In the design of a reactor and its associated plant systems the involvement of safety engineering is total. Safety appears in the selection of design concepts, the design itself, and as an evaluation of the design. The safety of the plant being the subject of the Preliminary and Final Safety Analysis Reports which are submitted in support of plant construction and operating licenses, in the final analysis may be an overriding consideration in the production of the nuclear power system.

Because of the total involvement of safety engineering at all stages of the design and in all sections of the design, the field of reactor safety requires an immense range of technical skills. In the past, reactor safety engineers have been drawn from the ranks of those who are specialists in one single area of reactor technology and who have attained experience enough to recognize the required wide background necessary for the assessment of safety. Nevertheless in any safety group it has always been necessary to cover the whole range of skills required by providing for a number of personnel with different backgrounds. Ideally these engineers should be subjected to an overall reactor safety course to enable them to think and speak in a consistent manner with respect to safety.

Modern university curricula instruct in sccialist skills each of which may be limited to a single technical field. It is therefore important to superimpose upon the basic university instruction, preferably as early in the educational process as possible, applied safety courses which emphasize and show the interactions among a range of skills drawn from many different fields. The short extra-curricular course is not likely to provide the balance and depth of understanding needed for valid training in safety.

The present volume is intended to fill the need for a university text for reactor safety applied to fast reactors in general and applied to liquid-metal — cooled fast breeders in particular. Liquid-metal-cooled fast breeders are the favored fast reactor concepts for the major nuclear countries of the world and therefore the emphasis is pertinent to our future needs.

One may ask why such a volume is not first devoted to the present genera­tion of nuclear power plants—the thermal pressurized and boiling light water systems. The answer is that undoubtedly such a volume is needed but that the author’s experience leads more directly to the fast reactor. However it is worth noting that all but Chapters 4 and 5 of the present volume also apply to the thermal reactor system and a thermal reactor safety engineer will also find the book of use.

The book is intended as a university text for graduates and undergraduates in nuclear engineering who are attending courses in reactor safety. Safety engineering encompasses mathematics, thermal hydraulics, fluid dynamics, control theory, logic analysis, nuclear physics, structural mechanics, stress analysis, metallurgy, licensing regulations, meteorology, health physics, and a host of other technical fields. It is therefore necessary to require that the student and the reader should possess certain prerequisites. The minimum should be a basic knowledge of differential calculus, nuclear reactor theory, and some heat transfer and fluid dynamics.

The text of the book has been used in teaching the subject of fast reactor safety at Carnegie-Mellon University, Pittsburgh, and the feedback from the presentation there has greatly improved the book. I am grateful for the comments received from my students.

The text also owes much to work performed by other organizations in­cluding: the International Atomic Energy Agency, the United Kingdom Atomic Energy Authority, the Atomic Energy Commission, Argonne Na­tional Laboratory, Oak Ridge National Laboratory, the British Nuclear Energy Society, the Institution of Mechanical Engineers, the Liquid Metal Engineering Center, the American Society of Mechanical Engineers, the American Society for Testing Materials, the Boeing Company, and Westing — house Electric Corporation. Many individuals have also helped the work by their criticisms as well as by material contributions, and John Zoubek should be singled out for his assistance in several sections of the book.

I am particularly grateful to Dr. R. G. Cockrell for his continued help and constructive advice and to my wife for her encouragement, enthusiasm, and tolerance of the curious habits of someone hampered by the lack of sufficient hours in the day.

Every power plant has an added control system. These systems may have small or large amounts of automatic functions. These functions might include a control of the reactor flow or reactivity balance as a result of temperature monitoring. For example, it might be required to maintain a constant or near constant outlet temperature. Thus this additional control function is also a feedback that needs consideration during any safety evaluation.

Such feedbacks are entirely dependent on the design of both the plant and its control system. However, control system criteria for the design will ensure that such feedbacks contribute to the stability of the system rather than detract from it. Indeed they have the ability to make the system stable despite any adverse inherent feedback loops there might be.

The next section will make further reference to control and protective system feedbacks in the reactor system closed loops.

Such structural movements can arise as thermally induced expansion movement (as in EBR-I: Section 2.5.5) and through a thermal model they can be related to temperatures in the core. Otherwise, the structural move­ment may arise from suddenly released thermal restraint or from seismic forces that can cause a movement of fuel, fuel support, and/or control material.

A structural analysis based on equivalent spring-mass systems gives the accelerations of various components for given seismic frequencies. Pessi­mistic vibratory modes give maximum deflections from which reactivity changes can be calculated on a steady-state basis. This can be done for vertical movement or radial movement of the fuel assembly considered as a simple supported beam. Such calculations will give pessimistic values since the fuel pins will be well supported by grids or wire wrap spacers and assemblies are usually close-packed.

Typical seismic movements might be in the range 0.01-0.1 in. resulting in reactivity changes of up to 100 and generally well within acceptable reactivity steps for adequate system protection to be guaranteed. These considerations apply equally to all three systems under discussion.

In addition there are two other sets of regulations published in the Federal Register. One applies under normal operations (10 CFR 20) and the other set is for extremely unlikely accident conditions (10 CFR 100). They detail the allowable releases in these situations. These will be discussed further in Sections 5.1 and 5.2. In the 1967 criteria, Criterion 70 was the overriding criterion because it simply stated that the design must be such as to comply with these two radioactivity release regulations, 10 CFR 20 and 10 CFR 100. However, in the 1971 criteria, Criterion 60 ensures that the design will “maintain suitable control” over radioactive releases. during expected oc­currences while Criteria 16 and 50 ensure that containment will be provided with a suitable low leakage rate during accident conditions.

The compressed liquid could expand down a constant internal energy locus. Equations (4.27) and (4.31) give the work that can be done by the fuel, but if no work is done, then the expansion is at constant internal energy. In this case the expansion is down to the core volume rather than to 1 atm and if the sodium is added into the expanding system, assuming that rapid heat transfer has brought the fuel and sodium into thermal equilibrium, then very large residual pressures can exist at point B.

The isentropic expansion process leads to a maximum available work energy which may be used for pessimistic shock damage calculations for the vessel walls. The constant internal energy expansion, on the other hand, leads to pessimistic subsequent quasi-steady-state pressures in the system. In fact, the hypothetical expansion would be somewhere between these two extremes.

The available work energy derived from an isentropic expansion is not always the same fraction of the energy above melting; on the contrary, for small energy releases it is a very small fraction, while for large releases the work available can approach half the total energy above melting. Tradition­ally this work energy has been employed in subsequent damage calculations by equating it to an equivalent amount of TNT explosive in order to compute damage to the vessel and the structure surrounding the core. Section 5.5 treats this problem of energy partition in some detail.

EBR-II, designed in 1955 under the EBR-I shadow, is the major United States irradiation facility today. It is a pool type reactor designed for 60 MWt with a metallic uranium alloy fuel but using oxide and carbide fuels in irradiation testing. It now uses oxide fuel for driver assemblies.

The core is a two-plenum design, a high-pressure inner plenum and a low-pressure outer plenum for the blankets. Emergency cooling in the 26-ft diameter tank is provided by natural circulation with an elevated IHX in the tank. The tank is doubly contained, has no fill line, penetrations, or drain lines. When natural circulation is insufficient, there is a small EM pump to augment the cooling and there are added tank coolers to reject heat by air blast coolers. These reject 10-20 kW continuously but could manage 250 kW per cooler if needed in an emergency. Also, to maintain adequate cooling, the reactor protective system does not scram the reactor flow when the reactor itself scrams. The thermal stresses inherent in this operation are accepted.

The reactor cover is held by flexible clamps and the reactor plug has a hold­down system comprising screwed obstructions designed to take 75 psig. The reactor vault has six steel girders embedded in concrete and is designed for 3001b of TNT. The concrete is reinforced and anchored to the containment.

The pool system was chosen here to take advantage of the simpler tank design and avoid the complex nozzles and pipes of a loop system. The pool also enjoys reliable natural circulation and a large heat capacity, although it has considerable problems associated with the head fabrication which is a vast, complex and very costly item.

Figure 4.39 shows a cutaway diagram of a vertical section of EBR-II.

The containment as we have seen is constructed to certain design bases, one of which is, that compliance with siting radiation limits must be shown even at raised design pressure and temperature conditions within the containment. These conditions are more severe than those following the worst accident to which the plant could ever be subjected. Thus, in order to calculate the containment safety design margin, it is necessary to follow the analysis of a containment evaluation or design basis accident from initiation to its possible final consequences.

5.4.1 Design Basis Accident Initiators

To date, design basis or evaluation accidents for containments have been selected hypothetical occurrences. A result was postulated either in terms of gross core damage or in terms of an ultimate energy release, and in many cases an initiator was not specifically isolated as the cause of the incident.

Table 5.8 shows that EBR-II and the Enrico Fermi Reactor, both built under the shadow of the EBR-I melt-down, were evaluated on the basis of a postulated worst compaction of the core. In both cases the top of the core fell onto an already molten and slumped core, the top being presumed to have hung in position for some time before dropping.

However Table 5.8 also shows that in the case of SEFOR the first glim­merings of light were entering into containment evaluation analysis; in this case a sequential slumping of annular sections of the core was assumed.

The fact is, that although smaller experimental earlier cores could be postulated to slump in a most unrealistic manner and still give rise to only moderate energy releases, the large commercial power plants cannot assume such all-enveloping pessimism without paying a severe economic penalty in the provision of hypothetical safety features and safeguards.

Thus it is important to start with the initiator and inject some plausibility into the accident chronology and at the same time obtain a better idea of where and how safety features may be provided to prevent the occurrence of such an incident.

Therefore the present trend in containment evaluation analysis is away from the hypothetical and toward the sequential description of the accident behavior. The analyst attempts to follow the course of the core disruptive accident from initiation through to the final energy release and the distribu­tion of that energy. In this way too he is better able to specify the required research and development to confirm his evaluation than he could have done with an upper limit analysis.

The following occurrences are incidents which might be considered to have consequences severe enough to be considered as candidates for a core disruptive accident (CDA):

(a) A total assembly blockage.

(b) A refueling accident in which an assembly is dropped into a near­critical core or in which a control rod is withdrawn or ejected from a near­critical core.

(c) A rod ejection from a critical core.

(d) Large bubbles passing through the core.

(e) A local subassembly blockage arising from a structural failure or a defective fuel pin.

(f) A pipe rupture.

(g) Scram failure in conjunction with some more probable accident such as a flow failure due to loss of power to the pumps.

Three industrial giants are in current competition in the LMFBR field: Westinghouse Electric Corporation, General Electric Company, and Atom­ics International Division of North American Rockwell, Inc. Others such as Combustion Engineering, and Babcock and Wilcox are showing partial interest in the LMFBR market as it develops. All industrial effort is subject to AEC contracts and to utility support during this development time.

Finally there are the hundreds of utility companies who have a stake in nuclear power and therefore support one or another of the major industrial designers in the business. The utility would eventually be the owner of any fast-reactor power plant supplied by an industrial vendor. Therefore, the utility would be the applicant in seeking a license to build and operate.

If q is very small, then co0 is also small and less than the smallest A,-. Thus e = (l*co0/keS) + o,0 £ (ft/A,) = К (1.13)

І-1

Thus the stable period, co0 — q/1, is inversely proportional to the mean ef­fective neutron lifetime / where:

/=(/*/*«*) +SOTO 0-14)

»-l

For a fast reactor l* is between 10~® and 10-8 and thus the terms of the right hand side of the equation for / are of the order of 10-e or less and 40 X 10-3 so that l* is not important here. For small reactivity changes then the delayed neutron characteristics are most important and

/ — E (AM«)

i-l

This is true also for thermal systems where І* ~ 10-3.

An AND gate is indicative of a safety feature, because two or more conditions must simultaneously be satisfied. In the example, these safety features are the timer and the fuse. Notice that the removal of the timer and the fuse, the safety features, would remove the AND gates.

AND gates also require a sequential operation of the events. The fuse must fail prior to the motor, and the timer must fail prior to the switch; otherwise, the consequences will be unrelated to the tree output.

An INHIBIT gate is similarly an indication of some safeguard, as there is only a conditional connection between the events. The undesirable event cannot occur, unless a certain condition is satisfied, as well as the input being present.

Thus a safe system will have a considerable number of AND gates and INHIBIT gates in its fault tree. A system with safety features in each branch would be demonstrably safe.