By defining an algebra to quantize each logic gate, we can calculate a probability for the final consequence in a single-failure fault tree from the initial probabilities of each causal event.

The AND gate is defined as a multiplicative operator; with inputs Х1г X2 Xn, the output of the AND gate is the product XxX2- ■ — Xn.

The OR gate however is defined as an additive operator; with inputs Хг, X2 Xn, the output of the OR gate is the sum xt + x% л— + xn.

The INHIBIT gate is also defined multiplicatively; if an input Xn has a condition W then the output of the INHIBIT gate is the product WXn.

Figure 1.32 shows the Boolean expression for each gate. The INHIBIT and AND gates are clearly very closely related. In many cases the fault tree

OR gate

Output event — В B=X, or X2or — Xn

=xt + x2 + ■■■ + xn

Input event

Fig. 1.32. Boolean quantization of AND, OR, and INHIBIT gates.

can be expanded by the use of either interchangeably; it depends on whether the analyst wishes to probe the reasons for the INHIBIT conditional modifier.

Figure 1.33 shows a representative section of a fault tree with inputs Xx, X2, and X3. The final output event may be quantized by evaluating each gate output thus:

Ax = BXA2 B2 = Xx X2 B3 = Xx + X2

Bx = X2+ B2 a2 = B3X3 (1.60)

Then the overall output is given by

Output = AX = BxA2 = (X2 + B2)(B3X3) = (X2 + Xx + X2)(X3)(Xx + X2)

— XxX2X3 + X1X1X3 + X1X2X3 + X2X2X3 + XxX2X3 + X2X2X3

(1.61)

There are two types of redundancies that can be used to simplify this

equation. The redundancies apply because Boolean combinatorial logic is binary, variables in the logic can only be one or zero.

Thus the AND redundancy states that

A-A = A (1.62)

The OR redundancy states that

В + В = В (1.63)

and so also

B + BC^B (1.64)

The logic of each redundancy can be checked by considering the original definition of the two gates. For example, if an output only applies when both of two identical inputs apply, then it is the same as if there were only one input.

Applying the AND redundancy, Eq. (1.61) becomes

and then, removing the OR redundancies, the expression is reduced to:

Output = XxX3 + X2X3 (1.65)

This is now a nonredundant Boolean expression of the combinatorial

logic of the fault tree in Fig. 1.33. It can be used to derive a probability of the output event from the probabilities of the individual input events X±) -^2) and X3.

1.6.5.1.1 Probability calculus.+ The Boolean expression is transformed into a true probability expression using the following relationships:

(a) P(AB) = P(A)P(B) (1.66)

The probability of a number of events all occurring is a multiplication of the separate probabilities of each event.

(b) P(A + B) = P(A) + P(B) — P(A)P(B) (1.67)

The probability of one of several events occurring is the sum of the separate probabilities less the probability of their occurring together. If the probabili­ties of each event are small then the last term in this expression can be omitted.

Similar expressions apply for three or more variables.

Thus the probability of the final output in the fault tree of Fig. 1.33 is given by a transformation of the logic expression of Eq. (1.65) into a probability expression:

P(Output) = P(X,)P(X:i) + P(X2)P(X3) — P(X,)P(X:i)P(X2)P(X3) (1.68)

1.6.5.1.2 Repair time. It is not enough to know the probability of each event, as each failure may remain in operation for a different repair time. Thus an infrequent failure rate of a system may be associated with a long repair time, and this may be more significant than a high failure rate of a system associated with a very short repair time.

It is conservative to assume that nothing is repaired. It is indeed very pessimistic and unrealistic for a minor event that has a high probability of occurring. No really satisfactory solutions to the problem of mathe­matically representing the repair time have been found, although computer programs that assume constant failure rates and constant repair times do achieve very close approximation to the true results for small fault trees (200 inputs or less). Such programs are used in the aircraft industry where the probability of initiating faults in protection systems is well known and can be applied to reactor systems to advantage (16).

A constant failure rate assumes that the system is operating in the flat portion of the life reliability “bathtub” curve when the burn-in period has ended and before the wearout period becomes apparent (Fig. 1.34). This is a reasonably good assumption for systems that are tested throughout the burn-in peiiod and that are replaced before the wearout period commences; in particular, it is reasonable for certain electrical control equipment.

The previous sections have outlined general disturbances to the reactor core. These disturbances may be ameliorated or aggravated by the control system or by human action.

2.6.1 Survey of Types

It is worth surveying possible initiators for the general disturbances so far considered, in particular, external initiators.

(a) Flow perturbations might arise from

(1) loss of electrical power to the plant or plant components result­ing in a loss of pumping power;

(2) pump mechanical failures;

(3) control malfunction.

(b) Reactivity perturbations might arise from

(1) the introduction of bubbles into the system;

(2) seismic deformations through structural movement;

(3) control malfunction;

(4) refueling accident.

(c) Thermal perturbations might arise from

(1) loss of feedwater supply;

(2) feedheater or turbine malfunctions resulting in a loss of heat removal capability;

(3) control malfunction in secondary and tertiary loops.

In each case a control malfunction is a possible cause of an accident, and as a result a controller error is treated in any safety assessment. The actual course of events depends critically on the mode of control used in any particular plant.

2.6.2 Control Modes

The control philosophy is shaped by certain restrictions which are set by plant material considerations and by the plant characteristics themselves.

The main requirements are: (a) a constant turbine stop-valve temperature, and (b) minimized temperature gradients in the vessel and in primary components. Whether or not these requirements are achievable depends on the time constants throughout the circuits of the system.

In a steam-cooled system which is a partly indirect cycle by virtue of the reheat cycle, load-following is possible if the feed supply-valve is administe­red correctly while the turbine stop-valve is varied. If the time constants and temperature feedback coefficients are suitable then this could be the control philosophy.

In a liquid-metal-cooled fast breeder the long delays in the intermediate circuit combined with positive void coefficients rule out load-following. A load-setting procedure is therefore a necessary control mode. This might take the following form: set the flow in the primary and secondary circuits; adjust the feed circuits; and adjust the reactivity in the core through control absorbers to meet the main control requirements listed above. The main problems are the difficulty in getting temperature signals from the core and the need to optimize control rod movement for small temperature changes.

Thus in the LMFBR control system, malfunctions might give rise to disturbances in primary, secondary, or feed flows, in reactivity, or possibly in a combination of all four.

In a given design a fault-tree analysis of the protective logic and the control system will be needed to decide on possible combinations of control operations that could give rise to adverse core effects. A faulty reduction of flows in the heat transfer loops following a signal of increased outlet temperatures would be an example of a gross control malfunction. The analysis of such possible malfunctions will need a combination of the analytical techniques discussed in Chapter 1.

One other possible control mode incident aggravation is worth mention. Noted above was the need to optimize control rod movement for small temperature changes. This optimization sometimes means the movement of a number of control rods in a staggered mode that makes it difficult to know what reactivity state the system is in at any given time. This ignorance of the reactivity state of the system hampered the diagnosis of the Fermi incident (see Section 4.6) which occurred during start-up.

Each control system must be treated as a special case for analysis.

The choice of a coolant is defined by a number of practical considerations. Primarily, excellent heat transport properties are required, but, in addition, the coolant should have little chemical activity and be compatible with the containment material so that corrosion is minimized. It should be stable and not be subject to decomposition even under irradiated conditions; its melting temperature should be low to avoid having to preheat the system to obtain a liquid coolant, but its boiling temperature should be high to avoid having to impose high pressures to suppress boiling. In addition its nuclear properties should be such that it is a poor moderator, and its indu­ced radioactivity build-up should be low to avoid having excessive shielding around the primary system. Added to all these requirements is the final one, that the coolant should be inexpensive; at least its cost should be a small fraction of the total cost of the plant.

Table 4.1 lists coolant properties for 15 potential liquid-metal coolants for fast reactors together with three evaluation parameters with which the effectiveness and suitability of a coolant candidate may be judged (2).

(a) The pumping power. This factor is a measure of the efficiency of the coolant. For systems with the same geometry, the same heat output, and the same temperature rise in the coolant channel, the pumping power varies
as

{10ЛІО2С2/

In this expression, /л is the viscosity in lb/ft-hr, £ is the density in lb/ft3, and cv is the specific heat in Btu/lb-°F. The pumping power is the product of the coolant volume flow and the channel pressure drop which is propor­tional to the friction factor. The friction factor is proportional to Rё02.

A low value of the pumping power is required in order to avoid an econo­mic penalty in heat transport. Table 4.1 shows that lithium has the lowest pumping power factor followed by zinc and gallium. Sodium ranks fourth in this assessment.

(b) Induced activity. The buildup in induced reactivity increases the amount of shielding required for the primary system and it therefore should be kept as low as possible. The specific activity in Ci/gm is given by

s = — Jr £ ‘W1 — exp(-O.6930/0,)] (4.1)

where is the atomic number of the z’th coolant isotope; N0 is Avogadro’s number (0.60248-1024); 9у is the neutron flux in the y’th energy interval (?z/cm2-sec); ац is the microscopic cross section for the z’th isotope and the y’th energy interval (cm2/nucleus); Aw is the coolant atomic weight (gm/gm — mole); тг is the coolant residence time within the neutron flux for one coolant cycle (sec); r0 is the cycle time for the coolant (sec); 6 is the irradia­tion time (sec); is the half-life for the z’th isotope (sec); and К is 3.7-1010 disintegrations/Ci-sec.

The exponential term accounts for the loss of activity due to the fast decay. Note too that the two cycle times rr and r0 depend on the heat transfer properties.

Table 4.1 once again shows that lithium is the most suitable coolant based on this assessment, followed by lead and an alloy of lead and bismuth. Sodium ranks seventh in the list although the addition of potassium brings it into fourth position.

(c) A temperature range ratio. In order to obtain some quantitative assessment of the working range of the coolant the following ratio of tem­peratures provides a useful measure

(Tb — Tm)/Tw (4.2)

Tb, Tm, and Tw are, respectively, the boiling, melting, and outlet absolute temperatures of the coolant (°R).

Properties op Liquid Metals® Potassium Rubidium Sodium Tin Zinc Na(56%)- K(44%) Na(22%)- K(78%) Pb(44.5%)- Bi(55.5%) Sulfur Phosphorus 19 37 11 50 30 16 15 39.100 85.48 22.997 118.70 65.38 30.082 35.557 208.2 32.066 31 44.6 84.4 51.4 421 428 47.4 46.3 625.5 102.5d 84.9е 0.41 0.415 0.55 2.736 6.192 0.47 0.43 2.88 680** <1 0.0057c 0.0022^ 0.0101 0.0347 0.0535 0.0071c 0.0078c NA 0.00294 NA 48 60′ 29 55.54 35.22 61 71 129.85 173d NA 62 139 9 Neg. Neg. 26і 45і Neg. 310.2d 227.5e

146 102 208.1 449 787 66.2 12 257 246 111.5 1402 1270 1618 4118 1663 1518 1443 3038 832 536 0.182 0.0877 0.301 0.0639 0.1165 0.2485 0.209 0.035 0.248d NA 21.2 13.2 37 19.0 33.2 16.4 15.05 8.05 0.0952 NA 25.5 11.0 48.7 26.1 43.92 NA NA NA 25 8» 9.06» 853 363 1718 1031 755.1 NA NA NA 121.2 254» 0.0035 0.00276і 0.0044 0.0095 0.022 0.0071 0.0060 0.0125 1771 <1 2.41 2.5 2.5 2.6 6.9 2.5 2.5 0.0 NA NA

0.59 46.0 0.87 14.0 13.0 0.80 0.64 3.5 1.4*.* 3ft, i 4(3.7 MeV) NA <1 1 1 NA NA 0.58і NA NA 12.4 hr 19 days 15 hr 112 days None See K, Na See K, Na None None None 0.32, 1.1 2.775, 0.39 None NA NA None None None 1.51 0.0507 0.0234 1.368 0.0852 0.0169 0.0305 NA NA NA 0.0616 0.0637

S 3.66 S 390 SO.17 S 1.00 SO.13 S 0.60 S 0.80 See Pb, Bi S 0.08 S 0.09 304 SS 304 SS 304 SS Quartz Graphite 304 SS 304 SS Cr-Mo steel Graphite NA Slight1 Slight* Slight* SI. sol. SI. sol. Slight Slight SI. sol. Reacts Reacts Slight1 Slight* Slight* Alloys NA Slight Slight SI. sol. Reacts Reacts High Moderate High None None High High High Slight Moderate High High High Slight as dust Moderate High High Moderate as dust Slight High

A high value of this temperature ratio is desirable for a practical coolant, and Table 4.1 shows that tin, followed by gallium and an alloy of lead and bismuth head the merit table. This time lithium comes sixth while sodium comes eighth in the list. Other temperature factors could be used to assess working ranges but they give similar results.

Using these three evaluation parameters to choose a liquid-metal coolant would appear to lead to a choice of lithium followed by gallium.

However, lithium has a strong absorption cross section for fast neutrons. The main culprit is the eLi content and 7Li comprises 92.5% by weight of natural lithium, so the absorption can be reduced by enriching the lithium in its 7Li content. Lithium also has the disadvantage of having a low atomic number and it is therefore a strong moderator, three times as effective as sodium, which itself is a strong moderator. Strong moderation is undesirable because it degrades the spectrum and lowers the breeding ratio, and since breeding and neutron economy are most important to the success of the fast reactor, lithium cannot be used as a coolant. Gallium is far too expen­sive, even though the price could be expected to decrease if it were used in bulk.

Sodium is chosen as a coolant therefore, because it is a better-than — middle runner in all the assessment contests.

If the sodium is sprayed out into an atmosphere that contains oxygen, then again the possibility of a fire is present. The sodium spray may arise from the failure of a primary sodium pipe under pressure or a similar cir­cumstance, although it is a little unlikely in an actual plant. Pipe leaks form­ing pools are more probable if a leak occurs.

When fine particles of sodium are sprayed into the air, the sodium may ignite at room temperature if it is in the form of a mist, although it may not ignite until the temperature is about 250°F if the sodium is in the form of droplets. The burning rate increases as the oxygen concentration is increased, up to 5%. It also increases if the moisture content of the atmosphere is increased, although there is no significant effect following an increase in the spraying pressure (55). Experiments have produced burning rates that are as rapid as the ejection rates themselves.

Heat from the spray fire is lost to the oxide particles, to the unburned sodium, to nitrogen in the air, and to the containment walls by radiation. Modeling of a spray fire must therefore take all these modes of heat transfer into account.

Due to the motion of the particle, the fire is less likely to be extinguished by oxide blanketing. Safety features that could be employed to protect against the consequences of spray fires include baffles to accumulate the spray volume thus reducing the heat transfer area and allowing the fire to be blanketed. A better safeguard is to provide inert gases only in proximity with sodium.

The main isotopic hazards arising from an inadvertent release from a nuclear power plant, apart from plutonium, are the iodines, kryptons, and

+ This is the effective biological half-life for bone-seeking a3sPu.

xenons. The iodines alone contribute to the thyroid as they alone accumulate in the thyroid gland, but all the isotopes contribute to the whole body dose.

Table 5.6 illustrates the isotopic contributions to the 30-day whole body dose for the whole passage of the cloud. The contributions to the 2-hi dose at the site boundary are of course different; 131I is then the most dom­inant isotope instead of 85Kr. These calculations assume that no iodine is absorbed by the primary sodium.

In most fast reactors at this time, a particular hazard is offered by the plutonium, in the unlikely event of an accident. Plutonium is a radioactive bone-seeker with a very long half-life; thus its release is more limiting than that of any of the above isotopes. In some hypothetical accidents, it might be limiting enough to require a double containment to meet the ICRP limits.

Tritium is not a particularly troublesome hazard. The yield from fission is only 0.01%. It may be produced from the soluble boron used in the LWR as a chemical shim reactivity control, but in a fast reactor it is mainly produced in the boron carbide rods. The stainless steel cladding allows diffusion of about 80% of the tritium into the coolant stream, and this could conceivably be released to the atmosphere after passage through the primary circuit, diffusion through the IHX tubes, passage through the secondary circuit, diffusion through the steam generator tubes, and penetra­tion to the steam and condensate circuits. If such a tortuous emission proved excessive, tritium traps could be employed in both or either of the primary and secondary circuits.

After the absorption of strain energy by the vessel, the remainder of the available energy is, in part, thermal energy (the core fuel is still considerably hotter than the surrounding sodium) and, in part, kinetic energy (the fuel particles are still moving outwards). The kinetic energy would be directed upward by the unruptured walls, while the thermal energy would be depos­ited in the sodium above the core thus vaporizing some of it. Both the kinetic energy and the sodium vaporization would combine to accelerate the sodium above the core upward toward the vessel plug.

The upward acceleration is therefore achieved by both direct momentum transfer and by further flashing of sodium as fuel particles come into contact with it. The sodium slug or hammer would eventually come to rest in contact with the vessel plug, lifting it against its restraint system. The stretching of this restraint system could allow sodium to egress from the vessel after the accident.

This coefficient is very similar to the thermal density coefficient, but the emphasis is slightly different. The effects can be summarized in terms of the following.

(a) Absorption variation. The sodium removal reduces nonproductive absorption and relatively more neutrons are productively absorbed in the fuel. This is a positive effect.

(b) Leakage changes. As the diffusion length increases it leads to a greater leakage and gives a negative contribution to the coefficient.

(c) Moderation changes. There is less moderation and thus the fractional loss in energy per collision (the energy decrement) reduces and so the spectrum hardens. Thus the number of neutrons per fission (v) increases and this too gives a positive contribution (Table 1.4).

(d) Self-Shielding. Self-shielding decreases giving a positive effect.

Thus the final sodium void coefficient is a matter of balance among these effects and the final value can be positive or negative. Because the effects are position dependent, the leakage being the dominating effect on the outer edges of the core and the moderation effect dominating at the core center, the sodium void coefficient is also very position dependent. Figure 1.13 shows the spatial variation of the sodium void coefficient and its components as a function of the core radius.

Section 1.4 showed that reactivity changes arise through perturbations to Mission, and through changes in leakage. The reactivity variations are input into the calculational model through keff in the kinetic equations.

Such cross-section and leakage changes can arise from: (a) feedback effects from temperature changes, pressure changes, and structural move-

ment; and (b) external influences from control rod movement, the addition of poisons or moderator due to component failure, or core voiding in the sodium system. The magnitude of the reactivity effects from each cause is the concern of the physicist who evaluates them, using steady-state codes, as if the changes were a set of pseudo-steady states. These reactivity changes are then used on the presumption that the changes in reactivity occur more rapidly than the initiating mechanisms.

Thus the reactivity input is:

Л*(0=ЛО + МГі(0 (2.6)

where f(t) represents external influences and ST^t) symbolizes temperature and pressure changes which give rise to feedback effects. The latter are linked to relevant model equations which produce those temperatures and pressures.

Three damage ranges are specified without reference to the accidents which could cause them and without reference to any probabilities for those accidents.

(a) No damage range. Within this range incidents give rise to slightly above normal temperatures and stresses but no physical damage occurs and there is no significant reduction in attainable burn-up. There is no fuel melting and the peak cladding temperature is less than e^F.

(b) Moderate damage range. Within this range some (up to x% cross­sectional area) fuel melting occurs but there is no loss of fuel pin integrity (maximum peak cladding temperature of 02°F). No fission gas is released but there is a reduction in the attainable burn-up and possibly in transient operational capability.

(c) Gross damage range. Within this range substantial fuel melting occurs (greater than x% of the cross section). Cladding failure together with a release of fission products and fuel material may occur. At the upper end of this damage range, this failure may be violent and combined with a loss

t See Fig. 3.3.

of core, and, possibly, an explosive disruption of the core. The upper limit of damage is defined as that arising from the worst credible accident.

3.1.3.1 Likelihood Classification+

Now one can define a fault classification which is based on a judgment of probabilities within the following ranges.

(a) Operational occurrences. These are off-normal conditions which in­dividually may be expected to occur during the plant lifetime. (The plant design and protective system is such that the effects of operational faults will be limited to lie within the no damage range but this criterion is not part of the definition of an operational fault.)

(b) Unlikely faults. These are off-normal conditions which individually are not expected to occur during the plant lifetime but which, when inte­grated over all components of the reactor, one such fault may be expected to occur once during the plant lifetime. It is probable that such an unlikely fault would simply lead to the necessary repair or replacement of the faulty component or system. (Plant and protective system design criteria will limit the consequences of unlikely faults to the no damage or moderate damage ranges but these criteria are not part of the definition of an unlikely fault.)

(c) Unexpected faults. These are off-normal conditions arising from a single very low probability failure which are expected never to occur during the plant lifetime but which are nevertheless mechanistically possible.

By virtue of the design of the plant and its safeguards some of these unexpected faults will represent extreme cases of failure which are identified as being possible but of extremely low probability. The worst of these credible* accident situations is chosen as the plant design basis accident. Its consequences form the upper limit of damage in the gross damage range. Plant design criteria seek to reduce this damage level.

(d) Incredible faults. These are off-normal conditions which arise from two or more very low probability failures or which are postulated to occur irrespective of the fact that no credible* initiator can be envisaged. These accidents are presumed to be of insignificant probability and therefore would not be used as design basis faults.

t See Fig. 3.3.

t Credible is defined as being mechanistically founded, arising from a real, even though low probability, fault initiator.

In the severity classification, 01; 02, and x will depend on the fuel design chosen but they might be expected to be of the order of:

0! = 1300-1400°F,

02 = 1500-1600°F, x = 20-40% (see Table 3.1).

Traditionally the worst rates of reactivity addition were calculated from a gravitational collapse of the core following gross core melting due to a loss of cooling. In many cases these were overemphasized by assuming that the center of the core had melted and collapsed before the top third of the core dropped onto the debris beneath. In this way, the worst possible addi­tion rates were calculated.

In order to obtain some idea of how high rates are produced, consider a cylindrical core of height 123 cm and radius 100 cm which is presumed to melt and suddenly lose cohesion so that it slumps. The coolant is presumed to have evaporated so that the core has 30% coolant volume within which to slump. It would therefore fully compact, if it only slumped vertically downward, to a new height of 86 cm.

Equation (4.13) states the reactivity condition of the core before collapse, in which the square of the diffusion length L2 and the dimensions of height H and radius R determine the leakage of the system.

ke(t =kx{l+ L2[(2.405/R)2 + (л/Н)2] }-1 (4.13)

When the core has collapsed to 70% of its height, assuming the diffusion length to be proportional to this height, Eq. (4.14) describes the new re­activity state k’cS of the system.

*;<r = *«{1 + L2(0.7)2[(2.405/R)2 + (Я/0.7Я)*]}-! (4.14)

If we assume that the system were originally subcritical due to the total core voiding, but that it just attains criticality on complete compaction, then = 1.0. Substituting the values for R and H and assuming L2 = 150 cm2, Eq. (4.14) gives koa= 1.1389 and Eq. (4.13) then gives keff = 0.9615.

Thus during compaction the core gained reactivity due to a decrease in leakage of 1.00— 0.9615 = 0.0385 or approximately $10. The gravita­tional collapse from 123 to 86 cm took 0.27 sec and thus the rate of reactivity addition was $ 37/sec.

The rate could of course be much higher, if centrally situated fuel material could move further into the center where the material worth is higher. This particular illustrative example only accounts for leakage differences, and it assumes that L is only volume dependent.

Actually, the reactivity states of the changing configurations of fuel material would be more accurately calculated by using a two-dimensional diffusion theory code to calculate the effective multiplication several times during the collapse. This calculation would take into account the changing worth of the core fuel as well as leakage differences.

Section 5.4 outlines the practical accident analysis case in which the reactivity changes are actually a combination of voiding effects as well as fuel movement effects.