1.3.4.1 Two-Phase Boiling ModeV

If heat is input uniformly into a liquid coolant channel (Fig. 1.9), the temperatures of the fuel element surface Tcd and the coolant Tc increase as the coolant flows along the channel and the sequence of heating regions is as follows:

(a) Convective heat transfer region, in which the heat transferred q is given by

q — h(Tcd — Tc) (1.46)

Tc and Год increase linearly and Ted reaches a value just above the coolant saturation temperature.

(b) Highly subcooled boiling region, in which heat transfer is mainly convective. Bubbles form and collapse on the element surface and Tc increases.

(c) Slightly subcooled boiling region, in which heat transfer is partly by convection and partly by a boiling mechanism. Bubbles persist and are swept into the stream only to diminish in size as they move along the channel. The value of Tc increases until the saturation value is reached.

(d) Bulk-boiling region, in which the heat transfer q is given by

q = rj(Tcd — TB&ty (1.47)

Steam bubbles grow in the stream and Tc remains constant as all the heat goes to convert liquid into vapor.

(e) Superheated region after the liquid is fully converted to vapor and the vapor temperature Tc and the surface temperature Tcd now both rise again.

A pressurized water reactor (PWR). channel terminates in the slightly sub­cooled region whereas a boiling water reactor (BWR) channel extends into the bulk-boiling region. In a steam generator, a section will also include the superheated region.

+ See Tong (8b).

The mathematical representation of this two-phase situation uses the three conservation equations of energy, mass, and momentum to define the void fraction, the vapor velocity, and the pressure.

Energy

-fa ((?гП — fvihi + Qvfovhv) + — fa ((?i[l — fhi + QvKf) — b<f> + ± Gx

(1.48)

Mass

((?;[! —fvi + Qvfiv) + ~fa ((?iD ~f] + Qvf) = 0 (1-49)

Momentum

feD — />г2 + Qvfvv2) + feD — f]»i + 6vfav)

= (1’50>

However these equations presuppose some knowledge of the ratio of the vapor velocity to the liquid velocity vvjvt, the slip ratio, for which experi­mental correlations exist. The equations also assume that the two phases are in thermal equilibrium with each other. This is usually a good assump­tion except in very severe transients when the vapor and liquid might have to be considered separately. Note that the densities (, ov) and enthalpies (hi, hv) are all pressure dependent and the calculation is now very complex.

This model applies well to water and it may be used for water-cooled thermal reactors or in steam generator modeling. However sodium vapor­izes at high superheats and the two-phase situation is over very rapidly, resulting in almost immediate bulk boiling (see Section 1.3.4.3).

This system is the second runner in both the United States and Europe, with possibly greater economic potential than the liquid-metal-cooled variety. However, it still has development problems to overcome (Fig. 2.2).

The particular version discussed here is a British design (2) which uses coated particle technology to produce a novel fuel that allows very high outlet temperatures in the range of 1000°C (1830°F). The fuel uses small silicon carbide coated particles of mixed carbide fuel which retain the deve­loped fission products. The power density is in the range of 240 W/cm3. The coolant is helium operating at a pressure of above 750 psia, and po­tentially the system has promise in direct cycle use with the addition of a gas turbine. Table 2.1 shows the main chacteristics for a 1000 MWe version of this reactor system.

A typical fuel pin in a fast reactor could be a ceramic fuel bonded within a metal cladding. Several varieties are possible, the main ones being helium- bonded U02 (enriched with Pu02) in stainless-steel cladding; and sodium — bonded UC pellet in stainless-steel cladding. The oxide and carbide can be fabricated in different ways (pelleted or vibro-compacted) and the cladding can be fabricated in different ways (solution-treated or cold-worked). Many other varieties are possible even in different configurations ranging from cermet fuels or silicon carbide-coated fuel particles (la). Each of these fuel elements has a different mode of failure depending on the circumstances and so different failure limits are required for each fuel element for each disturbance.

Bubbles within coolant channels may affect the heat transfer in two ways. If the bubbles are small and dispersed and spread evenly throughout the coolant, they have a homogeneous effect of macroscopically decreasing the density of the coolant. If the bubbles are larger, they may be considered individually as insulating a portion of the fuel pin either in a stationary manner or in a transient manner as the bubble moves up the core.

4.2.2.1 Homogeneous Effects+

If the bubbles are small and dispersed, the density is effectively reduced. The Nusselt number is given by an expression of the form

Nu = 4.8 + 0.025 P°-8 (4.3)

Thus as Nu = hDjk and Pe = QDv(cP/k) this equation directly leads to an evaluation of the heat transfer coefficient h, which is much simplified if one assumes that the density of gas is negligible compared to the density of sodium.

With gas in the sodium coolant, the effective density is given by Eq. (4.4) in which a is the void fraction. The average velocity of the coolant and the

+ See Hori and Hosier (52).

heat capacity cP’ are given by Eqs. (4.5) and (4.5a).

For a two-phase mixture the thermal conductivity for small void fractions is given (5a) by Eq. (4.6). This equation is valid up to a void fraction of 0.5

k! = £(1 — a)/(l + £a) (4.6)

Thus substituting these values for k’, v’, cv’, and q’ for the single phase values in Eq. (4.3) the homogeneous coolant heat transfer equation becomes

h’ = A[(l — a)/(l + £a)][4.8 + 0.025 P™( 1 + Jo)0-8] (4.7)

In the limit of the validity of this equation, for a void fraction of 50%, the heat transfer is reduced to about a third of its original value.

The fuel temperature is related to the coolant temperature in steady — state conditions through the heat-transfer coefficient as

fuel pin surface temp. = coolant temp. + power/А’ (4.8)

Thus the temperature difference between the surface of the fuel pin and the coolant will increase by something less than three times. Thus, even with a void fraction of 50% the surface temperature on the hot pin cladding might increase from 1200 to 1500°F and failure is unlikely. In practice, this volume of bubbles would not be possible.

Oxide contamination of the coolant was a major preoperational difficulty. Flow meters were erratic, 6 of the 12 rods could not be raised due to crud — ding on the rod mechanism which broke the surface of the sodium, and the cold trap circuits rapidly became clogged.

The coolant was dumped and cleaned, and the rod mechanisms were modified to avoid breaking the surface. Some of the purification circuit lines proved to be too small in diameter; they were eventually replaced by an external purification circuit. The dirty coolant was principally a quality assurance problem prior to the filling of the primary circuit and was cleared by draining and refilling with clean NaK.

Gas entrainment in the primary system was quickly observed. Expansion tank levels were erratic and, at low power, reactivity changes occurred due to the voidage in the core region. Some of the gas was being entrained through thermocouple and control rod guide tubes that dipped below the surface of the coolant. The entrainment problems in these areas were solved by drilling holes in the thermocouple guide tubes to equalize pressures in­side and out and by installing “hats” on top of the control rod guide tubes, so that they could be supplied with an independent cover gas system. Both of these problems, coolant crudding and gas entrainment, were accentuated by the multiplicity of circuits in the system, since a single modification to a circuit had to be repeated 24 times.

The wind direction and speed can be varied by macroscopic and local conditions. All the parameters must be measured and monitored so that not only is a mean value known, but its variances and statistical uncertain­ties are known also. The main characteristics are: prevailing direction that is largely a macroscopic effect dependent on the site proximity to large mountain ranges and the sea; persistence; wind shear or variation of speed and direction with height caused by the pressure gradient; local circulations due to the surface roughness in the site locality; and turbulence caused by a disparity of temperatures during the day and night.

In principle, it is important to maintain a subcritical system during the entire period in which the system is subjected to thermal failure, so that there is no excursion and no explosion, and to continue to maintain that subcriticality during the decay period until the damaged core can be removed.

Even if there had been a core disruption, the debris would need to be maintained in a subcritical condition to avoid further, and possibly worse, excursions. This would need to be done either until debris could be removed after the decay heat had subsided so that the fuel could freeze.

Figure 5.15 illustrates the system used in the Fermi Reactor {29). It comprises:

(a) a zirconium clad conical flow guide designed to disperse any molten fuel from the core into a distributed and subcritical configuration;

(b) a series of zirconium clad plates in a melt-down section through which

the fuel could possibly melt (this melt-down system would provide a time delay to reduce the decay heat level before the fuel reached its final resting place);

(c) a further internal cone in the melt-down section to maintain sub­criticality by dispersion;

(d) the vessel and the guard vessel, both of which provide delay time while the fuel penetrates them, and provide a coolant system boundary for some sodium cooling while the fuel is melting downward; and

(e) a graphite crucible outside the vessel designed to catch and retain any molten fuel which reaches it (at this point, the molten mass would be cooled by sodium in the flooded vault).

In fact, as Section 4.6 relates, the zirconium cladding on the first cone worked loose and blocked the coolant channels, thus causing a small melt­down of two assemblies. The molten fuel from these assemblies froze in the lower section of the core.

It is worth learning the lesson that safety features in the system should also be evaluated for their possible adverse effect on safety in other respects.

Figure 5.16 illustrates the system used in the Dounreay Fast Reactor (30). It comprises:

(a) annular fuel elements with an inner cladding (vanadium) having a lower melting temperature than the outer cladding (niobium) (intended to direct any fuel release following fuel element failure down the inside of the element itself);

(b) downflow to help molten fuel leave the core and make the system subcritical rather than to retain it in the system (downflow forces comple­ment gravity);

(c) an invessel cone to disperse the fuel in the same way as in Fermi;

(d) an outside vessel—a graphite, steel lined cone—again to disperse the melt into a subcritical configuration and into its final catchpots; and

(e) twenty-four steel lined drains or catchpots to take any molten fuel away into the bedrock on which the reactor stands.

This system has never been used, and the reactor has never experienced more than minor fuel failures, in which no molten fuel was involved.

The modern designer faces problems very similar to these, with the added complication that the fast reactors under consideration are now much larger. Dounreay is 72 MWt, the Fermi plant is 200 MWt, while present day systems in design are from 800 to 2500 MWt. With the larger plants, even in decay mode, more heat is produced than in Fermi at full power. This demonstrates the magnitude of the task of providing for cooling of a damaged core even when shut down.

Scaling up the simple solutions becomes prohibitively expensive and uncertain. It is difficult to justify such addition to the design to cope with an accident when confronted with a growing amount of evidence saying that such an accident will never occur.

Some recent work indicates that it may be possible to allow the molten fuel to take its own course in penetrating the vessel and falling onto the vault floor. Melt-through of the vessel would take about 5-10 min if the whole core were involved, although fuel cooled by a pool of sodium above might never penetrate the vessel if only one or two assemblies were involved.

Even if the fuel emerged from the vessel, it could be contained in from 5 to 20 ft of concrete depending on whether cooling was applied through a cooling pipe system close to the concrete bed or not. Other factors which are critical to such a calculation are the delay before the fuel arrives at the concrete, what heat is being produced by decay, and, moreover, in what form the debris arrives at the concrete. Exactly what occurs is dependent on the type of concrete in use (31a, b) and it is important to have compatible
materials and concrete which does not dissociate or produce gaseous sub­stances such as carbon dioxide which could over-pressurize the system. No design solution has yet been found or, moreover, has been shown to be needed.

Further study at ANL is showing that the heat flux from debris is such that, with some in vessel cooling, the best and most promising position in which to retain debris is above the core support plate. This has the ad­vantage of being simpler to design to and somewhat more believeable than core catchers used to date.

FAST REACTOR SAFETY

JOHN GRAHAM

Westinghouse Advanced Reactors Division Madison, Pennsylvania

This book is a step along the arduous path of developing the technology of nuclear safety as a fully recognized discipline with quantitatively defined standards and an accepted methodology of analysis, design, and test inter­pretation. Completion of this task is needed to stabilize the nuclear power industry and eliminate the elements of unfounded opinion, and even emo­tion, which too often characterize public discussions of nuclear power plant safety, particularly in the application of fast power reactors.

A book devoted to nuclear safety as a special and separate skill raises immediately a conflict for engineers who have been associated with the design, construction, testing, and operation of a total nuclear power plant, a conflict caused by the conviction that if the designer does not provide reliability and safety in each of the components and systems for which he is responsible, that plant will not be reliable or safe. In fact, the existence of a separate skill in nuclear safety opens up a potential risk that the system or component designer will leave the matter of safety to this new specialist and in so doing, miss providing the safety features which only he can suc­cessfully assure. Guidance in resolving this conflict can be obtained by examining other fields in which I feel a similar dilemma has been faced and resolved. Let us look at an analogous case.

The development of high performance equipment in fields such as avia­

tion, space, modern structures, and of course, nuclear power itself, has required the development of specialized skills in stress analysis and me­chanics. This technical specialty is so demanding that the full careers of highly trained people must be exclusively devoted to it. Yet, their skills must be utilized by the designer and highly effective technical communica­tion between the designer and the sophisticated practitioner of mechanics is necessary. The success of achieving such communication has meant the success or failure of many projects. Similarly, the skill and knowledge of the highly trained metallurgist, pursuing his experiments and analysis as a separate endeavor, must be absorbed by the designer to ensure the proper use of materials in the component he is designing. Here again the skill must be developed independently because of its demanding nature, but the designer must utilize results of such development if he is to make a success of his project.

Nuclear safety, although not as well recognized today in the curricula of universities as is the study of mechanics or metallurgy, fulfills an analogous role. This skill must be recognized in a manner similar to that of mechanics and metallurgy. Further, it should not simply be restricted to nuclear safety but the basic methodology must also be applied to safety of all modern, massive, “high-technology” devices. The forerunner of this book, in fact, has been a set of lecture notes developed by the author for a course given as part of the nuclear engineering curriculum at Carnegie-Mellon University.

The transfer of nuclear safety skills to the designer must involve more than discussion, consultation, and teaching. It requires the definition and acceptance of safety design criteria, and the development of design meth­odology, to which a substantial portion of this book is devoted. In modern application of analysis and design techniques, the computer code is ever present as a specific device for this methodology transfer. It should be apparent from the discussions in the text, however, that many of these codes are still in a state of development and should not be used by the designer except with a full appreciation of their limitations. A third, and ultimately most important, means of transfer of safety skills is the incor­poration into design of the actual experience gained by safety experiments and by plant operation. The former must be incorporated through the comparison of design methods against definitive experiments and the sub­sequent improvement of these methods to more accurately portray the accident, or the accident initiators. This area of accident analysis verifica­tion is still quite weak, as indicated by the relative paucity of such experi­mental comparisons the author of this book is able to make. It is not clear that there is enough emphasis today, in the planning of experiments and in the development of analytical methods to interpret such experiments, on satisfying the need of the designer to have design methods which can be compared with such experiments and then applied with prudent extra­polation to his reactor design. In the latter case of the incorporation of plant operational experience, the methods of reliability analysis reviewed in the book are a main vehicle of transfer. Fortunately, there are many common features between fast reactors and the present generation of thermal reactors, particularly in the areas of reactor protection and accident pre­vention. As a result, the operational data accumulated on present day nuclear plants and their components can be incorporated into the reliability analyses of the fast reactor designer.

Attention by specialists in nuclear safety to the above means of transfer of their skill will prevent the “separation” of design from safety expertise and will, in addition, assure the proper balance in all the activities needed to design, construct, and operate a safe nuclear power plant.

One must be concerned about the tendency of pursuing safety technology for its own sake rather than in close coordination with design, so as to overemphasize the study of highly unlikely accidents and means of coping with their consequences. Such overemphasis inevitably results in a less than desired effort on (a) accident prevention through the study of accident initiators and design approaches to eliminate them, (b) the study of relatively probable accidents and the design of protective systems to assure that no significant loss in reactor or plant integrity will occur as a result of the accident, and (c) the definition of a highly reliable design of the plant systems and components which achieves safety through such reliability.

The importance of keeping the proper balance is underlined by the realiza­tion that I believe is held strongly by those experienced in nuclear operation: namely, that a functionally complex or awkward plant or one with un­reliable components is an accident-prone plant. No matter how many engi­neered safeguards systems there are on such a plant to cope with accidents, an accident-prone plant is not a safe plant. Further, the goal of designing a reliable plant, if rigorous standards, quality assurance procedures, and thorough preoperational testing and diagnostic in-service testing are em­ployed, is more assured than the counterpart goal of designing reliable engineered safeguards. Experience tells us that when we need a system to provide protection against accidents we should, wherever possible, utilize equipment which is a continued operational part of the plant and thus will receive the ultimate test of reliability—continuous performance.

One other important contribution this book can make, particularly for those of us devoting our energies to the development of the fast reactor,

is to bring fast reactor safety into context. Those engaged in fast reactor development do not find substance in the popular image that there is some­thing especially dangerous about a fast reactor. I can do no better in this respect than to quote from a statement by F. R. Farmer in his Foreword to a summary report+ on fast reactor safety published last year with which I heartily agree. He states,

There has been a prolonged and excessive preoccupation with the ap­parent differences between fast and thermal systems and, for many years, a particular interest in the explosive disruption of a fast reactor core…. In general, it is shown that differences exist between all reactors and the fast reactor is not notable in this respect, nor in respect to explosive potential…. The facts which may initiate the various modes of destruc­tive failure will be different between fast and thermal systems and will call for different methods of detection, but it is not obvious that one deserves greater effort or leads to greater concern than the other.

This book, by examining as quantitatively as our present technological capability permits the specific features of safety of the fast system, makes it clear that the fast reactor can be designed to be safe. The sodium coolant in the Liquid Metal Fast Breeder Reactor, for example, has significant advantages from a safety standpoint. The system can operate essentially at atmospheric pressure where the maximum pressure is a result only of the pump head. The boiling point of sodium is 500-600°F above the peak operating temperature range of the sodium coolant, largely eliminating concern about boiling in the reactor core. The historic concern about the short, prompt neutron lifetime of a fast reactor has been allayed for the most part by the finding that the rate of power increase caused by a re­activity addition in excess of prompt critical is limited to safe levels by Doppler feedback. The historic concern relative to a core disruptive accident is being brought into perspective by focusing attention both in analysis and experimentation on defining the quantitative features of this accident rather than the qualitative upper limit possibilities of it. Effort is also being placed on study of the initiators of the core disruptive accident so that design steps can be taken to eliminate such initiators. Of particular importance in this regard is the experimental program on fuel element failure propagation which must either establish that failure propagation is limited to safe levels

+ F. R. Farmer et at. An Appreciation of Fast Reactor Safety (1970), AHSB(S)-R-188. Authority Health and Safety Branch, United Kingdom Atomic Energy Authority, Risley, Warrington, Lancashire, England.

or show the way to fuel and fuel assembly design modifications to limit propagation to safe levels. Thus, there is no unique barrier to providing this power generating device that opens up vast natural fuel resources to mankind without exposing him to undue risks to his life and property.

It would be consoling to be able to say that this book completes the task of placing fast reactor safety beyond opinion and emotional issues, and reduces the entire subject to that of professionally recognized skills and standards. It does not because there are still substantial technical develop­ments in nuclear safety which have yet to be completed, both in the analytical and experimental areas. Lest we be discouraged, however, we must remember that this is the first major industrial technological enterprise which is being subjected to rigorous, professional development of its safety characteristics.

A final word on one other aspect of the book’s contribution. There has been an increasing call in fast reactor breeder development to establish safety criteria and licensing standards on an international basis. Such a step would better assure the coordinated and constructive response of all workers in the field to achieve the best set of such criteria and standards. In addition, artificial barriers involving licensing requirements set up along national lines would hopefully be reduced or even eliminated. This book does not directly address this issue. But is assists the process of achieving a more uniform international approach by presenting the licensing position as it stands today in the U. S. Similar presentations of licensing positions in Britain and Germany are also making a contribution to this international cooperation. John Graham, the author of this book, has carried out in his own career a significant amount of safety work across national boundaries, having participated heavily in the fast reactor safety program in Great Britain and now, more recently, in the safety analysis and licensing activities associated with the liquid metal fast breeder reactor program in the United States.

J. J. Taylor General Manager Breeder Reactor Divisions Westinghouse Electric Corporation

As the fuel burn-up proceeds, the fuel composition and the control effectiveness changes and thus the reactivity balance of the system alters. These changes are also feedback effects, although the time scale is very large. Because these changes are long-term, they have no immediate effect on stability and so they are generally omitted from transient calculations. They are, however, accounted for by performing safety evaluations at several times during the burn-up cycle, particularly at start-of-life, during the equilibrium cycle, and at end-of-life.

We can separate out effects due to fuel and control changes:

Fuel, (a) The reactivity effect of the core fissile concentration decrease can be expressed as

дк _ 1 6M _ IB-10-» l + a

~k T Ж ~ ~~T ~ T+~<5 — bi)

If the internal breeding ratio bt of the core is 0.9 and the fractional enrich­ment є in the core is 0.16, then at a burn-up В of 50,000 MWD/tonne this reactivity change is —0.015 or about $ 3 to $4 negative. (Here the ratio of fissile captures to fissions a is taken to be 0.15 and the ratio of fertile to fissile fissions <5 is assumed to be 0.2.)

(b) Fission product build-up can be expressed as

dk 2 В-10-6 1 + a a4v

к ~ 5 є 1 + <5 cr

which includes the competition of absorption cross sections in the fission products a4p and in the plutonium cra239 . This reactivity change is usually about $ 2-І 3 negative.

(c) In 233^232^ cycle systems, the reactivity effect is a swing due to the hold-up of the intermediate 233Pa. There is a delay of about 30 days before a 232Th capture results in the production of an atom of 233U. This leads to a decrease in reactivity at the start of irradiation, with a consequent increase of reactivity after shut-down due to the decay of the 233Pa. It is similar to a reverse xenon poisoning effect (see Section 1.4.2.3). The re­activity swing is given by

J_ Ф_ <*<=,„

к 2 Є ^233

where the protactinium decay constant Д2зз *s taken as 2.9-10-7 per sec and the 232Th capture cross section aCai is about 0.4 b. Thus, for a fast flux of 2-1015 n/cm2-sec, the reactivity swing is 0.008 or $2.5.

Control assembly, (a) The 10B absorber burns out at an appreciable rate of approximately one percent per month for an in-core rod. Therefore the rods must be replaced every year or two.

(b) The 10B absorber captures by a (n, a) reaction and the helium gas inside a boron carbide rod leads to a pressure build-up inside the control assembly cladding, which also leads to a need to replace the rods.

(c) Fuel management compensation leads to possible multizone refueling

schemes to reduce the reactivity swing by a factor of approximately 2. Such multizone refueling schemes of course lead to additional shut-down time.

As previously discussed, a voiding in the center of a LMFBR core results in a reactivity increase. There are two methods of subtracting moderator:

(a) the introduction of bubbles, and (b) sodium boiling.

Boiling is dealt with in ensuing chapters of this book. It suffices to say here that if the coolant is boiling, then something is radically wrong before any reactivity change arises from the core voiding!

Bubbles could be introduced from a variety of sources such as entrained gases, fission product gases, chemical reaction products, and such sources are separately discussed in Section 5.4.1.

Figure 2.20 shows the worth map of sodium across a typical LMFBR core while Fig. 2.21 shows the variation of reactivity as a bubble passes through a core as a function of the bubble width, height, and coherency. These curves are calculated by simply integrating the worth map, and rates of reactivity addition are produced from an assumption as to the probable bubble size, shape, and velocity through the core. Rates of $ 100/sec are possible with investments of over a dollar but such sizes of bubbles are incredibly large.