Codes are produced by engineering societies, both as an aid to their members and as a public service. Codes are not government controlled even though they are sometimes the subject of joint effort or subsequent agree­ment by the government agencies. The American Society of Mechanical Engineers (ASME) codes are an example. Among other things they provide methods for nuclear vessel design (7). Figure 6.1 shows an example of a specific code for jointing sections of wall of unequal thickness from Sec­tion III of the ASME code for nuclear vessels. The Institution of Electronic and Electrical Engineers (IEEE) codes, on the other hand, deal with elec­trical components and systems (2a, b,c).

Heads thir than shell

■Taper may be inside or outside

Permissible

Fig. 6.1. N-466 category A and В joints between sections of unequal thickness. ASME code: section III, nuclear vessels (7). The length of required taper L may include the width of the weld. In all cases L shall not be less than 3 times the offset between the abutting plates.

Section 10 of the Code of Federal Regulations (CFR) for Atomic Energy

(5) is important in the sense that these are the codes by which licensing bodies judge the applicants. The codes 10 CFR 20 and 10 CFR 100 for radiological evaluation have been referred to previously. Section 6.3 refers to 10 CFR 50 as a guide to safety evaluation report preparation.

This book therefore presents safety as an embryo science by outlining the analytical tools which are available to the safety engineer, by present­ing the experience which has been obtained using fast reactors to date, and finally by posing the questions which remain unanswered. This is done within the framework of designing a fast reactor power plant and of taking it through the regulatory process.

Chapter 1 presents the methods of safety evaluation, Chapter 2 outlines possible disturbances to the system and their interactions. Chapters 3-6 take the reader through the design and licensing process, from the establish­ment of safety criteria, through special fast reactor considerations in safety, the barrier concept of safety, and the final presentation of the plant safety to the regulatory bodies and the public. For a detailed discussion of fast reactor technology, overall reactor safety, and a review of current safety practices, the reader is recommended to use the general references listed at the end of this chapter to supplement the present text.

Having now constructed a mathematical model of the system and knowing the interaction between its relevant variables, we can calculate the system behavior resulting from certain disturbances.

These disturbances may be operational (the closure of a valve restricting steam flow or the insertion of rods to obtain a reactivity reduction), or they may be faults (pump failure, a burst steam main, or an inadvertent withdrawal of control). The model may be suitable for investigating each of them, or it may have to be modified for each set of circumstances. One might have to add a representation of the pumps in more detail if their behavior off their normal characteristic is required.

The calculations are performed either on an analog or a digital computer. The analog is especially convenient for time-dependent differential equa­tions but the sheer size and nonlinearity of the calculation may demand the use of a digital machine. Presently it is customary for a reactor designer to have several standard codes that he may use as tools in the representation of certain types of transient—using one with a detailed fuel model, for example, to calculate the response to a reactivity transient and one with a detailed pump and circuit representation to calculate flow transient be­havior. These are usually digital codes (see the Appendix).

Analog machines are in use for stability investigations and for control simulations, their range having been extended by the addition of some digital facilities, making them into hybrid computers with a combination of digital and analog functions.

Local temperature and heat transfer changes in the LMFBR core will be treated in detail in Section 4.4. One possible perturbation not treated is the addition of cold sodium to the core. This might be presumed pessi­mistically to occur if an inactive loop is activated in some sudden fashion resulting in a reduction of the inlet temperature. The result would be a slight addition of reactivity if the overall coolant temperature coefficient were negative, which might be followed by a further reactivity addition as the fuel temperature was reduced. However, even on an instantaneous basis assuming very pessimistic inlet temperature changes, this reactivity change cannot be larger than that which the protective system can handle. In practice the system would be surveyed for possible ways in which the inlet could experience colder sodium flow, and the reactivity change would be calculated. It could then be shown to be small compared to the largest acceptable step of reactivity as defined in Section 2.3.2.3.

One further local temperature change not yet noted concerns the steam — cooled fast reactor system and the gas-cooled system. In reactivity or flow transients which result in coolant temperature variations, the coolant density is very sensitive to these temperature changes, and additional heat transfer variations will occur in addition to the usual reactivity feedbacks. Such effects will be included in the modeling by ensuring that the density of the coolant is allowed a pressure and temperature dependence.

mc = Aoc = Aoc0 T0P/TP0 (2.7)

The application of redundancy is an attempt to decrease the probability that an accident will occur.

3.3.1 Redundancy

In reactor systems, a component or system which is vital to the safety of the plant is made redundant; that component or system is doubled in the design, so that in a fault condition one of the components or systems could fail and there would still be one to do the vital job. Thus the probability of failure of the component or system is reduced. There are, however, three main drawbacks to the principle of redundancy.

(a) There is a design inhibition against redundancy; the incorporation of a system or component which may never be used. Some designers may tend to believe one Webster definition of the word redundancy: “an act of needless repetition.”

(b) Mere redundancy does not ensure greater safety if the redundant components or systems share vital components or lines, interfere with each other so that a failure of one could cause the other to fail, or are subject to common mode failure (failure from the same fault). Thus true redundancy also implies independence.

(c) The cost of doubling up some systems and components is often considerable and may be more than the plant can economically allow.

Thus the application of redundancy requires a certain engineering and safety judgment to obtain optimum safety and operational capability.

It is assumed now that no molten fuel is present. The problem is whether, following the cladding rupture, the release of fission gases might blanket

and insulate an adjacent pin and cause a secondary failure. The results quoted below all refer to fuel pins of 0.2-0.25-in. diameter in a pitch-to — diameter ratio of about 1.25. The case is a very important one because the event of a failure of a high burn-up pin is a likely fault by the very statisti­cal nature of the fuel and cladding fabrication process. Indeed plants have been designed to run with some failed fuel.

What experimental evidence there is suggests that no damage results subsequent to the first failure. The Soviet BR-5 was deliberately run at higher then design burn-ups for some considerable time and despite a significant number of failures, no report of any propagation mechanism was discovered (18).

Table 4.4 outlines results obtained in the USA for a 19-rod bundle (6 ft by 0.24 in. diameter with a 50-mil wire wrap on a 12-in. pitch) in which gas was released through different sized holes at different flow rates. Photo­graphic records of the experiment, staged in water, showed that for large hole sizes, the outgoing gases could cause the channel flow to reverse but only for a very short time. Smaller hole sizes sustaining a longer outflow of gas caused no reversal and no coherent channel bubble but merely a stream of bubbles (19, 20).

Table 4.4 also outlines other work for a 7-pin bundle in water (21). Air was released through holes of varying sizes at various pressures into the coolant flowing with a coolant velocity of 20 ft/sec. The coolant pressure was 30 psi. No reversal was observed in the coolant flow, although measure­ments of flow against the opposite pin showed regions where the effective flow was reduced to as little as 5% and very small regions where the flow was zero.

Analytically, the consequences of fission-gas release within a coolant channel may be bracketed between large and small flow rates and their different consequences. First the rate of emission of gas may be calculated for a given rupture, depending on the pressure differential between the fuel — pin fission-gas plenum and the external pressure in the channel, if one knows the pressure drops along the path through the fuel by which the fission gases emerge (19).

Figure 4.15 shows a cross section of the fuel and the sintered and un-

sintered regions. Also shown is a postulated path for the flow of fission gas from the plenum through cracks in the outer region, through inter­connected pores in the inner zone to the central void and a reverse path through the sintered and unsintered zones to the rupture of the cladding. Digital codes (see Appendix) exist to calculate flow rates through this tortuous path based on estimates of pressure drops that might be expected. The calculation takes into account the fact that the fission gas exits at sonic velocity, as long as the pressure ratio across the cladding rupture is greater than about 2 and thereafter the release is subsonic. Thus the gas outflow is calculated for different hole sizes, for different locations of the rupture, and for different assumptions of the condition of cracking in the fuel which determine the pressure drops through the fuel.

Fission gas outflows can last anything between a few milliseconds for large holes to even minutes for very small holes. Subsequent channel flows depend critically upon whether the flow rates are large or small as Table 4.4 shows; therefore, the analysis is separated into these cases.

(a) Large gas flow rates (Fig. 4.15). Based on a momentum balance, the flow rate in the channel can be shown to decrease rapidly when the fission gas enters, but it then recovers as the fission gas is swept out of the channel, until the flow regains its original value. This reducing and recover­ing flow transient can be input to a thermal assessment code to calculate the transient effect on the cladding temperature for neighboring pins. Even in the most pessimistic cases, the outflow of gas is too rapid to cause more than a moderate rise in neighboring cladding temperatures.

(b) Moderate gas flow rates. In these cases no flow reversal is assumed but it is supposed that the flow rates are large enough to allow a jet of gas to impinge upon and blanket an opposite fuel pin. Other results show that this can occur for a certain critical range of rupture sizes: between 0.005 and 0.07 in. in diameter (21).

A three-dimensional code TOSS (see Appendix) used to calculate the heat transfer for a pin that is effectively insulated for an angle 6 of its cir­cumference shows that the cladding temperature beneath the point of insula­tion rises to a level which depends on 6 (Fig. 4.16a). As Section 4.2.2.2 showed, this level is much higher for coverages of larger than about 90°.

The cladding will attain failure temperature (5b) if the insulating or heat­ing impingement of fission gas remains in situ for a long enough time (te) which varies with the angle of coverage 6°. The value of te will depend on the characteristics of the jet and its possible deflection by the stream (19).

The following empirical equation can be used to represent the jet deflec-

tion (velocity in feet per second and dimensions in inches):

x/d0 = (2.02 ?g Kg2/ec Ус2) log [1 + (0.049y/d0)] (4.31 a)

where x is the penetration into the mainstream, у is the downstream de­flection in a channel of diameter d0, and gg, Vg, gc, VB are the density and velocity of the gas and coolant, respectively. The deflection у varies with time as the gas velocity decreases through the rupture and te is the total time that a point on the adjacent cladding has been blanketed by the jet of gas. The jet also disperses in the flow according to the equation

jet width h = 2.25r/0 + 0.22x (4.31b)

and this jet width will define 0, although of course the jet will also tend to smear around the adjacent pin thus increasing the effective blanketing coverage.

Thus failure can only occur by this mechanism if the cladding rupture is such as to produce a blanketing of the opposite pin of 6° for a time long enough to achieve failure temperatures te. This demands that the rupture size be large enough to give a reasonable coverage, since smaller holes will give a smaller gas flow rate and therefore the jet may be deflected too greatly by the stream. On the other hand the rupture size must be small enough to sustain a gas jet for a time greater than t0. Thus there is a critical range of rupture sizes which might cause an adjacent failure.

Recent calculations (19) report that this critical range is between 10~4 and 10-5 in.2 in area.

Even within this critical range, there is yet no hint of the possibility of a continuing failure, for if a second failure is produced, it will still be direc­ted back toward the original ruptured pin. In order to produce a chain of failures the second pin would have to also fail with a rupture size within this same critical range and at the same time be directed toward a third pin. This does not seem likely.

(c) Low gas flow rates. If the gas flow rates are very low then they will be sustained from small holes or locations distant from the fuel fission gas plenum for several minutes. The conditions in the channel are now two — phase and the analysis of Section 4.2.2.1 can be used to compute the effect on neighboring pins. This effect has been seen to be small for even void fractions approaching 50%.

Thus by separating the analysis into three distinct flow regimes, it has been possible to calculate temperature changes in the cladding of the neighboring fuel pins to determine whether any subsequent failure is caused that might lead to propagation of the original failure. The three analytical regimes are not strictly defined, they overlap although it appears that with internal fission pressures of 800-1000 psia the gas cannot cause a flow reversal for hole sizes greater than 0.06 in. in diameter at these flow rates (20).

The results lead to the following conclusions:

(a) For single failures the most critical size of rupture appears to be in the neighborhood of 0.01 in. in diameter (10~4-10-5 in.2 in area) when a jet can be sustained to blanket the opposite fuel pin.

(b) For single failures, the most critical rupture location is at the middle of the fuel pin; ruptures nearer the plenum release the gas too rapidly and ruptures further away do not provide a very large flow volume rate.

(c) Even at these most critical conditions, temperature rises in the clad­ding of the adjacent pins are limited to very local positions, so that if a failure occurred in an adjacent pin, then the failure would be directed back toward the original failure. Thus it is most unlikely that this failure could propagate. Experience to date certainly substantiates this position.

Although once a problematic condition, it appears that experience and analysis have shown that a failure which releases only fission gas does not propagate. Because of this, experimentation on this condition is now being brought to a close.

BOR-60 is a second stage in the Soviet fast-reactor program, a sodium — cooled fast reactor designed to supersede the BR-5 by producing 60 MWt. It attained 20 MWt in the spring of 1970 and should reach full power early in 1971. It will provide further information for the Soviet program in which the BN-350 and BN-600 plants, 350 MWe and 600 MWe respectively, are already being built (46b).

The sodium for the BOR-60 fast breeder fuel irradiation reactor was
shipped under a layer of paraffin wax. Some of this wax found its way into the sodium storage tanks and has thus resulted in an early clean-up problem. The experience echoed earlier purity assurance problems in Dounreay.

The plant has a conventional building which is not a leaktight contain­ment. The design emphasizes engineered safety features, with a doubly contained primary system up to the isolation valves. Redundant safety circuits are included and backup power is provided as well as a plant designed for natural circulation to ensure that heat removal capability is available under all circumstances.

Fig. 4.42. Cross section of LAMPRE (2).

Because there is a fairly small inventory of sodium in the vessel, the outlet components experience a substantial thermal shock on scram. This is offset by a programmed flow reduction following the scram signal.

A large size bubble introduced into the region of the core that has a positive void reactivity worth, could give rise to more than one dollar’s worth of reactivity, and such a bubble could enter at a rate that might give rise to a very rapid reactivity rate of addition.

Section 4.2.1 discussed the sources of bubbles in some detail and showed that the likelihood of a large coherent bubble’s arriving at the core inlet plenum was very remote. A bubble of tens of liters in size would be required before large reactivity ramps would result, and good design of the primary system and its cover gas surfaces prohibit the appearance of such a bubble.

Thus, although it is indeed necessary for the plant design to consider gas entrainment and accumulation very seriously, a reactivity addition from the introduction of external voids into the core is not a credible CDA initiator.

These comprise a descriptive outline of the whole plant, together with specific reference to the safety of each system. Compliance with the relevant safety criteria is demonstrated in these sections and the codes and standards used are noted.

As an example, Section VIII (electrical systems) requires comment on the following subjects: design basis—electrical system; design—network inter­connections, station distribution system, emergency power, and tests and inspections. Section III (reactor) requires discussion of design bases—nu­clear, reactivity, mechanical, and thermal hydraulic; design—nuclear char­acteristics and evaluation, mechanical characteristics and evaluation, ther­mal hydraulic characteristics and evaluation; and safety limits and condi­tions—tests and inspections.

The transfer of heat through any material is governed by the heat balance equation:

qc dT/dt = к V2T + H (1.18)

where H is the heat production term. This, like Eq. (1.3), is also time and space dependent.

Fig. 1.6. Schematic representation of the thermal distribution through a cross section of a cylindrical fuel pin.

Considering a cylindrical fuel pin in which heat is produced (Fig. 1.6), Eq. (1.18) can be used to derive the average fuel temperature in the follow­ing way. In the radially symmetrical pin

qc dT/dt = аф + k[(d2T/dr2) + r-‘(dT/dr)]

and by defining a volume-averaged fuel temperature and volume-averaged flux (or power) as

T = (2л/A) f Tr dr and ф = (2л/A) f фг dr (1.20)

Jo Jo

where

A = 2л r dr

J 0

Equation (1.18) becomes

Aoc(df/dt) = афА + 2лкЯ(дТ/дг)лШ (1.21)

By now assuming that

(дТ/дг) ]atiJ = (TBUl[~ Tc)/A

we have

me df/dt = а’ф — (2л Rk/A)(TBai{ — Tc)

and defining the heat-transfer coefficient h = 2лЯк/A, the average fuel temperature is given by

Now the heat-transfer coefficient h’ must include not only an allowance h for the film drop heat transfer between the surface temperature reurf and the coolant temperature Te as before, but also an allowance for conduction between the point of average fuel temperature T and the surface of the fuel. So

1 /К = (1 /h) + (/%лк) (1.25)

This adjustment is made so that Eq. (1.24) enables Г to be directly calculated whereas using Eq. (1.23) would have required an additional equation to obtain ГзигГ from f and Tc. Thus for the average fuel temperature, the equation becomes (Fig 1.7)

m[C{(dTf/dt) = аф— h^Tt — Tc) (1-26)

In a similar manner the average coolant temperature equation becomes

mcec(dTc/dt) = ht(Tt — Tc) + hB(Ts — Tc) — mcecvc(dTJdz) (1.27)

where the last term accounts for the transfer of heat as the fluid moves down the channel with velocity v0. Average temperatures of any other material such as structural components in the core can be established in an exactly similar manner; i. e.,

mBc3(dTJdt) = Ьф — hs(Ts — T0) (1.28)

where in this case Ьф accounts for any direct у heating of the structure. Equation (1.27) accounts for heat deposited in the coolant from the fuel element h((Tt — Tc) and from the structural material hs{Ts — Tc).

1.3.1.1 Steady-State Temperatures

With all time derivative terms set to zero, by adding the steady-state temperatures of this system (fuel, coolant, and structure) we can obtain

Thus one can obtain a complete distribution of temperatures as a function of z if the heat input distribution ф(г) and the coolant inlet temperature Tc. are known.

It is worth noting that the inlet temperature is effectively a base tempera­ture for the system. Any increase in coolant inlet temperature is reflected by an identical increase in all the other temperatures in the steady state—if the power is retained constant. In practice, we shall see in the next section that, in the absence of external controls, the power ф will also change as a function of temperature because of feedback reactivity changes. However this change of power is a secondary effect.