Proctor’s correlation cannot be applied to deformation of the bottom head of the vessel, since it is based only on experiments that apply to the radial deformation of cylindrical vessels. Thus, for the bottom head, the following equation by Cole (24) may be used for damage predictions in the axial direction

Impulse = KW°-33(W°-33I Ry (5.14)

where R is the distance from the charge W, fi = 1.05 for a range of under­water explosions and can be put equal to unity for the classical acoustic law with adequate accuracy, and К is an experimental factor.

Table 5.12 shows typical vessel properties that may be used in the evalua-

tion of these equations. The ultimate strain eu should be diminished by a factor of between one-third and one-half to account for vessel irregularities, welds, and nozzles. The dimunition factor is relatively constant for different regularities considered in Proctor’s explosive work (22). Thus for a real vessel

eu (for the calculation) = ej3 (5.15)

One large uncertainty in this type of simple calculation for damage to the vessel wall is just how much the shock is attenuated by the vessel internals. Proctor (23) has shown that the attenuation could be considerable.

Concern has been expressed regarding the long term build-up of long — lived isotopes within the atmosphere even though individual discharges are well within the recommended limits. This concern arises from discharges from fuel processing plants rather than from the nuclear power systems, but nevertheless a word of clarification is in order.

During fuel reprocessing the isotopes are removed with the exception of xenon, tritium, and krypton. However, after a 45-day hold-up to allow short-half-life isotopic decay, the xenons are removed and only tritium and 85Kr are released. They have half-lives of 10 and 12 yr and they therefore collect uniformly throughout the biosphere. What levels might these isotopes reach if nuclear expansion continues at its expected rate?

Figure 6.8 shows that the planetary build-up of tritium, assuming pro­jected nuclear power expansion, attains about 100 million Ci by the year 2000. Although this level sounds high, it is in fact about 6% of the maximum tritium activity due to weapons fallout at its peak in 1963 and it is only just equal to the natural production of tritium from the sun’s cosmic rays. The planetary exposure of the world’s population at the year 2000 would be about 0.002 mrem/yr. This assumes that half the world’s power by this year would be produced from nuclear plants.

The case of 85Kr is a slightly different matter because the atmospheric content is produced entirely from nuclear reactions. The present dose is less than 0.1% of the combined background due to cosmic rays and other natural background. However, Fig. 6.9 shows that by the year 2060 the accumulated krypton will increase to about a level which would give an exposure of approximately 1000 times that of tritium, with an annual individual dose of 50-100 mrem/yr. While this dose is still not dangerous, the accumulation does imply that some retention schemes should be em­ployed in fuel processing plants to avoid this accumulation. Present techno­logical capabilities promise effective future means of controlling krypton discharges by cryogenic concentration (10).

This short review of discharges into the air from fossil-fueled and nuclear — fueled plants shows that the nuclear plants are subjected to far greater control in discharge rates, and indeed they have less of an immediate prob­lem. Moreover, in the long run, biospheric accumulation from fuel pro­cessing plants, although the subject of sensation-seeking journalism, is not a problem. Even so, improvements in the management of 85Kr are to be expected.

[1] Note that the leakage is quoted in volume percent or weight percent per day at the design basis pressure unless otherwise noted.

8. Before operation a further license is required. Same steps are followed but with a FSAR

AEC Commissioners review

5. Licensing Board review all testimony and evidence, makes license decision

[3] DRL distributes copies to public and ACRS, DRL makes technical review and prepares analysis

[4] ACRS receives report, makes independent study, reports to Press and AEC Commissioners

Fig. 6.5. Licensing of power reactors: how central-station atomic power plants are licensed and regulated (7a).

The various system temperatures Ті affect the cross sections and escape factors which go to make up the multiplication factor keff.

The total feedback may be separated into its component effects as shown in the following discussion.

In a LMFBR the effect of a loss of primary system integrity is a loss of coolant and a loss of core flow, whereas in the gas-cooled and the steam — cooled systems the effect can better be represented as a depressurization.

The calculation of core flow in a LMFBR after a pipe rupture is again a hydraulic balance. The effects are very similar to a flow coast-down but more severe. Figure 2.5 shows a comparison of the flow reduction due to a coast-down and a pipe rupture. The problems are the same; the time scales are different.

However, because in a pipe rupture the system is also losing coolant, it is necessary to make sure that there is sufficient sodium to maintain a cooling circuit. In a loop system this means that the sodium must not drain down to a level such as to cut the main cooling circuit, but in a pool system, despite a primary line break (say between the intermediate heat exchanger and the core inlet), adequate sodium is always provided although the flow rate is reduced.

2.2.3 Depressurization Effects

These effects are very different in each of the three reactor types.

2.2.4.1 LMFBR

In the sodium-cooled system the main effect of depressurization (which may arise from a pipe rupture or a loss of cover gas pressure) is to reduce the pump suction head.

The normal pump characteristic curve (Fig. 2.6) shows the relationship between the mass flow M and the pump head as a function of pump speed w:

pump head = aw2 + bwM + cM2 (2.5)

The figure also shows the system resistance and the normal operating point for the primary system. At this operating point the available net positive

suction head (ANPSH) must be larger than the required net positive suction head (RNPSH) for that pump.

The behavior is different in the case when system pressure has been reduced, for the pump may now be cavitating. The pump characteristic now varies considerably (5).

Figure 2.7 shows predicted behavior following a large pipe rupture. The pipe rupture is first seen as a loss of system resistance and this curve rapidly falls to a new lower position B. The pump attempts to move to a new operating position C by increasing flow and moving down its characteristic

at constant pump speed. However as soon as it moves to that flow where the ANPSH falls below the RNPSH, then the pump cavitates at D. Mean­while, due to the loss of system pressure, the ANPSH curve has been dec­reasing from E to F to G. In order for the pump to operate to balance the system resistance and at the same time always maintain a RNPSH less than or equal to the available head, the behavior of the pump follows the curve A to D to H to J to K. The final flow is very low, satisfying the new system pressure conditions. Figure 2.8 shows transient conditions.

This effect and its representation complicates the prediction of core flows in the analysis of a pipe rupture in this fast reactor system (Section 2.2.3).

A simpler criterion would now be more valid, either one simply related to the cladding melting temperature in the range of 2500°F, or a strain due to thermal stresses (say 0.5 or 1% strain) at 1700 to 1800°F, or the boiling point of the coolant sodium (1632°F at atmospheric pressure). The reason­ing for the latter (5) is that although sodium boiling does not infer cladding rupture, conditions are probably such that cladding failure is not far away.

3.1.1.1 Accident Severity Levels

It is now possible to define accident severity levels for gas-bonded oxide fuel in stainless-steel cladding. Table 3.1 shows typical severity levels for

start- and end-of-life conditions. These may be used in a classification of core accidents (Section 3.1.3). The actual values will depend critically on the fuel pin design.

3.1.2 Steam Generator Failure

Other components of the plant can fail; one of the more probable being the steam generator in which a sodium-water interaction becomes a possi­bility in the LMFBR system.

Table 3.2 shows the modes, the locations, and the causes of failures experienced to date, some of the failures being primary and some secondary as noted. Such a survey of nuclear facilities gives some indications of practical experience. Out of 16 facilities, only 6 reported failures, and all of these were due to faults that could have been caught by adequate quality assurance and inspection techniques, rather than being due to behavior outside normal operating conditions. The locations of the failures were mainly in the tube sheet or at the tube-to-tube sheet joint.

From this information a failure rate can be calculated for sodium and nonsodium steam generators: (a) sodium operation, 21 failures per 10® tube-hr; and (b) non-sodium operation, 29 failures per 10® tube-hr (6). Thus the experience with sodium is not significantly different from the experience in water-to-steam systems. This failure rate would imply a failure about every 3 or 4 years for a 700 MWt plant.

This information can be used to assess availability and maintainability and can perhaps be used to establish some quantitative failure probabilities for fault-tree analysis. However such information cannot be used for establishing the point of steam generator failure during abnormal op­eration.

Similar failure rates can be established for all other components in a nuclear power plant and this is currently being organized in the US by the Liquid Metals Engineering Center (7). The center collects all failure data available for liquid-metal systems and analyzes the incidents for cause and origin. Naturally, statistics are still poor, but Table 3.3 shows some of the results available. Note how misleading the failure rate for diesel generators might be since it is as yet derived from only four failures. The low failure rate for core fuel and breeder elements is worth noting because almost all the data arise from fuel failures in the Enrico Fermi plant.

The accumulation of failure data is a necessary part of safety engineering. At present it should be considered as long-term data which will be available when fault-tree analyses for plant failures become quantitative sometime in the future.

Reactivity accidents have multiple safety features in the form of com­ponent-failure and flux-increase trips that initiate a shut-down of the reactor system before much has happened (beyond minor overheating of the fuel in the worst cases). This section therefore deals with those hypothetical accidents in which the reactivity addition is uncontrolled and in which eventual shut-down of the system is only achieved by a dispersion of the core.

Section 5.4 treats a discussion of design basis accidents; here we are simply concerned with the behavior of the system in the event of a complete loss of control and with the energy release from a superprompt critical system.

a. Zero Doppler coefficient. The Doppler coefficient reduced to zero after 150 days at power due to fuel expansion within the central fuel void. It is expected that it would be available under high power conditions and would still act as a safety factor. However this supposition cannot be tested.

b. Sodium expulsion (39). Figure 4.32 illustrates the scheme by which argon was moved from tank A to tank B. During the movement valve C was inadvertently left open and argon was compressed into the reactor vessel. The vessel safety valves were not designed for the high pressure that ensued, and they had a much lower limit setting, but their design caused them to fail to open at the higher value. The pressure then forced sodium out through a dip guide tube onto the reactor face. The pressure reached 0.6 bar.

About one cubic meter of sodium was ejected and fortunately it did not

ignite but simply glowed a rosy red, being hot. There was no smoke. A considerable clean-up job resulted.

Besides the obvious faults of the bad system of pumping argon from tank A to В while in connection with the vessel, and the bad design of the vessel safety valves, this incident was compounded by several other factors: There was no hole in the upright dip tube to equalize pressures inside and out. The cap had been left off because two people from different groups were responsible for the job and each left it to the other. Valve C was left open because the design of the control layout made it difficult to see the indicator which showed whether the valve was closed or not. In addition, administra­tive delays occurred in making a safety modification to correct the situation. These took the following sequence (57):

October 4, 1965. A fire was experienced at the reactor mock-up due to this same cause of sodium expulsion through a dip tube.

October 13, 1965. The mock-up operations group reported the incident.

November 22, 1965. A safety meeting analyzing the incident concluded that bad design was the cause and that holes should be drilled in the dip tube. A recommendation to Rapsodie to this effect was made.

February 4, 1966. Rapsodie group reported that, although inconve­nient, a hole could be made.

March, 1966. Instructions were issued to this effect to the contractors. In the same month the contractors refused and made a counter suggestion.

April, 1966. Rapsodie operators insisted on their instructions.

During the summer discussions ensued between the operators and the contractors without resolution.

October 18, 1966. The incident occurred at Rapsodie on the day prior to a visit by the Minister of Technology. Soon after all dip tubes were cut off without further delay. However…

April, 1967. The same accident occurred in another facility.

The safety lessons inherent in this sequence of events are clear.

c. Secondary circuit leak (39). During filling of a secondary circuit, a filling line became plugged due to an erroneous order of heating. The heating was insufficient to avoid freezing. However, elsewhere in the circuit other insufficient trace heating caused another plug to occur independently. Between the two plugs excessive heat caused pressures to rise to give a leak. Indication of the leak into the double containment was received but ignored as it was obtained on a panel of other known faulty instruments. Thus further leaks were caused throughout the doubly contained pipework. There was no drainage point within the double containment.

d. Fuel handling incident. Figure 4.33 illustrates diagrammatically the operation of the hold-down tube in holding and slightly spreading assem­blies around the one which is to be removed. The hold-down tube is kept in place by compressing a 0.5 ton spring to cock a latch in order to restrain a 0.3 ton upward force on the assembly to be removed.

In order to compress the 0.5 ton spring, it was convenient but bad design to use the weight of the shielding on the refueling machine that weighed 40 tons. This had the effect of overcompressing the spring. On this particular occasion, it did so and was unlucky enough to catch the edge of the hold­down tube against the marking ICZ on the top of a neighboring assembly. The horizontal edge actually caught against the upper horizontal bar of the Z. This had the effect of bending the adjacent assembly head over as shown in Fig. 4.33, so that on the removal of the hold-down tube, the hold-

down tube was able to pick up the adjacent assembly by the bent head. It did exactly the thing it was designed not to do.

The procedure that used excessive weight to compress the 0.5 ton spring was bad, but the incident points toward the need to remember that every event may not be anticipated (especially those associated with a Z engraving on an assembly!).

e. Pump intermittent operation. Initially a pump had been jammed by extraneous material that had to be cleared, but in general there was very little difficulty with the pumps. However, in one instance during operation, flow loss occurred for no apparent reason. The reactor was shut-down, and later the pump came on to full flow in 3.5 min. Then later it again stopped, this time after a few seconds. The reason was difficult to isolate.

Figure 4.34 indicates the brushes which had been sparking. This over­heated the holder which removed the brushes by differential expansion. When the pump cooled down, the brushes recontacted and the pump restarted. Visual checks did not catch this effect even during inspection. The problem was cleared by collecting the sparking on a dc collecting mechanism used as a sensing device.

f. Plugged argon lines. During operation, the argon lines quickly plugged

Fig. 4.34. Diagrammatic arrangement of brushes in the Rapsodie pump drive motor (37).

with sodium oxide crud. This was solved by pumping sodium through the argon system by an EM pump. The occurrence shows that such lines should be designed for flushing by sodium and should be used to pump sodium through from time to time.

g. Jammed rotating plug. The plug was exposed to sodium vapor that froze and gave rise to sufficient crud to jam the rotating plug. This problem was very difficult to solve and needed several attempts, because it got progressively worse during operation. Continuous rotation was first tried. Heating of the joint in order to keep the sodium from freezing failed. Shaping the plug fitting to avoid hold-up ledges, on which the crud might stick, did not work either.

The problem was finally solved by forcing helium down between the plug and the plug support to keep the argon and the sodium vapor contained in it, down in the vessel. This continuous purge also helped to cool the head.

Thus Rapsodie despite its successful operation has had a short catalog of unusual incidents from which lessons may be learned. Others may be expected before the useful life of the plant terminates (37).

These are postulated faults which are being monitored by the operators:

(a) If the flow meter associated with the siphon breaker were to need repair, its inaccessibility would make this extremely difficult.

(b) The pump cable connections are, so far, in close proximity, making a common mode failure a possibility following a cable fire. This could be remedied by separating the cabling.

(c) The serpentine concrete shielding consisted of concrete conventionally laid with organic interlayers (which contained chlorine). Despite the fact that this is in the nitrogen atmosphere, problems may arise since it is not known what the effect of irradiation on the organic interlayers might be. Has hydrochloric acid been produced? Will there be or is there already corrosion in that area close to the vessel? These questions show that the safety engineer’s task does not end with successful operation of the plant.

Location and Total Area. The site is located on the east bank of the North River, 35 miles north of Middletown, the nearest large city. It is 25 feet above the minimum river level

Land is generally available surrounding the site at the same cost. It is assumed that no easements are necessary.

Access. Highway access is provided to the Hypothetical Site by a 15-mile secondary road to a state highway; this road is in good condition and needs no additional improve­ments. Railroad access shall be provided by constructing a railroad spur which intersects the В & M Railroad. The length of the spur from the main line to the plant site shall be assumed in accordance with the following table:

An airfield is located 3 miles from the state highway and 15 miles from Middletown.

The North River is navigable throughout the year for boats with up to a 6-ft draft. All plant shipments will be made overland except that heavy equipment such as reactor vessel and generator stator may be barged to the site.

Population. The Hypothetical Site is near a large city (Middletown, 250,000 popula­tion) but in an area of low population density. Variation in population with distance from the site boundary is:

The nearest residence to the 60-300 MWe plants is f mile east of the site boundary, and to the 10 and 50 MWe plants is mile east of the site boundary, on the secondary road.

+ Author’s note: Costs are those of 1961 and, therefore, should be regarded as indicative of trends only. Absolute values today will be somewhat higher.

Fig. 5.4b, c.

Fig. 5.4. The Middletown site for the comparative evaluation of 1000 MWe LMFBRs. [Adapted from the U. S. Atomic Energy Commission {14a).] (a) Plot plan. The reactor and facilities area and the turbine area show the relative location of the reactor and turbine generator plants only. The detailed arrangement of reactor, turbine generator, fuel handling, and waste treatment facilities are established separately to meet the require­ments of each nuclear reactor concept. Key:

Land Use in Surrounding Region. There are five industrial manufacturing plants within 15 miles of the Hypothetical Site. These are small plants employing less than 100 people each. Closely populated areas are found only in the centers of the small towns so the total land area used for housing is small. The remaining land, including that across the river, is used as forest or cultivated crop land, except for railroads and highways.

Utilities. Utilities are available as follows: The North River provides an adequate source of raw make-up and condenser cooling water for the ultimate station capacity. The average maximum temperature is 75°F and the average minimum is 40°F.

Natural gas service is available four miles from the site boundary on the same side of the river.

Communication lines will be furnished to the project boundaries at no cost. Cost for communication within the project boundaries will be in accordance with standard utility company practice.

Construction power is available at the southeast corner of the site boundary. Cost of this power is 15 mills per kilowatt hour.

An emergency power source in the plant is necessary, as the distribution system in the area is a single source transmission.

The safety evaluation will first show that the system design and its opera­tion adhere to certain codes, standards, and criteria that have been laid down to guide safe design.

These guidelines can be defined as rules of conduct: the criteria to provide general design aims for the system; standards to provide design limits and values to be used in the design methods laid down by codes.

Power reactor safety has several objectives: protection of the plant against damage; protection of the public; and the presentation of evidence of safety. These objectives must be viewed against a background in which a new source of energy that is vitally needed to solve the world’s power problems was born during wartime. The political use to which nuclear power was put
has done a considerable amount of damage to its civilian use. Thus the final safety objective is a vital one.

In the long run, the presentation of safety is concerned with the education of society to nuclear power in general and fast reactors in particular, while in the short run it is concerned with the presentation of the safety analysis of a particular power plant.

The protection of the public is concerned with obtaining an assurance that there can be no plant or system disturbance which could ever result in the release of a significant quantity of fission products from the plant site. Such a subject also involves siting policies as part of the safety considerations.

However, the main objective is the design objective in which the plant (and of course the public) is protected against damage. The design objectives for any power plant will include safety, economical operation, reliability as well as flexibility, ease of operation, and compatibility with other power sources; but safety is a primary one,