Figure 1.17 shows the basic blocks of the closed loop—the kinetics, the thermal representation, and the feedback from thermal effects. An added xenon feedback is included to indicate how the thermal reactor xenon poisoning arises directly from flux changes. (Note also that the delayed neutrons contribute to the calculation of the flux only through the kinetics block.)

Further feedback lines can be added to this basic reactor core closed — loop model. They might arise from the control and protective system, and the figure shows the flux and excess outlet temperature trip lines as indica­tive of this type of feedback. External influences also play their part; here control and coolant flow changes might disturb the state of the system.

Indeed as we have seen, the coolant inlet temperature is the reference temperature for the system.

This basic feedback loop is added to in different ways for each different reactor type.

a.

Boiling water reactor {BWR). Figure 1.18 now shows the closed-loop model for the BWR. The circuit between coolant outlet and inlet is closed by a primary loop which includes the steam drum. The time delay between outlet and the drum is shown as r3 and the subsequent delay to the inlet plenum is denoted by r4. Conditions in the steam drum depend on a rep­resentation of how much boiling is occurring in the core and what the outlet quality is and also on what steam load is extracted from the drum to

drive the turbine. Thus this model also requires a turbine representation and its return make-up lines to the steam drum. Notice also that the boiling in the core contributes a feedback reactivity to kefr. The closed loop is an example of a direct cycle system.

b. Pressurized water reactor {PWR). The circuit (Fig. 1.19) is very slightly altered by the addition of another secondary circuit as the PWR does not have boiling and must generate the steam for the turbine in a heat exchanger

(steam generator). It is an example of an indirect cycle system in which the steam drum and turbine are in the secondary cycle.

c. Liquid metal fast breeder reactor (LMFBR). Figure 1.20 shows that yet another circuit has been added between the secondary of the heat exchanger and the steam generator. This is an insulator between the primary radioactive sodium coolant and the water in the steam cycle. Now no xenon feedback exists.

External plant items in these loops will all be represented by thermal balance equations in as much complexity as the particular problem requires. The representation of the steam generator is difficult outside the normal operating range, because the boiling boundaries can shift so rapidly with steam collapse and water flashing into steam. The turbine, too, is particular­ly difficult since its transient behavior is largely unknown. Delays in the circuits must be included in the representations since they have a critical bearing on the stability of the system and these delays are variable, depend­ing as they do on the circuit flows.

It is possible to simplify models, depending on the investigation to be made. If, for example, a rapid reactor core variation is the phenomenon under consideration, it will be adequate to assume that the inlet temperature is constant (as it must be for a circuit time). This will allow the secondary and tertiary circuits to be neglected. If a secondary flow perturbation is to be investigated for its effect on the core, then it will be adequate in some circumstances to assume constant steam generator boundary conditions (in the LMFBR) and so obviate the need for representing the turbine and its feedwater line.

2.4.3.1 LMFBR

The tertiary loop in a power-producing LMFBR is the steam cycle, but in an experimental reactor such as FFTF (6), a bank of blowers constitutes the tertiary heat dump.

In a power-producing LMFBR there may be only a single steam cycle and feed loop even though the primary loop may be split into three. In this case a tertiary failure (feed-valve closure or failure of feed supply for example) would affect all the primary loops in the same way. However in an experi­mental system each of the primary and secondary loop systems can have its own heat dump air blast heat exchangers and then a failure in one of these would only affect a single primary and secondary loop combination.

In any case there are considerable delays (two cold leg circuit times) of the order of 20-30 sec before any tertiary loop disturbance is felt by the LMFBR core. The only requirement is that one fault should not remove all heat removal capability from the system, since even when the core is shut down successfully, the decay heat must still be removed.

The reactor can best be tripped from an intermediate heat-exchanger high primary outlet signal, although signals would available during the transient from the following sources: (a) tertiary component signals such as electrical supply circuits for loss of electrical supply initiators or pump speed indicators for a failure of the feed pump; (b) IHX primary outlet temperature; and (c) core outlet temperature.

Figure 2.22 shows assumed flows in primary, secondary, and tertiary loops which might arise if a LMFBR lost feed supply. Figure 2.23 shows typical steam generator sodium outlet temperatures that might arise from this failure together with IHX secondary temperatures and the IHX primary outlet temperature which eventually initiates a trip at about 8 sec. Figure 2.24 shows the reaction of primary and core temperatures. In fact the first indication in the core that a failure has occurred is that the system shuts down; no excess temperatures are recorded.

A set of very general design criteria is useful in licensing by providing a check list for licensing authorities; however, it does not give the designers any design guidance because there are many different ways of satisfying the criteria. So to further these general rules, a set of Specific Design Criteria must be prepared, a number to each of the general criteria.

These specify how the particular system will do the job and they might even enlarge on the protection provided. For example, the specific criteria for number 60 will detail separate gaseous, liquid, and solid waste criteria for low, medium, or high radioactivity levels during normal operation and during accident conditions. These criteria will specify numerical levels of radioactivity in various storage locations and even possibly detail volumes and rates of effluent release. These are then immediately useful to the designers and they provide the safety engineer with a detailed yardstick for measuring the safety of the design against his own safety evaluation.

Of course the safety engineer will also have to satisfy the AEC that the specific set of criteria do indeed satisfy the intent of the general set.

Figure 4.14 shows a fault tree for the undesirable event of a failure of a second fuel pin as a result of an original failure. It is conveniently divided into two cases: that in which only fission gases may emerge from the failed pin and that in which molten fuel is present and may emerge as well. These cases are very different because the emergence of molten fuel could cause sodium coolant vaporization and subsequent high pressures.

BR-5 is a Soviet 5 MWt reactor built in 1959 as an irradiation facility. It is fueled with Pu02 sintered in 0.2-in. diameter stainless steel tubes, 19 to an assembly. There are 88 such assemblies, with the fuel tubes held at the bottom but free to move at the top. The core is sodium cooled with upward flow (see Fig. 4.41) (45).

The system has a prompt positive contribution to the power coefficient but also has a delayed and overwhelming negative contribution.

At one time about $ 2 worth of positive reactivity was present in the core in the form of cover gas bubbles. There was some concern over safety at

the time, but the problem of entrainment was cleared. There have been no other incidents. Since then some fuel cladding failures have occurred, al­though these are due to excessive burn-up rather than any accident event (46a). Despite a number of fuel cladding failures there has never been any indication of failure propagation.

An ejection of a control rod could conceivably give rise to very rapid rates of reactivity increase. The accident might be feasible if the control assemblies were only restrained by their own weight and if some ejection mechanism could be envisaged.

However, in fast reactor power systems, the control rods are generally driven into the core and their followers and drive shafts remain above the rods. Only in the case in which a rod was in the act of dropping might its upward travel be unimpeded. In other cases physical restraint would not allow more than a few thousandths of an inch of upward travel.

Suggested mechanisms for rod ejection have included coolant flashing immediately below the rod tip or simple hydraulic forces. However hy­draulic forces are not sufficient to move a large control rod and coolant flashing would indicate that some other accident was already in progress and it would be most unlikely that the required force could be obtained in this way at exactly the instant of rod disengagement from its drive. Indeed, if a credible rod ejection process could be postulated, it would be relatively simple to include an anti-ejection device in the drive mechanism. However, credible ejection mechanisms cannot be envisaged, and a rod ejection cannot be considered a CDA initiator in a large fast power reactor.

During the licensing process at the times of the construction and operating license applications, evaluations of the reactor system safety must be sub­mitted for consideration. They are called the Preliminary Safety Analysis Report (PSAR) and the Final Safety Analysis Report (FSAR).

There is approximately a three-year gap between them so that the analysis can be revised and updated if required (see Fig. 6.6). The national research and development safety program is so organized that there will be new information constantly appearing, which may enable the plant to be better optimized rather than to have it overemphasize safety.

The production of these safety analysis reports is standardized according to 10 CFR 50 and some interpretive documents (7b). This standardization allows the licensing authorities to relate safety evaluations to each other and to check rapidly whether all the required information is present. The safety analysis document is divided into separate parts:

X. Steam and power conversion systems

XI. Radioactive wastes

XII. Conduct of operations

XIII. Initial tests and operation

XIV. Safety analysis

XV. Technical specifications

Although this format is not strictly adhered to by all applicants, the formats of most PSARs are approximately the same. It is, however, possible that this format may vary in the future with the advent of a standardized SAR with even standard sections and wordings.

The neutron population is a measure of the number of fissions that occur in the system, which is in turn a measure of the power produced. Thus the neutron concentration or flux is directly proportional to the power of the system. It is now necessary to understand how this power produces tem­perature changes that might effect the reactivity through temperature coeffi­cients. This understanding can come from attempting to model the system in mathematical terms.

A quantitative evaluation of a fault tree will establish the likelihood of the undesired event and will say what the relative contributions are to this likelihood from each failure mode. By knowing such a likelihood, it would be possible to decide whether or not corrective action is needed or war­ranted.

In fact, an engineer can make an evaluation of a fault tree, using his experience to discriminate among more and less likely failure modes, and he does indeed decide whether to take corrective action by assessing relative probabilities according to his engineering judgment.

If, however, the probabilities of the different initiating faults are known, it is possible to make a strict numerical fault tree quantization. There are two methods of evaluation, computation and statistics, and each method has two further submethods (15).

(1) Computation:

(a) direct fault tree calculation,

(b) algebraic expression evaluation.

(2) Statistics:

(a) Monte Carlo simulation,

(b) importance sampling simulation.

One can illustrate the use of the two major methods by pointing out that the probability of turning up a 7 from a throw of two dice can be obtained by calculating it or by throwing a pair of dice a large number of times and counting. Here we are interested in the computational methods.

The Enrico Fermi reactor, designed during the time when the EBR-I instability analysis was underway, had considerable attention paid to its stability characteristics and it was designed with a very restrained core. It has experienced no adverse primary instability effects. The stability analysis of the reactor was particularly complete (11). It is here reproduced in full as an example of fast reactor stability analysis.*

The heat transport system is a purely passive system, and any instability would have to have its origin in the reactor through an adverse coupling of the thermal reactivity feedback with the neutron kinetics. Feedback can be considered as the sum of two com­ponents: one, the internal feedback, caused directly by a power change, assuming a constant reactor inlet coolant temperature, and the other, the external feedback, caused by a change of the reactor inlet coolant temperature fed back around the coolant loops from a change of the reactor outlet coolant temperature. The relations involved in the kinetics of the reactor, including the feedback, can be represented schematically by the signal flow diagram of Fig. 2.39. The variables corresponding to each node are listed on

+ Equation, reference, and figure numbers referred to in quoted material here and on following pages follow sequence of the present volume, not the text of the original.

the figure. Each branch linking two nodes represents the transmittance or transfer function linking the corresponding variables.

By using conventional techniques, the reactor transfer function Gp at power P is:

, = 6PjP_^ ______________________ Go________________

Гр dRi 1 — PG0{X + [£>£2£3/(l — ЕгЕ4)]}

One can define a total power coefficient Xt:

so that

The feedback appears as a sum of two components acting in parallel. Hereafter X will be called the internal power coefficient (or simply the power coefficient) and EtE2EJ (1 — E2E,) the external power coefficient.

It is well known that the system will be stable if P < Pc, where Pc is the minimum power for which Gp has a pure imaginary pole icoc; this can be expressed mathematically as

1 — PcG0(,icoc) Xt(icoc) = 0 (2.45)

At P = Pc, the reactor would exhibit an oscillatory instability at angular frequency a>c.

Following construction of the reactor oscillator, tests run at progressively higher powers on the reactor will give a clear indication of whether or not any such power Pc exists.

If it is assumed that the feedback is not significantly different from what has been calcu­lated, it is possible to demonstrate, using in part results obtained by simulation, that no instability is possible. At frequencies higher than a certain value At, the external feedback is for practical purposes completely attenuated and can thus be neglected. At frequencies lower than a certain value /2, all temperatures inside the reactor respond to power or inlet coolant temperature changes in a quasi-steady state fashion, and hence X, £), E3, Et are equal to their steady state values X(0), £)(0), E3(0), £4(0). From simulation studies it was found that A and /2 are coincident and have the value of 0.01 cps. Since /,=/,, the entire frequency range can be covered by the ranges A> At, and / < /2, with the two ranges meeting at А — Аг-

According to the definitions of Ai and /2, the total power coefficient Xt = X + [E1E2E3I (1 — £2£4)] can be simplified as follows:

Since the two frequency ranges cover all frequencies, it is sufficient to investigate separately whether instability is possible in either of the two ranges.

Stability analysis in the higher Arequency range. In the frequency range/> A, Xt = X. The stability criterion given by Eq. (2.45) can be expressed in terms of amplitude and

phase, with the feedback separate from the neutron characteristics:

Amplitude: P | X(icoc) | = 1/|G0(koc) | (2.48)

and

Phase: Фх(‘^с) = я — фво(іа>с) (2.49)

where фх and фво are the phase lags of X and G0, respectively. Instead of Eq. (2.49), the following expression may be used.

гь(ішс) = фхІ<0с = [я — 0<го(кос)]/сос (2.50)

At any frequency со, the phase lags of X and G0 can be expressed as functions of | X | and I G0 I respectively as

Iя — 0<jo(ku)]/" —/(1/1 Go(‘“) |) (2.51)

and

4(io>) = фх(ш>)1<» = g(P I X(ia>) 1) (2.52)

The functions/and g are single valued explicit functions; however, in practice they are usually treated as implicit functions of the variable со.

Equation (2.51) is dependent only on the neutron kinetics characteristics of the system and Eq. (2.52) is dependent only on the feedback reactivity characteristics of the system. At the critical point for instability, со = coc,/ = g, and the curves for these two equations intersect. Hence Eqs. (2.51) and (2.52) are equivalent to Eqs. (2.48) and (2.50) at the critical point. For any reactor, Eq. (2.51) can be calculated as a function of the argument with good accuracy, since it involves only neutron kinetics parameters. This equation is represented on Fig. 2.40 for the Fermi reactor, and also for a reactor with a neutron lifetime of 10 4 sec. The two curves diverge only for frequencies beyond the range where instability is most likely. (At high frequencies where /^>/i the amplitude X of the feed­back is so attenuated and 1/G0 is so large that instability is not likely.) Since the dollar was chosen as the unit of reactivity, the intermediate part of the curve, where the abscissa is unity, would not be affected by a different value of the delayed neutron fraction. At low frequencies the curve would only be slightly affected by the different delayed neutron characteristics of other fissionable isotopes. Hence for all practical purposes the neutron kinetics curve of Fig. 2.40 is almost universal regardless of the reactor type of interest.

In order to investigate whether or not a reactor is stable at power P, there is also plotted on Fig. 2.40 the feedback reactivity curve with coordinates P | X(iw) | and t6(ico), when to is varied from zero to infinity. This curve should be analyzed in relation to the neutron kinetics characteristics curve shown on Fig. 2.40. If at some value of со, the points of both curves have the same ordinate, relation (2.50) is satisfied, and the phase is that required for pure oscillatory instability. If at that frequency the point on the feedback curve is on the left of the point on the neutron kinetics curves shown on Fig. 2.40, the power P is smaller than the critical power Pc. This is nothing more than the conventional Nyquist criterion, presented graphically in such a way as to keep separate the more accurately known neutron kinetics characteristics and the less accurately known feedback characteristics.

In most reactors it is sufficient to consider the zero frequency point, with coordinates P I A"(0) |, t(0), to ascertain that the reactor will be stable, if some assumptions are
satisfied regarding the frequency dependence of the feedback. These assumptions are:

I X(ia>) I < I X(0) гь(іш) < t„(0)

for all to, where r„(0) is defined as 1ітю_,0 т6(;’со). If these assumptions hold, a reactor is clearly stable if the zero frequency point P | X(0) |, r„(0) is on the left of the neutron ki­netics curve shown on Fig. 2.40.

The assumptions are certainly valid for most reactors. If the feedback followed exactly a transport lag model, one would have

X(iw) = X(0) е-*^мо) (2.54)

so that І Х{іш) I = I X(Q) | and t6(/co) = r6(0). This is the limiting case of the assumptions of Eq. (2.53) and the external feedback curve on Fig. 2.39 would be condensed in a point.

Actually the thermal reactivity feedback in solid fuel reactors results from a combina­tion of heat transport and head conduction so that the amplitude | X(ia>) | of the feed­
back is attenuated with increasing frequency. Also, as a result of heat conduction, the quantity rt(ioi) decreases with increasing frequency. For example, in the simple first order heat conduction model, one has

X(ico) = *(0)/[l + tor6(0)] (2.55)

so that

I X(ico) I = [ A'(O) ( cos 4>j(ia>) < [ A'(O) |

and

г „(гео) = фх(кo)/(o = tan_1[<BTs(0)]/<B < r6(0)

The assumptions of Eq. (2.53) possibly would not be valid if the total negative power coefficient consisted of a large positive prompt component and of a larger negative delayed component, as was the case in EBR-I, Mark II, or if the feedback was not of a purely thermal nature but was amplified by a mechanical or hydrodynamic resonance at some frequency. Note that, if the feedback is linear with power, P | X(0) | is the so — called power override, or reactivity, required to bring the reactor from zero power to power P at constant inlet coolant temperature.

For the Fermi reactor the calculated values of P | A'(O) | and r6(0) at full power and full flow are, respectively, 490 and 1.4 sec. As shown on Fig. 2.40, this point is well on the stable side of the curve. The safety margin is seen to be large, from 49 to 920 (the total available excess reactivity) for P| A"(0) | and from 1.45 to Msec for r6(0). The assumptions of Eq. (2.53) mean that, for increasing values of со, the point would move toward the left and the bottom of the graph, well away from the curve as shown. Even if the assumptions of Eq. (2.53) were not valid, they would have to be in error by a large amount if the point were to reach the curve, because of the large safety margin. With the feedback mechanism of the Fermi reactor, i. e., where there is no net positive com­ponent in the power coefficient, the assumptions of Eq. (2.53) are certainly valid, and the simple stability criterion is just as good as that which would be obtained by a detailed calculation of X(ia>) based on the same feedback mechanism. The conclusions are only as good as the physical assumptions, but, for given assumptions, the simple method is more conclusive because its simplicity leaves no room for errors.

As indicated by Storrer (12) the behavior of P | X(iio) and of Т(,(гсо) can present some anomalies at very low frequencies if some component of the power coefficient has a very large time constant so that it comes into play only at very low frequencies. The hold­down plate expansion coefficient, with a time constant of the order of minutes, is such a component. One can avoid the anomaly by taking for P A"(0) | and t6(0) the fictitious limit which is reached when the frequency is decreased to /. As was said previously, this frequency is low enough for all the other components of the power coefficients to have reached their steady state limits, while it is too high for the hold-down plate expan­sion coefficient to come into play. The values quoted above for the Fermi reactor are those fictitious limits, rather than the time zero frequency limits. The external power coefficient is also a component with a very long time constant. It is irrelevant in this section in which only the internal power coefficient X needs to be considered, since/ > /. However, one should also investigate the stability at other than full flow.

Storrer (12) demonstrates that r6(0) increases somewhat with decreasing flow, while P I X(0) I decreases somewhat if P is reduced in the same proportion as the flow in order to keep the same coolant temperature rise. For instance, at 40% flow, calculations show that r6(0) = 1.6 sec.

For many reactors now in operation, both fast and thermal, the point representing the asymptotic feedback characteristics is on the left of the curve shown on Fig. 2.40 so that these reactors satisfy the stability criterion presented here. In boiling water reactors, the power override, which is a good measure of the magnitude of P | A"(0) J and which consists mostly of the reactivity compensated by the voids, can attain many dollars. The zero frequency point is then well on the right curve and a detailed analysis of the frequency dependence of X(ico) is required to guarantee stability.

If plutonium or 333U were substituted for 235U in the reactor, and if the power coefficient were about the same in terms of absolute units of reactivity, the numerical value of this power coefficient and the abscissa of the points representing the feedback characteristics of Fig. 2.40 will be multiplied by about a factor of two if the dollar is used as a unit of reactivity. Since, as previously stated, the neutron kinetics curve of Fig. 2.40 will remain approximately unchanged, this substitution would reduce the critical power level for instability by about a factor of two. The plutonium build-up in the core of the Fermi reactor is so small in comparison to the 23SU content that no detectable change in the dynamic characteristics will occur.

Stability analysis in the lower frequency range. In the frequency range where /</2, Xt = A"(0) + {£i(0)£2£3(0)/[1 — ЕгЕі(0)]}, and the power Pc, at which the denominator of Eq. (2.43) becomes zero should be determined,

are valid for any frequency and, with these two conditions, Eq. (2.56) can never be satis­fied for any power or frequency. Hence, system stability is assured at any power level.

The relation 0 < a < 1 can be obtained in the following way. If the steady state reactivity feedback caused by a unit power change T(0) is identical to the reactivity feedback caused by an isothermal temperature increase of the whole reactor equal to the increase of the average coolant temperature, one would have

*(0) = £1(0)£3(0)/2 (2.61)

since £i(0)/2 represents the increase of the average coolant temperature per unit power increase and £3(0) is the isothermal temperature coefficient of reactivity. By combining Eqs. (2.57) and (2.61), one can see that a = 1. Note that the relation (2.61) would ap­proximately hold for a symmetrical homogeneous reactor. Since, in a symmetrical hetero­geneous reactor the fuel temperature at power is higher than that of the coolant, X(0) is certainly larger than in the homogeneous case and a must be less than 1. a > 0 means simply that the power coefficient and the isothermal temperature coefficient have the same sign.

In the Fermi reactor the calculated values are:

^(O) = 1.25°F/MW at full flow

E3(0) = O.29l0/°F

X(0) = 0.24580/MW at full flow

and thus a = (1.25 x 0.291 )/(2 x 0.2458) = 0.74 at full flow. At reduced flow the value of a is somewhat higher, but still smaller than unity, for the reason given above. Ег is the transfer function giving the change in reactor inlet coolant temperature resulting from the transmission around the coolant loops of a change in the reactor outlet coolant tempera­ture. The gain Ег of this transfer function is certainly smaller than unity, since a passive thermal system can never act as an amplifier.

From Eqs. (2.56) and (2.58), it is clear that, since the phase of the zero power transfer function G0 never exceeds 90°, and since AXO) is a negative number, Eq. (2.56) can only be satisfied if the phase of 1 + [2a£2/(l — Ег) is at least 90°. That this is impossible, and that therefore instability is impossible when / < /2, is demonstrated in the following paragraph.

1 + [(2£2a)/(l — £2)] can be written as [1 + (2a — 1)£2]/(1 — £2). For the case where a has its maximum value of unity, this expression reduces to (1 + £2)/(l — E2). From a simple geometric construction it can be seen that the phase of (1 + £2)/(l — £2) can never exceed 90° when | Ег | < 1, whatever the phase of Ег itself is. In Fig. 2.41, the geometric constructions of 1 + E2 and 1 — Ег are given for an arbitrary phase angle for Ег. The particular phase angle that was used is not important because, as will be seen

later, the results are independent of the phase angle of E2. The phase angles of 1 + E2 and 1 — E2 are indicated as фі and ф2, respectively. The former is measured in a counter­clockwise direction and is considered to have a positive value; the latter is measured in a clockwise direction and is considered to have a negative value. The phase angle of (1 + E2)/(i — E2) is (фі — ф2) by the rules of complex arithmetic. Consider now the case when E2 = 1. For this case фі and ф2 will be at their respective maxima in an absolute sense, since, by physical reasoning, | E2 | can never be greater than unity. Therefore, (Фі — Фг) will also have a maximum when | E2 | = 1. Now, when | E2 | = 1, the line formed by the vectors E2 and — E2 can be considered to be the diameter of a circle and the vector from the origin to unity a radius. Then the above-mentioned diameter and the vectors 1 + E2 and 1 — E2 become the sides of a triangle inscribed in a semi-circle. By geometric reasoning this triangle is a right triangle and the angle (фг — ф2) is a right angle. Thus, for this case, (ф1 — ф2) = 90°. By inspection it is obvious that when a is less than unity and | E2 | is less than unity the included angle at the origin between the adjacent sides of the resulting triangle will be less than 90°. This conclusion is valid for any value of the phase angle of E2. Thus, there is no possibility of instability when f <f2.