Redundancy with systems or components of different principles may force a designer to adopt a second system simply because it has a different principle, even though it is not as reliable or rapid or as safe as a second system of the same principle would be.

For example, two reactivity control systems provided according to Cri­terion 26 might comprise a group of normal absorber rods together with a poison injection system with speed, distribution, and effectiveness problems. This system would not be as safe as two rod systems, especially if they use different drive mechanisms. However, in the two rod system case, the designer would have to ensure that no common mode failure (such as a core distortion) were possible.

The principle of requiring an engineered safety feature to operate after a fault even in the event of an active component failure at any time, has been extended to requiring an engineered safety feature to operate after a fault even in the event of a passive component failure (see Section 3.3.2).

Thus, for example, an emergency cooling system which goes into opera­tion after a pump failure must be able to withstand subsequently a failure of an active component (valve or even part of its own pump), or a failure of a passive component (circuit or pipe wall or an electromagnetic pump component). This is an extension of the original active component failure criterion of the 1967 set.

So far it is not suggested that the engineered safety features must with­stand both an active and a passive failure after the original fault. However one of the paradoxes of criteria is that they grow. It is important to strike a balance between the maintenance of safety and an unreasonable limita­tion on the design. Overredundancy results in complex systems which are often less amenable to maintenance and are possibly less safe than the simpler less redundant system which is easier to design and test. For safe design it is important not to rely on redundancy as a cure-all.

Following fuel ejection sodium vaporization may occur due to the high heat transfer rates. The heat input into the channel may be calculated by using the previously calculated ejection rates with a calculated heat transfer rate, so that the final heat input is effectively of the form:

qlqо = [1 — exp(— Ґ//.ЖЛ — P2- 6P)H (4.38)

The first term in this equation accounts for the delay time in attaining full mass flow. This heat input is used in conjunction with the voiding model described in Section 1.3 (24) to account for growth of the bubble and the rise of channel pressure (up to 1000 psia). In Eq. (4.38), ta is the time constant for the fuel mass flow rate. Figure 4.17a shows the typical results which are produced. The size of the bubble is very small when the maximum pressure is attained; so condensation of the bubble does not have much effect on the maximum pressure value. However the maximum pres­sure is very dependent on the following parameters.

(a) The delay time expressed by [1 — exp(— t/ta)] which represents that rate of ejection of molten fuel.

(b)

The heat transfer rate and therefore the fuel fragmentation repre­sented by Я in Eq. (4.38).

(c) The efficiency of the heat transfer process, which is a measure of the fuel fragmentation or possible vapor blanketing of the fuel during its ejection or the number of subchannels to which the voiding extends.

Most of the calculations performed to date assume 100% efficiency in transferring heat from the molten fuel to the sodium. However the amount of work energy which is derived from this heat energy is dependent on the model used to describe the voiding.

The ratio of work energy to original molten fuel thermal energy is defined as a reaction efficiency, and theoretical models for the molten fuel-sodium interaction may be checked for adequacy by comparing calculated efficien­cies with values obtained from experiment.

Figure 4.17b shows the transient that resulted when uranium dioxide fueled pins were subjected to a high power transient in the TREAT facility piston autoclave. Sodium temperatures and pressure pulses were measured and correlated with the amount of fuel that was ejected from the fuel pins. The work energy was calculated from the motion of the piston as shown in the figure (23a).

The surprising result was a reaction efficiency of between 0.0015 and 0.018% and it seemed that the bond gas might be producing the pressure

interaction. Subsequent experiments with evacuated fuel pins showed that the gas might be blanketing the interaction as the reaction efficiency rose to 0.15%. How­ever the efficiency was still very low.

In laboratory experiments in which molten fuel (U02) was dropped into sodium, efficiencies of less than 0.01% have resulted although efficiencies of between 0.4 and 1.0% have been achieved with water injected into molten salt. The model described in Section 1.3 (24) is a pessimistic one, in that it results in a reaction efficiency in the neighborhood of 1-5%.

The voiding calculations should be linked to the fuel ejection calculations to provide a more accurate estimation of the channel backpressures. The voiding of a subchannel is very rapid and the complete subchannel may be voided in as little as 10 msec. The radial extent of that voiding occurs with about 80% of the speed of the axial voiding. This voiding is so rapid that the assumption that a jet of molten fuel might affect the neighboring pins depends on whether that jet transfers any of its heat to the coolant. If it does, then the coolant is likely to vaporize and failure could propagate by vapor blanketing rather than by jet impingement.

Once the void extends into the upper blanket region, the condensation
rate becomes very high and the pressure is reduced and the void-liquid interface begins to reenter in about 0.6 sec.

While the sodium is being voided from the channel, condensation takes place on all the pin surfaces and the film left on the pin surfaces increases. Eventually however when the film has built up, in about 0.15 sec, the reverse occurs and the film dries out, so that when the sodium reenters, it may arrive back in a channel in which the fuel cladding has failed following dry-out.

The exact course of the voiding of a subchannel depends on the assump­tion of the fuel behavior within that subchannel. It is possible to postulate fuel failure while the liquid is out of the channel, such that when the sodium tries to reenter, it is prevented from doing so by the high heat ratings present in the molten fuel. Thus the void increases again, starting a chugging motion that has been postulated as an extreme form of heat removal. It has also been suggested that some of the fuel material which is ejected into the channel may be carried out of the channel by the vapor-liquid interface in the form of solid frozen particles. Such a condition, if it occurred widely, could cause a reactivity decrease.

The concept of containment is to provide a series of barriers between the radioactive products of the fission process and the public. Any reactor has several such barriers, and the LMFBR has more than most. They are, successively: ceramic fuel that retains fission products; fuel-pin cladding; sodium coolant which absorbs radioactive iodine; primary circuit and vessel containment; containment building (possibly of two barrier construction); and exclusion distances.

This chapter is concerned with the latter two forms of containment: the containment building itself, which provides the final barrier to a release of radioactivity, either from normal refueling or waste removal operations or from accident conditions, and exclusion distances around the reactor itself.

In the higher probability accidents, such as the loss of electrical power to the pumps resulting in a reduction of core cooling, the ability to scram the reactor and to retain sufficient cooling for the removal of decay heat is necessary in order to maintain a safe system. For this reason, considerable redundancy and independence is built into the scram systems. However, if the ability to scram the reactor were lost, then a core disruptive accident would result from a loss of cooling.

The plant protective system is a multilevel redundant system: it has a multiplicity of trip signals (loss of power, loss of flow, high outlet tempera­ture, high power-to-flow ratio), a multiplicity of circuits (redundant com­ponents and independent cables), and a redundant scram system (two inde­pendent, rapid-acting, rod shut-down systems). For this reason the failure to scram is of very low probability and has been estimated in the region of 10-3 to 10~e per reactor year (17, 18). In addition, the probability of the original fault should be combined with this value for the overall probability of the total event.

Nevertheless, at this point in time, a loss of cooling accident and a failure to scram the reactor is considered a representative CDA initiator. This assumption is a direct result of licensing procedure rather than of any credibility in the accident itself, and it is of vital importance both to the fast reactor power industry and to the proper direction of safety evaluation that adequate work be done on the reliability of scram systems to show that the assumption of this accident as a CDA initiator is quite unfounded.

The siting of a power plant in a particular area will have an impact on the industrial growth of that area in terms of power availability in the long run and in terms of local employment in the short run. Both of these effects are political in nature, and both have positive and negative effects depending on whether the area was originally rural or industrial and whether it was a thriving or depressed (in terms of lack of employment) locality. Political effects are largely power plant independent, being associated largely with the area and its population. However, they should not be forgotten.

Before considering the enlargement of the thermal model to take account of further spatial effects, there is one term which complicates the solution of the present set of Eqs. (1.26)—(1.28).

1.3.3.1 The Term dTJdz

The term dTJdz in Eq. (1.27) complicates the solution because of the second implicit independent variable z. We can evade the complication by averaging the coolant temperature and assuming a mean gradient. This is good if the flux distribution is sinusoidal. Thus the usual approximation is

dTJdz = (rCout — TCJ/L = 2(Го — TC. J/L (1.39)

where Tc is now a channel volume weighted mean.

However when temperatures are used to predict reactivity changes, whole reactor averages are required rather than component averages and these need to be weighted, according to perturbation theory, by the square of the flux ф (3). Thus

rav = J Тф2 dVH ф2 dV (1.40)

and for a sinusoidal flux this gives

dTJdz = 2.33 (Tav — TC. JL (1.41)

This is a more accurate value for feedback calculations and the average temperature here has a different meaning. The effect is a multiplicative constant, 1.16, which can easily be included in the model. However the fast reactor has a relatively flat flux and this weighting is less significant.

1.3.3.2 Spatial Representation

The present core thermal model is very coarse since it has only a single fuel and a single coolant temperature. The spatial representation can be improved by including more points in the fuel and the structure within the unit cell. This is done by adding further heat balance equations in each of which the temperature is the average of a particular volume.

wflcfl dTjdt = (1 — y)(l — а)ф — htl(Tn — Tt2)

mt2ct2 dTjdt = y( 1 — а)ф + htl(Tn — Tt2) — hi2(Tt2 — Тсй)

WdCcd dTjdt = hf2(Tf2 — 7cd) — hcd(Tcd — Tc) — R(T*$ — T*4) (1.42)

mccc dTjdt = hcd{Tcd — Tc) + hs(Ts — Tc) — 2.33mcccvc(TB — Tc. m)/L m3ca dTjdt = аф — hs(Ts — Tc) + R(T*£ — T*4)

Now we have two points in the fuel, one each in the cladding and coolant and one in the structural material.

Notice the radiative cooling term of the cladding. The problem is now nonlinear because of this term and will require more elaborate solution even in the steady state. However radiation terms are usually very small except in accident conditions; they may therefore be neglected in opera­tional or near operational conditions.

Further axial representation and a better model for dTJdz demands a set of such equations at a number of points of the coolant channel, linked through the coolant equation term dTJdz by a finite difference representa­tion. One such representation is the Fox-Goodwin equation (8a).

dTCnJdz + dTJdt = 2(TCn+i — TCn)/Az (1.43)

This defines gradients and temperatures at successive points in the coolant channel (Fig. 1.8).

Lz Lz Lz Lz

‘ • ■——— 1 ■ Fig. 1.8. Finite difference nomenclature

n-i n n+i n+2 n+3 along the reactor coolant channel.

Coolant flow—

With this model in steady state, neglecting the term mccc(dTJdt) and omitting the radiative terms,

Tcn+i = TCn + (Az/2mcccvcA’)[hca(Tcdn + Tajn+1) + hs(TSn + F9b+i)] — BTCn

(1.44)

where

A’ = 1 + (Az/2vc)[(hcJmccc) + (hjmccc)] and В = (2A’ — 2)1 A’ (1.45)

thus defining the coolant temperatures at a point n + 1, in terms of heat input to that channel at that point n + 1, and upstream n.

Thus a set of such equations can be obtained at each axial point and for every channel whose representation is required. All of these equations depend on a knowledge of the inlet temperature and the power distribution for their solution.

2.1 Description of Main Reactor Systems

In order to discuss possible system disturbances comprehensively, it is convenient to relate these disturbances to three distinct fast reactor systems. These three systems are representative of fast reactor types and moreover cover a wide range of coolant pressures and fuel and coolant types, thus making the discussion more general. Although the present book is intended to particularize toward the sodium-cooled breeder, it is nevertheless impor­tant to know what the alternatives are and how they behave. The major alternatives are the gas-cooled and steam-cooled systems.

Most component defects, be it in material, design, or fabrication, can be considered as external disturbances to the system which are built in but which may appear at any time, especially when that material or component is operating under adverse off-normal accident conditions. Such component defects take three major forms as we shall note in the coming chapters.

(a) Fuel cladding defects. Under typical quality control procedures and methods it is only possible for a one mil defect in 15 mil cladding to avoid detection. This size of defect has no significant effect on the strength of the cladding (13).

(b) Bad design. Section 4.6 will detail examples of bad design of com­ponents, procedures, and operations. Fault trees attempt to take into account all bad design possibilities and such errors are included in the safety evalua­tion. However, bad design, being a human failing, is always a present possibility against which safeguards are provided.

(c) Lack of quality assurance over materials. Examples have occurred of materials which, through lack of quality control at the original suppliers, were not produced according to specification. An example is the inclusion of one carbon steel tube among 3600 stainless steel tubes for the Enrico Fermi reactor steam generators. Such a tube could have failed and resulted in further failures if not excluded from the component. The safety evaluation will include the consequences of material being other than as specified in strengths, heat-transfer coefficients, erosion and corrosion resistances, etc.

Liquid-metal coolants may contain voids due to externally introduced gases or due to vaporization of the coolant itself. Previous sections have already dealt with some aspects of core voiding and its analysis. Section 1.3 outlined modeling of sodium boiling due to an imbalance of heat production and heat removal in a core channel. Section 1.4 discussed the reactivity feedbacks obtainable from voiding and outlined design choices which were available to reduce these void feedback coefficients. Finally Section 2.3 dealt with integrated reactivity effects and reactivity addition rates from possible bubbles passing through a reactor core. This section discusses the sources of possible external gases in a practical system and investigates what effects bubbles in the core might have, in addition to reactivity feedbacks.

The DFR is a 60 MWt system cooled with down-flowing NaK. When built, the system used the present state-of-the-art which led to the use of small electromagnetic pumps and 6-in. diameter main loops. There are thus 24 loops of all welded construction doubly contained throughout. There are no valves or seals, and even the control rod drive is transmitted through the vessel by an electromagnetic clutch. The fuel element had a

TABLE 4.7 Reactor Characteristics and Safety Features Reactor Power (MWt) Fuel loading (kgm) Fuel Heat transport and auxiliary cooling (ACS) DBA Containment EBR-II 62.5 363 U Pool 440 MW-sec (1) Reinforced concrete (2) Steel Enrico Fermi 300.0 2000 u 3 loop 1900 MW-sec (1) Steel SEFOR 20.0 1920 Pu-UO, 1 loop, ACS 20 MW-sec (1) Reinforced concrete (2) Steel FFTF 400-0 3000 Pu-UOj 3 loop — — FARET 50.0 260 Pu-U 1 loop, ACS 60 MW-sec (1) Reinforced concrete PFR 600.0 6000 Pu-UOa Pool, cooler Limited melt-down (1) Primary tank (2) Containment building SNR 730.0 5000 Pu-UOa 3 loop, ACS? 2400 MW-sec (total) (1) Reinforced concrete and dome (2) Steel shell Rapsodie 20.0 300 Pu-UOj 2 loop (1) Disruption (2) Sodium fire (1) Concrete blast shield (2) Steel shell Phenix 560.0 3500 Pu-UOj Pool, cooler (1) Disruption (2) Sodium fire (1) Concrete blast shield (2) Steel shell

safety design with a niobium outer cladding and a vanadium inner cladding that was designed to fail first, in the event of any overheating, to allow any fuel debris to run down the center of the annular element. The fuel pins are restrained from bowing. All the control rods are worth less than $ 1; they are moving fuel assemblies inserted from beneath.

There is a thermal siphon capability for decay heat removal upon shut­down. The containment sphere is designed for a pressure range of from + 18 psig to —4 psig. Final dispersal facilities are provided by niobium — plated cones inside and outside the reactor vessel, leading finally into a series of cylinders terminating in the bedrock. Figures 4.30 and 5.16 show reactor cross sections.