Very qualitatively then, safety can be said to penalize the breeding ratio. If one designed for a large Doppler coefficient by having a softer spectrum with more resonances below 10 keV playing a significant role, then the breeding ratio would decrease.

Fortunately, however, other considerations also demand a softer spec­trum. The ceramic fuel required to increase the fuel lifetime, the coolant required to remove heat, the cladding for support and containment, and the fertile material in the core to reduce the reactivity swing during burn — up—all these degrade the spectrum and give rise to a reasonable Doppler coefficient anyway.

However, one would like to soften the spectrum a little more to increase the Doppler coefficient and gain an extra safety margin. This has to be done while keeping strict account of the resultant breeding ratio. If there were a particular need to enhance the Doppler feedback, then one could soften the spectrum and improve the Doppler coefficient by:

(a) Choosing a low molecular weight fuel with moderating atoms. Metal fuel gives the smallest Doppler coefficient and this is improved successively by changing to carbide, nitride, and then oxide fuels.

(b) Adding beryllium oxide to the core.

(c) Using boron and not tantalum rods for control, although then more boron would be required for the control required.

(d) Using a relatively low temperature and using the jT dependence of the Doppler coefficient. This solution is not available in a power producing system.

(e) Making sure that the plutonium and uranium isotopes are intimately mixed in the fuel. The point here is to keep the uranium that gives the negative contribution to the Doppler coefficient in close association with the plutonium where the neutrons are produced by fission and where, otherwise, only a positive Doppler coefficient would result. In fact, because the plutonium and uranium tend to migrate away from each other at high burn-ups, the Doppler tends to be delayed as a function of burn-up and could also be reduced if the separation were sufficient to cause spectrum changes.

The other coefficient of great interest in the sodium-cooled system is the sodium void coefficient. This too can be affected by the design.

Figure 1.15 shows the neutron worth (adjoint flux) as a function of energy plotted against the background of a fast spectrum. An increase in

the mean neutron energy clearly results in an increase in reactivity. This is the main effect of voiding the center of a sodium-cooled core where leakage has very little effect, so that design changes seek to alleviate this effect by flattening out the worth curve or by moving the mean neutron energy lower to a positive slope of the worth curve.

Several design choices will accomplish this effect:

(a) Add a nonvoidable moderator such as beryllium oxide.

(b) Use NaK rather than sodium in the first place. It is a poorer mod­erator and thus its removal makes less difference to the neutron energy (but the use of NaK would also reduce the Doppler coefficient).

(c) Use dilute fuel to soften the spectrum as for the Doppler effect above.

(d) Use clean 239Pu with no higher isotopes which have a greater worth in neutrons produced per fission.

(e) Use 233U as the fissile species and so flatten the worth curve above 1 MeV.

(f) Use a higher core pressure to maintain a higher vapor density after voiding with a consequent slightly softer spectrum.

(g) Increase the sodium inventory in the core to make the spectrum much softer initially.

Then one can also use design to increase the leakage effect:

(h) Use a pancake or modular core to increase the leakage.

(i) Power flatten and decrease the core size and so increase the effect of leakage. This would not help at the center where the power is of course always flat.

However voiding effects are not necessarily all important; time effects may be more important in particular accidents and, of course, the avoidance of accidents in the first place, by providing a reliable system, is the primary objective of safety engineering.

Here the system is not at significant temperature and so a rise in power produces no significant Doppler feedback to help to cut back the transient. Thus the power rise might progress through several decades in flux before significant feedback is induced. During this stage of the calculation only the neutron kinetics equations are needed.

The following trip signals are available: (a) control rod drive sensors;

(b) period meters if they are included; (c) low flux; (d) intermediate flux;

(e) high flux; and (f) high coolant temperatures eventually. Again, it is possible to define highest acceptable rates of reactivity addition if the pro­tective system is well defined.

Figures 2.14-2.16 show power, fuel temperatures, and reactivity feed-

backs involved following a continuous rod withdrawal initiated at low power. Two rod withdrawal rates are shown for a typical LMFBR. In both cases even the fourth of the above sequence of trip signals will maintain acceptable conditions within the fuel. Figure 2.16 very clearly shows how important in each case the Doppler reactivity feedback is in reducing the reactivity addition and curtailing the power rise. In the 50/sec addition case, no feedback occurs for 15 sec, but when it does occur, the power is almost immediately curtailed.

It now remains to put accidents to the plant in their respective probability ranges. Table 3.4 gives a prospective listing of accidents, but this list is by no means final for any given plant, each system having to be considered on its own merits. Such a list is prepared on the basis of engineering judg­ment, although in the future it is expected that a qualitative classification will be defensible.

Operational occurrences Reactivity control withdrawal error at power or start-up Random fuel failures

The above comments refer to an ideal single zone core, but present designs of sodium-cooled fast breeders comprise two zone cores in which the zones differ in enrichment; therefore, they have separate power and worth distri­butions. At the boundary between the zones there is a discontinuity in the

f See Nicholson (12a).

reactivity worth and in the power, so that fuel moving outward across the boundary between the zones experiences an increase in worth.

The discontinuity in power density produces an energy generation that is also discontinuous. A pressure discontinuity is produced that relieves itself as a compression wave inward and a rarefaction wave outward. Both waves can cause material to move inward near the interzone boundary.

Even in a homogeneous core there are also local areas in which flux and worth gradients do not coincide; this too can cause fuel material to implode rather than to disperse.

Calculations with the hydrodynamic code VENUS (12b), which includes a calculation of the reactivity effect of actual fuel movement rather than relying on a constant density material model for the expansion, have shown that the implosion effect is relatively unimportant. The inward implosion does not continue with ever increasing violence, but it rapidly explodes with a relatively small total energy production.

A calculation of the energy release, excluding consideration of the surface effects, may only be about 20% less than a calculation that includes all the surface or boundary effects.

An indication of a small change in reactor period during start-up was ignored by the operator because it occurred at 3.00 p. m. and he had previous­ly noticed that considerable line noise occurred at this time of the day from external power supplies, and he associated the signal on the recorder with this.

There was difficulty in determining the reactivity state of the system, or what 6k had been changed during the start-up, because a staggered rod movement system was used in order to stay on a steep reactivity slope. There was no automatic computing equipment to calculate the ensuing reactivity changes.

No high temperatures were observed to indicate that sodium boiling might be occurring. This may have been because flow through those failed assemblies was very small and insufficient to transport high temperature indications from the assembly. There were not sufficient thermocouples and they were not reliable enough to give confident indications of over heating. In addition, previously “hot” assemblies had been moved and were still apparently running a little hot.

The subassemblies were eminently blockable, having simple flat orifice inlets. The inlet design has now been changed to include cruciform pro­jections. The material to block the subassemblies was available. The last — minute design changes had not been properly documented, and diagnosis was difficult because the zirconium liners were not included on the master drawings.

There had been no acoustic “fingerprints” taken prior to the failure, and therefore acoustic detection methods could not be used for diagnosis. They could not be compared to normal steady-state and unfailed signals. There was inadequate operator monitoring analysis. However, this has now been remedied by including a computer in the diagnostic system although it is not yet integrated into the protective system.

These were the contributors to the accident which, in themselves, were all relatively innocuous but, in combination, could have a damaging po­tential. The value of such an incident is that the postmortem provides considerable input of data into safety engineering methods.

Another barrier mentioned at the beginning of this chapter was the physical barrier of the containment building. It is provided as the last barrier, before the exclusion distances finally separate the public from any products of fission within the fuel. The design basis of the containment building is to ensure that any leakage from the primary system following any accident is safely contained within the limits set by the AEC (Section 5.2). With this design basis certain criteria may be set for the containment building:

(a) Radiological leakage must comply with the terms of 10 CFR 20 during normal operation and with the terms 10 CFR 100 during accident conditions.

(b) This compliance must be achieved even in conditions arising from the design basis accident that is taken to be the worst accident to which the plant could ever be subjected (see Section 5.3.1).

(c) These restrictions on leakage also apply to all parts of the contain­ment such as air locks, penetrations, isolation valves, etc.

(d) The containment building should be capable of being tested through­
out life to demonstrate that it still complies with pressure and temperature conditional leakage rates required by radiological dose limits at the site boundaries.

Section 6.1.3 shows a more detailed set of containment criteria as an illustra­tion of how criteria may be developed for plant systems and components.

Fig. 5.5. Fault tree for the release of radioactivity to the atmosphere in excess of 10 CFR 100 limits.

50.1 Plant containment will be provided to limit radioactivity release to the environ­ment. This release will not exceed the limits described in 10 CFR 20 for normal opera­tions and for transient situations which might be expected to occur, and 10 CFR 100 for potential accidents which have a very low probability of occurrence.

50.2 This inner containment structure will be designed to withstand peak pressures and temperatures above those which could occur as a result of the design basis accident, taking into account the calculational uncertainties. The structure will be designed to P, psig excess pressure associated with a maximum temperature of 7i°F at the liner, but not necessarily simultaneously.

50.3 The design basis accident for the inner containment will be the worst credible core disruptive accident.

50.4 The reactor inner containment structure atmosphere will be at all times inerted with a maximum oxygen content of 2%. A sodium fire will be deemed to be incredible within the reactor containment structure.

50.5 The reactor inner containment structure will be designed to have a leakage rate of less than Lj v/0 per day+ even under the design peak pressures and temperatures.

50.6 The outer containment building will be designed to withstand peak pressures and temperatures above those which could occur as a result of its design basis accident, taking into account the calculational uncertainties. The building will be designed to P2 psig excess pressure associated with a surface temperature of T2°F.

50.7 The design basis sodium fire for this outer containment building will be that associated with a sodium pool in an open IXH vessel.

50.8 The outer containment building will be designed to have a leakage rate of less than L2 v/0 per day even under the design peak pressures and temperatures.

50.9 The design will preclude open interconnection between the atmosphere of the inner containment structure and the atmosphere of the outer containment building unless the sodium temperature in the primary circuit has been reduced to below 300°F.

50.10 Primary coolant components of the IHXs and pumps will be drained of primary coolant before the components are removed to maintenance areas.

50.11 The design of both containment buildings will accommodate earthquake load­ings and other environmental loadings that the site might make necessary, in addition to normal static loads.

The design pressures and temperatures P1,P2,T1, T2 and leakages Lx, L2 are set with suitable margins from the safety evaluation of certain design basis accidents as outlined in Section 5.4.

Within these still fairly wide rules the designers’ codes and standards must set the methods and define the numerical limitations within which he works to meet the criteria. There may be a number of design methods of meeting the leakage limitations set by 50.5 for example, even at the condi­tions specified in 50.2 to restrict the choice. Ultimately there are other criteria that also come into play in the final choice of solution, the most important being the cost. The designer has many masters to satisfy, and he uses the criteria as guide lines in his work.

The behavior of average neutrons is governed by certain probability functions called cross sections. These define the probabilities of absorption, scattering, and of fission within the given system.

Assuming an initial flux of thermal neutrons <f> in a thermal reactor core we can calculate the multiplication of neutrons as follows:

Thermal flux ф

Number absorbed into the fuel ZfUel<^/27a = /ф

Number producing fission fф ^tmon/^ш

Number of fast neutrons pro­duced by fission rj f ф

where rj is vlfWon/^fueI

Number of neutrons after fast fission enhancement єг]/ф

Now in the thermal system the neutrons slow down through the resonance absorption region:

Number which escape resonance capture РЩ/Ф = A:,*,ф

Number which escape leakage during slowing down к^ф exp(—B2t)

Having now arrived at thermal energies the neutrons diffuse until they again have a chance to be absorbed in fuel or are nonproductively absorbed in structure or poison material.

Number which escape leakage during diffusion к^ф exp(—B2r)/(l + ZAS2)

Final thermal flux, ке№ф k00^[exp(—BH)/(l + ZAS2)]

(1.1)

where keff is called the neutron multiplication factor. The system is now critical if ketf = 1.0 since the original neutron flux ф is not diminished after an average generation time. If keff is less than one, the neutron population dies away and the system is subcritical, while if k,,ff is greater than one, the system is supercritical and the population continues to grow.

In fast reactors however there is little slowing down so there is very little resonance capture and p is close to unity and there is little leakage at this stage. The fast fission enhancement factor є is of course not a useful con­cept when we are only concerned with fast neutrons. Thus for a fast system

k^vfP/Q + L2B2) (1.2)

Although keff being unity implies criticality in the steady state, a fraction
of the neutrons, delayed neutrons, only arise some time later. Thus on the

short term basis only fceff(l — /3) are immediately available. Thus the prompt criticality condition is fceff(l — /3) = 1.0.

When *efl(l — /3) > 1.0, the delayed neutrons have an insignificant effect since the system is critical on prompt neutrons alone. However, if — /3) < 1.0 and keff = 1.0, then the system is not critical until the delayed neutrons are produced; the delayed neutrons allow the control of the eventually critical system.

The cross sections 2fueI, 27flssitm, 2a, and the resonance escape probability p are all dependent on temperature. The fuel and other system temperatures are involved and their effect is given by temperature coefficients of reactivity a,- where

*etr = кет + Z ai(Ti — Tio)

І

for each temperature 7). Section 1.4 will refer to these effects in detail.

A BWR is an interesting basis for any discussion on instability because so many different modes of instability have been identified. In practice, any instability would actually be a combination of two or more of the following:

a. Simple voidage coupling. This has already been referred to as oscillatory instability in Section 1.5.3.1. Reactivity, power, and voidage rise and, in combination with suitable delays, a reactivity decrease follows; if the delays are unfavorable, the reactivity may increase. A typical frequency would be in the range of 1 to 5 Hz.

b. Hydraulic instability,+ This is nonnuclear and oscillatory with the following sequence of interactions. Following a disturbance to the inlet velocity (say an increase), the boiling boundary rises and the pump head thus required increases. Again, if delays in the circuits are unfavorable, then the resulting decrease in inlet velocity due to pumping inefficiency would come too late. Oscillations would occur with a frequency of about 1 Hz.

c. Pressure variations. A static instability, independent of time delays, was thought to exist. A pressure rise resulting in an inlet enthalpy decrease and thus a boiling boundary rise, would result in a reactivity, a power and thus a voidage increase, and then a pressure rise. The frequency would be of the order of 0.1 Hz. However, this effect is no longer important relative to the others.

d. Ship’s motion. This would perhaps result in instability with a natural circulation BWR because the circulation head would be increased with an upward motion of the ship and vice versa. A 50% oscillation in apparent gravity could result in 100% oscillations in power and 10% in temperatures with a frequency of 0.1 Hz.

e. Parallel channel instability.+ Such an instability would be exhibited between two or more channels having the same pressure difference across them and with the same common inlet and outlet headers so that flow can be divided between them in different fractions. The mass flow can oscillate between them, resulting in different two-phase pressure drops and voidages. It can only occur for exit qualities greater than 20-30%.

Sodium-cooled reactor systems are not subject to these types of instability and, indeed, a sodium-cooled system does appear to have excellent stability. However during accident conditions, unstable conditions might suddenly result. Section 4.4 will refer to sodium chugging after assembly failure, which is a form of static instability.

Stability studies are required to demonstrate that the particular system will be stable under normal and abnormal conditions. Such studies give information on such design features as the necessity for channel inlet gagging (in a BWR to make the total channel pressure drop less voidage dependent), pressure relief systems, or the avoidance of critical time constants in the circuit. Pump characteristics would also be tested for their satisfactory behavior following flow disturbances.

* See Davies and Potter (13).

If it were supposed that a given type of instability might occur in the system as a result of a change in a particular variable Хг, and that a design modification in another parameter X2 could correct the situation, then the following method of assessing this instability could be used:

(a) Set up a mathematical simulation of the system to include the full dependence of both the system variable Хг and the parameter X2. (Xt may be the power-to-flow ratio and the parameter X2 may be a given feedback coefficient.)

(b) Disturb the model by a “kick” in a significant variable (say, pressure or flow) and observe the dynamic results. Figure 2.25 shows what the results might indicate.

(c) Calculate a damping factor from successive peaks of the transient.

damping factor A = (x2 — Xj)-1 In(уг/у2) (2.8)

where Уі and are defined in Fig. 2.26.

(d) Vary sensitive parameters for their effect on the damping factor; this sensitivity study would include both the system variable Хг and the design parameter X2. Figure 2.27 shows the result of such a sensitivity study. [The damping factor is a system characteristic and does not depend on the variable used for its calculation (mass flow shown in Fig. 2.25).]

(e) Invoke the design parameter needed to achieve the damping factor required. In Fig. 2.27, damping factors of 2 and above are acceptable while

those below about 1.5 show poor damping, neutral stability without damp­ing, and finally instability. Thus, if (say the power-to-flow ratio) can be 1 in this system, then X2 (the feedback coefficient) must be designed to be at least B.

This method can achieve very rapid results if an analog computation is used. Digital methods, which may be more comprehensive, can then be used to check the result.