The safety analysis presentation is the purpose of the PSAR document. It requires a core and primary circuit analysis and a standby safeguards analysis with emphasis in each section on abnormalities considered, identi­fication of causes, and a complete analysis with methods and results.

Table 6.2 is an outline of a safety analysis section, as an example of exact­ly what might be covered in such an analysis, in this case for a three-loop LMFBR.

This document would be prepared by the design and safety groups of the industrial vendor for their utility customer and the utility would submit it to the AEC in support of their application. The vendor acts as an expert witness for the utility if any questions on the work arise.

Section XIV
SAFETY ANALYSIS

1. INTRODUCTION

2. REACTOR PLANT PROTECTION AND FAULT CONDITIONS

2.1 System Design Safety Features

2.1.1 Core Design

2.1.2 Heat Transport System Design

2.1.3 Reactivity Design

2.1.4 Protective System Design

2.2 Reactor Stability

2.3 Plant Protective Trip Levels

2.4 Classification of Events Considered

2.4.1 Fault Tree Analyses

3. REACTOR PLANT PROTECTION ANALYSIS

3.1 Primary Flow Failures

3.1.1 Loss of Electrical Supply to All Pumps

3.1.2 Loss of Electrical Supply to Two Primary Pumps

3.1.3 Loss of Electrical Supply to a Single Primary Pump

3.1.4 Mechanical Failure of One Primary Pump

3.2 Secondary Flow Failures

3.2.1 Loss of Electrical Supply to the Secondary Pumps

3.2.2 Mechanical Failure of One Secondary Pump

3.3 Steam System Failures

3.3.1 Turbine Stop-Valve Closure

3.3.2 Loss of Feedwater Supply

3.4 Reactivity Faults

3.4.1 Power Range Reactivity Addition

3.4.1.1 Continuous Rod Withdrawal

3.4.1.2 Loss of Control Material from a Single Rod

3.4.1.3 Loss of Control Rod Hold-Down Features

3.4.1.4 Loss of Operation of a Single Control Rod

3.4.2 Start-Up Reactivity Addition

3.4.3 Seismic Effects

3.4.4 Cold Sodium Insertion

3.4.5 Core Distortion

3.4.6 Sodium Voiding

3.4.7 Local Assembly Faults

3.5 Local Faults

3.5.1 Heat Transfer Impedance

3.5.1.1 Cladding Crud Deposition

3.5.1.2 Fuel Pin Swelling

3.5.1.3 Gas Bubbles

3.5.2 Flow Blockage to Subassemblies

3.5.2.1 Total Blockage

3.5.2.2 Partial Blockage

3.5.2.3 Defective Fuel Failure

3.5.3 Continuous Local Overpower

3.5.4 Fuel Failure Propagation

3.5.4.1 Fission Gas Release

3.5.4.2 Fuel and Gas Release

3.6 Primary System Ruptures

3.6.1 Small Leaks

3.6.2 Large Ruptures

3.7 Secondary System Ruptures

4. CONTAINMENT DESIGN BASIS ACCIDENTS

4.1 Philosophy

4.2 Possible Initiating Conditions

4.2.1 Flow Blockage to a Subassembly

4.2.2 Local Failure Propagation

4.2.3 Primary System Ruptures

4.2.4 Loss of Reactor Scram

4.2.5 Voids Introduced into the Core from External Sources

4.3 Energy Release Mechanisms

4.4 DBA Consequences

4.4.1 Vessel Damage

4.4.2 Head Damage

4.4.3 Radioactivity Release

4.4.4 Compliance with 10 CFR 100

5. REFUELING AND FUEL HANDLING ACCIDENTS

5.1 Loss of Cooling

5.1.1 Fuel-Handling Machine Cooling

5.1.2 Decay Storage Cooling

5.2 Loss of Power

5.3 Dropped Fuel Assembly

5.4 Sodium Leakage

5.5 Misloading

6. SUMMARY AND SAFETY POSITION

6.4 Other Siting Considerations

The regulatory process includes a public hearing and public groups and individuals are allowed to make comment on the proposed power plant and the applicants’ submissions. The attitude of the public is influenced by the safety of the plant and radiological limitations which are set by possible normal and off-normal emissions which would not be expected.

However the public are also influenced by aesthetic and ecological con­siderations as well as by possible radiological consequences. It is therefore pertinent to make some reference to these considerations before leaving the subject of license application. To put these effects into context, the fast breeder will be compared to thermal reactors and fossil-fueled plants.

All components within the reactor system have natural temperature time constants which are included in the model equations (1.26)—(1.28). They are:

Fuel

rf=WfCf/Af (1.33)

For a graphite moderated thermal reactor with a Magnox fuel element, this time constant could be 5-10 sec; for a light water thermal system fueled with plates or small pins, the time constant is reduced to 1-5 sec; while for a fast reactor fuel pin, the time constant is 1 or 2 sec at the most. The fast reactor fuel therefore reacts very rapidly to power changes and the time which it takes to reach a higher temperature is reduced compared to the thermal systems.

Structural components

rs = macjha (1.34)

For a graphite moderated system, the graphite itself might have time con­stants in the range of 10 to 15 min; however, in the fast reactor almost all structure reacts in times of less than a few seconds.

Coolant

rc = L/vc (1-35)

The effective time constant here is the channel transit time which might be 0.5 sec for a light water thermal reactor but is about 0.1 sec for a sodium — cooled fast breeder.

Thus it can be seen that the fast reactor reacts to disturbances very much more rapidly than thermal systems in almost all respects. It is therefore less liable to some of the instabilities exhibited in the other systems, but it requires faster operating control and protective systems to ensure an accep­table response to reactivity and flow disturbances.

The other method of obtaining the probability of a fault tree output event is by statistical methods, which include simulation. The various logic gates are simulated on a computer, even to incorporating a repair time generator with a randomly generated fault sequence. The simulator then traces the mock use of the system for a large number of computer generated faults.

One severe disadvantage of this method of evaluation is the large number of trials required. The probabilities to be demonstrated in the fault tree may range to 10-10 and below. For verification of a probability of 10-e at 10% confidence 105,000 trials are required if no output fault occurs in the simulated trials. For 90% confidence 2,300,000 trials would be needed However if one fault occurs in the simulated trials, 530,000 and 3,900,000 trials would be needed, respectively, to obtain 10 and 90% confidence in the 10~6 result produced.

Then, for a computer taking 10 jusec for each increment of the fault tree, where the fault tree requires 104 increments per trial, a million trials would

take 28 hr of computer time. Such a calculation is prohibitively expensive. For this reason, new Monte Carlo methods are being produced to obtain simulated statistical probabilities.

Scramming a reactor causes thermal shocks to the system and there is need to minimize the number of unnecessary fast scrams. Section 3.4 details the place of scrams in safety analysis and the possibility of using adverse reactor signals for warnings and power setbacks rather than scrams. Here the discussion is concerned with scram participation in the dynamic analysis.

The following comprise the principal sodium reactions of interest for exposed sodium (5).

4Na + 3COa 2Na2C03 + C

2Na + 3CO Na2C02 + 2C

Na + H20 ->- NaOH + Ш2 Na + NaOH NaaO + Ш2

Na + 4H2 NaH

2Na + 402 —Na20

2Na + Oa Na2Oa

The final two reactions are discussed in Section 4.5, which is concerned with sodium fires. It suffices to say here that air has to be excluded from areas in which sodium is handled and where temperatures may be high. Both these reactions release considerable heat and dense oxide smoke.

Components which have been immersed in sodium are cleaned before inspection or repair. The cleaning is performed on the basis of either dissolv­ing the sodium or reacting with it before rinsing away the cleanser and the cleaning products. Cleaners are alcohol, ammonia, nitric acid or other acids such as hydrofluoric, acetone, and steam.

The only effective difference between explosive ejection and high pressure spray discharge is one of burning rate. Under given temperature conditions, the rate of reaction is a function which depends on the rate of sodium exposure, which in turn depends on the mass rate and particle size of the sodium discharge.

Experiments at Argonne National Laboratory (35) for explosive ejections of 400°F sodium in 3-10 msec have shown that the pressures produced are much less than theoretically possible (Fig. 4.29). It is clear that there are three zones of combustion:

(a) When only a small amount of sodium is present, the peroxide is formed an pressures are only moderate because the peroxide reaction has a lower heat release than the oxide reaction.

(b) When more sodium is present, more heat is produced as the oxide is produced, because the extra sodium reduces the peroxide.

(c) When even more sodium is present, it acts as a heat sink and it is very effective in reducing the overall pressure rise.

The rate of fallout of the reaction products is an important parameter in the pressure-time characteristic, since, in the experiments, over half the airborne reaction products had settled to the floor of the reaction vessel within one minute of the ejection.

The dose at any point may be calculated according to the following equa­tion

dose = (total inventory) (fraction released) BR J (%IQ) Q(t)DCF dt (5.2)

where BR is the breathing rate (3.47-10-4 m3/sec), DCF is the dose con­version factor (disintegrations/Ci), and xlQ is the meteorological dispersion factor.

The release rate is Q(t), taking leakage from the containment into account as well as plate-out, filtration, agglomeration, and decay removal mecha­nisms. Also included in Q{t) is allowance for any hold-up due to a double barrier containment, so it is a sum of a set of exponentials, each with a different removal decay time constant.

Q(0 = E Qoi ех-Р(—(/Т() (5.3)

і

The integral in Eq. (5.2) will be integrated over 2 hr for the site boundary dose and over 30 days for the low population zone boundary does. As the dose conversion factor (DCF) and Q(t) are both dependent on the isotope involved, the integral will also be integrated over the isotopes of interest (the iodines for the thyroid dose and all isotopes for the whole body dose).

For a double containment design in which leakages from the inner and outer barriers are typified by the inverse time constants A* and A2, Q(t) is given by

6(0 = AjA2C0[exp(—AjO — exp(— A2t)]/(A2 — Aj) (5.4)

where C0 is the inner containment fission product concentration.

The calculation of C0 is a critical part of the dose calculation.

Codes have been produced (10a, b) which, starting with an initial aerosol distribution and concentration within a containment volume, model and calculate the agglomeration and plate-out of the aerosol to derive its chang­ing concentration as a function of time (10c). The methods are also used in following the behavior of a sodium aerosol as a function of time. The assumption of agglomeration is critical because, for larger aerosol concen­trations, the rate of agglomeration increases and the ensuing concentration at any given time thereafter reaches a maximum. Thus the dose calculated as a function of the initial aerosol concentration saturates as the agglomera­tion removes more and more of the initial material. Thus C0 is obtained from these agglomeration calculations which are checked by experimental settling data.

Following the radial strain of the vessel, the chemical explosive analogy (23) would have us imagine that the pressure of the gases in the center of the core are relieved. Nevertheless, these pressures are still quite large and can accelerate the sodium above the core upward. The energy put into the sodium is equal to the work that is done on the hammer in moving it into contact with the vessel head.

For a 2-in. vessel with a diameter of 18 ft, an energy release of 1000 MW — sec would result in the following figures if Proctor’s SL-1 analysis were followed:

Initial chemical charge equivalent to

1000 MW-sec 524 lb TNT

Charge volume 5.52 ft3

Charge volume “chemical” pressures 56562 psia

Pressure after vessel strain of 8.7% 1203.8 psia

Pressure after sodium hammer upward movement 765.0 psia

Work done on the sodium hammer 0.204-108 ft-lb

Sodium final velocity 68.8 ft/sec

Under this sort of impact the vessel plug would suffer considerable strain. It would have a restraint system to prohibit it from becoming a missile

because, if it were restrained only by its weight (say 100 tons), it could rise

92.5 ft into the air. The rise height simply serves to emphasize the potential problem. Some designs provide for bolted-on heads, rub fit heads with friction restraint, or even beam restraint.

However, this momentum calculation is based upon a chemical explosion study interested in radial deformation. The extension of this analogy to the vertical direction may be illogical, since the mechanism is much slower than the shock damage to the vessel and the postulation of an imaginary gas bubble may be quite wrong. It is therefore necessary to study the heat transfer effects by which real energy can be transferred to the sodium hammer. Proctor’s SL-1 analysis (25) did not consider heat transfer and although the results of a momentum analysis were apparently in agreement with observed values, this may well have been fortuitous. The calculation of the upward motion of the water in the SL-1 accident analysis should be repeated with later heat transfer methods to clarify this point.

1.4.2.1 Spectrum

Changes in core configuration or core materials all have an effect on the neutron spectrum (Fig. 1.14). It is instructive to note the differences between a light water thermal system and the current LMFBR designs.

(a) Sodium is substituted for the water coolant. This decreases the mo­deration and hardens the spectrum, thus leading to less parasitic and non­parasitic absorption effectiveness (Table 1.4).

(b) Stainless steel cladding is used instead of Zircaloy. This can be done, since parasitic absorptions are less important in the harder spectrum and absorption in steel is not significant. The steel also allows the use of higher cladding temperatures with consequent improved efficiencies.

(c)

The fissile enrichment is increased from about 3 to 15%. More enrich­ment is required to cope with increased inelastic scatter due to the harder spectrum.

(d) The volumetric proportions of fuel to coolant and structure are re­tained at the same levels (about 35:45:20) approximately, although, if anything, the LMFBR is a tighter lattice.

Thus the LMFBR has a harder spectrum, almost entirely above 100 eV, whereas the light water thermal system has a considerable thermal peak (Fig. 1.14).

The breeding ratio calculated from a static neutron balance in a clean core is the ratio of fertile captures to fissile absorption:

where rj239 is the number of neutrons produced per neutron absorbed. In the hardest possible spectrum, rj23i is highest and thus the harder the spectrum the better the breeding ratio. Table 1.5 shows that breeding is impossible with plutonium in a thermal environment, whereas it is very good in a fast spectrum.

The reactivity inputs due to control rod malfunctions are limited both in the rate of addition and in the magnitude of the addition due to the design of the control rods themselves. It is usual to consider control rod malfunctions that add reactivity while the reactor is at power and the system is hot, and also during the start-up procedure.

2.3.2.1 At Power

When the system is hot, thermal feedbacks are immediately available, because any power change will produce a significant fuel temperature change.

The following trip signals would be available: (a) control rod drive sen­sors; (b) period meters if they are included in the system; (c) high flux; and

(d) high coolant outlet temperature eventually. Knowing the trip signals available and the delays between the monitored parameter reaching the trip value and the rods commencing to move into the core, it is possible to define a highest safe rate of addition and a largest acceptable step addition of reactivity. In a typical LMFBR a step addition of 60 cents may be accom­modated and rates of up to $ 3 or $ 4/sec could be acceptable. Naturally it is also possible to design the control system to do better than this if needed by shortening the delays in the electronics and accelerating the rods when inserting the shut-down absorbers.

Figures 2.11 and 2.12 show the effect of adding terminated ramps of reactivity to a typical LMFBR in terms of its power rise and increase in

temperatures. Figure 2.13 demonstrates the difference between adding re­activity as a terminated ramp and as a step, and it also shows the very significant improvement which arises from an increase in the Doppler coefficient. Such an analysis defines the need for protective system response times of a given value depending upon the control rod malfunctions which are possible: if the control accident could add reactivity at a rate of $ 2/sec, then the protective system would need to cut back reactivity following a high flux signal in about 0.25 sec for example.