In a practical system, there are a number of sources which should be considered both during operation and during accident conditions. For illustrative purposes we consider a loop-type plant.

(a) Preoperational filling. It is possible that a considerable number of free spaces may have entrapped gas when the primary circuit was initially filled and these entrapped gases could be swept into the coolant stream if they were allowed to remain. However, before operation, cold and hot hydraulic tests of the system at low power will ensure that such gases are removed from the circuit.

(b) Gas entrainment. Cover gases may be entrained from a free surface if a vortex is formed due to the particular flow path of the design. In a loop-type plant the outlet nozzles should be sufficiently immersed to avoid the formation of vortices.

Gas may also be entrained by differences of pressures inside and outside instrument guide tubes that dip below the sodium free surfaces. If the cover gas systems are not regulated well, then it is possible that streams of gas may be introduced within the sodium (4d). However in all cases gas entrain­ment can be prohibited by good engineering design. The problem arises in making sure that all possible cases have been considered. Accident experience has shown that this is not easy.

(c) Gas absorption at a free surface. Gas may be collected by a fluid in motion below a cover gas, and this may later be concentrated within the primary circuit at some high point of the system. However absorption rates are very small, of the order of hundredths of a pound of gas per hour; this may be reduced by ensuring that the sodium in contact with cover gas volumes is nonturbulent.

(d) Fission gas release. The core does contain gas in each fuel pin fission gas plenum and a sudden release of a lot of this high-pressure gas could give rise to a considerable volume of gas in the circuit. For this reason the fission gas plenum is, in most designs, at the outlet of the core rather than at the inlet, so that any fission gas would be immediately swept out of the coolant channels. However, fuel pins are not likely to rupture in large quantities unless something else is seriously at fault, and gas released from small numbers of pins is rapidly removed from the circuit at the vessel free surface and hot and cold purification traps.

(e) Production from oil releases. If a pump lubricant, say the Fluorolube M-10 used in the Fermi pumps, could possibly penetrate to the primary circuit, then in contact with hot sodium, the lubricant would decompose into gaseous products. To avoid this possibility the system is engineered with multiple seals, a tortuous path for any possible leakage, and an oil sump well removed from the sodium coolant. Indeed, if this source were considered possible, then an oil which is compatible with sodium could be used.

(f) External purification and make-up circuits. External purification lines have cover gas systems that may give rise to gas sources, and although in any case it is simple to design the system to avoid a source for primary circuit gas, it is nevertheless difficult to ensure that all possibilities have been covered.

(g) Entry at pipe rupture. In certain loop designs in some low flow cir­cumstances, it is possible that part of the circuit may be at less than atmo­spheric pressure. A leak in this region would result in an inleakage of external gas to the primary. Alternatively, a large break may result in an input of gas, even though that break took place at a part of the circuit which was originally at high pressure. Thus, circuits should be designed to avoid inleakage of gas in the remote event of a rupture of the primary circuit.

If, despite engineering precautions to prohibit gas from entering the primary system, gas were to enter, it is unlikely that after passage through the pipework, the heat exchanger, and the pumps that a coherent bubble would result at the core inlet. Tests have shown that any bubble is dispersed by inlet plenum flows rather than concentrated at a single point. Therefore it is most unlikely that externally introduced gases could give serious re­activity effects. However, it is likely that very small bubbles will penetrate to the core and their effects on the heat transfer should be considered.

Downward flow was chosen for the DFR, because the top shield and mechanisms are kept cool at the reactor inlet and down-flow avoids levita­tion of the fuel subassemblies.

Against these reasons must be set the disadvantages that the coolant flow is in the opposite direction to natural circulation for the thermal siphon

and is opposed to buoyancy forces. The cover gas must be pressurized and the instrumentation at the core outlet is very difficult because of its remote­ness from the operating floor.

It should be added that a considerable number of problems have arisen due to the choice of down-flow; it is unlikely that such a choice would be made in any present or future system.

The main meteorological concern is the wind behavior following a radio­active release or leakage following an accident. The wind dispersion appears in the dose calculations as the factor %jQ [Eq. (5.2)]. Meteorological para­meters which require study for a given site are wind direction and speed, atmospheric stability, the vertical temperature distribution, and precipita­tion.

Damage to the head plug can be minimized to a certain extent by paying some attention to the design of the vessel and its internals.

The vessel could be allowed to rupture at any earlier stage of the accident. The SL-1 explosion interpretive tests showed that a vessel jump of 11 ft resulted from a liquid hammer if the vessel did not rupture, whereas no significant jump resulted from a case when the vessel did rupture. False rupture could be arranged in the vessel above the cover gas-liquid sodium interface by the use of carefully selected rupture disks if it seemed preferable to seek this design solution to the relief of invessel pressures.

The core barrel and thermal shields could be minimized in order to avoid the gun barrel effect whereby the force of the explosion would be directed upward. Radial vessel deformation reduces damage to the plug.

A sodium slug suppressor plate above the core could allow the plug to

feel the effects of the slug movement before the sodium has time to accelerate if the suppressor plate were rigidly connected to the plug. This would allow the plug to absorb the energy gradually rather than be subjected to an impact. However the plug would also be subjected to shock, against which it would otherwise be insulated by the height of sodium and the cover gas. A European design of LMFBR does include such a sodium slug suppressor. It has not been yet demonstrated that its inclusion is an advantage.

Gas volumes included in the vessel may attenuate pressure waves, but they would have associated hazards during normal operation if they were to become connected to the primary circuit, by being a source of gas which might be introduced into the core.

To minimize the result of the impact on the vessel plug, the plug may be equipped with energy absorbing honeycomb crush shields and it may be bolted down. The head design may be such as to avoid allowing the sodium access above the operating floor by a reentry design to direct sodium to drains and from there it could be directed to vaults. Finally, outside the vessel a missile dome or shields would protect the containment from pene­tration.

Table 5.14 shows some of the safety features used in U. S. fast reactors to hold down the head plug and contain missiles. No system uses rupture disks, and it is debatable whether any plant should go to that extent to design for a hypothetical event.

5.6 Engineered Safety Features

A list of safety features was given in Section 3.4.3 conforming to the definitions made in Section 3.4.1. Here we are interested in consequence limiting systems for various circumstances.

To avoid criticality following a hypothetical core melt-down, it could be necessary to maintain subcriticality by dispersing the fuel, by retaining the molten fuel in catchers where it might be cooled, and by providing terminal cooling to ensure that the fuel would remain where it was safe and could be cooled until the decay heat decreased.

To contain the effects of blast, head hold-down systems, blast shielding, missile barriers, and double containment are obvious design aids. Aerosol settling devices, filtration systems, and hold-up volumes would also aid the reduction of radioactive effluent following an energy release that released fuel from the system.

To avoid sodium fires and other reactions, the absence of air from the vaults and the containment, and the absence of water from these areas are self-evident solutions. The retention of sodium below its ignition tempera­ture at those times when a sodium fire is more likely to occur (during main­tenance) can be just as effective. Procedural controls are, of course, extremely important in separating sodium from oxygen and keeping it separate during start-up of the plant, during operation, and during maintenance.

In fast reactors which have very small cores, the bowing or buckling of fuel elements due to temperature changes may shift fuel in or out of more reactive regions with consequent increases or decreases in reactivity.

EBR-I exhibited both a prompt inward bowing that produced a positive reactivity change and a delayed outward bowing that produced a negative reactivity change (see Section 2.5.5). However, most power reactor designs would seek to keep such changes to an absolute minimum by employing a core restraint system, either by physically squeezing the core fuel assem­blies together as in the Fermi reactor or by using a thermal restraint which uses the expansion of the core itself to tighten the core assemblies against fixed supports.

Those who work with fast reactors have to contend with the fact that an addition of moderator softens the spectrum and effectively increases the reactivity but only when this moderator is applied throughout the core. If the moderator is applied at the center, then the reactivity is liable to be reduced, whereas a reduction of moderator would cause an increase in reactivity. See Section 1.4.1.2 for a more detailed discussion of this point.

An LMFBR is not subject to moderator addition but to subtraction (Section 2.3.4). Gas-cooled and steam-cooled reactor systems are sensitive to the flooding accident, which is a moderator addition (2).

Figure 2.19 shows the variation in reactivity following the ingress of water as a result of a failure of heat exchanger tubes in the gas-cooled fast reactor system. An amount equal to 10 kgm/sec is assumed to leak in from a simul­taneous failure of three tubes. However, in this case, the addition of re­activity is at a slow enough rate for detection to remedy the situation. Temperature changes in the fuel were about 0.2°C/sec.

To get some perspective of plant and core level limitations, Table 3.5 shows a typical set of trip points for a LMFBR system. These levels also constitute a set of failure criteria, at least as far as continued operation of the plant is concerned. The operator is concerned with remaining inside these values, which necessarily means that he will also not approach the previously discussed fuel pin failure criteria because a considerable margin of safety is provided by the choice of the low trip points.

Other trips may be possible and desirable. However it must be remembered that too many trips constitute a safety hazard because they cause operator frustration in shutting down the reactor when the operator’s job is to keep it operating safely. This situation is worse on an experimental system, where the operators are under considerable pressure from experimentalists to maintain constant power conditions.

A power rate-of-change trip (period meter) is sometimes required as it gives a very early indication of things beginning to change. However the device is noisy [being a divider to give P(dPjdtY1] and is not particularly

in favor among control designers. A reactivity meter which derives the reactivity as a function of time from measurements of flux as a function of time is a requirement in modern LMFBR systems.

The previous section has shown how the energy release calculation depends on the equation of state. Figure 4.5 shows several versions of extra­polations from three different sets of basic data.

To understand the importance of this equation in the calculation of total energy and, subsequently, the work energy, it is important to know how it fits into the phase diagram.

Figure 4.11 shows the two-phase diagram for fuel material in terms of the reduced variables pressure pjpc, specific volume vjva, and energy E/Ee. These reduced variables are all unity at the critical point C.

The solid normal configuration fuel exists in a state illustrated by A. When the fuel is overheated it expands, melts, and further expands, all at constant pressure, until all the volume normally occupied by coolant has been filled. Then the fuel state will move along a constant volume line, now with increasing pressures, until some terminal state В is reached, de­fined by the fact that the reactor has shut down due to the dispersion. The constant volume line for the final configuration is usually about vlve of 0.7 as a core has approximately 30% coolant volume.

The path from A to В is the equation of state included in the energy release calculations above. It may pass through the two-phase region in certain cases.

There is very little data available at high temperatures and pressures, even for metal fuels let alone the oxides and carbides; thus the equation of state depends on extrapolations from low temperature data. An alterna­tive method of obtaining the equation of state is to derive it from the generalized tables in terms of the reduced variables.

The law of corresponding states applies for materials with compressibility factors not very different from that of water (0.23). That for uranium oxide defined by Eq. (4.25) is 0.3.

compressibility factor = pcuJRTc (4.25)

The path A to В in Fig. 4.11 is clearly a threshold function and indeed threshold equations of state have been used. Other versions in use are shown in Table 4.3.

In the accident analysis, the true core equation of state should not be that of the oxide or carbide fuel alone, but it should include allowance for the equation of state of the structural steel present as well as the remaining sodium in the core. Difficulty arises since the amount of sodium remaining in the core is generally unknown.

4.3.4 Work Production

The energy release calculations are performed in order to determine the amount of energy that is available to do damage to the structure sur­rounding the core. The ultimate objective is to be able to define the final position and distribution of the core debris, so that this debris can be main­tained subcritical and adequately cooled. Thus we are interested in how much of the total energy release could be converted into damaging work energy.

Some idea of the magnitude of the damage which could be caused by nuclear explosions can be obtained from Fig. 4.12, which shows the energy generated in the destructive tests of the SPERT and BORAX reactors. Also shown is the calculated comparison of the SL-1 excursion (16). The energy ranges up to 200 MW-sec, which, from chemical explosion tests performed on scaled down reactor vessels, is equivalent to approximately 105 lb TNT.

After the power excursion is terminated by a small dispersion of the fuel material, the core will still be in the “constant volume” state assumed in the previous section. The coolant volume is occupied by fuel and structure debris. The center of the core is in a compressed liquid state under high pressures, and there may be some vaporized fuel in the core center while the periphery may be liquid or even solid. There is no sodium within the core, although there will be some sodium surrounding it.

The details of this homogeneous model of the disrupted and collapsed core depend on the severity of the energy release. From this state the core now expands and, in doing so, it does work. There are two basic expansion processes.

The reactor was normally stable, the power coefficient having a prompt positive component and a delayed negative component. Instabilities could occur if the power-to-flow ratio were high.

If the flow were decreased, the power would first rise and then later it would decrease to a new level. The first power changes were due to mechani-

cal variations and bowing of fuel rods. The second changes were not under­stood. A new restrained core composed of rods inside a hexagon can with a tightening rod in the center and a heavy structure with which to clamp all the assemblies was provided. This new core had only a prompt negative power coefficient, having lost both the prompt positive effect of bowing and its delayed negative effect.

The eventual explanation was that, while the bowing provided a prompt inward bowing, it also brought the upper end of the fuel rod into contact with a shield plate (see Fig. 2.38) that subsequently expanded, levering the fuel rod backward away from the core and thus giving the negative effect delayed by the thermal time constant of the massive shield plate.

where te and ts are the thickness for cylindrical and spherical shells, respec-

tively (in.); P is the design pressure (psig); S’is the maximum allowable stress (psi); E is the joint efficiency; and R is the internal radius of the building (in.). Assuming a joint efficiency of unity and neglecting the small pressure effect, then, for cylindrical and spherical shells, the wall thickness (neglecting the corrosion allowance) should be t = PRjS and t = PR/2S, respectively.

The relevant code (13) waives stress relief for wall thicknesses of less than one and one-eighth inches. For this thickness, the above equations show that the containment building would stand 20-30 psig. It therefore appears to be very fortunate that in each case the design basis accident gave rise to design pressures within the limit for which expensive stress relief of the containment outer shell was not required.

In practice, it is possible to include design features, such as an inner containment barrier of reinforced concrete, which would avoid subjecting the outer steel shell to high pressures even in the remote event of a core disruptive accident.