Rapsodie is an originally 24 MWt system cooled by up-flowing sodium which has been uprated to 40 MWt in 1970. It is fueled with mixed pluto­nium-uranium oxide, stainless steel clad, and wire wrapped in 37-pin hexa­gons. The power rating is 340 W/cm3. Figure 4.31 gives the reactor cross section.

The vessel is hung for bottom entry, the loops are nonelevated but are all doubly contained. The two loops join before vessel entry and come in as a single saxophone pipe. Figure 4.31 shows a cross section of the reactor vessel and its nitrogen filled guard vessel. All the circuits have up to 4% natural circulation capability, and they are provided with EM pumps with double check valves.

Six control rods are driven in, and a digital computer is used for trip analysis since there are: 15 scrams on high flux, one each on у activity in vaults, power-to-flow ratio, thermocouples at the reactor outlets, seismic disturbance, and manual trips. In addition there are 84 trips derived from each thermocouple of each subassembly outlet.

Failed fuel detection instrumentation takes the form of delayed neutron detectors in the primary sodium circuit and within the argon cover gas system.

The fuel handling equipment was a very complex machine handling more assemblies than one at one time. This was eventually changed for a simpler device, another instance in which simplicity improved reliability and safety. Emergency cooling is provided inside the double containment.

The dispersion depends critically on wind conditions and the stack height h from which the emission takes place. The basic dispersion equation is

X(x, y, 0) = (Q/novozH) exp[—(h2/2az2) — (y2/2ov2)] (5.5)

where x is the concentration on the ground at (x, y) (Ci/m3); Q is the release rate (Сі/sec); ay, az are the crosswind and vertical plume standard devia­tions (m); й is the mean wind speed at the height of the stack h (m/sec); and x, у are the downwind and crosswind position of the point of interest relative to the stack base (m). In Eq. (5.5) the crosswind and vertical plume standard deviations are both functions of the wind conditions and are therefore tabulated as a function of the Pasquill classification. Thus from this equation the wind dispersive factor xlQ таУ be calculated for insertion into the calculation of the dose by Eq. (5.2).

For a ground concentration directly downwind of the elevated source Eq. (5.5) becomes

X(x, 0, 0) = (Q/nayazu) exp(— h22l2az) (5.6)

Standard tables (13) are available for the plume standard deviations, but the actual calculation is complicated by the necessity of considering different wind conditions existing for different times. Table 6.1 details assumed wind conditions for calculations performed on the Indian Point 2 reactor plant. These conditions include allowance for building wake correction, plume meander, and various Pasquill type winds (C, D, and F) during the total time of 30 days. They give an idea of the various factors which must be included in the calculation. The set of conditions detailed in Table 6.1 are standard comparative data for PWR’s rather than a set of data for the Indian Point site. They are standards set by the AEC’s division of reactor licensing for use in comparative assessments.

To protect the containment building integrity against missiles that might be generated at the reactor vessel head following a core disruptive accident, the source and strength of possible missiles must be assessed. If critical components do become effective missiles, then either barriers or adequate height may have to be provided within the containment design.

Missiles might arise from control rod drives or their shafts, from unused head penetration plugs, from head restraint bolts which snap under impulse by the sodium slug, from whipping cables, or from small components asso­ciated with head equipment.

The energy imparted to each is calculated by a momentum transfer, and the trajectory of the missile may be calculated by the usual mechanics. If the trajectory meets a containment building, the velocity and energy at impact can be calculated in order to find the penetration the missile produces.

The real characteristic of interest is the areal density in lb/ft2, since the missile is more penetrating if it has a large mass and small effective dia­meter. Assuming a missile with weight M (lb), velocity v (ft/sec), area A (in.2) and diameter D(in.), there are a large number of penetration correlations available to relate the energy of the missile to the barrier needed to contain it (32).

For steel, the usual correlation used is the Stanford equation (33)

E/D = (£/46,500) (16,000г2 + 1500 WT/WS) (5.32)

where E is the missile energy, S is the ultimate tensile strength of the steel (psi), T is the barrier thickness (in.), W is the length of a steel square side between rigid supports (in.), and Ws is the length of a standard width (4 in.).

For concrete, the Petry formula is commonly used (34)

d = (KM/A) log10(l + t^2/215,000) (5.33)

This gives the penetration depth d (in.) when K, an experimental coefficient, is obtained for the particular case under consideration. However, the Petry formula is rather optimistic compared to a large number of other formulas that have been derived largely by military and naval research. A recom­mended correlation is

d = (282M/2(£U)Z)2) (D)°-215(v-lO"3)1-* + (D/2) (5.34)

where Sn is the compressive strength of concrete (psi) (55).

Some reactor systems have included specific missile shields built above the vessel head. The Enrico Fermi reactor missile shield completely en­closed the head and included an aluminum absorber section to reduce the missile impact energy. The component is illustrated in Fig. 5.18.

It should be noted that the most efficient missile barrier is distance and therefore it may be possible to specify a minimum ceiling height for the containment or any attendant hot cells so that penetration does not become a problem. Such a possibility will depend largely on layout and refueling method.

External missiles are treated in much the same way. Sources of missiles from such items as a runaway turbine, components of overflying planes, and tornado-driven debris are assessed for the energies involved and their penetrations are calculated by the same formulas as those given above. For very large and improbable external missiles, barriers cannot be provided but it is still necessary to know the probable consequences in order to ensure that the reactor fuel itself would not be damaged and that no radioactive fission products would be released to the atmosphere. Generally, the concern is not with the reactor itself, which is well protected by the massive head plug, but with the spent fuel storage pit which may only be covered by a thin lid, but which, nevertheless, contains a large inventory of fission products.

1.1 Purpose and Plan for Safety

We have to place safety in perspective by first outlining the position of nuclear power in the world power production program and then showing how fast reactors in particular might enter into consideration. Safety is not an absolute science, and it can only be viewed in relation to the questions of how much safety is needed and how much one is prepared to pay for it. These questions will have to be answered ultimately by society itself. For the present we will outline the choices and present a personal answer.

Having now seen that the reactor system consists of a closed loop, in­volving the reactivity, power generation, temperatures, and back to the reactivity, and having seen that there are other feedbacks which operate with different time scales and from different initiators (temperature, flux, fuel composition, and control), it is necessary to see how the whole picture fits together for particular reactor systems.

The safety engineer is interested in setting up a complete model of the system in order to assess the various interactions within the model for their safety in the face of expected and unexpected external and internal disturb­ances. By modeling a fast reactor system and disturbing that model with a flow change which might arise, such as a pump coast-down, he can calcu­late resulting temperatures to determine whether the behavior is acceptable or not.

This section deals primarily with the principles of interacting variables. The next chapter treats specific disturbances to fast reactors cooled by gas, steam, and sodium but here we are concerned with seeing how the safety engineer deduces or calculates what the results of disturbances might be.

2.4.1 System Modeling

Section 1.3 showed that thermal effects formed a link between the power input to the system and the feedback reactivity effects which, in turn, affect power. Thermal modeling was included in the section.

Thermal changes in the system can be system-induced but they can also be induced by external means: (a) inactive loop start-up, (b) heat exchanger rupture, (c) secondary pump failures, (d) feed supply failure, (e) turbine stop-valve closure, or a large number of minor steam cycle malfunctions.

These disturbances will be witnessed by the core as a change in the inlet temperature. This has, in turn, three effects: (a) an immediate coolant re­activity temperature feedback; (b) a delayed Doppler feedback; and (c) a further delayed (by the loop time constant) effect on the inlet temperature.

All these effects may be taken into account in a comprehensive system model such as would describe Fig. 1.20. Some models which do not repre­sent the steam cycle may have to be supplemented by additional calculations performed to produce a perturbation for the model in the form of the inlet temperature as a function of time.

Trips available during such transients are the following: (a) primary signals such as pump control or valve control monitors or steam generator pressure relief signals; (b) thermocouples in secondary and tertiary loops;

(c) heat exchanger primary outlet temperature; and (d) core outlet tempe­rature (eventually). There is considerable time available in steam cycle incidents due to the insulation of the core from the steam cycle by the intermediate or secondary loop. The trips are in order of occurrence. It can be seen that the core is very well protected from this kind of disturbance.

The following differences exist which make some of the AEC general criteria inapplicable to the liquid-metal-cooled fast reactor systems.

(a) The LMFBR is a low-pressure system whereas the LWRs are high- pressure systems.

(b) LMFBR fuel is generally enriched with plutonium, which presents a different radiological hazard from that of iodine and krypton fission products.

(c) The LMFBR plant is cooled with sodium, therefore water systems cannot be used for pressure reduction or for emergency cooling.

(d) A soluble reactivity poison for control purposes is impracticable in a liquid metal system, since no suitable injection systems exist at the present time.

(e) The LMFBR has a different set of reactivity coefficients from a LWR, and therefore the criteria dealing with coefficients deserve different treat­ment.

(f) The LMFBR has a different range of accidents and the design basis accidents are very different ones from those in the LWRs. The AEC criteria refer specifically to the loss-of-coolant (as opposed to loss-of-cooling) acci­dent, which is so critical in the LWR systems.

To clear the charge of inapplicability, a set of fast reactor criteria will necessarily be produced within a few years. At that time there are some omissions that could be rectified; the most outstanding being some classi­fication of accidents, their probability ranges and their allowable conse­quences. This classification could be stated in general terms, whereas at present a classification is only implied in terms of the redundancy required, the emphasis placed on certain accidents, and the definition of an antici­pated operational occurrence (an unlikely fault as defined in Section 3.1.3.2).

Since the original Bethe-Tait calculations (5), the calculation of the energy release has improved significantly in the following ways:

(a) Doppler feedback coefficients are now included; they provide con­siderable amelioration of the energy release.

(b) Reactivity changes are calculated from a worth function D(r) rather than from a one-energy-group perturbation theory and in the latest codes the reactivity changes are continuously computed by a diffusion equation calculation.

(c) The power function is now included as a shaped function.

(d) Two-dimensional geometry is used instead of spherical geometry.

(e) Improved nonthreshold equations of state are now used.

(f) It is to some extent possible to investigate nonhomogeneous auto­catalytic effects to see what aggravation of the accident might be caused.

It has been pointed out that the history of energy release calculations has been marked by a succession of advances in calculational techniques that generally tend to diminish the energy releases calculated and a succession of conjectural physical occurrences, such as an implosion of the core, which tend to give greater explosive values. Fortunately over the years, although the energy release has been a saw-toothed curve, the tendency has generally been downward. So that, although the fast reactors considered have grown larger, the energy releases calculated have not grown markedly. Present day explosive values are at a level where they can be contained in containment barriers which the system might possess for other reasons (e. g., the reactor vessel).

Thirty-three experiments or more are included in the system with a plant factor of about 45%. It has been an extremely reliable system despite the usual crop of minor incidents.

In general, the design was overenthusiastic about scram signals. There are trips on period, flux, sodium level, coolant flow rate, flow rate of change, upper plenum pressure, 12 trips of primary pumps, fire in the building, bulk sodium temperature, and many other temperatures. There are check points against changes in interlocks. As a result scrams occur two or three times a month from these 69 independent signals. Each scram wasted about 8 hr when diagnostic and return to power periods are included. Now the number of trip signals is being reduced. Excessive tripping facilities create an un­healthy and unsafe atmosphere of a nuisance protective system. Operators are under considerable pressure to keep things running and a large number of trips that are spurious create a hazardous frame of mind. On some occa­sions in some plants this has lead to a manual locking out of some sensors. It is far better to include power setbacks in the system and to avoid scrams on selected signals. (It is worthwhile also to note the French experience (37), in which 161 design primary pump trips were eventually reduced to one. This stated that the pump should be tripped if there were no flow. This trip was also removed.)

The Enrico Fermi reactor suffered a complete blockage of two sub­assemblies as a result of a piece of structure being forced free by the coolant flow. The consequences were a melt-down of those subassemblies with some damage to surrounding subassemblies which were only partially blocked. There was no evidence that the failure had spread, although the accident occurred at low power and in an area of low power rating (15a, b).

A good lesson has been learned from this accident and now all LMFBR subassemblies are specifically designed against such blockage. The EBR-II nozzle design is shown in Fig. 5.7 to include side entry paths for the coolant. Most designs now include both vertical and horizontal entry paths. The only possibility for blockage could be a slow build-up of crud due to coolant contamination. Such a slow build-up could be detected either as a local flow reduction in the subassembly or by resulting higher outlet temperatures long before the blockage reached dangerous proportions. However the usual quality assurance programs also ensure that crud is of negligible quantity in the circuit. Thus a total subassembly flow blockage is not a credible CDA initiator.