Category Archives: Fast Reactor Safety. (Nuclear science. and technology)

General Safety Criteria

3.2.1 AEC Criteria

In July 1967, the AEC published a set of 70 design criteria for use by nuclear power plant designers. The AEC had the following objectives in doing this: (a) the provision of a record of the criteria which had already been used by designers to that date; (b) the provision of a standard set of criteria so that all designers could follow the same rules. This would make licensing somewhat easier; and (c) the provision of a safety check list to ensure that all safety considerations would be covered before a license was issued.

The criteria were published as “General Design Criteria for Nuclear Power Plant Construction Permits” (8). These criteria were reduced to 58, rewritten and republished in February 1971 (9). They are split into six general categories.

Criteria

I. Overall plant requirements 1-6

II. Protection by multiple fission product barriers 10-19

III. Protection and reactivity control systems 20-29

IV. Fluid systems 30-46

V. Reactor containment 50-57

VI. Fuel and radioactivity control 60-64

The criteria certainly fulfilled the objectives above but they had certain disadvantages for fast reactor designers.

(a) The criteria were too vague, partly because of the state-of-the-art and partly because of a desire not to hamper the designer in his design choices.

(b) They apply to the nuclear reactor of the day: the light water reactor (LWR) system. They do not necessarily apply to fast systems, although many of the criteria are general enough to include all reactor systems.

(c) They were almost law and therefore difficult to change. Fast reactor designers have undoubtedly obtained relevant criteria of their own, but no AEC criteria specifically for fast reactors have yet been prepared. However the American Nuclear Society is moving to prepare such criteria through one of its standards subcommittees.

Isentropic Expansion

Figure 4.13 shows the state of the system in its initial state of compression at point A. It has an internal energy of a Btu/lb. If it now undergoes an isentropic expansion all the way to 1 atm, then it finally arrives at a state with an internal energy of у Btu/lb.

Thus, in expanding, work has been done by the core on the surrounding material. From the first law of thermodynamics

work done dW = —dU = (a — y) (4.26)

image184

Internal energy

Fig. 4.13. Calculation of available work energy: expansion of fuel from high pressure condition during the core disruptive accident; Kr—reduced volume, ST—reduced entropy.

This work is available to do damage to the structure around the core. The rest of the energy (y Btu/lb) remains in the fuel material to be released on a somewhat slower basis to the surrounding sodium through heat conduction. This residual heat forms a large proportion of the total energy release and following transfer to the sodium, which may vaporize, further damage can be done.

The calculation of the exact isentropic expansion process can be performed if generalized tables are available. However, this is not so for uranium oxide.

Hicks and Menzies derived an approximate analytical method (9):

work = U,— U,-U, In (UJUj) (4.27)

The available work is the change in internal energy minus the unavailable work during the irreversible change from state 1 to state 2.

work = U, — 17,— unavailable work during

the energy generation phase (4.28)

= 17,-17,- — S,) (4.29)

= U,-U,-T, ldQ! T (4.30)

Assuming that dQ = cv dT for a constant volume process, but that for a liquid cv is approximately cp and then using an average value of cp, Eq. (4.34) becomes:

work = U, — U, — cpT, ln(7’2/7’1) (4.31)

This expression is similar (17) to the Hicks and Menzies version in [Eq. (4.27)] but it does not assume that cpT, = U,. Actually U, = cp(T,— Tm) where Tm is the base temperature chosen as the fuel-melting temperature.

EBR-I Melt-Down (1954)

This melt-down occurred when doing reactivity addition runs for period tests at low flow. The order to scram was misunderstood and a slow shut­down initiated rather than the fast scram. The whole core melted down in a few seconds. The accident was of course not directly due to the above instability considerations (43).

The detailed sequence of events for this accident was given in Section 4.4.4.1.

Design

There are many possible alternative types of containment building. Some of the suggested varieties (14b) include:

(a) Underground containment, in which excavation alone may cost millions of dollars.

(b) Hemispherical containment with a wall and footing below grade.

(c) A prestressed concrete containment designed with compressive stresses of over 2000 psig at pouring, which can give a leakage rate below

1%

(d) Conventional wall and roof panels for which leakage rates of less than 1% can be achieved with differential pressures of up to 0.5 psig for metal panels and 5 psig for a concrete building.

(e) Designs which include internal or external expansion volumes, such as in the case of the CP-5 at ANL which had a hold-up volume with a floating neoprene diaphragm to allow a hold-up of any fission gas release for up to 20-30 days.

As the LMFBR system contains plutonium, any gross fuel aerosol release to the containment system may necessitate leakage dilution factor of 10~3 or 10-4. Such values cannot be achieved with a single barrier because such values cannot be tested. However it can be done with two enclosure buildings

Fig. 5.6. Cross section of the EBR-II containment. [Courtesy of the Argonne National Laboratory (14b). Identification key:

1. 5-ton crane

11.

Reactor vessel cover

2. 75-ton crane

12.

Neutron shield

3. Crane bridge

13.

Basement

4. Concrete missile shield

14.

Sodium purification cell

5. Gripper-hold-down mech.

15.

Na-to-Na heat exchanger

6. Control rod drives

16.

Reactor

7. Storage rack drive

17.

Subassembly storage rack

8. Rotating plugs

18.

Concrete biological shielding

9. Blast shield

19.

Subbasement

10. Primary coolant auxiliary pump

20.

Primary tank

with a combined leakage of the right value, say 2 and 0.5 vol%/day or 10 and 0.1 vol%/day. Thus, for plutonium containment, two barriers are usually required although one containment volume may be merely a rather leaky aerosol settling volume.

There are many other containment design requirements. The building must house the plant with convenience and layout is of importance. The design must account for lateral stability, withstand windload, snow and roof loads, and lightning loads, and it must allow these loads to be trans­mitted to the foundations. It must accommodate internal mechanical and heating loads, cope with penetrations, and be designed to withstand seismic loads.

The windload, for example, is calculated according to the equation

F = PAS = Cdou2AJ2g (5.9)

where q is the air density; и is the wind velocity; g is the acceleration due to gravity; As is the exposed surface area; P is the wind pressure; F is the wind force; and Q is a shape factor.

The internal loads must also include those which arise from reactor transients, and particular attention must be paid to the design of air locks and various penetrations to achieve the leakage rates required.

Figure 5.6 shows the EBR-II containment building and its two barriers; the inner containment barrier comprising the reactor vessel and vaults that withstand an internal pressure of 75 psig, and the outer containment shell of steel in the form of a cylinder that would withstand at least 24 psig with an overall leakage rate of 0.25 wt%/day. Similar designs modified to include a refueling cell have been suggested for the large 1000 MWe LMFBR plants.

Privately Endowed Laboratories

Certain other laboratories also deeply concerned with fast reactor tech­nology development and safety are the Pacific Northwest Laboratory (PNL), run by the Battelle Memorial Institute; the Liquid Metal Engi­neering Center (LMEC), run by Atomics International Division of North American Rockwell, Inc.; and the Hanford Engineering Development Lab­oratory (HEDL), run by Westinghouse Electric Corporation.

These laboratories are also subject to AEC contracts and under commit­ment to the AEC for certain projects. HEDL’s Westinghouse management is now engaged in bringing the FFTF facility into being, while LMEC provides sodium technology information and acts as a clearing house for failure data.

In-Hour Equation*

If we assume the separability of time and space dependence in the flux, for a step change of dk at t = 0, the flux and the precursor concentrations will eventually attain a steady period

Ф(Е, t) = ф0 exp(/a>) фі(Е, t) = фі0 exp (no)

After substitution in the single-point Eqs. (1.10) and cancelation of фі01ф0 and exp(/co), the in-hour equation is obtained:

q = dk/keS = (l*(o/keff) + £ «&/((о + A*) (1.12)

i-l

This equation relates all the N + 1 time constants of transient ф and фі behavior for the reactivity level q. Thus

A+l A+l

Ф=Фо^ап exp(/ft>„), фі = фі0 £ bin exp(ton)

n—1 П“1

For Q > 1 there is at least one dominant positive root m0 and the neutron flux increases with time. Figure 1.3 shows co0 as a function of q.

image005

Shorted Motor Protection Circuit

An electrical circuit is particularly simple to analyze by a fault tree because the connections are straightforward. Consider the protection circuit shown in Fig. 1.24 (14).

Подпись: Timer contacts Fig. 1.24. A circuit diagram for a motor timing circuit in which a timer and fuse appear as safety devices (14).
image049

When the switch is closed, power is applied to the timer coil. This closes the timer contacts and applies power to the relay coil, which in turn closes the relay contacts. Power is then supplied through the fuse to the motor. When the switch is opened, the reverse procedure applies.

The fuse and the timer are safeguards; if the motor fails shorted while the relay contacts are closed, then the fuse opens and shuts off the power, and if the switch fails to open again after some time (which is preset) then the timer will open its contacts and remove power from the motor.

The overheating of the wire A-В is an undesirable event in this circuit and it can be prevented if the safeguards operate. As an example of fault tree technique, the following paragraphs analyze the causes which might allow the overheating of A-B.

Figure 1.25 shows the basic fault tree for the undesirable event: an over­heated wire. It could arise only as a result of excessive current and the power being applied for an extended time. The excessive current could come only if the motor fails shorted and the fuse fails to open, and the extended time during which this overpower is applied may result if either the relay contacts fail in a closed position, or the power is not removed from the relay coil.

image050

Fig. 1.25. Fault tree for the motor timing circuit {14).

The power is not removed from the relay coil only if both the timer fails and the switch fails to open. Thus the symbols demonstrate the logical connections between the events.

There are two analytical techniques for constructing fault trees. Each develops the tree to a different depth of detail. The first considers primary component failures that occur while the component is functioning within conditions for which it was designed. The second technique considers secondary component failures that occur when the component is subjected to abnormal conditions.

1.6.2.2.1 Primary failure technique. This method is used mainly in the communication field (control and instrumentation) and in data processing systems (control).

To illustrate the technique we may further analyze the causes of an over­heated wire (Figure 1.26) (14). The motor failed shorted and relay contacts failed closed are both primary failures. To cause the timer to be unable to open there are two other primary causes: the timer coil failed to open and the timer contacts failed closed. If the switch fails to open, a primary failure of the switch contacts failed closed may be responsible, although there are other possible external causes which are here undeveloped.

image051

Fig. 1.26. Fault tree using primary failure technique (14).

1.6.2.2.2 Secondary failure technique. This method requires a greater insight into the system and its component parts because it needs a knowl­edge of how systems might operate and interact in abnormal conditions. It is used mainly in accident analysis and therefore it is of most concern to this discussion.

To illustrate this technique we can again further develop the example (Figs. 1.27a and 1.27b) (14). The motor and relay are sensitive to the failure of one another. In Fig. 1.26, relay contacts failed closed was a primary fault, but there may be a secondary reason; they may fail to open because

image052

Fig. 1.27a. Fault tree using secondary failure technique (14). Branch in which there is an overcurrent in the system wiring, which helps to cause an overheated wire.

they have been fused shut by an overcurrent. The overcurrent is a cause of failure only if the relay contacts fuse. Therefore an inhibit conditional gate is needed to describe this situation. The overcurrent might arise if failure of the fuse occurred and the motor failed shorted.

The motor failed shorted might also come from a secondary (abnormal conditions) failure, an extended period of power, but power applied for extended time is a cause for failure only if the motor actually does fail shorted, so another inhibit gate is required. This extended power might arise from a failure of the relay contacts or power not being removed from the relay coil.

image053

Fig. 1.27b. Fault tree using secondary failure technique (14). Branch in which the power is applied for an extended time, thus helping to cause an overheated wire.

Now we notice that the tree is no longer a simple structure but some faults occur in different parts of the tree; thus interconnections or transfers are required.

Frequency Response Analysis

This is an alternative analytical method in which the stability is assessed from an open-loop analysis.

The frequency response of the open-loop system G(s)H(s) is plotted in two distinct ways to give two equivalent stability criteria.

a. Nyquist criterion. This criterion allows one to calculate the gain and phase margins to give the degree of stability of the system, whereas the

Plotting Rules for Root-Locus Construction

Подпись: StepPlotting rule

1 Number of locus branches equals order of denominator of G(s) H(s).

2 Locus is drawn for values of К as К varies from zero to infinity where К is

given by

G(s) H(s) = K(s-z)—/(s-p)—.

3 As К tends to infinity the locus of the closed-loop poles terminates on a zero

of G(s) H(s). Zeros at infinity are included. Also as К tends to zero the locus approaches the poles of G(s) H(s).

4 Loci on the real axis include those sections of the axis to the left of an odd

number of critical frequencies (zeros or poles) of G(s) H(s).

5 Loci near infinity asymptotically approach straight lines which meet the real

axis at an intersection point given by

sum(real part of poles) — sum(real part of zeros)
number of finite poles (p) — number of finite zeros (r)

and they meet the axis at angles given by в = плКр — z) for n odd.

6 Loci have symmetry about the real axis.

7 The values of К at which loci go into the right half-plane can be determined

graphically.

location of poles allowed one to obtain a rate of exponential decay that could be related to a damping factor as in the simulation technique of Section 2.5.2.1.

The frequency response of the open-loop system G(s)H(s) is plotted on an Argand diagram and the criterion states: “If a system is unstable the number of unstable frequencies is given by the number of times this fre­quency response curve encircles the —1 point in a clockwise direction.” Defining

W{s) = G(s)H(s) + 1 (2.17)

to be the closed-loop characteristic, from Cauchy’s theorem in complex number theory, assuming that IT(.s) is single-valued and has finite poles in a contour C and is not zero on C, then

Подпись: (2.18)Jc W'{s)IW{s) = 2ni(Z — P)

Подпись:[In W(s)]c = 2ni(Z — P)

= A2 + iB2 — Ax — iBx where Fig. 2.29a defines the anticlockwise path around contour C.

Подпись: Thus Fig. 2.29a. C contour in the і plane.

Подпись: (2.21) (2.22) Аг — A2

В2— B1 = 2n(Z — P)

One revolution of the W plane origin gives Ini, thus the number of encir­clements of the W origin is equal to Z — P.

The stability criterion now arises because the closed-loop transfer func­tion pole is a zero of W(s) and therefore for stability there should be no zeros in the right half-plane of W(s). For stability there must be as many encirclements as W(s) has poles in the right half-plane.

Thus the number of encirclements of the origin in the W(s) plane (Z — 0) is equal to the number of encirclements of the point —1 in the G(s)H(s) plane, and this in turn is equal to the number of poles of the open-loop transfer function as shown above. The negative sign now implies clockwise encirclements. Examples are given in Section 2.5.3.3.

The effect of a time lag is to make the closed-loop system more unstable in general. See the second Nyquist example in Section 2.5.3.3.

b. Bode plot method. Again using the open-loop response of the system, the phase and gain may be plotted and the Nyquist criterion used in a slightly different manner.

The gain is defined as M where:

Подпись: (2.23)

Подпись: so

M = 20 log10 (response argument)

and the gain and phase are plotted against frequency. Because of the loga­rithmic formulation the gains and phases can be added for multiplicative systems, so that the frequency responses of sections of the system can be easily totalled. See the example in Section 2.5.3.3.

Thus the response of the neutron kinetics can be calculated separately from the thermal characteristic response, and the feedback and each can be converted into a separate tabulation of gain and phase versus frequency which can be summed. The only diffculty occurs where multiple feedback paths exist.

image121

The Nyquist diagram for the — 1 point is translated here into a similar one on the Bode diagram for the point of 0 dB and a phase of —180°. For mere stability, the system must have a negative gain at 180° but, in practice, for suitable operational stability one needs some damping, which is provided by a gain margin of about 20 dB (Fig. 2.29b).

Prevention of Loss of Coolant

Following a break in the primary circuit the following engineered safety features might be invoked by a particular design. (Naturally not all of them would be required and exactly which would be used would be a func­tion of the plant size, layout and concept details, and other safety features being used.)

Plant protective system to shutdown the reactor.

Wrapped and restrained pipework to guard or restrict pipe breakage.

Safety guard tanks around components (or minimum volume containers to restrict coolant loss).

Double pipework to avoid coolant loss.

image167

Comparison of Earthquake Scales0

Elevated design and layout designed to minimize outflow.

Check valves to reduce loss of coolant.

Hydraulic diodes to reduce loss of coolant.

Reserve coolant volumes to provide for coolant loss.

Siphon breakers to reduce outflow.

Isolation valves to isolate the failed loop or pipe.

Multiple path design to minimize the effect of a pipe rupture.

Pressure Response

In the failed assembly the pressure may attain 1000 psia locally which reduces to 150 psia when the whole subassembly is voided. Thus the pressure transient is roughly a very rapid rise to the peak followed by an exponential decay over the next 8-10 msec to the lower value.

If the failure is in the center of the subassembly, then explosion work (28a) has shown that the subassembly duct may only experience an atten­uated value of a third of the peak value of pressure. Static calculations for the response of the assembly duct show that even in the irradiated state the duct can withstand several hundreds of psia without failure. However, if the original failure is close to the subassembly duct wall, then the original localized pressure of 1000 psia could cause failure in the corner of a hex­agonal boundary (28b).

In any particular case, inertial calculations may be performed on the subassembly duct since the usual duct thickness is sufficient for the duct to have a natural damped vibrational mode with a period of about 1 msec. It will therefore not respond to acoustic waves generated in shorter times. Thus the duct essentially sees a steady pressure acting upon it even though this pressure may be localized. Any acoustic wave will have a very small invested energy (1 or 2 W-sec) because the relaxation time is so short (40 psec for a central pin). The questions to be answered include:

(a) Does the duct wall fail for localized pressures and over what axial extent does it do so?

(b) If the duct fails, what pressure deformation does the adjacent duct wall experience and does this deformation cause boiling of the coolant in the second subassembly?

If boiling is caused in the second subassembly, then of course this con­stitutes propagation of the failure, since there is nothing now to stop the process of damage from repeating itself though on a slower time scale.

However, calculations to date appear to show that even with considerable deformation, the adjacent assembly does not experience boiling, even when the outer coolant channels are completely constricted (28b).