Local failures are defined here as those which cause local damage within a fuel assembly. The subject deals with the failure of individual fuel pins and the possible propagation of this failure from pin to pin and the sub­sequent possible failure propagation from assembly to assembly.

Section 3.1.1 dealt with fuel failure criteria arising from conditions within a fuel pin at the moment of failure, in particular for the case of fuel under­going a power transient. It also dealt with changes of fuel configuration within the pin during burn-up.

This section is concerned primarily with conditions following failure, especially with how neighboring pins might be affected.

a. Sodium fire. During maintenance a pipe had been plugged at two places and cut. The plugs were being kept frozen by the use of two fans, but a welder switched off one fan that was obstructing his welding operation. The plug then melted and released sodium from the open end of the pipe.

A contributor to the incident was the fact that the rest of the system was pressurized and therefore the sodium emerged under pressure. A fire ensued and a considerable clean-up job resulted.

b. Fuel handling drop. One step in the fuel handling procedure from the core to an in-vessel storage location was designed to give the operator a better feel for what was going on. Thus the only nonautomated part of the handling process was one designed to give the operator some psychological control.

The hold-down device spreads six adjacent assemblies, while a grapple engages the top knob of the subassembly. The operator then, remotely, engages a lifting arm (see Fig. 4.40) below the knob and closes a pin to lock-in the knob. He then performs a “wiggle” test to ensure the connection before the assembly is lifted out and transferred. In this particular case the operator did not fully engage the knob and the pin was closed with the knob out. When lifted, the knob rested on the two ends of the grapple and was lifted out of the core, over a well outside the core but inside the vessel and

Knob on assembly head

Correct operation Incorrect operation

Fig. 4.40. Diagram of a fuel grapple failure in the EBR-II fuel handling incident (43).

then it dropped off. No damage occurred, and the assembly was easily retrieved from a previously installed catch basket in this position.

In this case, total automation might have been safer. The operator is not the most reliable of machines, and the probability of failure is unity in most cases.

c. Lost oscillator bearings. Bearings from an oscillator installed to do some response tests were lost from the oscillator and they jammed the control rod helical drives. However, the safety rods were not affected.

There were a number of contributory factors to this incident also. Bad design specified using ball bearings in the temporary piece of equipment (the oscillator) despite the fact that they were purposely not used in any permanent equipment. There was also a loss of quality control. The bearings were not stainless steel even though they were marked as such.

Experimental reactor systems operate with small shut-down margins and with, in many cases, manual refueling. Thus in college-based experimental systems a refueling fault is not unlikely. Accidents have occurred in which an assembly was dropped into a near-critical core or a control rod was withdrawn (16).

However, in large fast power reactors the system is shut down during refueling by as much as 10% ($ 30) and the only way in which the system could be inadvertently brought to criticality would be by removing a number of control rods completely or by misloading a number of enriched assem­blies from an outer enrichment zone into che central region and then remov­ing one or more control rods. Such a procedure would require a large number of consecutive errors on the part of refueling operating personnel.

In addition, a well designed refueling system will have interlocks and

grapple identifying features that allow the operator to positively identify what type of assembly, be it control or fuel, the refueling machine is han­dling at any time. Interlocks can also be included to prevent removing two control rods sequentially, and procedural controls will also prevent sequen­tial errors.

Thus a refueling accident must be a well planned program of events and cannot be considered a credible CDA initiator in a large fast power reactor system.

The projected time scale for a 800 MWt fast reactor plant might occupy five years as shown in Fig. 6.6. It is worth noting that long term items such as the nuclear vessel and head must be ordered very soon after the PSAR is submitted. These order dates become the critical dates at which the design needs to be fixed to some extent.

The time scale for obtaining a license is very long: this is a public safety factor to allow the most searching reviews by the designers, the utility, the ACRS, and the public. Here again, a balance must be struck between a lack of critical review and an overemphasis of the review period with review for the sake of review. Both extremes can be detrimental to the plant safety.

There is nothing magical about the usual six groups of delayed neutrons, other than the fact that the decay characteristics of a shut-down infinite system can be represented adequately by six exponentials and six yields. These do not vary greatly for thermal or fast fission except in the final value of /9.

There has been some attempt to identify the groups with some predo­minant fission product but after 87Br that corresponds to the first group, there has been no success.

Notice the mathematical progression in anyway. (See Table 1.2.) The progression of Я; values (each approximately e times the previous one) arises from a mathematical matching or peeling of the decay curve rather than from actual fission product decay times.

In some problems where the number of equations makes the problem computationally large, say on an analog computer, or where the effect of delayed neutrons is small, then it is usual to take less than six groups.

A smaller number of groups can be arranged to represent the average behavior very well:

No groups (N — 0). One simply modifies the neutron lifetime in equation 1.10 so that

/ = і* + і Wd

t-i

The equation then gives the correct stable period for small reactivity changes. One group (N — 1). Define Д and A so that:

д = І A, m = iwd (i. i7)

1-І t-1

The equation now satifies the high and low frequency response gain and phase (Fig. 1.4). See also Section 1.5.3 for a frequency response discussion.

Two groups (N = 2). The smallest number of groups with which one can represent delayed neutron behavior adequately is two.

The relevant data can be obtained by matching particular transients, from the in-hour equation, or by matching the transfer function in more detail than for a single group. These methods are all discriminatory in that they relate best to particular transients, to steady periods, or to certain frequency disturbances, respectively. However they all give very adequate results.

Table 1.3 shows figures derived from a transfer function match for a plutonium-fueled reactor. The method is general and can be applied to any reactor system.

Figure 1.5 shows the same transient, a $ 0.5 reactivity decrease as a step, represented by Eqs. (1.10), using different numbers of delayed neutron groups. It can be seen that while the modified effective neutron lifetime model at least gives the correct trend, the two-group representation is very adequate for transient calculations.

Both of the preceding trees are really parts of a tree that has a multiplicity of roots and branches. This is called the multiple-failure tree. It starts with many faults and traces them through the various conditions and events to many terminations. It is more generally used as a survey of the whole of a given system that may then be broken down into critical and more detailed single-failure trees and accident-process trees. It is particul­arly useful in defining the interrelationship between events, systems, and safety features.

Figure 1.31 shows a multiple-failure tree devoted to four major faults that might occur in a sodium-cooled system. Terminations are shown to be mainly of the safe variety (including transient but undamaging over­heating), although a major accident to the core is another termination shown. Safety features abound to inhibit the accident from reaching this termination. Also shown is the importance of the plant protective system in providing for the detection of the abnormality and rapid shut-down. It is the one safety feature that applies across the board to all the faults considered.

PROPAGATION

LOCAL DAMAGE

DETECTION ft SHUT-DOWN

EXTENSIVE CORE —> MELT-DOWN CRITICALITY «… n У———- NO YES-

y£s ‘N PARTIAL MELJ-DOWN RETAINED IN CORE SAFETY*————————————

CORE CATCHER

->MAJOR ACCIDENT

L/1 SO

Fig. 1.31. A multiple-failure fault tree for major reactor system accidents (LMFBR).

Apart from Fermi steam generator problems (Section 4.6), the only fast reactor which has exhibited a substantial instability is the original core of EBR-I. This proved to be the result of a secondary fuel rod bowing effect, by
which a primary prompt positive reactivity change, produced by an original bowing of the fuel rods, was counteracted by a delayed and negative eifect (10).

When the system was brought to power, the fuel rod first bowed inward while supported by the first shield plate and the lower grid plate, but some time later the rod began to be affected by the expansion of the third shield plate which then effectively moved the fuel element away from the center of the core giving a slow negative reactivity coefficient for large power-to — flow ratios (Fig. 2.38).

The diagnosis of this eifect was very difficult but the problem was solved eventually by using a restrained core to prohibit all bowing, including the

original prompt positive effect. The absence of any instability confirmed the analysis.

The easiest way to prevent chemical reactions is to prevent the constit­uents from coming into contact. One would need inerted vaults and con­tainment, absence of water in system, and drainage points for sodium spills.

It should be reiterated that the main safety feature is that the fault should always be detectable and then that remedial action can be taken by the protective system: to scram and to provide emergency core cooling. The criteria (9) which apply to safety features have been discussed in Section 3.3.

Sodium interacts with oxygen according to the reactions:

2Na + iOa-» NaaO 8H = -104 kcal/mole (4.39)

2Na + 02 -» Na2Oa 8H = -20 kcal/mole (4.40)

The interaction is characterized by low flames and dense white oxide smoke, which itself can create a visibility hazard for workers in the area. Once started, enough heat is liberated to maintain the reaction and gradually raise the temperature of the molten sodium.

4.5.1 Pool Fires*

If sodium in a pool is exposed to oxygen, either because sodium is spilled in an air atmosphere or because what should have been an inert atmosphere was somehow contaminated or exchanged for air, then the possibility of a sodium fire is present.

However, the right conditions for that fire must be present. The sodium has an ignition temperature below which it will not ignite but will slowly oxidize. If the sodium surface is undisturbed, the ignition temperature is about 550°F, whereas this might fall to 400°F if the surface were disturbed. On the other hand some cases in which a sodium fire did not occur up to 800°F have been reported. There must be not less that 4% of oxygen pre­sent; otherwise there will only be considerable incandescence and a lot of smoke. This would occur all the way down to 0.1 vol% of oxygen. Humidity in the atmosphere is an important catalyst for a sodium fire.

If, however, a fire does start, the combustion rate is about 0.10-0.3 lb/min — ft2 of surface. This rate would increase with the depth of the pool and decrease with the surface area of the pool. A fairly standard rate used in calculations is 5 lb/hr-ft2.

Heat is generated at the surface and is dissipated from the sides and bottom of the sodium pool, so that there is a temperature gradient within the pool which might reach about 30°F/in. if it were quiescent. Above the surface of the sodium, there is a more severe gradient in “still” air of up to 500°F/in. Sodium fire modeling should take these possibilities into account.

When the sodium has burned completely, it liberates between 4100 and 4850 Btu/lb, although in most cases it does not seem to burn completely, and among the debris there is always unburned sodium.

Having described the units in which radiation is measured, and discussed how radiation relates to biological damage even in the most severe cases, it is necessary to put this information into perspective with the background radiation that is continuously received from the natural environment and then to relate to the allowable radiation doses set by regulatory bodies.

5.1.3.1 Background Radiation

The natural environment gives every individual a dose of approximately 100-600 mrem per year due to cosmic rays and due to radioactive materials in the Earth’s crust. Table 5.3 demonstrates the origin of this natural background.

The natural cosmic ray-induced radiation varies with height above sea level, such that a resident in Denver, Colorado could better than halve his

exposure to cosmic radiation by moving to a new home at sea level. Areas at high altitude such as the Himalayan areas of Tibet are particularly high in this form of background radiation.

Terrestrial radiation also varies with location, the granite areas of France being ten times as high in radioactive background as that of the continental USA, while Kerala, India is another factor 5 higher still.

Added to this natural background are man-made radioactive sources. Table 5.4 shows the origin and levels of some man-made sources. The high rate from medical x rays is being now reduced by the education of operators, more use of shielding, and the use of discriminating x-ray beams. A great deal still remains to be done to limit the indiscriminate use of medical and dental x rays.

In the past, highly radioactive sources were presented to the public out of an ignorance of the consequences: diagnostic x-ray machines for shoe fitting, the use of uranium compounds for coloring yellow bathtubs, further use of uranium compounds in jewelry and watch dials. Many of these sources had very high radioactive levels: the yellow pigment colored bath­tubs gave an average clean individual exposure of some 100 mrem/yr. Many of these practices have now been discontinued with the imposition of modern licensing radiation standards.

Nevertheless, it is apparent that even today man may apparently be content to double his background radiation levels by his own acceptance of man-made radioactivity from such things as x rays and TV sets.

5.1.3.2 The International Commission on Radiological Protection (ICRP)

The ICRP has recommended limits to be placed on the dose that an indi­vidual may incur in the course of his work. These limits, published in 1967, are listed in Table 5.5 (7).