Having defined severity ranges and an accident likelihood classification, the scales of a graph have been established onto which accidents and their consequences can in principle be plotted. There will be a whole galaxy of points but because the plant has been well designed, the points will tend to fall towards the origin. The expected faults will contribute only minor con­sequences whereas severe consequences could come from only the very low probability accidents. This good design is supported by design criteria which set the shape of the curve which envelops all the plotted occurrences (Fig. 3.3). The following criteria will define the curve shown in the figure.

(a) No operational occurrence in the system shall result in consequences worse than the no damage range. Thus point A must lie below point В (0j).

(b) No unlikely fault in the system shall result in consequences worse than those in the moderate damage range. Thus point C must lie below point D (02, x).

(c) The unexpected fault with the worst consequences shall be designated the design basis accident for the system. Thus point E sets the upper limit of the gross damage range.

(d) Incredible faults are not considered in the safety evaluation beyond showing them to be incredible according to the definition. The design does not accept their existence.

The original mathematical model for the energy release following a re­activity addition was due to Bethe and Tait (8); although this model has been subsequently refined by a number of other workers (9,10) and the calculational methods involving computers have improved, the basic prin­ciple of the model remains the same.

4.3.3.1 Basic Calculational Procedure

Figure 4.4 shows that the reactivity addition provides an increase in flux 9о and, therefore, in energy E, which is contained only by negative feedbacks from the Doppler coefficient and eventually from a dispersion

of the core. The dispersion of the core is achieved because the high energy produced melts the fuel and the high internal pressures produced push the core aside into a subcritical configuration. The calculation terminates at this point because, in this model, there is no mechanism for recompacting the fuel material.

The equations which describe this model are the following.

k(t) = k0 + A:input(t) + kj}(t) + &disp(0 (4-15)

d<pldt = [*(0 -1-і?] <p/l* + S’ (4.16)

E(r, t) = Ґ <p dt N{r) (4.17)

j о

MO = *d(1 — {EJ[E0 + Д0]}1/2) (4.18)

f (у — 1 )q[E(r, t) — Q*] for E > Q* (4.19)

P(r, t) =

І0 for E<Q* (4.20)

d2u(r, t)/dt2 = —(1 Iq) grad p(r, t) (4.21)

*dlsp(0 = I u(r, t) grad D{r) d3r (4.22)

The effective multiplication (4.15) is a sum of the initial value, added reactivity diminished by Doppler kB and dispersion feedbacks kdlsp. In the neutron kinetic Eq. (4.16) the delayed neutron contribution S is assumed not to vary during the excursion. The power distribution N(r) which defines the production of energy following the increase in flux (4.17) is assumed to remain constant in time.

Doppler feedback [Eq. (4.18)] is assumed to be dependent on the inverse of the square root of the temperature and therefore the energy of the fuel. The initial energy state of the system is denoted by E0. The equation of state of the fuel [Eqs. (4.19) and (4.20)] defines the pressures p that are produced by the energy of the system E, although these pressures are not presumed to increase until the core is fully compacted and the fuel expands to fill the coolant volume. This initial expansion corresponds to an offset in energy Q*. Once the pressures start to increase then a displacement of the fuel и occurs [Eq. (4.21)]. This equation is a normal hydrodynamic description of a fluid system. As in the equation of state, the density is assumed constant rather than taking account of a reduction of density due to the dispersion. This assumption of constant density means that the propagation of and reflection of pressure waves is ignored. It is a good assumption, as the fuel during dispersion does not expand much (less than 2%). The feedback reactivity due to the dispersion kdisp is calculated by knowing the reactivity change which would occur if a unit volume of the homogenized core at r were to be removed from the core. This value is called the reactivity worth function D{r). Therefore, u(r, t) grad D(r) is the reactivity change involved in moving material from r to r + u(r, t), and the feedback reactivity [Eq. (4.22)] is the volume integration of such changes.

Both the reactivity worth distribution and the power distribution, D{r) and N(r), respectively, are here assumed independent of time, ignoring the fact that these distributions will change as core materials move. Thus the reactivity changes are calculated from first-order perturbation theory. The assumptions are good for violent dispersions, as the volumetric expansions required to compensate for reactivity added above criticality may only be about 2 or 3%.

Using these equations, the total energy produced from this power burst may be calculated, as well as the residual pressures and core displacement. These values must then be interpreted in terms of the damage that could be done external to the core following the explosion. This subject is treated in Section 4.3.4; but first let us consider the sensitive parameters in the above set of equations and see what accuracy might be attached to the energy calculations.

4.3.3.2 Sensitive Parameters

The model above requires that the power distribution N(r) and worth distribution D(r) be provided as input functions. It is possible to use more exact diffusion equations to calculate these functions if a lattice model of the reactor system or core is used.

Thus Eq. (4.23) may be written for each mesh module, where the leakage V2(p may be expanded in finite difference form depending upon the coordi­nate system chosen for the model.

I* dcp/dt =[kJ-p)-Yp + D V2<p (4.23)

The most sensitive parameters in the calculation of the energy release are the following:

(a) Equation of state. Figure 4.5 shows typical energy release calculation results that vary by about a decade depending on which equation of state is used. Available data is limited and has been obtained in temperature and

pressure conditions well below those which are attained in these hypothetical accident conditions. Thus the extrapolation from available data to the region of interest is large. Not only does the available data vary, but the interpretations of this data also vary.

Figure 4.6 shows a number of equations of state in use at this present time for uranium oxide (11a, b). The most important version appears to

be the fit to Menzies data {11a) from the Argonne National Laboratory:

p = 10-e exp[—4.34 In 7- (76800/7) + 69.979] (4.24)

in which the temperature 7 is given in degrees Kelvin and the pressure p is defined in atmospheres.

In general, it would be preferable to have larger pressures for a given energy, so that as the energy increased the increased pressures would disperse the core more rapidly and thus lower the total energy release.

(b) Reactivity addition rate. Naturally, the faster the reactivity is added, the more the power rises and for a given Doppler feedback the energy release is generally higher. There are exceptions to this statement that depend on the fact that certain Doppler feedback values may be more effective at curtailing one power rise rate than another. This effect is detailed below.

Figure 4.7 shows that the reactivity rate makes a large difference in the energy production when the energy release is high and only a small dif­ference when the energy release is low.

(c) Doppler coefficient. Figure 4.8 illustrates the power transient for a given reactivity addition rate for very different Doppler coefficient values. In the case of the smaller Doppler coefficients, power values are higher because of the smaller feedback, and dispersion shuts the system down before the Doppler coefficient can really terminate the prompt power rise.

When a larger Doppler coefficient is involved, the power is generally held at lower levels and the power rise is turned over on Doppler feedback alone. However, a second power rise occurs as the reactivity addition rate still proceeds and dispersion later shuts the system down. Despite the fact that in the case of the larger Doppler coefficient power values are lower, the integrated energy release may be higher. From the cyclic occurrence of this paradoxical result the graph of energy release against Doppler coefficient obtains its oscillatory behavior.

Thus although, in general, a higher Doppler coefficient results in a lower energy release, for small changes in Doppler coefficient this may not be true. The Doppler coefficient makes a good deal of difference for small negative values, but after a value of approximately —15-10-4 TdkjdT very little

extra alleviation is obtained. Figure 4.9 presents typical results for an oxide fueled LMFBR.

A short delay time in the action of the Doppler feedback could affect the size of the energy release. Two such delays that have been postulated (11c), were the slowing-down time for fast prompt neutrons to attain the energies (about 1 keV) at which the Doppler feedback is generated, and the heat transfer time to attain the asymptotic temperature distribution between the U02 which is responsible for the Doppler feedback and the Pu02 where most of the heat is generated.

Analysis however showed that, to be significant in a superprompt critical excursion resulting from a $ 100/sec addition rate, the delays should be greater than approximately 8 jusec. The first of the above delays in the slowing of neutrons to about 1 keV, is calculate to be 2 jusec and is there­fore not significant. The second delay in Pu02 to U02 heat transfer amounts to between 50 and 130 /isec for 40-60 ц grain sizes, and the delay should therefore be considered in evaluating the Doppler feedback. However the effect of such delays is not likely to be an overriding consideration in the energy release calculation.

(d) Power distribution and reactivity worth distribution. Figure 4.10 pre­sents results as a function of the distributions of power and worth. In both cases the steeper the distribution in a single zone core, the smaller the energy release, although this effect is not so marked as the effect of the previous parameters.

(e) The neutron lifetime. The energy release varies with the value of the neutron lifetime but it is not a marked effect. It may be positive or negative.

In fact, the uncertainties associates with the above parameters in the calculation of the total energy release may be secondary to the uncertainties associated with the calculation of the proportion of this work that is avail­able to do damage to the surrounding structure. This point is discussed in Section 4.3.4.

a. Rod incident. Figure 4.36 shows how the control rods were operated through bellows seals used to prevent sodium vapor from reaching the rod shaft. However overpressure experiments to test the reactivity effects of pressure caused a bellows failure, and the sodium rose into the rod drive — shaft fitting. The sodium froze and caused the rod to stick immovably.

b.
IXH flow distribution. No flow tests had been made on the heat ex­changer because it was felt that the sodium, being such a good conductor of heat, would solve in itself any problems of maldistribution of flow.

However, in fact, the flow was so badly maldistributed that the heat transfer was 40% of that expected.

Q = hA6T (4.53)

Thus as Eq. (4.53) shows, the temperature difference (6T) for a given heat flux (Q) had to be larger than design to accommodate for this failing in hA. The moral to be learned is that sodium is an ordinary working fluid and needs flow testing for any heat transfer use.

c. Check valves. Operation of the check valves gave sodium hammer problems which were solved by the incorporation of dashpots. These now allow up to 6% backflow, which is twice the previous value.

d. Steam generator problems. The steam generators had problems even before fabrication. It is a once-through design with 1200 tubes. Of the 3600 crolloy tubes delivered, one alone turned out to be carbon steel although it was stamped crolloy. This was a quality assurance problem.

During operation one tube failed and others subsequently failed due to the reaction products. The relief system worked to relieve the high pressures in the sodium side and the damaged tubes were plugged, since about 16% spare tubes are available in the design. The monitoring of the hydrogen produced by the reaction was doubtful.

Figure 4.37 shows a diagrammatic cross section of one steam generator unit. Instability problems were encountered in which the top cool stagnant sodium in the central column would suddenly reverse position with the hot lower sodium. This would vary the sodium outlet temperature downward, and the automatic control reacted by cutting back the feedwater. This problem was solved by putting a lag into the control system, so that al­though the instability of the central column of sodium remains, the control system does not react adversely to it, but reacts only after equilibrium has been reached again and no control function is required.

e. Refueling problems. The shielded cask car for transferring fuel from the lazy Susan to storage and vice versa caused a number of problems. It could handle 11 assemblies and therefore it had shielding for 11 and was thus very heavy. In addition it had cooling facilities for 11 assemblies; it was self-driven; and it had argon, water, and steam lines attached. It could transfer from a core lazy Susan to a steam cleaning station, to a decay pool, or to a fresh pool port, and it was therefore far too complicated for safety. It was replaced by a simple single-assembly, single-operation machine, because it had been so troublesome. It is worth noting that the French had the same experience (Section 4.6.3).

f. Whole subassembly blockage.+ A last-minute change in the design caused the addition of zirconium liners to the flow distribution cone in the reactor inlet plenum. This liner was in three sections, and two subsequently came adrift during operation when the spot-welded screws broke off. The liner sections were twisted and were forced up under the core by the coolant flow. This may have happened once toward the periphery of the core without more than a local overheating being noticed, but then, as the reactor was being brought to power, two fuel assemblies failed from overheating. This was due to the liners which had blocked the inlets to those subassemblies.

The two fuel subassemblies suffered considerable melting. See Section

4.4.4.1 for the sequence of failure that was subsequently reconstructed by analysis. It is worth now surveying the factors contributing to this accident.

Sewage. All sewage must receive primary and secondary treatment prior to dumping into the North River.

Volatile Wastes (Radioactive and Toxic Gas). Maximum permissible concentrations or dosages shall be as prescribed in:

(a) AEC Standards for Protection Against Radiation, as published in the Federal Register (24 F. R. 8595, September 1960 and as amended in 25 F. R. 13952, December 30, 1960).

(b) National Bureau of Standards Handbook 69, Maximum Permissible Body Burdens and Maximum Permissible Concentration of Radionuclides in Air and in Water for Occupational Exposure.

In the event of conflict between items (a) and (b) above, item (a) shall govern.

Liquid Wastes. Maximum permissible activity of water entering the North River shall be as prescribed in the references listed under “Volatile Wastes” above. The activity level of the liquid effluent shall be measured as it leaves the plant. No credit for dilution in the North River will be assumed.

Solid Wastes. Storage on site for decay will be permissible but no ultimate disposal on site will be made.

Labor

Availability of Local Labor Force. Labor availability for plant construction and opera­tion at this site is adequate, although the distance of 35 miles to the nearest large center

of population requires an additional transportation allowance in the wage rates for all classes of construction labor.

Labor Productivity. Assume productivity will be equivalent to western Massachusetts.

Labor Rates. Assume craft labor rates to be in accordance with those shown by current Statistics of United States Bureau of Labor for a western Massachusetts site.

Work Week. The construction work week will be based on a 40-hour week with no regularly scheduled overtime.

Other Site Information

The Hypothetical Site is located within the general distribution area of the Central Edison System. The cost of the step-up transformer, transmission line, and all related structures and substation equipment, required to connect the power plant to the system, will not be included in the estimates of plant construction cost. Based on projections of load growth, the system will absorb the entire station output as it becomes available.

Qualified machine shops are available in Middletown so that only minimum shop facilities are necessary at the plant.

All Hypothetical Site data not provided in these ground rules shall be consistent with a western Massachusetts plant site, provided that they do not conflict with other informa­tion contained in these ground rules.

General design criteria are design rules (6) that could be expanded to include codes and standards as specific criteria. Chapter 3 has already dealt with criteria in some detail.

To show how specific criteria guide the designer without telling him either how to do the analysis or what design limits to use (apart from the ultimate ones), consider General Criterion 50 (6) rewritten very slightly to apply to fast reactor systems.

50: Containment Design Basis (for Fast Reactors)

The reactor containment structure, including access openings, penetrations, and con­tainment heat removal systems shall be designed so that the containment structure and its internal components can accommodate, without exceeding the design leakage rate and with sufficient margin, the calculated pressure and temperature conditions resulting from the maximum credible accidental energy release. This margin shall reflect conside­rations of (1) the effects of potential energy sources which have not been included in the determination of peak conditions, such as the energy in steam generators and energy from chemical reactions which may result from degraded emergency cooling function­ing, (2) the limited experience and experimental data available for defining accident phenomena and containment responses, and (3) the conservatism of the calculational model and input parameters.

The corresponding specific criteria for a two-compartment containment building might be:

The heart of the kinetics model is the representation of the neutron be­havior. This behavior is very similar, whether the neutrons concerned are at thermal energy or whether they are, on the average, fast (i. e., more energetic). Most university courses expand nuclear reactor theory from the point of view of thermal reactor systems and therefore the following text, for the convenience of its readers, does the same. The points at which the fast reactor differs from the thermal system are noted and this emphasizes where and how fast reactor systems differ from their thermal counterparts.

Figure 1.22 shows a reactivity addition to a PWR (12). The power rise resulting from the reactivity addition is curtailed by a reactor trip following a detection of excess mean channel temperature rise. This results in an immediate increase in the burn-out margin and safety for the PWR.

However, real protective systems cannot avoid delays and therefore, following the trip signal, a delay would result before the control rods are inserted. During this delay the burn-out margin would continue to decrease. The extrapolated curve shows that fuel burn-out would occur within 1.5 sec. This then is the allowable delay for this protective function. Such a calcula­tion then has control implications and possible design implications for the control rods and the core.

A similar transient in the LMFBR would have very similar design motives. The only differences would be the result of smaller fuel time constants and the fact that failure would be marked by fuel melting and excessive cladding strain rather than burn-out (see Sections 2.2-2.4).

1.5.3 Stability

The stability of a system can be assessed using a transfer function approach to give gain and phase margins to safety. These margins, being functions of system parameters, will have design implications. Section 2.5 deals with the assessment of stability in detail. Here we are concerned with instability time constants and with modes of instability as exhibited by a boiling water reactor (BWR).

By preparing a model of the system and by perturbing this simulation with sample disturbances, it is possible to get a limited idea of the system stability. The weakness of this method is that it is impossible to cover all cases of perturbations and initial states (upon which feedbacks depend) and thus only a partial assessment is possible. The method therefore de­mands a critical choice of the power levels and instability modes and even the system components that might be of direct interest. A good deal of experience on the part of the evaluator is necessary.

The strength of the simulation technique is that quicker information is available about the effect of various delays, pressure drops and design changes if an analog simulation is used. For example, it is much easier to include a bypass line in an analog patch than it is in a transfer function analysis.

Redundancy in valves that are normally open is provided by valves in series, and in valves that are normally closed by valves in parallel. A valve which has no safety function is not required to be redundant even though it provides an extra degree of safety.

Redundancy in power supplies is provided by parallel supplies: onsite power is backed by offsite power, by diesel generators and ultimately by battery power if needed.

Separation in protection systems includes a physical separation of cable lines to avoid jointly disabling cables by electrical-short-induced cable fires and other hazards. Additional components are sometimes required because the shared component might be put out of action by a fault in one of the independent lines. This is expressed in Criteria 6 and 21.

In addition the single-failure criterion will force safety features to have redundant active components as well as protection against the passive failure. However, the passive failure may not be needed if the mechanical system is of “unusually high quality.” This implies a degree of overdesign and thus a low-pressure sodium system may be able to qualify whereas a high — pressure steam loop would find it difficult to qualify for exemption from the subsequent passive failure accident.

It is important to know whether the heat transfer rates to the sodium are high and can cause rapid sodium vaporization and high channel pres­sures. These high heat transfer rates can arise if the fuel is well dispersed in fine particles.

Experiments in Grenoble by the CEA and at Argonne National Labora­tory (22, 23a) have measured sphere sizes and fragmentation following the injection of molten U02 into sodium. Table 4.5 shows the Grenoble data which agrees well with the ANL data.

Sphere sizes of 0.05 and 0.003-in. diameter were measured, and correlated to Weber numbers of 10-20 fairly well for the conditions of the experiment where the Weber number is defined in Eq. (4.35).

Nw = DQV2/og (4.35)

Assuming a Weber number of 20 for a maximum sized particle, in reactor flow rates of 25 ft/sec then the maximum size of particle is 0.009 in. in diameter.

Using the heat transfer correlation for small particles given in Eq. (4.36) or (4.37), the heat transfer rates possible may be calculated for particles of this size

Na = fc(Pr/?e)1/2 (4.36)

Au = 2 + 0.39 (PTRe)1/2 (4.37)

Thus heat transfer rates between 24,000 and 210,000 Btu/hr-ft2-°F are to be expected.

As the fuel emerges from the ruptured pin, the path can be calculated by assuming a drag coefficient for the given particle size and Reynolds number of interest. Particles of 0.009-in. diameter at 32 ft/sec excess velocity above that of the sodium stream are decelerated in a few milliseconds, and they move upward with the sodium and at the same time the heat transfer rate decreases as the relative velocity decreases. The relative velocity can decrease to 2 ft/sec in 1 msec.

Suppose however that the fuel manages to strike the opposite pin as a jet. Thermal calculations (23b) in which the jet effectively heats up the adjacent cladding show that the fuel pin is likely to fail within 10 msec depending on the angle of contact of the jet with the adjacent pin. These calculations assume that the cooling during transit across the coolant subchannel is small and it assumes a fairly small fuel viscosity (1 cP). If the viscosity is higher, then the Reynolds number and heat transfer rates would decrease and the situation would not be so severe. On the other hand the channel may be rapidly voided, so that the jet exists within the voided channel.

The foregoing considerations of fuel behavior are small sections of a larger picture which relate to each other. The next section considers the voiding of the coolant within the subchannel and then all these separate considerations are put together into a single description of possible pin­to-pin failure propagation modes. This final pieced-together picture is of course very dependent on the starting conditions and on the case being studied. We are here considering fairly typical LMFBR conditions for the first generation of power plants and therefore the final illustration should be generally applicable.