involving transport flasks can be postulated. First, they may be accidentally dropped during transfer from the storage pool to the vehi­cle. To withstand such an impact, the flask must be designed to survive a drop of 30 ft onto an unyielding (e. g., concrete) surface without any impairment of its integrity and also survive a 40-in. drop onto a 6-in. spike. Second, the flask may become involved in a fire, and prototypes of a given design of flask are subjected to tests in which they are placed in a fire at 1000°C for a period of 30 min. Survival of these stringent tests is a necessary condition for licensing. Apart from these standard tests, demonstrations have been carried out by CEGB in the United Kingdom and at Sandia Laboratories in Albuquerque, New Mexico, in which simulated accidents have been staged. For instance, the effect of a low — loader truck with a transport flask on it, stationary on a railway crossing, being hit by a locomotive traveling at 100 mph. has been examined. The fact that the flask survived such dramatic impacts unscathed (although the locomotive did not!) has inspired great confidence in the safety of transporting spent nuclear fuel in this way.

In this book we shall use the now widely accepted System lntemationale (SI) units

of energy. Here the basic unit of energy is a joule. The magnitude of the joule may

be understood from the following examples for various types of energy.

Kinetic energy. A mass of 2 kilograms (4.4 Ib) moving at a velocity of 1 meter per second (3.3 ft/s) has a kinetic energy of 1 joule.

Potential energy. A mass of 0.1 kilogram (3.5 ounces) at a height of 1 meter (3.3 ft) above the earth’s surface has a potential energy of 1 joule.

Chemical energy. Burning 1 kilogram (2.2 Ib) of coal releases approximately

3.5 million joules of energy.

Electrical energy. A 100-watt lamp burning for 1 second uses 100 joules of electrical energy.

Nuclear energy.-. Converting 1 kilogram of mass into energy releases 80 thousand million million joules.

Thermal energy.. Heating 1 kilogram of water by 1 °С (1 .8°F) requires 4187 joules.

The rate of energy flow or production is measured in watts, I watt being I joule of energy per second.

Units such as the joule and the watt are rather small for many practical pur­poses. In the SI system of units the practice is to use prefixes to denote larger quantities. Thus:

1 kilojoule (kj) = 1000 joules 1 megajoule (MJ) = 1 million joules 1 gigajoule (GJ) = 1 thousand million joules 1 terajoule (TJ) = 1 million million joules 1 kilowatt (kW) = 1000 watts 1 gigawatt GW) = 1 thousand million watts

Many other measures of energy are in common use, and it may be helpful to state here the relationship between these units and their SI equivalents:

1 calorie (energy required to heat 1 gram of water by 1 °C)

1 British thermal unit (Btu) (energy required to heat 1 lb of water by 1 °F) 1 therm (100,000 Btus)

1 mtce (energy released by burning 1 million tons of coal)

Typical examples of integral circuits are the advanced gas-cooled reactors and the type of reactor used most commonly for ship propulsion. The original C02-

cooled reactors (Magnox) were of the loop type. However, the development of large concrete pressure vessel technology allowed the incorporation of the steam generators and circulators inside the pressure vessel, as illustrated in Figure 2.5. A typical marine reactor is illustrated in Figure 3.7, where the circulators, steam gen­erators, and reactor core are all encapsulated in a single steel pressure vessel.

The great advantage of the integral type of circuit is that all the primary cir­culating fluid is contained within the vessel, removing the need to circulate the primary fluid through connecting pipework to the steam generator. A possible accident source in the loop-type circuit is the rupture of one of the primary coolant pipes, and this is obviated in the case of the integral circuit.

One lesson stemming from the Chernobyl accident was the need for prompt dissemination to the public of the safety significance of an event at a nuclear in­stallation. A similar need in other areas is filled by an appropriate scale, for ex­ample, the Richter scale for earthquakes and the Beaufort scale for winds.

Tn 1ЧЧ0 the International Atomic Enemv A2"encv (IAEA) introduced.1 sewn-

level scale designed to allow prompt classification of such events. The levels, their descriptions, and detailed criteria are shown in Figure 5.26. Three criteria are applied:

Levels 3-7 relate to the extent of releases of radioactivity off-site.

Levels 2-5 relate to the extent of on-site contamination or exposure.

Levels 1-3 relate to the extent to which the defense-in-depth philosophy has been challenged.

Each of the incidents described in this chapter has been evaluated using the INES scale to provide a best estimate of the incident. The resulting classification is given in Table 5.2.

Table 5.2 • The International Nuclear Event Scale (for prompt communication of safety significance)

Level Descriptor Criteria Examples

• External release of a large fraction of the Chernobyl, USSR

reactor core inventory typically involving a 1986

mixture of short-and long-lived radioactive fission products (in quantities radiologicaly equivalent to more than tens of thousands terabecquerels of iodine-131).

• Possibility of acute health effects. Delayed health effects over a wide area, possibly involving more than one country. Long-term environmental consequences.

• External release of fission products (in quantities radiologically equivalent to the order of thousands to tens of thousands

of terabecquerels of iodine-131). Full imple­mentation of local emergency plans most likely needed to limit serious health effects.

• External release of fission products (in Windscale, UK

quantities radiologicaUy equivalent to the 1957

order of hundreds to thousands of terabec­querels of iodine-131). Partial implementation of emergency plans (e. g., local sheltering and/or evacuation) required in some cases to lessen the likelihood of health effects.

• Severe to large fraction of the core ^Three Mile Island, USA

due to mechanical effects and/or melting. 1979

• External release of radioactivity resulting in a dose to the most exposed individual off­site of the order of a few millisieverts:"

Need for off-site protective actions generally unlikelyexcept possibly for local food control.

• Some damage to reactor core due to Saint Laurent, France

mechanical effects and/or melting. 1980

• Worker doses that can lead to acute health effects (of the order of 1 Sievert).b

• External release of radioactivity above authorized limits, resulting in a dose to the most exposed individual off-site of the order of tenths of a millisievert. a Off-site protective measures not needed. [3]

Table 5.2 continued

Level Descriptor Criteria Examples

• Incidents in which a further failure of safety Vandellos, Spain systems could lead to accident conditions, or 1989 a situation in which safety systems would be unable to prevent an accident if certain initiators were to occur.

2 Incident • Technical incidents or anomalies which,

although not directly or immediately affecting plant safety, are liable to lead to subsequent reevaluation of safety provisions.

1 Anomaly • Functional or operational anomalies which

do not pose a risk but which indicate a lack of safety provisions. This may be due to equipment failure, human error, or proce­dural inadequacies. (Such anomalies should be distinguished from situations where operational limits and conditions are not exceeded and which are properly managed in accordance with adequate procedures.

These are typically “below scale:’)

Below No safety

scale I significance

zero

Source: International Atomic Energy Agency, April 1990.

“ The doses are expressed in terms of effective dose equivalent (whole body dose).Those criteria, where appropriate, also can be expressed in terms of corresponding annual effluent discharge limits authorized by National authorities.

6These doses also are expressed, for simplicity, in terms of effective dose equivalents (Sieverts), although the doses in the ^ge involving acute health effects should be expressed in terms of absorbed dose (Grays).

Table 5.3 shows the ratings of the various incidents discussed in this chapter in terms of the INES scale. This table also shows how each of the safety princi­ples (the Three Cs—see Section 5.1) were met in each case and whether de­fense in depth was effective.

Table 5.3 a Nuclear Reactor Incidents

Prospect for the Future

9.1 INTRODUCTION

In the preceding chapters we have seen how uranium, mined from the earth’s crust, is utilized in a nuclear reactor to create energy and how the resulting waste products can be dealt with safely. We have concentrated on the thermal or heat-generating aspects of the materials at the various stages of the cycle. We have seen that the energy that can be recovered from nuclear fission of 1 ton of uranium can be increased 60-fold by the use of fast reactors and that this can extend our use of fission power from a few tens to many hundreds of years. Nevertheless, the world’s uranium resources are finite, and energy resources will increasingly be required by the developing world. Scientists have therefore turned to alternative ways to release nuclear energy. What more natural place to look than to the ultimate source of the earth’s energy—the sun. The energy generated by the sun is not the result of splitting up nuclei of heavy elements but of the joining together—fusion—of nuclei of light elements such as the iso­topes of hydrogen or lithium. These elements are abundant and easily available on the earth, so what is the problem of releasing fusion energy for our use?

The problem is that to release the energy of fusion in a controlled manner re­quires heating the reacting nuclei to temperatures of tens to hundreds of mil­lions of degrees and holding them in sufficient quantities at these temperatures long enough for the reaction to take place. A device capable of creating such a reaction is called a thermonuclear reactor.

The energy release in the sun results from the conversion of hydrogen into helium. Effectively four protons fuse together to form one helium nucleus with

an energy release of 7.7 x 10 ~’.J joules. Thus the conversion of 1 gram of hy­drogen to helium produces 0.71 x 1012 joules. The energy released by the sun is almost incomprehensibly large: 0.39 million million gigawatts (3.9 x 1026 watts). This requires the consumption of 5.5 x 101’* grams/s. (or alternatively, 550 million tons per second). Even so, the sun has an expected lifetime of 10,000 million years!

On Earth it is not possible to reproduce the solar conditions. The specific ther­monuclear reaction is too slow to produce a practical size of reactor. Fortunately there are other fusion reactions that might form the basis of a practical reactor.

By far the most common civilian reactor is the pressurized-water reactor (P^^). Reactors of this type were originally developed to drive nuclear submarines. The P^^ circuit is illustrated schematically in Figure 2.7. Water at typically 150 bars (2200 psia) is pumped into a pressure vessel, which contains the reactor core. The water passes downward through an annulus between the reactor core and the pressure vessel and then flows up over the fuel elements. It then leaves through a series of pipes, which pass to the stream generator. The light-water coolant also acts as the moderator for this reactor. The absorption of neutrons by the light water (as described in Chapter 1) necessitates a significant enrichment of the fuel to 3 2% S5U (-4.5 times the concentration in natural uranium).

In the steam generator, the hot water from the reactor passes through verti­cal U-tubes (Figure 2.9), and water at lower pressure is fed into the steam gen­erator shell and contacts the outside of the U-tubes. Steam is generated at approximately 70 bars (1000 psia) and passes from the steam generator into the

turbine and from there to the condenser, the condensate being returned to the steam generator via feed preheaters. Figure 2.7 illustrates one complete coolant loop; PWRs typically have two, three, or four such loops per reactor vessel. A typical four-loop PWR is illustrated in Figure 2.8. The fuel elements in a PWR are illustrated in Figure 2.9; the fuel is in the form of uranium oxide pellets mounted in a 12-ft-long tube made of a zirconium alloy (Zircaloy). The tubes are usually mounted in separate bundles of 17 rows of 17 tubes, with some pins omitted to allow passage of control rods into the core.

In 1993 there were 243 operating civilian PWR power reactors in the world and 33 under construction. Although the steam cycle efficiency of a PWR is rel­atively low (32%), its capital cost may be considerably less than that of an AGR. The main reason for this is the great reduction in core size made possible by the enormous increase in volumetric power density and core rating, as shown in Table 2.3. Another factor contributing to the low capital cost is the fact that much of the P^^ can be constructed off-site under factory conditions.

Because of the high rate of heat generated per unit mass of fuel (fuel ratiniJ, the response of a PWR to changes in operating conditions is much more rapid than that of an AGR. It has been argued that this is a negative safety factor. Even when the reactor is shut down, the level of decay heat is such that the fuel must always be kept covered with water. We shall discuss these safety features in Chapters 5 and 6. Pressurized-water reactors have experienced problems with steam generators, which have failed due to corrosion on the secondary (steam­generating) side. Reactors are often more susceptible to problems outside the core than in it. Although it is now believed that design improvements can pre­vent these corrosion problems, most existing reactors are still prone to them. This is not a major safety issue, but it does limit their performance.

The most serious accident considered for the design basis of a B"^TC begins with the rupture of one of the pipes connecting the (external) circulating pump with the reactor vessel as illustrated in Figure 4.28 This initial rupture produces a more gradual depressurization than is the case in a P"^WR since the pipe is con­siderably smaller than the main pipework in a P"^TC system (50 cm compared with 80 em in a P"^WR Other factors restricting the depressurization rate are the facts that the reactor vessel contains about 40% steam by volume and that the steam line is shut off within a few seconds, isolating the vessel from the main heat sink (the turbine) so that the system coolant can escape only from the break. Although the flow in the damaged loop would reverse due to the break, core cooling is maintained during the early part of the accident since the feed pump continues to rotate (coast down) for some time, feeding water to the ves­sel, and circulation continues in the undamaged loop. Eventually the feed pump flow stops and the suction of the jet pumps (which circulate liquid in the

vessel) becomes uncovered, causing the core flow rate to drop to zero (Figure 4.29). Due to this core flow stoppage, the core begins to dry out and increase in temperature after about 10 s from the initiation of the break. The flow at the break switches mainly to steam, the water in the annular space containing the jet pumps being completely discharged, and steam formation occurs in the lower plenum as the system pressure decreases more rapidly. Vaporization oc­curring in this way because of depressurization is often referred to as flashing, and the effect of lower plenum flashing is illustrated in Figure 4.30. The flash­ing effect causes a two-phase mixture to flow up through the jet and the core, resulting in enhanced core heat transfer during this period.

After about 30 s, the emergency core cooling system is triggered and the au­tomatic depressurization system operates, reducing the vessel pressure and al­lowing the LPCI and LPCS to come into operation. In the boiling-water reactor, the fuel is in the form of fuel elements consisting of a number of fuel pins mounted in a shroud, i. e., a rectangular box open at the upper and lower ends. The systems inject water above the core, and this water flows into the lower

plenum down the shroud surrounding each fuel element. The existence of this water near the fuel elements causes them to heat up much more slowly, and, eventually, water passing down the shroud into the lower plenum floods the lower plenum and water begins to rise through the core, quenching it in much the same way as in the P’^TC. Just as in the P’^TC, during this reflooding phase, the reflood rate is limited by the rate at which the generated steam can es­cape—the steam binding effect. This phase of the LOCA event is illustrated in Figure 4.31. Figure 4.32 shows a typical calculated temperature response of the shroud (channel) and fuel rods during a LOCA.

If it is not possible to cool the debris bed within the containment building, the debris begins to react with the concrete floor of the building and penetrates this and also the bedrock on which the reactor is built. This gradual downward pen­etration of the molten pool has colloquially been referred to as the “China Syn­drome," it being imagined that the pool could ultimately penetrate through to the other side of the earth, which in the case of the United States is imagined to be China. Actually, this imagined situation is impossible: the pool would miss China by a long way and could only pass outward from the center of the eaith if gravity mysteriously became negative. However, penetration of the molten material is limited.

Figure 6.5 shows an overall diagram for the containment for a PWR. Turland and Peckover (1979) calculated the behavior of a molten pool arising from a 3- GW(t) reactor core. There are two extreme situations.

First, if the melt consists mainly of oxide, it is likely to be miscible with the base concrete and rock. A molten pool would be formed of limited depth (around 3 m) and with a diameter of about 13 m (Figure 6.5). This pool will re­main for a period of up to several years. Figure 6.5 illustrates the situation after 1 year and shows the temperature profile in the rock-concrete around the pool. The heat generated by fission product decay within the pool is dissipated into the surrounding rock due to the temperature gradients illustrated.

Second, if in the melting process molten steel is produced, this may dissolve fission products from the fuel. If this molten steel is oxidized, the melt pool will be miscible with the concrete-rock base and a pool such as that illustrated in Figure 6.6 will be formed. If the steel is not oxidized, the steel-fission product solution will not be miscible with molten fuel and concrete-rock and will itself penetrate the base rock much farther. Calculations by Turland and Peckover (1978) are illustrated in Figure 6.7. It shows that a molten metal, immiscible pool of this type could penetrate to a maximum depth of about 14 m.

The two melt pools illustrated in Figures 6.6 and 6.7 are drawn in scale in the diagram of the containment shown in Figure 6.5.

It is noteworthy that the interaction between the molten fuel and the con­crete-rock will result in the release of significant amounts of vapor and gas as a

result of the chemical reaction. This may result in pressurization of the contain­ment building over a long period of time, particularly if no cooling is available.

As the fission products in the pool of material decay, the molten fuel gradu­ally solidifies. Calculations indicate that the pool of molten material under the reactor might reach a maximum size equivalent to a hemisphere about 27 m in diameter. Because a considerable amount of concrete is mixed with the fuel, it has been suggested that the final form of the solidified mass is likely to be a glasslike substance that would immobilize the fission products and limit their subsequent migration.

As we have seen above, even the worst case of fuel meltdown and failure to cool would lead to an acceptable situation provided there is no failure of the containment.