13.50. Core and vessel features are shown in the Fig. 13.11 assembly. Internal pumps at the bottom of the core shroud force the recirculating water-feedwater mix up through the core. A two-stage steam separator and dryer arrangement is provided as in present BWRs. Since there are no large coolant nozzles below the top of the core, a loss-of-coolant accident is unlikely. Control rod drives have been redesigned to permit fine motion. Numerous other design innovations have been made that improve safety and reduce construction time.

Standardization and Certification

13.51. Standardization regulations provided in 10 CFR 52 have been followed for the entire plant package, including the nuclear steam supply system, or “nuclear island,” the “turbine island,” and the radwaste facility. The resulting certification by NRC is a type of prelicensing which should also reduce construction time significantly (§12.240).

15.27. Engineered safety features rely on gravity or stored energy for core cooling and decay heat removal. In the event of a core overheating accident leading to excessive system pressure, relief valves automatically release the steam-reactor coolant mixture to a suppression pool similar to that in present BWRs. Nitrogen is used to inert the containment to reduce the potential for a hydrogen explosion. The system, now at low pressure, is then flooded by gravity with water stored in an elevated pool. Since there are no large pipes attached to the vessel at or below the core level, the core should remain covered for all design basis events. The consequences of a severe accident would be mitigated by gravity-driven dry well flooding.

15.28. Decay heat removal while the system is at full pressure is ac­complished by nonpassive pumps and heat exchangers. However, after blowdown, when the reactor vessel is isolated from the turbine-condenser, decay heat is removed by three passive condensation loops. Following a loss-of-coolant accident, the steam-air-nitrogen mixture in the upper dry — well flows to three condensers which are submerged in a separate elevated water pool which supplies the cooling. Condensate is drained to the gravity — driven injection pool and noncondensable gases are discharged below the surface of the suppression pool. Steam formed in the condenser pool as a result of the 30-MW(th) heat-transfer capacity is vented to the atmosphere. The pool has a capacity to provide 3 days of condenser cooling before water replenishment, which, of course, would normally be accomplished automatically.

15.29. A passive natural circulation air system is used to serve the con­trol room area in the event of station blackout. Since the various core cooling features are also passive, the safety grade emergency diesel gen­erators necessary for present systems can be eliminated.

12.220. A technique for the quantitative assessment of the risks (or probabilities) of specified accidents is based on the use of event trees, in conjunction with the fault tree method just described. An event tree is a graphical means of identifying the various possible consequences of a par­ticular event (or failure) called the initiating event. These consequences depend on the different options that are applicable following the initiating event. Event trees are similar in principle to the “decision trees” widely used in making business decisions. Since the event tree starts with an initiating event, it represents a deductive logic process, whereas the fault tree is inherently inductive.

12.221. An outline of an event tree is depicted in Fig. 12.17, where the initiating event is a large pipe break leading to an LOCA in a nuclear power plant; let Px be the probability of the occurrence of this event, as determined from a fault tree analysis. The next step is to consider whether or not electric power will be available to operate the active engineered safety features. The probability that electric power will fail, as estimated from the appropriate fault tree, is taken as P2. If power (including auxiliary

power) is not available, the active safety features will not operate and the core will be disrupted, leading to a very large release of radioactivity. The probability of this sequence of events, as indicated on the bottom line of Fig. 12.17 is thus Px x P2.

12.222. If electric power is available, the next event to consider is whether or not the ECCS will operate; suppose the probability of failure is found to be P3. Subsequent options are concerned with the fission-product (F. P.) removal system and the containment integrity; the probabilities of failure are P4 and P5, respectively. At each stage, the probability that the system will be available is 1 — P, where P = P2, P3, etc.

12.223. The overall probability of a chain of events, as given at the right of Fig. 12.17, is the product of the probabilities of the individual events in the chain. Hence, the second line from the bottom should include the factor 1 — P2, and the third from the bottom should include (1 — P2) (1 — P4). However, P2, P3, etc., are small and so the values of 1 — P are taken to be unity in each case.

12.224. It is apparent that if the failure probabilities, i. e., Pb P2, P3, etc., were known from the appropriate fault tree analyses for each of the systems in the event tree, the overall probabilities of the different failure consequences could be calculated. Thus, a combination of an event tree with a number of fault trees provides a means for evaluating the risks associated with various conceivable consequences of accidents.

12.225. The foregoing description of an event tree is presented in a simplified form to illustrate the general principle of risk assessment. In practice, several of the systems shown in Fig. 12.17 would be divided into subsystems, each of which would have its own event tree supplemented by the requisite fault trees. As is the case with fault tree analysis, uncertainties are involved in the use of event trees. For example, no allowance is made for the possibility of a partial failure or for a delay before a safety system becomes operable. Nevertheless, risk assessments based on fault trees and event trees are useful in estimating the probabilities of various accident sequences.

14.17. The general startup approach for a BWR is similar to that for a PWR except for the sequence of operations needed to bring the plant on­line. Also, for a BWR, nuclear heat is used in a cold startup to bring the coolant system to temperature and pressure. Therefore, the reactor is brought to critical by control rod removal when cold, but after thorough prestartup checks are made and recirculation at a low rate is initiated.

14.18. An extensive startup procedure calls for bringing the various systems on-line at appropriate stages. The heat-up rate is usually limited to 50°C per hour to avoid thermal stresses in the reactor walls. In the approach to full power following heat-up, there may be a rate restriction to avoid a too rapid increase in the fuel temperature, which could lead to pellet-clad interaction (§7.172) problems.

14.19. During the approach to power, thermal-hydraulic stability must be considered. Many stability studies have been made over the years to predict acceptable conditions which have led to plots using dimensionless parameters. Such variables as operating pressure, heat input, flow rate, and coolant conditions are relevant. More recently, various computer codes such as TRACG [3] have been used for stability analysis. A different type of plot, known as a power map, is shown in Fig. 14.1. This shows typical BWR operating conditions with the natural circulation and minimum re­circulating pump speed ranges indicated. A particularly important feature of such a power map is to show the role of the reactor protection system at varying core power levels and recirculating flow rates. Withdrawal of the control elements is “blocked” at the combination of power and flow indicated by the so-called block line. Conditions leading to reactor trip are also shown. Since the power is measured by several (normally four) average power range monitors, each receiving signals from many detectors through­out the core, the term APRM rod-block is commonly used.

15.53. Should an electrical generating capacity of 1395 MW be desired, a plant would consist of nine reactor modules arranged in three identical 465-MW(el) power blocks, each with its own turbine generator. Thus, smaller plant sizes of 465 MW(el) and 930 MW(el) can be provided by using one or two of the standard power blocks. Steam generators, one for each module, are in a separate building. Thus, only the reactor modules themselves need be constructed to nuclear safety grade standards.

15.54. A summary of important system characteristics is given in Table 15.4. A reactor module is shown in Fig. 15.5. The core immersed in a pool configuration provides large thermal inertia. Primary sodium coolant is circulated by four electromagnetic pumps from an outer compartment of the vessel receiving cold discharge from two intermediate heat exchangers (IHXs) to a high-pressure plenum at the bottom of the core. Heated sodium leaving the core enters the surrounding pool, from which the IHXs are fed. Secondary sodium flow to the IHXs is provided by an electromagnetic pump in the steam generator facility.

REACTOR VESSEL AUXILIARY COOLING SYSTEM (RVACS)

CONTROL — DRIVES (6) "ROTATABLE PLUG „SEISMIC ISOLATORS

-PRIMARY EM PUMP (4) — SPENT FUEL STORAGE (1 Cycle) ‘ METAL FUEL (Oxide Alternative) ‘RADIAL SHIELDING

HIGH PRESSURE PLENUM

Fig. 15.5. Advanced liquid-metal-cooled reactor module (General Electric Co.).

15.55. Decay heat is normally removed by sending steam directly to the condenser. Natural circulation of secondary sodium to the steam generator is one passive backup. A second backup is by natural circulation of at­mospheric air around the containment (guard) vessel in the silo as shown in Fig. 15.5 for the reactor vessel auxiliary cooling system (RVACS).

15.56. The reactor modules, located in underground silos, rest on seis­mic isolators which decouple the systems from horizontal accelerations. Containment is provided by a guard vessel which backs up the primary vessel and an upper containment dome which backs up the head closure. During power operation, all sodium and cover gas service lines are closed with double isolation valves. Although there are no penetrations in the reactor vessel, the reactor vessel and containment vessel are sized so that if a leak should occur, the core and IHX inlets will always remain covered.

13.6. The reactor vessel and internal components for a typical PWR are shown in Fig. 13.1. Control rod drive mechanisms are integral with the removable upper reactor head. Magnetic couplings for these drives are used across the pressure boundary. There are steel pads integral with the coolant nozzles for vessel support. These pads rest on steel base plates atop a structure attached to the concrete foundation. The low-alloy carbon steel vessel is clad on the inside with a minimum thickness of 3 mm of austenitic stainless steel. Neutron shield panels are attached to the core barrel opposite the core corners, where the flux tends to be higher.

General Thermal-Hydraulic Power Thermal 3800 MW Electrical 1300 MW Specific power 33 kW(th)/kg U Power density 102 MW(th)/m3 Coolant Pressure 15.5 MPa(a) (2250 psia) Inlet temp. 293°C (560°F) Outlet temp. 329°C (624°F) Flow rate 18.3 Mg/s (1.45 x 108 lb/ hr) Mass velocity 3.67 Mg/s • m2 (2.7 x 106 lb/hr-ft2) Rod surface heat flux Ave. 0.584 MW/m2 (1.85 x 105 Btu/hr-ft2) Max. 1.46 MW/m2 (4.63 x 105 Btu/hr-ft2) Linear heat rate, ave. 17.5 kW/m (5.33 kW/ft) Steam pressure 7.58 MPa (a) (1100 psia) Core Length 4.17 m (13.7 ft) Diameter 3.37 m (11.1 ft) Fuel Rod, OD 9.5 mm (0.374 in.) Clad thickness 0.57 mm (0.0225 in.) Pellet diameter 8.19 mm (0.3225 in.) Rod lattice pitch 12.6 mm (0.496 in.) Assembly width 214 mm (8.43 in.) Rods per assembly 264 (17 x 17 array) Assemblies 193 Fuel loading, U02 115 x 103 kg (2.54 x 105 lb) Ave. feed enrichment —3.3% Ave. core enrichment —2.8% Burnup 2.85 TJ/kg (33,000 MW • d/t) Control Rod cluster elements 24 per assembly Control assemblies 61 full length, 8 part length

13.7. The coolant water leaving the steam generators flows down the annular region (downcomer) between the vessel wall and the lower core barrel and then upward through the core. Flow holes in the lower core plates are sized to permit a higher coolant flow rate through the center of the core where the power generation is greater than at the periphery. After passing through the core, the coolant enters a common upper plenum and exits through the outlet nozzles to the steam generators.

13.8. Thermocouples entering through the vessel head indicate coolant outlet temperatures from fuel assemblies at selected locations. Movable neutron flux detectors, in guide tubes entering through the bottom of the vessel, can be inserted at various points to determine the power distribution in the core.

13.9. The core contains about 200 assemblies of fuel and control rods; in most of the Westinghouse designs, each assembly consists of a 17 x 17 array. Of the 289 spaces available in an assembly, 264 are occupied by fuel rods; the remaining spaces contain guide tubes (thimbles) for control rods with a central tube available for instrumentation. About one third of the assemblies in the core include control rods; in the other assemblies the guide tubes are partially blocked. The fuel rods in an assembly are sup­ported and separated by grid assemblies at intervals along the length (Fig. 13.2). The top and bottom “nozzles” control the flow of coolant water through the fuel assembly. Because the assemblies are open at the sides, lateral flow of coolant is possible from one assembly to another. This arrangement is in contrast to that in a BWR where the fuel assemblies are enclosed by vertical “channel separators” (§13.32).

13.10. The ratio of hydrogen atoms (in the water) to uranium (in the fuel) is an important parameter in PWR core design [3]. This ratio deter­mines the neutron spectrum which, in turn, affects the extent of resonance capture, the Doppler coefficient, and the fraction of fast-neutron fissions. An increase in the H/U ratio results in decreased resonance capture and hence an increase in reactivity. This means that a lower uranium enrichment is required in the fuel. On the other hand, should the H/U ratio be de­creased, the harder spectrum would result in an increase in the conversion of uranium-238 to plutonium-239. However, with no plutonium being sal­vaged through reprocessing, the present trend is to increase the water/fuel ratio. Present designs have atomic H/U ratios in the range 4.0 to 4.3. This corresponds to a H20/U02 volumetric ratio of about 2. The assemblies listed in Table 13.1 have a water/fuel volumetric ratio of 1.95. One newer design for this 17 x 17 lattice features rods having an outside diameter of 9.144 mm, which would provide a 6 percent increase in the water/fuel volumetric ratio.

13.11. Thermal and hydraulic considerations influence core design. The fuel-rod diameter determines the lattice spacing and thus affects the resist­ance to coolant flow. The selected rod diameter depends on such param­eters as fabrication and cladding costs, desired core power density, and surface heat flux limitations. As the diameter of the fuel rod is decreased, the specific power and power density are increased, assuming a constant volume ratio of water to fuel. The linear heat rate remains constant, but the number of rods per unit core volume is increased as the diameter is decreased. A decrease in fuel-rod diameter, however, also results in an increase in the surface heat flux and thus a closer approach to the DNB

condition (Chapter 9). This factor and the increase in fabrication cost of the larger number of fuel rods set a lower limit to the fuel-rod diameter.

14.50. The cost of decommissioning and the problems associated with the retirement of nuclear power reactors have become issues that have affected public acceptance. Therefore, it is useful to examine some of the considerations involved. One of the requirements for an operating license is to provide reasonable assurance that funds will be available to decom­mission the facility. Detailed requirements for a minimum guarantee of the order of $150 million, with provisions for escalation, are given in 10 CFR 50.75. Therefore, with funding assured, the important considerations are the technical options available and the availability of an experience base to confirm the methods to be used.

13.52. The use of heavy water as a moderator instead of light water permits natural uranium to be used as the fuel. This freedom from the need for enriched uranium has made the concept attractive in several countries, especially in Canada where heavy-water moderated reactors have been developed and operated successfully in commercial power plants. Although other coolants have been suggested and used to some extent, the present discussion will be devoted to reactors of the CANDU (Canadian- Deuterium-Uranium) type in which heavy water is the coolant as well as the moderator.

13.53. A special feature of the CANDU (pressure-tube) reactors is that the heavy-water coolant and the heavy-water moderator are separated from each other forming two completely independent circuits. This is possible because heavy water is a poor neutron absorber; consequently, the moderator — to-fuel ratio can be higher than is acceptable in light-water reactors.* Hence, the fuel rods in a core moderated by heavy water are less tightly packed. Space is thus available for confining the heavy water coolant under pressure (to prevent boiling) in tubes containing the fuel; the moderator, which does not need to be pressurized, surrounds the pressure tubes.

A similar situation arises in graphite-moderated reactors.

STEAM

SEPARATORS

RPV

STABILIZER

LOW

PRESSURE FLOODER & SHUTDOWN COOLING SPARGER

TOP GUIDE

CONTROL ROD GUIDE TUBE

CORE

DIFFERENTIAL

PRESSURE

LINES

THERMAL

INSULATION

REACTOR

INTERNAL

PUMP

CONTROL ROD DRIVE HOUSING

FINE MOTION CONTROL ROD DRIVE

15.30. Similar to the ABWR (§13.49), the SBWR has electrical-hydraulic fine-motion control rod devices. The advanced control system makes wide use of multiplexing and microprocessor-based instrumentation.

15.31. The power generation system has been simplified. For example, an advanced tandem, double-flow turbine permits a more compact con­denser and piping arrangement, reducing the building requirements. Also, as for other advanced plants, the design for the SBWR complete plant package includes numerous subsystem simplifications that utilize factory fabricated modular components which reduce costs and contribute to shorter construction schedules.

12.226. Many code packages are available for the development and analysis of system logic models. Many are specialized depending on the application desired. Although a discussion of such applications is beyond our scope, it is useful to mention several characteristics of fault trees that affect modeling.

12.227. The concept of cut set is important in fault tree analysis. In a collection of basic events, called a cut set, if all of these basic events occur, the top event is guaranteed to occur. In words, a cut set is defined as a set of system events that, if they all occur, will cause system failure. For example, in the simplified fault tree shown in Fig. 12.16, if we have the rupture of both headers A and В, the top event will occur and we have a cut set. A path set is complementary to a cut set in that it consists of a group of events (or failures) which must not occur in order to ensure that the top event will not happen. The path set usually includes events in addition to those in the cut set.

12.228. Since a large system may have thousands of cut sets, it is nec­essary to simplify the analysis by identifying and eliminating subsets which tend to duplicate simpler logic paths and therefore are not essential. There­fore, one class of computer program is used to generate minimal cut sets, usually by Boolean manipulation techniques. A classic code for this pur­pose, known as qualitative evaluation, is MOCUS [29]. Although various codes are available to assist in the actual construction of fault trees by using automated procedures, some level of manual involvement is usually required.

12.229. The next requirement is to carry out a quantitative evaluation by introducing probabilities to the logic gates. For example, an extensive data base exists for the reliability of mechanical and electrical components which can be used in a suitable computer model to calculate the failure probability of the top event. As pointed out in §12.217, the probabilities of each event in a cut set are multiplied together which could result in some very small values to be added at OR logic gates. Thus, some sim­plification is possible. A typical code for quantitative evaluation is WAM — BAM developed by the Electric Power Research Institute [30].

12.230. Various other codes are available for uncertainty analysis and consideration of common cause failures. Since often no data base is avail­able to establish probabilities for many logic gates, expert system proce­dures have been used in recent studies as described in the following section. At any rate, the establishment of confidence levels for the results continues to receive major modeling development attention.