Heavy water (deuterium oxide, D20) is present to the extent of 0.016%o in ordi­nary water. Heavy water may be separated from ordinary water by various processes, which is an expensive business requiring a very large plant. Never­theless, heavy water has considerable merit as a reactor coolant; it has a much lower thermal neutron absorption cross section than light water, which enables reactors using heavy water as a coolant to be operated without enrichment of 235U in the fuel. The most common example of such a reactor is the Canadian C^NDU, which was described in Chapter 2.

With the exception of neutron absorption, heavy water has practically the same physical properties and therefore the same disadvantages as light water.

Since heavy water is a very valuable material, losses and contamination with light water must be minimized. This demands a high-integrity primary circuit, particularly in the steam generators, where light and heavy water are separated only by the heat transfer surface. In practice, an annual loss of about 2% of the heavy-water inventory seems unavoidable, probably mainly in the form of vapor escaping through leaks.

Another problem with heavy water is that in a neutron flux the component f deuterium is converted, to a small but significant extent, to tritium (hydrogen-3),

f; which is radioactive and decays to helium-3 with the emission of a р-particle. Be­

cause tritium has a relatively long half-life (12 years), tritium contamination of the environment by coolant leaks from the reactor is a problem that must be taken into account in the design.

On April 26, 1986, the worst accident in the history of commercial nuclear power generation occurred at the Chernobyl Nuclear Power Station some 60 miles north of Kiev in the Ukraine, on the Pripyat River not far from the town of Pripyat (poplation then 49,000). The site at that time had four 1000-MW(e) RBMK reactors operational and two more under construction. The four reactors were built in pairs, sharing common buildings and services. Construction of Units 3 and 4 started in 1975-76; Unit 4 became operational during 1984. The main elements of the reactor are described in Section 2.4.6.

The Expe^ment. Ironically the immediate cause of the accident that wrecked the No. 4 Unit was an experiment designed to improve the safety of the plant. The objective of this experiment was to see whether the mechanical inertia in a turbine generator isolated from both its steam supply and the grid could be used to supply electricity via the station distribution system to impor­tant station auxiliary loads (including the emergency cooling pumps) for a short period (4(}.50 seconds). In essence, this was an attempt to use the turbine gen­erator as a mechanical flywheel coupled to the pumps electrically.

A turbine generator unloaded normally would take about 15 minutes to come to rest from 3000 rpm, but when coupled to the pump motors might pro­vide a few tens of seconds’ supply. Even so, given the rapid coast-down of the main circulating pumps without this provision and the long time required to shut down the reactor and start the auxiliary diesel generators and diesel, this “flywheel” effect could have provided a valuable margin in the safety case. In the experiment, to simulate the load from the ECCS, the generator was coupled to four of the main circulating pumps (each rated at 5.5 ^W) and the feedwa­ter pumps.

The experiment had been attempted twice before, in 1982 and 1984. On the latter attempt, following isolation of the generator from the grid, the voltage level in the unit system fell rapidly and the operators were unable to arrest the drop by manual control of the voltage regulator. The fall in voltage resulted in the pump motors slowing down much faster than the generator.

For the fateful experiment on April 26 an automatic voltage regulator, acting on the generator excitation current, had been fitted that maintained the voltage level in the unit system so that the pump motors ran down in step with the main generator at synchronous speed, drawing on the stored kinetic energy of the turbine generator.

The planned experimental initial conditions required the reactor to be at about 25% full power with one of its turbine generators shut down and the other supplying the grid, four main circulating pumps, and two feed pumps. The remaining auxiliary plant was fed from the grid.

The experiments had been badly planned, the safety case was inadequate and had not been properly reviewed, and as we shall see in the following sec­tions, the operators failed to achieve the chosen plant conditions, departed from the laid-down procedures, and violated several operating mles.

Status of the Plant before the Accident. On April 25, 1986, all four units at Chernobyl were operating. The No. 4 unit was due to be shut down for maintenance work. A total of 1,659 channels were loaded with fuel, most of it (75%) from the initial fuel charge, having been utilized to an extent (“burn — up") of 12-15 MW, day kg. What follows is an abbreviated and simplified ac­count of the sequence of events that took place. For ease of description the accident is divided into a series of logical phases. Diagrams illustrate the con­dition at each phase.

Phase 1: Prelude [01.00-23.10 h, April 25 (Figure 5.12)]. The reactor was at nominal full power conditions [1000 MW(e), ca. 3000 MW(t)]. The oper­ators started to reduce power at 0.100 h, on April 25, and about 12 hours later, at 13.05 h, with the reactor at 1600 MW(t), turbo generator No. 7 was discon­nected from the grid. Four of the main circulating pumps and two of the feed­water pumps were connected to turbo generator No. 8 in preparation for the test.

At 14.00 h, the emergency core cooling system was disconnected from the primary circuit. This was in accordance with the experimental plan (presumably because it was anticipated it would be spuriously initiated by the expected low level in the steam drum during the experiment).

However, the grid controller requested the unit to continue supplying to the grid until 23.10 h. Operation with the emergency core cooling system disen­gaged was a violation of the operating rules (violation l—one of many to come), but it does not appear to have had any significance in the accident se­quence. However, disabling of the reactor protection system seems to have been regarded rather lightly both in the operating procedures and by the oper­ators themselves.

Phase 2: Preparations for the Experiment (23.10 h, April 25, to 01.00 h, April 26). At 23.] 0 h, the operators start ed to reduce power to obtain the test condition of 700-1000 MW(t). The local automatic control (LAR) system, which operated 12 control rods, was disengaged at 00.28 h on April 26. Here the op­erator made a major error ( violation 2) in failing to reset the set point of the au­tomatic regulation (AR) system and was then unable to control the reactor power with a combination of the manual and overall automatic control (AR3), the latter using only four control rods. The result was that the reactor power dipped to below 30 MX'(t).

The first reduction from 100% power nearly 24 h earlier had initiated a xenon poisoning transient. The fission product Xe-135 is of considerable im­portance in thermal reactors because it has a very high neutron capture cross section. Only a sma11 proportion of Xe-135 is formed directly by fission; most comes from the radioactive decay of I-135 (half-life 6.7h). The xenon is re­moved partially by decay (half-life 9.2h) and partly by its capture of neutrons. About 2% of all neutrons are captured by Xe-135, so it is an important item in

the overall neutron balance (see Section 2.2). The balance of formation of xenon and its destruction are such that a fall in reactor power (and thus of neu­tron flux) leads to a rise in xenon concentration.

Figure 5.13a shows the reactor power-time history together with (Figure 5.13 b) the poisoning effect of the xenon present. It will be seen that the peak in the transient (at about 12-14 h after the initital decrease in power) had passed but that the uncontrolled drop in power to around 30 MW(t) had induced a sharp increase in the xenon poisoning by the time the experiment started. Be­cause of the sharply increasing xenon the operator had considerable difficulty in raising reactor power with the small operating reactivity margin he had avail­able. Finally, at 01.00 h on April 26, the power was stabilized at 200 MW(t)— well below the power level proposed for the experiment.

Phase 3: The Experiment [01.00-23.40 h, April 26 (Figure 5.14)]. At

01.3 and 01.07 h, respectively, the operators started the main standby circulat­ing pumps (see 4 in Figure 5.14), one on each main loop, so that at the end of the experiment, in which four pumps were to operate “tied” to the No. 8 tur-

bine generator, four pumps would remain coupled to the grid to provide reli­able cooling of the core.

The reactor power was lower than intended; so too were the steam voidage in the channel and the pressure drop along the fuel. As a result the coolant flow rate was higher than anticipated with all eight pumps operating. Such an oper­ating mode was normally prohibited because of the possibility of single-pump trip leading to cavitation and vibration of the main feed piping (violation 3).

Because the reactor power was only 7% of full power and the coolant flow rate through the core was 115-120% of normal, the enthalpy rise across the core was only 6% of nominal, or equivalent to just 4QC. Thus although the entire pri­mary coolant system was only slightly subcooled and still very close to boiling, there was very little steam being generated in the core.

Under these conditions the coolant voidage would have been much re­duced. The water was absorbing more neutrons, so the control rods were cor­respondingly further withdrawn. The decrease in steam generation resulted in a drop in steam pressure and disturbances to other reactor parameters. The oper-

ators tried to control both the steam pressure and the drum level manually but were unable to hold these parameters above the normal “trip” point settings (5 in Figure 5.14). To avoid the reactor’s tripping, the operators overrode the trip signals with respect to these variables (violation 4).

At 01.09 h (4 minutes before the initiation of the test), the operator opened the main feed valve (6 in Figure 5.14) to increase the water level in the steam drum. With the feedwater flow increased by a factor of 3, the desired water level was reached 30 seconds later. However, the operator continued to feed the drum. As the cold water from the drum passed into the core, the steam gen­eration rate fell noticeably, resulting in an even further reduction in steam voidage. To compensate, all the 12 automatic control rods moved upward to a “fully withdrawn” position (7 in Figure 5.14).

To maintain reactor power at 200 MW(t) the operator had also to move a number of manual control rods up. This allowed one group of automatic con­trol rods to reenter the core by 1.8 m.

The cool feedwater and the decrease in steam generation led to a small fall in pressure. At 01.19.58 h, a steam bypass line to the condenser was closed, but the steam pressure continued to fall (by 5 bars) over the next few minutes.

At 01.21.50 h, the operator sharply reduced the feedwater flow rate, which resulted in an increase of water temperature passing to the inlet water with a delay of the transit time (20 s) from the steam drums to the reactor inlet. The au­tomatic control rods started to lower into the core to counter the effect of the in­creased voidage.

At 01.22.30 h, the operator looked at the printout of the reactor parameters, especially the residual reactivity margin left in the control rods. Over this period the control rods remained substantially withdrawn.

A “safe” operating level was set to ensure that the control rods “dipping” into the core were effective when they moved. The operator noticed that the reac­tivity margin was at a value (less than 15 rods inserted into the core) that re­quired him to trip the reactor. The test was, however, continued in violation of this operating restriction (violation 5).

Calculations have shown that the number of control rods in the core at this stage was 6 to 8—less than half the design “safe” minimum and a quarter of the minimum number of 30 inserted rods given in the operating instructions (re­lated to a negative reactivity insertion rate of 0.5-0.7% / s).

It should be observed that measurements from in-core flux monitors showed the neutron flux profiles to be normal in the radial plane but doubly peaked in the axial direction with the higher peak in the upper region of the core. This was caused by high xenon levels in the central part of the reactor, coupled with steam generation in the upper parts of the core.

At 01.23.04 h, the experiment was initiated and the main steamline valves to turbine generator No.8 were closed (8 in Figure 5.14). The protection provided to trip the reactor when both turbine generators were tripped had been disen­gaged to allow the reactor to continue to operate. However, this was not part of the original plan for the experiment and was done apparently to enable the test to he repeated if the first test was unsuccessful. Needless to say this was a fur­ther violation of the operating procedures (violation 6). The operation of the re­actor after the start of the experiment was not required.

The No. 8 turbine generator together with the four main circulating pumps (see 2 in Figure 5.14) and two feedwater pumps (6 in Figure 5.14) started to run down. With the closure of the main steam and bypass valves the steam pressure rose slightly and the steam generation in the core correspondingly decreased slightly (01.23.10 h). However, the main coolant flow and the feedwater flow re­duced, causing an increase in both water inlet temperature and steam generation. An increase in reactor power was noted at 01.23.31 h. An attempt was made to compensate with the 12 automatic control rods, but this was ineffective.

A power excursion was experienced, and at 01.23.40 h, the shift manager at­tempted a manual ‘’scram” of the reactor. All the control rods and emergency rods began motoring into the core. However, the rods could not be fully inserted. Be­cause the rods were in a nearly withdrawn position, a delay of about 10 s oc­curred before the reactor power could have been reduced. Indeed, the very act of driving in the “overdrawn” control rods may have contributed to the initiating event for what followed. The control rod “followers” (see Figure 2.14) displaced the neutron-absorbing water on reinsertion to start the power excursion.

In this time a prompt critical power excursion driven by the increased steam generation in the core (due to the pump rundown) and the strong positive void coefficient led to severe fuel damage and fuel channel disruption. After 3 s the reactor power had reached 530 MW(t) and continued to increase exponentially to much higher levels. Only the negative fuel temperature coefficient (Doppler effect) was acting to reduce the neutron population over this period. The spe­cific energy deposited in the fuel was estimated to be greater than 1.2 MJ/kg. There were two excursions in power. It has been suggested that the second power peak was from additional voiding caused in turn by the rupture of the pressure boundary during the first excursion.

The condition of prompt criticality (see Section 2.3) is believed to be what occurred in the last stages of the accident at Chernobyl. Complete voiding of the RRMK core would have produced about a 3% increase in k, greater than the delayed neutron fraction.

At 01.24 h, witnesses heard two explosions, one after the other. Molten and burning fragments flew up from the Unit No. 4 plant and some fell on the roof of the turbine generator building, starting a fire.

Phase 4: Explosion and Fire [01.23.40-5.00 h, April 26 (Figure 5.15)].

The precise sequence of events following the reactivity insertion will probably never be known, but based on analysis, actual observations, and previous ex­perimental work a plausible picture can be put together.

One particularly relevant experiment is that undertaken in 1979 at the Power Burst Facility (PBF), Idaho Falls, as part of the Thermal Fuels Behavior Program for the USNRC A single unirradiated U02 fuel rod, operating under conditions representative of hot stait-up of a boiling-water reactor (i. e., veiy similar to the

conditions at Chernobyl) was subjected to a power burst, resulting in a total en­ergy deposition of 1.55 MJ/kg U02 (cf. Chernobyl about 1.2 MJ/kg UO).

Extensive amounts of molten fuel debris were expelled into the flow channel and against the pressure tube wall. A pressure pulse of 350 bars, suggesting an energetic molten fuel-coolant interaction, was observed. Following the model­ing of the accident, it would appear that in the case of the Chernobyl transient the energy deposited in the fuel from the power transients probably resulted in fuel melting or fuel fragmentation and dispersion. The fuel cladding initially re­mained intact until voiding in the channel-induced “dryout,” after which the clad temperature increased at 250°C/s. The subsequent explosive formation of steam caused a sharp increase in the pressure within the fuel channel sufficient to increase the steam drum pressure at -10 bars/s and to stop or even reverse the primary coolant flow. This is known because the check valves downstream of the pumps closed at 01.23.45 h. This further voiding of the fuel channels re­sulted in a second, larger power surge to about 440 times full power.

Fuel ejected from the fuel pins under the driving force of fission gas pressure impinged on the pressure tubes, causing failure and releasing steam into the graphite moderator space. With the pressure relieved at 01.23.47 h, water rushed back into the fuel channels to interact with the fuel being ejected from the fuel pins. A conservative estimate of the total thermal energy deposited in the fuel is 50-100 GJ. Assuming a 1% efficiency for the conversion to mechani­cal energy in an energetic fuel coolant interaction (FCI), a conservative explo­sive energy of 0.5-1 GJ is estimated. This is broadly equivalent to 100-200 kg of TNT (but, in the case of the explosive, detonation is much more rapid than in the FCI). The conditions were also appropriate for other chemical reactions in­cluding molten zirconium-steam and hot graphite-steam reactions. At 0.23.48 h, two explosions were noted in succession; the first could have resulted from the fuel-coolant interaction and the second from hot hydrogen and carbon monoxide mixing with air and exploding as the containment of the reactor vault failed. These detonations, together with the buildup of steam pressure, blew the 1000-ton top shield off and rotated it through 90° (Figure 5.16). It also broke all the pressure tubes and lifted some of the control rods. Some of the graphite blocks from the reflector were ejected, the charge face was destroyed, and damage was done to the charge hall and some of the structural parts of the building. Fragments of core materials fell onto the roofs of the reactor and tur­bine buildings. The refueling machine that stood on the charge face “leapt up and down,” causing further pipework failures. Over 30 fires were started in var-

-(:hernobyl unit no. 4 befori

Chernobyl unit no. 4 after

Upper lid

Debris (graphite ^blocks, sti’JCtural elements. concrete)

Lower lid (dropped 4 m) 9 m level

Nuclear fuel masses (‘lava) under reactor rooms .

Figure 5.16: Chernobyl Unit 4 before and after the accident.

ious areas due to mptured fuel lines, damaged cables, and thermal radiation from the exposed core.

By 01.30 h, the firefighters on duty had been called out and were reinforced with firefighting units from Pripyat and Chernobyl. Graphic accounts have been given of the extreme heroism of these firefighters, many of whom have since perished as a result of their exposure to lethal doses of radiation. By 05.00 h, the fires on the reactor and turbine buildings had been extinguished. Amaz­ingly, the three other units at the station continued to operate. The No. 3 Unit, which was adjacent to the damaged unit, was not shut down until 05.00 h. The other two units continued to operate until the early hours of the following morning, some 24 h after the accident. Fuel temperatures, initially high due to the energy deposited in the transient, fell as the heat was transmitted to the graphite and other reactor components.

Phase 5: The Aftermath (05.00 h, AprU 26 to May 6). With the reactor core badly damaged and the cooling system not functional, the Soviet engineers started to consider how to fight the graphite fire and how to reduce core tem­peratures, deal with the decay heat, and limit fission product release. They ini­tially tried to cool the core by the use of emergency and auxiliary feedwater pumps to provide water to the core. This was unsuccessful. Given the continu­ing graphite fire and ongoing significant release of fission products, the decision was taken to cover the reactor vaults with boron compounds, dolomite, sand, clay, and lead. The boron was to stop any recriticality; the dolomite gave off C02 as it heated up (which reduced the access of oxygen to the graphite fire); the lead absorbed heat, melted into gaps, and acted as shielding; while the sand acted as an efficient filter.

Over the period April 27-May 10, over 5000 tons of materials were dropped by military helicopters. The reactor core was thus covered by a loose mass that effectively filtered the fine aerosol fission products. Around May 1, some 6 days after the accident, fuel temperatures started to increase due to fission product decay heating and graphite combustion. To reduce temperatures, compressed nitrogen was fed into the space beneath the reactor vault. Fuel temperatures peaked about May 4-5 at around 2000°C and then began to drop. It is believed that about 10% of the core graphite was consumed during this period. By May 6, the discharge of fission products had virtually ceased, having decreased by a factor of several hundred.

Phase 6: Stab^teation and Entombment [from May 6 (Figure 5.17)].

From early May the situation at the damaged reactor improved. Monitoring de­vices to measure temperatures and air speed were lowered into the debris. The exact disposition of the fuel in the damaged reactor is not known. By May 6 at least 60-80% of the fuel had been released from the reactor vessel itself. About 130 tons of the molten radioactive material from the core formed into a “lava” most of which found its way to the lower parts of the reactor building.

From May 6, temperature conditions in the reactor vault were stable at several hundred degrees centigrade but falling at 0.5°C/day, fission product releases were down to tens of curies/day, and radiation levels in the areas immediately adjacent to the reactor were at levels of single sieveits per hour. Further fires broke out on May 23 in the plant areas above the damaged reactor. Although these were in high-radiation zones, they were successfully dealt with.

The worry was that the molten debris would melt through the last 50 cm of a 2-m-thick concrete slab at the 9-m level. A flat concrete slab incorporating a heat exchanger was designed and installed in the area beneath the reactor vaults by the end of June. A decision was taken to entomb the critically dam­aged unit in protective concrete walls 1 m thick. This included a perimeter wall enclosing the turbine and reactor blocks as well as internal and dividing walls between Units 3 and 4 and a protective cover over the turbine and reactor blocks. An internal recirculating ventilation-cooling system was installed, and the entombed reactor was maintained at reduced pressure (in respect of atmos­pheric pressure) and the exhausted air discharged through filters and a stack. This work was completed by early autumn of 1986. However, the “sarcopha­gus,” as it is known, did not remain leak-tight for long and there continue to be concerns about its integrity and the up-ended top shield-reactor roof.

Consequential Events and Core Damage. The reactor core was very se­verely damaged by the explosion, which also caused structural damage to the reactor building. A considerable discharge of fission products took place (Fig­ure 5.18), and it is estimated that excluding the noble gases, 70 megacuries (when related to the time of the reactor shutdown, ~ 2.6 x 10IH Bq) were re­leased in essentially two periods: the initial explosion and early stages of the graphite fire (April 26—27) and the later heat-up transient (May 2-5). This total release corresponds to 3-3.5% of the total fission product inventory—some 6—7 tons of material.

Of this, some 0.3-0.5°% (0.6—1 ton) is estimated to have remained on the site,

with 1.5-2.0% (3-5 tons) being deposited within 20 km and 1.0-1.5% (2-3 tons) being transported to greater distances. Particle sizes of the released material ranged from below 1 micron to lOs of microns.

Table 5.1 shows the estimated fractional releases of fission products during the accident. Most of the gaseous fission products (Xe, Kr) were released to­gether with significant amounts of 1131 and cs137 as well as smaller amounts of fuel aerosol material produced by corrosion of U02 exposed in the mechanical and thermal disruption of the reactor core. Table 5.1 shows the corresponding releases for the accident at Three Mile Island, both for the release from the re­actor core and the release to the environment.

It will be seen that the extent of fuel damage and fission product release from the core in the two accidents is very comparable. However, the effective­ness of the containment and the ECCS in preventing any significant release to the environment in the case of TMI-2 is dramatically clear.

At Chernobyl two operators were killed hy falling debris and burns < luring

the first few hours after the accident. Up to the end of August 1986, a further 29 people, all involved in firefighting or other accident recovery methods, had died of massive doses of radiation. About 200 staff received high radiation doses and burns.

A 30-km radius control zone was established around the Chernobyl site. Pripyat, Chernobyl, and other population centers were evacuated from April 27 onward: in all, about 135,000 people plus several thousand livestock. In 1990,

50,0 more people were evacuated, and further evacuations have occurred since, although the average doses delivered by the environment directly are now low.

A massive effort was undertaken to decontaminate the Chernobyl site (to permit entombment of the No. 4 Unit and the return to operation of the other undamaged units) and the surrounding 30-km zone. Special measures were de­vised to protect ground and surface water from contamination by way of cur­tain walls between the reactor site and the Pripyat River. In all, about 650,000 persons involved in the cleanup of the plant site and the 30-km zone were ex­posed to radiation.

Very extensive areas of the former Soviet Union and beyond its frontiers were affected by fallout. The plume from the initial fission product releases reached a height of 1200 m. The cloud was generated over several days (Fig­ures 5.19 and 5.20). Initially the cloud traveled northwest, missing Pripyat, across the Soviet Union and northeast Poland to Scandinavia. Some days later it changed direction and swung southward across Poland and Central Europe. Figure 5.19 shows the likely trajectories of materials reduced from Chernobyl on April 26.

Heavy rain on April 30 and May 1 led to wet deposition of radioactivity across France, Switzerland, southern Germany, and Czechoslovakia. On Friday, May 2, the cloud reached Britain. While the cloud cleared southern and eastern Britain on May 2 and 3, heavy rain occurred in North Wales, Cumbria, and Scot­land, causing relatively high levels of Cs137 activity (Figure 5.20). From May 3, the cloud passed more to the south, over Yugoslavia, Italy, and Greece.

An assessment of the implications of this spread of radioactivity over Europe can only be approximate. The United Kingdom’s National Radiological Protec­tion Board has estimated a collective effective dose integrated over all time of

80,0 man Sv. Current estimates indicate perhaps 30,000 fatal cancers resulting over the next 40 years in the affected parts of Russia and Western Europe. This value needs to be compared with over 30 million cancer deaths expected in the same population over the same time period.

In 1991 the International Atomic Energy Agency issued the results of a major study, the International Chernobyl Project, looking at the health effects of the accident. It involved about 200 independent experts from 22 countries and seven international organizations. It concluded at that stage that there were no health disorders that could be directly attributed to radiation exposure and

there were also no indications of an increase in leukemias and cancers. There were, however, significant non-radiation-related health disorders in the popula­tion surrounding Chernobyl. Nine years after the accident, many of the ex­pected health effects had not become apparent because of the latency period for some radiation-induced cancers. So the health effects can be summarized as:

• Acute radiation sickness and burns from P radioactivity to some 200 people causing 28 deaths.

• Childhood thyroid cancer in children living in and around Belarus and the northern district of Ukraine. So far nearly 500 cases of childhood thyroid cancer (associated with the uptake of 1131) have been detected in a population of 3 million children at risk.

• Nonradiological effects from stress-related conditions in a population of 10 million living in the most affected regions.

On the basis of past experience, some further health effects may be observed in the 100-km-radius regions around the plant, particularly in relation to breast cancer and skin and lung cancers.

In Britain, restrictions were imposed on the movement and slaughter of sheep and lambs grazing on caesium-contaminated grass in North Wales, Cum­bria, and Scotland; originally about 4 million sheep out of a national flock of 25 million were subjected to controls. By March 1988, the number had been re­duced to 300,000, but some controls were still in place as recently as 1995. The extra radiation dose received due to inhalation from deposited activity or through the food chain is expected to be on average about 3.5% above the nor­mal annual dose due to natural background radiation (70 micro Sv. in about 2000 micro Sv.). This increase, however, varies from 10°% in the north and west to just 1 % in the south of the country.

Causes of the Accident. Given the magnitude and severity of the accident and the fact that other reactors of this type were still in operation, the (then) So­viet Union established a Government Commission to study the causes of the ac­cident. In its report to the IAEA Chernobyl Post Accident Review Conference in August 1986, the Soviet delegation acknowledged that a number of factors had contributed to the accident. Underlying the specific design and operational as­pects of the accident were the institutional and organizational shortcomings of the Soviet nuclear industry. Since the accident, many analyses have been un­dertaken and published. The general conclusion from these analyses of the Chernobyl accident is that no new reactor safety issues have been identified.

One unusual, perhaps remarkable, feature of the Chernobyl accident is that failure of equipment played no part in the events leading up to the explosion. Likewise, only one of the actions taken by the operators—violation 2, failing to reset the set point of the automatic regulation system at 00.28 h on April 26— can be considered a mistake. All the other violations of the operating rules were deliberate with the specific objective of completing the voltage regulation ex­periment.

Design Shortcomings. First, the concept and design of the reactor itself was the major contributory factor. While the RBMK reactor has some inherent features that made it quite attractive (including the lack of a thick-walled pressure ves­sel, the absence of steam generators, the capability to replace fuel on load, and ease of construction on remote sites), it also has features that were shortcom­ings:

1. Positivepower coefficient at low power levels. The power coefficient and de-

sign of a reactor dictates its behavior and stability. If the power coefficient is negative, any power rise will be self-limiting; if positive, the converse. The power coefficient is made up of a number of individual components, but in the case of the RBMK, two components are dominant: the negative effect of fuel temperature (Doppler) increases and the positive effect of an increase of steam voidage in the core. At power levels below 20%, the pos­itive void coefficient becomes much stronger than the negative fuel tem­perature coefficient. As a result the power coefficient is overall positive and the reactor unstable.

2. Slow shutdown system. The reactor control and protection system was too slow and inadequate in design. The shutdown system was dependent for its effectiveness on appropriate operation of the reactor control system, which was complex and largely manual. Because computers were rudimentary and unreliable when the RBMK reactor was originally conceived, the designers assumed that human operators would be more reliable. They failed to see the need for engineered safeguard features to counteract the operator’s dri­ving the reactor into extreme situations for which the slow shutdown system would be ineffective.

3. “Positive scram. ’’ Associated with the poor design of the protection system is the design feature that with the control rods fully withdrawn, the initial effect of insertion is to increase reactivity in the lower parts of the core, due to the displacement of water by the graphite followers. Normally, the entry of the boron carbide absorbers would reduce reactivity at the top of the core and overwhelm this increase. However, in the specific sequence of April 26, 1986, because of the double-peaked axial flux profile resulting from the xenon transient, this was not the case. The converse happened: entry of the control rods initially produced either a neutral or even a slight increase in re­activity—’’positive scram.”

4. Design of containment. This was inadequate to cope with this extreme acci­dent. The RBMK reactors do not have a common containment to cover both the reactor and primary circuit.

These unfavorable features, either individually or in combination, are inconsis­tent with Western safety design principles and would not have been licensed or built in the West.

Operator Violations. Clearly the operators had violated a number of operat­ing regulations vital for the safe operation of the plant, but these only magnified the design shortcomings, particularly at low power. The most serious violations have been highlighted earlier.

It is appropriate to ask why the operators seemed prepared to violate so many operating rules. The explanation seems to be that no serious consideration had been given to the safety aspects of the experiment. The Soviet Government Com­mission report states: “Because the question of safety in these experiments had not received the necessary attention, the staff involved were not adequately pre­pared for the tests and were not aware of the dangers." It seems the experiment was regarded as simply another electrical test. At the same time, operators report­edly felt they were under extreme pressure to complete the planned experiment that night since they knew it could be a full year before they had another chance. Other factors could also have influenced the operators to cut corners: The Cher­nobyl station was “top of the league" for availability, the experiment was delayed (by grid control) and came at the end of a working week early in the morning, and it was the eve of the May Day holiday.

Institutional and Organizational Shortcomings. In addition, shortfalls in managing the safe operation of the power plant were a major contributory cause, and a number of local and central government staff were removed from their positions and convicted of negligence. A separate Ministry of Nuclear En­ergy was set up alongside the Ministry of Power and Electrification. Professor Legasov, head of the Soviet delegation to the August 1986 IAEA Conference, in his memoirs (he died on April 27, 1988, the second anniversary of the accident) noted the many instances when expediency overcame quality—poor con­struction, defects in design and manufacture not rectified, etc. Most of all he was critical of the management of safety in the Soviet Union. “The level of preparation of serious documents for a nuclear power plant was such that someone could cross out something and the operator could interpret, correctly or incorrectly, what was crossed out and perform arbitrary operations.” This has been described succinctly as a lack of a safety culture.

1he Remedies. Russia and Ukraine have now implemented a number of measures to improve the safety characteristics of the RBMK reactors, but the measures also produce some increases in unit generating costs.

1. The control rod positional set points have also been reset so that all the con­trol rods “dip" into the core at least 1.2 m, with the physical capability to pre­vent their being withdrawn outside that limit. At the same time the positive scram effect has been eliminated by lowering the rods 0.7 m-1. 2 m.

2. The minimum number of control rods in the reactor at any one time has been doubled to 7(^$0. This limits the influence of the positive void coefficient and ensures a less rapid reactivity insertion.

3. As a longer-term measure the void coefficient has been significantly reduced so that the reactor cannot become prompt-critical. This has been done by in­creasing the number of fixed absorbers in the core. To compensate for the associated loss of activity, the fuel enrichment has been increased from 2% to

2.4% U-235.

4. Additional instrumentation has been provided to measure subcooling at the inlet to the main circulating pumps.

5. An additional independent “fast” shutdown system with an insertion time of 1-2 seconds has been introduced. The reactor will be automatically tripped without operator intervention if the reactivity margin for control reduces below a preset level.

In addition, wide-ranging improvements in technical management and operator training have been implemented at Chernobyl and the other RBMK reactors.

Given that no accident of such magnitude had previously happened to any nuclear power plant in the world, the coordination and response of the many Soviet recovery services appear to have been exemplary. However, the re­source and monetary cost to the Soviet economy is impossible to estimate—it must be at least one order of magnitude greater than the $1 billion for TMI-2.

Radioactive wastes can arise in gaseous, liquid, or solid forms. In general, at some stage of the management process the radioactivity in the gaseous and liq­uid forms is converted into a solid form. Most attention is therefore directed at the disposal of solid waste. Critics of nuclear power sometimes refer to radioac­tive waste disposal and decommissioning as the Achilles’ heel of this energy source. In fact, safe, sound, and economic technical solutions have been estab­lished for these activities.

Essentially, waste products from nuclear power may arise as follows:

Uranium Mining. The spoil from uranium mining is mildly radioactive and may need stabilization and monitoring.

Fuel Fabrication Plant. The enrichment and fabrication plants for ura­nium-based fuel present no particular problems in terms of radiation hazard. However, the fabrication of plutonium-based fuel produces low-activity pluto­nium-bearing residues of wastes arising from the fabrication process.

Spent Nuclear Fuel. As we have seen in Chapter 7, spent nuclear fuel in­cludes the highly radioactive fuel matrix together with the fuel can and sup­porting grids. The matrix itself contains the highly radioactive fission products, the remaining part of the original fissile and fertile materials, and the material bred in the reaction (see Section 7.1). Even if the fissile and fertile materials are recycled, the highly radioactive fission products remain and are the most im­portant wastes arising from nuclear power. Their disposal will be the main focus of this chapter.

Reprocessing Plant. In addition to the recycled product streams (uranium and plutonium) and the fission product stream, reprocessing produces a number of other waste streams. These include aqueous and organic streams containing medium levels of radioactivity. Another waste product is the residual cladding and support materials from the fuel elements, often referred to as hulls. These are reduced by compaction and then stored in a matrix of concrete or bitumen prior to final disposal. Reprocessing plants also generate waste with low levels of active contamination, including rubber gloves, tissues, and plastic containers. Some of these materials are contaminated by plutonium. The disposal of low — level waste materials will be discussed in Section 8.7.

Nuclear Reactors. In addition to the spent fuel, certain other radioactive products come from the reactors themselves. These include gaseous wastes (such as xenon and krypton) that may escape from defective fuel within the re­actor, liquid wastes such as tritium oxide (the form of water produced from the tritium isotope of hydrogen), solid wastes such as the resins from the water treatment plants that are used to clean up any small amounts of fission and cor­rosion products that may enter the primary system, and the filters from the cleanup system in a gas-cooled reactor. Finally, when the reactor comes to the end of its useful life, it must be decommissioned: the strnctural materials will have become slightly radioactive during the operation of the reactor and a care­ful program of work is needed to return the site safely to normal use. We shall discuss this problem in Section 8.7.

The heat content of the earth represents an energy store of enormous magni­tude. If the average temperature of the earth was reduced by 0.001°C, energy equivalent to that available from 130 million million tons of coal would be re­leased. This is roughly equivalent to 200,000 times the amount of coal mined in the United States in 1 year. Also for comparison, the total available resources of energy (from both fossil fuel and fission sources) are estimated to be equivalent to about 3 million million tons of coal (Armstead, 1978). Tapping this geother­mal source of energy might be one way out of our energy difficulties, but great technological problems and costs are involved.

The temperature of the earth’s core is estimated to be around 4000°C (Gass, 1971), but because of the insulating properties of the earth’s solid crust, heat leaks from the center of the earth to the outside very slowly—at a rate estimated by Gass (1971) to be about 0.06 joule per second per square meter of the earth’s surface. This gives a total heat out-leakage of 800 million million million (8 x 1020) joules per year, which is equivalent to approximately 20,000 million tons of coal per year and corresponds to a very small fraction of the total heat content of the earth.

There has been a tendency for the radioactive (heat-generating) material to be concentrated in solid form in the earth’s crnst, contributing to the net out — leakage of heat of 8 x 1020j/yr. The natural outflow of heat from the earth cor­responds to about 30,000 GJ/s (or gigawatts), which may be compared with the total worldwide electricity consumption of about 570 GW. Both of these figures pale in comparison with the amount of energy received from the sun, which is about 170 million GW. The heat flows to and from the earth are shown in Figure 1.5 (Doff, 1978).

We thus see that the amounts of energy received from the sun and arising from the earth’s core grossly dominate in magnitude the energy required to sus­tain human activities at any conceivable standard of living. The problem is not one of a shortage of energy but rather one of the economics of utilizing the en­ergy from their sources. Both geothermal and solar sources are highly dis­persed, and the capital costs involved in concentrating the sources and tapping them are enormous. Regarding the capital costs as a direct measure of the amount of human effort required to exploit energy resources, we see that we may not be able to meet our ambitions for human development with energy from these dispersed sources. When we can make use of natural concentrating mechanisms such as geothermal hot springs (for geothermal energy) or hydro-

electric power sources (for solar energy), we should clearly do so. However, the opportunities are limited and would not allow us to progress at the rate we desire. Specific problems with solar energy are its diurnal variations and the se­vere effect of cloud interference, as illustrated in Figure 1.6 (Duffie and Beckman, 1980).

The optimum solution, in our view, is to use the best features of all available energy sources, and we believe that any sensible energy scenario for the earth must of necessity include one or another form of nuclear energy.

Problem: The development of nuclear power reactors has been such that for gas — cooled reactors the integral-type design has become standard (using a pressurized con­crete vessel), whereas for water-cooled reactors the loop-type design is favored. Discuss the relative advantages and disadvantages of these alternative designs and es­tablish why each is preferred.

Bergles, A. E., Collier, J. G., Delhaye, J. M., Hewitt, G. F., and F. Mayinger 0981). Two — Phase Flow and Heat Transfer in the Power and Process Industries. Hemisphire, Washington, O. C., 719 pp.

Berglund, R. C. 0993). “Progress Report on GE Advanced Reactor Family." Nuclear Eu­rope Worrldscan 13 (March-April): 48.

Caso, C. L. 0993). "Advanced Designs for World Applications.” Nuclear Europe World — scan 13 (March-April): 50.

Catron, J. 0989). “New Interest in Passive Reactor Designs." EPRIJournal 14 (April-May): 4-13.

Collier, J. G., and J. R. Thome 0994). Convective Boiling and Condensation, 3d ed. Clarendon, Oxford, 596 pp.

Delhaye, J. M., and M. Giot 0981). Thermohydraulics of Two-Phase Systemsfor Indus­trial Design and Nuclear Engineering. Hemisphere, Washington, D. C., 540 pp.

French, H., ed. 0981). Heat Transfer andFluid Flow in Nuclear Systems. Pergamon, Elmsford, N. Y., 582 pp.

Golay, M. W., and N. E. Todreas 0990). "Advanced Light Water Reactors.” Sci. Am. 262 (April): 82-89.

Hall, W. B. 0958). Reactor Heat Transfer. Temple University Press, Philedelphia.

HUttl, A., and J. C. Leny 0993). “Framatome-Siemens Co-operation on the European Pressurized Water Reactor (EPR).” Nuclear Europe Worldscan 13 (March-April): 43-45.

Kutateladze, S. S., and V. M. Borishanskii 0959). Liquid-Metal Heat TransferMedia. Con­sultants Bureau, 150 pp.

Lahey, R. T., and R. J. Moody 0977). The Thermal Hydraulics of a Boiling Water Reactor. American Nuclear Society, LaGrange Park, Ill.

Merilo, M., ed. 0983). Thermal-Hydraulics of Nuclear Reactors, 2 vols. International Topical Meeting on Nuclear Reactor Thermal-Hydraulics, Santa Barbara, Calif,. Janu­ary 11-14, 1983, 1529 pp.

“The New Reactors" 0992). Nuclear News 35 (September): 66-90.

Runermark, J., and I. Tiren 0993). “ABB’s Program for Evolutionary LWR’s." Nuclear Europe Worldscan 13 (March-April): 4(6-47.

Tong, L. S., and J. Weisman 0979). Thermal Analysis of Pressurized Water Reactors. American Nuclear Society, LaGrange Park, Ill.

Winterton, R. H.S. 0981). The Thermal Design of Nuclear Reactors. Pergamon, Elmsford, N. Y.

4

6.2.1 Core Damage

Essentially, the first barrier, that of the fuel matrix and its cladding, can be chal­lenged in one of two ways: loss of cooling or increase of power. First, loss of ef­fective cooling of the fuel can lead to overheating as happened at TMI-2. Alternatively, a significant increase of neutron population (or reactor power) can result in excess energy deposition within the fuel, leading to fuel expansion and melting and consequent failure of the cladding. This can occur in spite of apparently adequate cooling. The accident at Chernobyl is an extreme example of this class of fuel failure.

Let us concentrate initially on the consequences of a loss-of-cooling situation. There are many ways this could develop with the primary circuit at either high pressure or depressurized, and on a time scale of a few seconds to a few hours. The progressive failure of the fuel can be summarized as follows:

1. As the fuel canning material increases in temperature, it will either burst or under some circumstances swell because of the gas pressure inside it. This may lead to a restriction of the coolant flow between and around the fuel el­ements and make more difficult the problem of cooling them. This factor is, in fact, taken account of in the design of fuel for water-cooled reactors, and it has been shown that blockages of up to 90% can be coped with.

2. As the fuel temperatures rise, so the volatile fission products are released and a temperature is reached (1200-1400°C) at which the first signs of molten material in the core begin to be observed. The melting process is ve1y com­plex with the formation of eutectics and occurs most rapidly in the regions of the core that have had the highest neutron flux (and therefore the highest concentration of fission products whose decay is causing the heating). The
grids that hold the fuel together also melt around 1400°C, followed by the control rods passing through the fuel.

3. At core temperatures above 1100°C the steam reacts with the zirconium can, destroying the can. The reaction is exothermic, that is, the chemical reaction itself releases additional heat. As the temperature increases, so the reaction rate increases and at high temperatures the chemical reaction can contribute as much or even more heat than the fission decay process. The chemical re­action produces hydrogen, which we shall see is a potential threat to con­tainment integrity.

4. Zircaloy itself starts to melt around 1700°C; the sequence of melting may he as illustrated in Figure 6.1. Molten droplets and rivulets of eutectic are formed (rather like wax running down a candle; Figure 6.1a). They solidify in the lower, cooler regions of the core, causing further blockage, which ex­acerbates the lack of cooling (Figure 6.1 b). The solidified material forms a crncible. With the cladding around them gone, the fuel pellet stacks are un­stable. Any transient (like the starting of the primary pumps in the TMI-2 ac­cident) can cause a redistribution of this material with the pellets falling into the crncible to form a debris bed. This material is still generating heat and there will he a tendency for it to melt and move down through the core, growing in volume as it does so (Figure 6.1 d)

5.

The mass of molten material will eventually reach the bottom core support plate and will he held there for a period of time until that core plate also fails

Figure 6.1: Sequence of core melting. Initial stages: (a) Molten droplets and rivulets beginning to flow clown intact fuel rods: ( /J) formation of local blockage in colder re­gions of fuel rods and formation and growth of a molten pool; (c) formation of a small molten pool: (d) radial and axial growth of the pool.

and the core debris then has access to the lower plenum of the reactor pres­sure vessel.

Example: For the Tokamak reactor described in Example 2 above, lithium is fed to the breeder zone at a temperature ( T) of 2500C and leaves the zone at T = 600°C. Calculate the lithium flow rate required and the maximum wall temperature on the lithium side of the first wall if the heat output of the reactor is 2 GW and the heat transfer coefficient (a) between the lithium and the wall is 25,000 W/mK. Assume a specific heat ( ер) for lithium of 3.4 kj/kg K and a density (g) of 500 kg/rn4 Also assume that 70% of the energy from the reaction that is released to neutrons (80% of the total energy) is converted to heat in the lithium.

Solution: Of the total energy originally generated by the reactor, (20 + 0.7 x 80)% = 76% eventually finds its way into the lithium blanket. The heat released is given by

Q = VQcp(T0-T) = 0.76x2x109 =1.52 x 109 W where V is the flow rate of the lithium. Thus:

6cp (To — Г )

_ 1.52 xlO9

_ 500 X 3.4 X 10: X (600-250)

= 2.55 m-/s

As explained in Section 9.2, 80% of the energy arising from the fusion reaction is in the form of the kinetic energy of the neutrons, and the neutrons will pass into the lithium, reacting with it to form ‘He and T and also releasing heat into the lithium stream. It was assumed that 70% of the original neutron energy (56% of the total energy) is released as heat in the lithium (the remainder being used in the conversion of 7Li; see Section 9.2). Assuming that the remaining 20% of the fusion reaction energy is radiated from the plasma to the first wall, and finds its way into the lithium via that wall, the maximum wall temperature would be

Tmax = 600 + f1T°C

where AT is the temperature difference between the wall and the lithium and is given by

_ 2 x l09 x0.2

AT =———————-

first wall area x a

= 2x10x0.2 = 340c

470 X 25000

Thus, the maximum first wall temperature would be 634°C.

Problem. Repeat the calculations in the example for the reactor calculated on the more relaxed energy flux constraint given in Problem 2.

BfflUOGRAPHY

American Nuclear Society (ANS) 0983). Proceedings of the Fifth Topical Meeting on the Technology of Fusion Energy, Knoxville, Tenn., April 26-28.

Carmthers, R. (1977). “The Fusion Dilemma.” Interdisciplinary Sci. Rev. 6 (2): 127-41, 198l.(See also VIIIFusion Prague 1977, 8th European Conference on Controlled Fusion and Plasma Physics, vol. 2, 217-29.)

Gibson, A. 0977). ‘The JET Project.” Atom (254): 3-15.

International Atomic Energy Agency 0982). Plasma Physics and Controlled Nuclear Fusion 1982, Conference Proceedings, Baltimore, Md. September 1—8, vols. 2 and 3. IAEA, Vienna.

Lehnert 0977). “Thermonuclear Fusion Power.’’ Energy Res. 1, 5-25.

Lomer, W. M. 0983). “Remaining Steps towards Fusion Power.” Nucl. Energy, 153-57.

Pease, R. S. 0977). “Potential of Controlled Nuclear Fusion.” Contemp. Phys. 18,

113-35. (See also “Physics in Technology,” 144-51.)

—— (1978). “The Development of Controlled Nuclear Fusion.” Atomic Energy Rev. 16

(3): 519-46.

—— 0979). “Nuclear Fusion: The Development of Magnetic Confinement Research.”

Fusion Technol. United Kingdom Atomic Energy Authority.

Pease, R. S., and A. Schluter 0976). “The Potential of Magnetic Confinement as the Basis of a Fusion Reactor.” In Nuclear Energy Maturity, Proceedings of the European Nuclear Conference, Paris, 91-94, Pergamon, Elmsford, N. Y.

[1] The Atomic Energy Research Establishunent of the U. K. Atomic Energy Authorities, founded in 194(].

[2] Inlet pipe rupture in a Magnox reactor

Example: A severe accident in a Magnox reactor contained in a steel pressure vessel is rupture of an inlet cooling duct followed by 50 s of stagnation in the core. During this period the only means of cooling is heat lost by radiation to the graphite moderator, which remains at 350°C. The metal fuel pin has a diameter of 30 mm, and the initial can temperature is 450°C. The temperature drops across the Magnox cladding and fuel — to-clad gap may be neglected. The initial fuel rating (R) is 35 kW/m, and it takes 4 s for the control rods to enter the reactor to shut it down. What is the maximum Magnox cladding temperature at the end of the stagnation period?

Solution: We consider ihe four sources of energy that will make the clad temperature rise. (1) Delay in shutting down the reactor. The energy per meter length due to the

[3] High radiation levels and/or contamination on-site due to equipment failures or opera­tional incidents. Overexposure of workers (individual doses exceeding 50 millisieverts)."

The RBMK reactor is a direct-cycle boiling-water pressure tube, graphite-mod­erated reactor developed from Russia’s first nuclear power plant, commissioned in 1954. The concept is unique to the former Soviet Union, and it was this type of reactor that was involved in the very serious nuclear accident at Chernobyl in the Ukraine in April 1986. This accident is described in Chapter 5. To aid this later description, the RBMK is covered in rather more detail than the other re­actor concepts.

Figures 2.12 and 2.13 show the main elements of the reactor. The reactor core is 12 m (40 ft) in diameter and 7 m (23 ft) high, and is built up from graphite blocks (A in Figure 2.13) penetrated by vertical channels (B) and con­taining a zirconium alloy (Ar + 2.5% Nb) pressure tube 88 mm (3.5 in) in inter­nal diameter and 4 ^m thick. For a 1000-MW(e) reactor there are 1663 channels. Each channel contains two fuel assemblies each 3640 mm (12 ft) long, held together by a central tie rod suspended from a plug at the top of the channel.

The fuel assemblies consist of 18 pin clusters, each pin in the form of en­riched (2%) uranium dioxide pellets encased in zirconium alloy tubing (13.6 mm in outside diameter. x 0.825 mm thick). The maximum power of any chan­nel is 3.25 MW (thermal).

The fuel is cooled by boiling light water at 70-bar (1000-psia) pressure. The water enters the channel at 270°C, and the “quality" (fraction of the total mass flow that is steam) of the existing steam-water mixture is on average 14% (20% maximum).

Two separate identical coolant loops are provided. Each loop consists of two steam drums (C) (to which the riser pipes from the fuel channels carry the steam-water mixture) and four primary circulating pumps (D) (three are nor­mally operational and one standby).

Fi^^e 2.13: Outline diagram of the RBMK: A, Graphite blocks; B, Vertical chan­nels; C, Steam drums; D, Circulating pumps; E, Turbine generators; F, Feed pumps; G, Absorber rods; H, Refueling machine; I, Circulating pump compartment; J, Distribution pipework; K, Surface condenser; L, Pressure supression pools; M, Emergency core cooling.

The dry steam from the steam drums passes to one of two 3000-rpm 500- MW(e) turbine generators (E). The very low pressure steam leaving the con­densers is condensed in tubular condensers, and the condensate is returned to the steam drums via purifying systems and electrically driven feed pumps (F).

About 5% of the energy of the fission is dissipated in the graphite structure as a result of the slowing down of neutrons and of ga^ma heating. This heat is transferred to the fuel channels by conduction and radiation via a series of “pis­ton ring”-type graphite rings that permit good thermal contact between the pressure tube and the graphite blocks while also permitting small dimensional changes. The maximum temperature of the graphite is 700°C. To improve the thermal contact and to prevent graphite oxidation, the graphite structure is en­closed in a thin-walled steel jacket through which a gas (helium-nitrogen ^hr — ture) is slowly circulated.

Perhaps the most important characteristic of the RB^K reactor is that, as originally designed, it has a positive void coefficient. This can be explained in simple terms by recognizing that if the power from the fuel increases or the flow of water decreases (or both), the amount of steam in the fuel channel in­creases and the density of the coolant decreases.

The term positive void coefficient is reactor physicist’s jargon for the fact that reducing coolant density results in an increase in neutron population (light water is a strong absorber of neutrons) and hence in an increase of reactor power. However, as the power increases so too does the fuel temperature, and this has the effect of reducing the neutron population (negativefuel coefficient). The net effect of the positive void coefficient and the negative fuel coefficient clearly depends on the power level.

At normal full-power operating conditions the fuel temperature coefficient dominates and the net effect, termed the power coefficient, is negative. However, below about 20% of full power because of the lower fuel tempera­tures the power coefficient becomes positive. For this reason restrictions were placed on operation below 20% power.

As we shall see in Chapter 5, this fundamental design shortcoming was the critical factor of the accident at Chernobyl.

In short, at lower power an increase in power or a reduction of flow leads to increased boiling and further increases in power and hence to the potential for an unstable situation. As a result, RBMK requires a complex, rapidly responding control system to cope with this positive feedback.

Channels for the control and shutdown rods and for the in-core flux instru­mentation pass through vertical holes in the graphite blocks. Radial flux moni­tors are provided in over 100 channels, and axial flux profiles are monitored in 12 channels.

The system for reactor control and protection uses 211 solid absorber rods (G in Figure 2.13). The rods are divided functionally as follows (Figure 2.14):

• 163 manually operated rods of which 139 are control rods (RR) for radial power shaping and 24 are dedicated to emergency protection (AZ).

• 12 rods for automatic regulation of average power (3 groups of designated AR1, AR2, and AR3, respectively).

• 12 rods for automatic regulation of local power (MR).

• 24 shorted absorber rods (USP) for axial flux profling.

The manual control rods (RR), the automatically operated rods (AR), and the emergency shutdown rods (AZ) are distributed uniformly throughout the core in six groups of 30-36 rods. The control system includes subsystems for local automatic control (MR) and local emergency protection (MZ). All rods except the shortened absorber rods are withdrawn and inserted from above.

The emergency shutoff rods are motor-driven at a speed of insertion of 0.4 m/s. Full insertion takes 15-20 seconds. The shorter absorber rods are intro­duced from below the core. The control rod channels are the same diameter as the fuel channels (88 ^m) and are cooled by a separate water circuit. At the end of each rod are a number of articulated elements that do not contain neu­tron-absorbing material. As the rod is withdrawn these “followers” prevent water from occupying the space vacated by the absorber.

The control system is arranged to operate over the following power ranges:

1. From subcritical to 0.5% power, manual operation was used.

2. From 0.5% to 10% power, automatic regulation of overall power was performed

using one of the sets of four rods designated for this purpose (i. e., AR3).

3. From 10% to 100% of the working range, overall automatic regulation was

carried out using control rod groups AR1 and AR2.

4. From 10% to 100/o power, local automatic regulation (fu3R) was also invoked.

The reactor is “tripped” (i. e., switched off completely) only for a specific number of faults, e. g., loss of off-site (station) power, both turbines tripped, loss of three main circulating pumps, 50% loss of feed water, low steam drum water level, and high neutron flux.

For all other faults the reactor power is set back to some lower level consis­tent with the fault’s consequence for the reactor (e. g., on loss of one circulating pump to 80% full power, trip of single turbine to 50% full power).

The RBMK reactors are designed to be refueled at full load, and Figure 2.13 shows the refueling machine (H) operating from the gantry rnnning the length of the charge hall.

The primary coolant system is housed in a series of compartments that act as the containment in the event of an accident. Separate compartments house the primary circulation pumps (I), the coolant inlet headers and distribution pipework (J), and the reactor vault.

Each compartment is designed to withstand a pressure of 4.5 bars and is equipped with sealed electrical and mechanical penetrations and isolation valves on piping. The compartments are connected to one another and to a surface con­denser tunnel (K in Figure 2.13) as well as to two pools of water (“pressure sup­pression pools,” L) to condense the escaping steam and lower the pressure.

The steam drums (C) are housed in separate compartments on either side of the charge hall, but these are not pressure-tight compartments because of the large number of joints in the charge hall floor needed for refueling that provide a leak path between the steam drum compartments and the charge hall.

The RBMK reactor is equipped with an emergency core cooling system (M) that feeds both coolant and consists of

1. a fast-acting flooding system that automatically injects cold water into the damaged part of the reactor from two sets of gas-pressurized tanks holding enough water to cool the core for the first 3 minutes of a major loss of coolant accident. This system is supported with flow from the main feed pumps.

2. an active system of three pumps taking water from the condensate system after the pressurized tanks have emptied. These pumps are driven by three standby diesel generators that can be started within 2-3 minutes.

3. an active recirculating cooling system that consists of six pumps drawing water from the upper suppression pool through heat exchangers feeding the damaged part of the reactor and also driven by the diesels.

The emergency core cooling system is triggered by the coincidence of a high — pressure signal from any of the containment compartments and a low-level sig­nal from the steam drnms.

As a consequence of the accident at Chernobyl a number of modifications have been carried out on other RBMK units. The control rod design has been improved and the rate at which the rods can be inserted into the core has been increased. Automatic shutdown systems have been fitted to prevent the reactor from being operated continuously below 20% full power. The problem of the positive void coefficient has been reduced by fitting fixed neutron absorbers. The main influence of this measure is to alter the balance between absorption of neutrons in fixed absorbers and the variable absorption in the steam-water coolant. To compensate for these measures the enrichment of the fuel has been increased from 2.0% to 2.4% U-235.

The safety of both Magnox reactors (Figure 2.4) and advanced gas-cooled reac­tors (AGRs) (Figure 2.5) has common elements, and the two reactor types will be dealt with together here. However, many of the detailed points are more relevant to the more modern form of gas-cooled reactor, namely, the AGR.

Using the classification of operational states outlined in Section 4.1, we regard the following forms of transient behavior as relevant:

1. Operational transients. Operational transients of the type encountered in water reactors—e. g., the problems of start-up and shutdown and of variation of load during operation—are also found in gas-cooled reactors. Attainment of criticality in the reactor is controlled by the operator, who is prevented by various interlocks from carrying out actions that are potentially hazardous. For instance, the control rods may not be raised until the main reactor pro­tection system is operative. Another form of operational transients that oc­curs in gas-cooled reactors is associated with replacing used fuel elements with new ones (refueling) while the reactor is operating at power. Briefly, this process demands attaching a small pressure vessel to the cooling chan­nel, breaking into the primary system and extracting the fuel element into the subsidiary pressure vessel, releasing a new fuel element from the sub­sidiary pressure vessel (sometimes called the refueling machine or recharg­ing machine), and sealing the primary circuit before removing the spent fuel element for further processing.

2. Upsets. Again, similar upset conditions are encountered in gas-cooled reac­tors and water-cooled reactors. An upset can consist of loss of site power, a turbine trip, or faults on the secondary/steam side. An example specific to the gas-cooled reactor would be failure of one of the gas circulators.

3. Emergency conditions. Interrnption of the normal electricity supply to the power station represents the emergency condition in gas-cooled reactors. An automatic reactor trip shuts down the fission reaction and is initiated by a drop in circulator supply voltage or in circulator speed. Upon loss of electri­cal supplies from the grid, diesel generators are brought into operation auto­matically to provide essential power supplies to the plant, including the circulators. Heat is extracted from the circulating gas by means of special heat exchangers known as decay heat boilers. The AGRs are designed such that even if it is not possible to maintain circulator rotation, natural circula­tion of the gas through the core and then through the decay heat boilers will be sufficient to remove the decay heat. The effectiveness of this process is il­lustrated in Figure 4.35. It is estimated that natural circulation flow represents about 2% of the normal full-power flow, whereas, as shown in Figure 4.35, any flow above about 0.35% of the normal flow would be sufficient to main­tain the fuel temperature below the maximum allowable value of 1350°C to prevent excessive clad corrosion. Other faults leading to emergency condi­tions include:

a. Boiler feedwater faults. Loss of boiler feedwater would lead to an increase in coolant gas outlet temperature from the boiler that could, if sufficiently severe, potentially damage the gas circulator. The reactor is tripped and posttrip cooling is provided by the decay heat boiler system.

b. Steam line breaks. The AGR is divided into four quadrants, each of which has two circulators and two boilers with associated control and protection systems. Failure of a steam main from one of the boilers could

at worst, render two quadrants of the plant unavailable. Again, the reactor is tripped and posttrip cooling is provided by the main boilers and the decay heat removal boilers.

c. Water entering the reactor. A fault in the boiler could lead to water entering the primary coolant circuit. The presence of steam arising from the boilers would give a rapid increase in pressure, causing a reactor trip. The reactor pressure vessel is protected against overpressurization by safety relief valves.

4. Limiting fault conditions. For gas-cooled reactors, typical faults in this cate­gory might be:

a. Depressurization following a breach of the primary circuit outside the prestressed concrete pressure vessel, e. g., through a stuck-open safety valve or a break in the pipework in the gas purification plant.

b. Withdrawal of a group of control rods either at power or with the reactor shut down.

c. Single-channel faults resulting from blockages or fracture of the graphite sleeves surrounding the fuel element. Of these limiting fault conditions, the depressurization fault is considered the most severe and is discussed

4.6.1 Design Basis Accident for the AGR: Depressurization Fault

The heat transport capacity of carbon dioxide falls essentially in proportion to its density; in a depressurization from 40 bars to 1 bar (atmospheric pressure) the density is reduced by a factor of 40, reducing the heat transport capacity similarly. Provided the reactor is tripped as a result of the depressurization, the reduction in heat removal capacity is quite closely matched by the reduction in heat generated in the fuel in going from normal operation to shutdown (where there is only decay heat to consider). Thus, it should not be necessary for fuel temperatures to rise significantly above their normal operating values during a depressurization accident in a gas-cooled reactor.

Guaranteeing heat removal capacity after a depressurization presupposes that a means is always provided to circulate the coolant adequately. As we saw above, if the reactor is not depressurized during an emergency condition in which the circulators become inoperative, natural circulation cooling is suffi­cient to take away the heat. However, if the circulators are inoperative and the reactor is depressurized, natural circulation may be insufficient to keep the fuel temperatures below melting.

There are several mitigating circumstances related to depressurization and fuel temperature increase in an AGR. First, it is an integral type of circuit (see Section 3.7), and the majority of components are inside the containment vessel. Thus, the diameter of the maximum break is limited to about 200 ^m. This means that the depressurization from such a large vessel (which is equivalent in volume to about 30 P^^ vessels) is very slow. Typically, it might take about an hour to depressurize the vessel from its operating condition to atmospheric pressure. During this time, the decay heat rate diminishes substantially (see Table 2.2). However, even at this reduced rate, it is important to keep at least one of the circulators operational in order to maintain long-term cooling. Thus, an essential feature of safety protection in an AGR is that of safeguarding the in­tegrity of operation of the circulators. This is achieved by having diversified backup electricity supplies to ensure that power is available to drive the circu­lators together with reliable supplies of water to cool the oil, which is used both as the circulator seals and for circulator cooling.

Another safety problem related to an AGR is that the prestressed concrete pressure vessel must be maintained at all times at a temperature less than 100°C. This condition is achieved in normal operation by using cooling water pipes set into the concrete vessel walls. In handling fault conditions it is impor­tant to maintain this cooling water supply, and this is done by having auxiliary and reliahlp snnnlips av::ibihlp nn o;itp Auxiliary snnnlies are also needed to pry

sure that the feedwater to the decay heat boilers is always maintained.

Finally, the need for assured supplies of electricity, cooling water, and feed­water means that very great care must be taken to provide a diversity of sup­plies in case of failure. For instance, there must he at least four sets of diesel generators to provide electricity for the circulators. The safety of the reactor would be assured if only one of these was available.

1 Total decay heat from a reactor

Example: The total amount of decay heat that can be generated from a reactor core is finite; eventually, all the fission products decay to a nonradjoactive state and the en­ergy that is released in this long-term process is fixed and can be calculated by esti­mating the energy release from the decay of each relevant fission product and summing the energy released from all fission products. As an example of this process, calculate the total decay heat released from 1 kg of iodine-I 31 that is present in the re­actor at shutdown. Iodine decays to xenon-131 by the reaction

I-131 Xe-131 + P + y

each atom that decays releases 0.57 MeV (9.12 x 10-14 joules) of energy. Assuming a half-life of 8 days for I-131, what fraction of this energy is released in the first 30 days of decay?

Solution: The number of atoms (N) of I-131 in 1 kg is given by

_ number of atoms per kg mole atomic weight _ 6.022 X 1026 _ 131

= 4.597 x 1024 atoms/kg

Total energy released =4.597 x 1024 x 9.12 x 10^14 J

= 4.192 x 1011 J =0.419 terrajoules (TJ)

The number N, of atoms of I-131 remaining after fdays is given by

NtN exp(-At)

where A is the decay constant, in reciprocal days. From the substitution

0. 5N = N exp(-8A)

we have — sA = lnO.5

A = 0.8664

The number of atoms remaining after 30 days is given by

Ni0 = N exp( -0.08664 x 30)

= 0.0743N

Thus, 1 — 0.0743 = 0.926 of the energy released by decay of the iodine-131 will have been released in the first 30 days.

Problem: Calculations reveal that the total amount of decay heat released from the core of a 1000-MW(e) reactor following shutdown is around 100 TO’. If all this heat is released into a boiling-water pool, what would be the total mass of water evaporated from the pool if the latent heat of evaporation is 2257 J/kg? If the heat were released and absorbed in melting the concrete surrounding the reactor, what mass of concrete would be melted (assuming no heat loss to the environment)? If the molten concrete formed a hemispherical pool, what would be the radius of this pool? (Assume that the latent heat of melting of concrete is 1000 J/kg and that the density of the molten con­crete is 2000 kg/m:l)

material at 3000 K is released into a pool of water remaining at the bottom of the reac­tor pressure vessel. A steam explosion occurs, releasing 3% of the original thermal en­ergy of the fuel, and the energy of the explosion is transmitted to a 10-ton slug of water that rises up the vessel, hitting the top of the vessel. At this stage the vessel is unre­strained and weighs (with its contents) 500 tons. Calculate the height that the vessel rises as a result of the impact with the water slug. Assume that the thermal energy of the fuel is 1.5 GJ per ton.

Solution: The amount of energy released by the explosion is given by:

E = 50 X 0.03 x 1.5 x 109 J

E = 2.25 x 109 j = 2.25 GJ

If this energy is transmitted into the kinetic energy of a 10-ton water slug. we may cal­culate the velocity V. of the water slug, since the kinetic energy of the slug is given by 1/2 m V_2 where m is its mass. Thus

V2 mV;2 = 2.25 X 109 J

and

( 2.25 x 109 X 2 ^

10,000

After the impact with the vessel the vessel begins to rise with a velocity V: The princi­ples of conservation of momentum apply and we may write

mVs = MV,,

where M is the mass of the vessel. Thus:

m 10

V— Vs =——- x 670.8

M 500

= 13.42 m/s

The kinetic energy of the vessel after impact is given by

Kinetic energy = MV2 = _!_ x 5 x 10s x 13.422
2 v 2

= 4.50 x 107 J

= 45.0MJ

Note that a large proportion of the original energy of the water slug has been lost in the impact.

The initial kinetic energy of the vessel is converted to potential energy as the vessel rises from its original position. Suppose the vessel rises to a height h before coming to rest. The potential energy gained at this height relative to the original position is Mgh, where g is the acceleration due to gravity.

Mgh = і MV;! = 4.5 x 107 J

, 4.5×107 4.5 x 107

h =————- =——- 5———

Mg 5×105 x 9.81

= 917 m

A rise of 9.17 m would not normally be sufficient to bring the vessel into contact with the containment, but it would probably lead to its hitting the missile shield above the vessel, depending on the system design.

Problem: Calculations reported by Gittus et al. (1982) suggest that a 0.4-m-diameter missile of 850 kg traveling at 300 m/s would penetrate both the missile shield and the containment, giving rise to containment failure and partial release of fission products to the environment. In the steam explosion described in the example, suppose the impact between the water slug and the upper part of the vessel led to breaking up of the ves­sel and the formation of an 850-kg, 0.4-m-diameter missile. What fraction of the origi­nal water slug energy would have to be imparted to this missile to cause it to break the containment?

b

Barsell, A. W. (1981). A Study of the Risk Due to Accidents in Nuclear Power Plants. Ger­man Risk Study—Main Report, various pages.

Dunster,. J. (1982). “The Assessment of the Risks of Energy.” Atom (303): 2—6.

Farmer, F. R. (1981). “The Assessment of Risk in Relation to Major Hazards, with Particu­lar Reference to Nuclear Reactors.” Contemp. Phys. 22 (3): 349—60.

Gittus, J. H. (1982). “International Experience and Status of Fuel Element Performance and Modelling for Water Reactors.” Report. ND-R-604(S), U. K. Atomic Energy Au­thority, UKAEA Risley Nuclear Power Development Establishment, 115 pp.

Green, A. E. and A. J. Bourne (1972). Reliability Technology. Wiley lnterscience, New York, 636 pp.

Griffiths, R. F. 0978). “Reactor Accidents and the Environment.” Atom, December, 314-25.

Jones, 0. C. (1981). Nuclear Reactor Safety Heat Transfer. Papers presented at the sum­mer school on nuclear reactor safety heat transfer, Dubrovnik, Yugoslavia. August 24-29, 1980. Hemisphere, Washington, D. C., 959 pp.

Kelly, G. N. (1981). “The Radiological Consequences of Notional Accidental Releases from Fast Breeder Reactors.” Ann. Nucl. Energy, 8 (7): 307-18.

Merilo, M. (1983). Thermal-Hydraulics of Nuclear Reactors, Papers presented at the Second International Topical Meeting on Nuclear Reactor Thermal-Hydraulics, Santa Barbara, Calif., January 11-14, 1983, 1529 pp.

Muller, U., and C. Gunther (1982). “Post Accident Debris Cooling.” In Proceedings of the Fifth Post Accident Heat Removal Information Exchange Meeting, Karlsruhe,

West Germany, July 28-30, 1982. Braun, 364 pp.

7