It is hoped that readers have concluded that the design and safety of nuclear power plants are soundly established. In this respect, their antagonists sometimes overlook that researchers and operators live in reactor neighborhoods with wives and families.

Spokespersons for non-nuclear organizations frequently assure us that “lessons have been learned:” yet the same misadventures reoccur. This is not the case with the nuclear industry in that the Three Mile Island and Chernobyl [12] incidents are shown herein to have had a tangible impact. Indeed the latter provoked the shutdown of all Russian — designed RMBK reactors in Germany, and also initiated the interna­tional requirement for water reactors to have negative reactivity void coefficients. Prior to the earlier US incident, Severe Accidents with fuel melting were regarded as hypothetical or just imaginable. Thereafter internationally coordinated research began into their phenomenological dynamics, and legislation demanded a hierarchical operational structure based on technical qualifications, simulator training and plant experience [59,65,91]. In this respect, note that human error aggravated or precipi­tated both incidents. It is also contended herein that the Fukushima incident resulted from a site-planning error rather than from a flawed nuclear technology. Because these reactors lay on the unsheltered East Coast, the enormous tidal surges were able to swamp the emer­gency power supplies for the ECCS. If they had been sited on the West Coast, as some other Japanese plants, they would have been shielded from tsunamis and their successfully initiated neutronic shut­downs by scram rods likewise maintained in spite of the Richter-scale 9 earthquake.

Renewable energy sources, especially windpower, were incipiently greeted with public approbation for their perceived potential to decel­erate global climate change. Indeed a UK government ratified an international agreement for particularly low national carbon emissions believing that renewable energy sources would deliver its promise. Now however the media and an often vociferous public raise concern over renewables’ green credentials and their ability to provide a secure UK electricity supply. If the proposed 18 GW of wind power are lost by not uncommon nationwide high-pressure weather, then despite the pro­posed construction of a European Supergrid [38,39,43], it is argued that the necessary back-up would not always be available. Specifically, Northern Europe has the heaviest industrialization with peak demands in the same winter solstice as the United Kingdom, and their existing aged stations lack the requisite margins. Moreover, Germany’s intention to shut down all its nuclear plants by 2020 clearly exacerbates compe­tition for any available power by the privatized utilities: even if it were to be available. Finally, wind turbines annually produce only some 20% of their rated outputs [36] which intensifies this competition, worsens their economics and necessitates reliable back-up by gas-fired or nuclear stations whose capacity factors are between 80 and 90%.

Actual or potential environmental impacts have been identified for all commercially viable renewable energy sources. For instance the Isle of Thanet wind farm of a nominal 300 MW has a visual impact of over some 3500 ha,[117] whereas the relatively unobtrusive SGHWR generated 100 MWe with over 60% reliability on a total of just 31/2 ha which included car parking areas. The “largest whirlpool in the world” is created when sluices of the La Rance tidal barrage open to capture a rising tide. Rather than being viewed in terms of estuarial damage, it has become a tourist attraction and shortly after construction EDF quietly switched to nuclear power. To place the heroic loss of emergency workers’ lives at Chernobyl in perspective, the catastrophic failure of the Banqiao hydroelectric dam in 1975 resulted in 171,000 fatalities [11], whilst a multi-national IAEA investigation [13] concluded that no subsequent medical conditions could be directly attributed to this crassly initiated and managed nuclear incident. Radioactive releases at Three Mile Island have been calculated to induce just an additional one or two thyroid cancer presentations during the following 20 years, [66] and there were no direct fatalities.

The necessary back-up for renewable generation can be provided only by fossil or nuclear stations. Until carbon capture [56] becomes viable, neither coal nor partially fossilized lignite is likely to be deployed as fuel. Over the past 2 years, there has been a marked shift in the prospects for gas as a result of the enormous quantities of shale gas made available by fracking. Though exploration in the northwest of the United Kingdom has apparently identified commercial quantities, its large-scale exploitation is under review due to concerns over minor earth tremors and possible aquifer pollution. These anxieties appear less relevant in the far less densely populated United States, which has become a potential major exporter of liquefied gas rather than a previous importer. Since 1992 the high thermal efficiencies (‘50%) and favorable cash flows of combined cycle gas turbine (CCGT) plants have resulted in their increasing UK deployment [51,52]. However, a KPMG report [52] concludes that the supply of UK electricity by a continuing investment in CCGT plants alone could not meet government obliga­tions on carbon emissions. In addition, the country is not self-sufficient in gas and so is vulnerable to external political unrest. On this basis nuclear power is argued herein to be a necessary component in a “mix” to guarantee the United Kingdom a secure and reliable electricity supply within its emissions obligations.

As well as largely predictable daily and seasonal changes, there are rapid unpredictable power variations on a Grid network such as the start-up of a 1 MW main-line locomotive or the disconnection of a 1000 MW station due to lightning, a bird strike or component failures [80]. Transient differences between instantaneous power generation and that consumed are shown to create network-wide common frequency fluctuations about the nominal UK value of 50 Hz, and for the explained technical and statutory reasons these fluctuations must be within ± 0.5 Hz. Due to operational rate constraints rapid unexpected changes in power demand cannot be met by modulating the primary energy sources, but only from the thermal energy stored in components of the load-following (Coupled) stations and the rotations of all synchronized motors and generators [80,117]. In this respect gas-fired CCGT stations, preferably with steam drums, are more flexible than PWR and BWR designs whose slower power changes are imposed to achieve economic fuel cycles[118] and the intervention of safety systems. Accordingly, nuclear stations operate in the decoupled mode to supply the more slowly varying and largely predictable base load: as consistent with their larger initial capital costs. The UK mix of CCGT, nuclear and wind power generation as outlined by the government on May 20, 2012, hinges at the time of this writing on consumer price guarantees to attract private equity investment.

An atmospheric release as aerosols of radioactive Iodides and Caesium in the size range 1 to 5 mm is identified as the principal hazard in nuclear power production. However, the dispersed mass would be markedly reduced by dissolution in the large quantities of reactor coolant present [104]. For instance just some 16 curies of the 3 to 5 million in the Three Mile Island reactor were released due to absorption in the water or vapor present in the containment building and its sump [66]. Since then enhanced safety systems, statutory operating protocols and pre-planned public evacuation schemes have been put into place [59,65,91]. It is also required that the aggregate probability of all Severe Accidents with or without an atmospheric release must be no greater than 10“7 per operating year throughout a plant’s lifetime. Reactor safety assessments such as Farmer’s [157] specify a particular station to be safe if and only if the statistically expected increase in cancers from all Severe Accidents during its operational life is orders of magnitude less than from natural causes. Radiological dose rates in such assessments involve variations in local population density and wind-direction statistics. However, they over-predict fatalities because

i. Induced cancers from a radiation dose are calculated from linear extrapolations of data from Japanese A-bomb survivors. Consequently there is no allowance for the natural repair mechanisms of the human body that become effective at much lower doses [66]. For example, the background radiation in the granite city of Aberdeen is three times that in London: yet there is no statistically significant increase in comparable cancers.

ii. Some 1770 cases per million of natural thyroid cancers present annually in the United Kingdom of which 80 to 90% are successfully treated by surgery [163,164].

It is also contended that safety assessments are biased against nuclear power because

a. Risks are assessed without attendant benefits: like some medical vaccinations [169].

b. Humans peculiarly accept much larger self-imposed risks than risks externally imposed, and a cancer risk is to be avoided no matter how slender. Specifically nuclear power is often rejected despite the orders of magnitude greater fatal risks from natural cancers, road traffic accidents and tobacco smoking (see Sec­tion 4.3).

Public concern remains over the storage of nuclear waste. Reference [320] details its classification by activity levels and the appropriate storage technologies. Unlike the atmospheric release of dioxin at Bhopal with an indeterminate active life, radioactivity in nuclear waste reduces to that of mined ores after about 7000 years [320]. To obstruct any environmental release during and beyond this period, a well-researched multi-barrier technology has been developed for high level (highly active) waste. After an initial storage in “ponds” to reduce decay heat the contents of intact fuel pins are glassified before being concreted within copper-clad stainless steel drums. Finally these are embedded in Bentonite clay before being stored in deep igneous rock formations that allow their subsequent inspection or retrieval. The natural fission reactor at Oklo [321] about 1800 million years ago demonstrates that impervious igneous rock strata alone can retain fission products for well over the required time span. With regard to public opinion, 80% of the populations in Sweden’s Forsmark and Oskarsham towns voted in favor of local storage facilities in their neighboring igneous rock tunnels [32].

Commercial nuclear power generation is frequently wrongly asso­ciated with offensive weapons due to the military antecedents of nuclear fission. In fact the economic viability of nuclear power necessitates the fission of just so much U-235 (fuel burn-up) that fissile Pu-239 transmuted from U-238 becomes itself transmuted into the «-emitter Pu-240 in concentrations greater than 7%. Consequently the inseparable plutonium mixture is then unsuitable for weapons. Indeed nuclear power was described in the pioneering days of Calder Hall as “The Peaceful Use of Atomic Energy”.

Power generation by thermal reactors involves less complicated (expensive) engineering than by fast reactors, which for example require intermediate heat exchangers to isolate further the primary circuit’s sodium from steam generators. There is presently no foresee­able shortage of mined uranium, so the fertile-to-fissile fuel-breeding feature of fast reactors has neither strategic nor immediate economic benefit. Accordingly thermal reactors have become the worldwide choice. Section 1.8 shows that water reactors are intrinsically the most compact designs, and because 60 to 70% of a nuclear station’s capital costs reside in civil engineering [74], they are also more cost — effective than grosser AGRs. Though BWRs need neither separate steam generators nor pressurizers, Section 2.3 shows that boiling channels can be unstable, so this apparent advantage is eroded by their lower linear fuel ratings that are necessary to present fuel damage by burn-out [63,64,297]. Other relative disadvantages of BWRs are iden­tified so that PWRs have become the more favoured worldwide choice. Finally, SGHWRs require enrichment of both fuel and moderator (deuterium) with the former necessary to achieve a negative reactivity void coefficient [61]. Consequently, economics have led to their discontinuation despite their reliability and safety having been proved over 1966-90.

[1] See Chapter 4 for the nuclear power plant case. For the Banqiao Dam, the probability of a storm created overflow was assessed [11] as 0.001 p. a., so it was considered safe for 1000 years.

[2] Experience indicates that semiconductors are most likely to fail in a short period after fabrication; hence a manufacturer’s “burnin”.

[3] Fossil-fired stations rank in a merit order corresponding to their annually averaged generation costs per kWh.

[4] Wave devices so far appear unable to meet the sporadic violent storms in the United Kingdom and Australia.

[5] Two 40-minute periods per day around Alderney.

[6] About 80% national capacity.

[7] Output steam density for a PWR boiler is some two decades larger.

[8] Apart from its scheduled annual overall and an insignificant number of short duration trips, its actual capacity factor was 60%.

[9] By using forced draught cooling towers, for example.

[10] With ac transmission, the above P is the average power per phase per cycle (i. e., in one conductor). However, three-phase cables with a constant instantaneous power compare even less favorably as the peak voltage between phases is 3V.

“After commissioning Isle of Thanet, 2010.

The stochastic meanderings of high and low barometric pressure zones across the planet are patently beyond human control. Also a high-pressure region, in which there is little or no wind, can blanket a sizeable portion of a European country for as long as a week thereby disrupting electric power generation. Correspondingly reduced annual capacity factors and installed wind powers [36,37] are illustrated in Table 1.4 for 2005-07.

Though large countries like the United States and Russia can “hedge” by spatially distributing their wind farms, smaller Northern European nations can face major disruptions which are especially critical during their peak winter demand periods. Accordingly, if wind power is to enable a significant reduction in European carbon emissions, a solution to its intrinsic intermittency must be found in order to preserve the security of national power supplies. Due to the withdrawal of govern­ment support from the Severn Barrage scheme, the remaining option for a materially sized renewable UK energy resource is wind power, which is potentially required to be the largest in Europe [42].

Though electrochemical batteries or diesel generators are reliable backups for isolated low-power applications, they are totally nonviable for sizeable offshore wind farms in a national Grid. For instance wind power developments in the United Kingdom have installed, either in construction or in planning a rated 18 GW for operation by 2020. Because this power equates to the output of about 18 large fossil or nuclear stations, radical measures are necessary to secure the national power supply. Toward this end a memorandum of understanding [38,39] was signed in 2009 for the creation of a European Supergrid network at an estimated cost of D30,000M, but construction plans remained under discussion in 2012. In particular, the French-UK ac connector of 2 GW is to be supplemented by dc links from both Norway

[11] To access existing grid connections between Germany, France, Belgium, etc.

[12] See Chapter 3.

[13] Refer to the Basel CH experience in Section 1.2.

[14] See Figure 1.1.

[15] So-called because fissions largely occur at neutron energies around the thermal vibrational energies of the fuel molecules.

[16] Allows a higher fuel temperature than the metal and a longer life.

[17] Using the warm condenser outflow into the Caspian Sea.

[18] Coordinated by the IAEA of the United Nations Organization.

[19] About 100 mrem = 1 mSV.

[20] Half-life 8 days.

[21] At$1 = £0.65.

[22] Presently over 60MWd per kg of U in pristine PWR fuel — Ref. [77].

[23] See Ref. [108] for details of European Utility requirements.

[24] Section 1.8 contends that Fukushima is a site-planning error.

Nuclear Electric Power: Safety, Operation, and Control Aspects, First Edition. J. Brian Knowles.

© 2014 John Wiley & Sons, Inc. Published 2014 by John Wiley & Sons, Inc.

[27] The classical SISO system notion that transfer function zeros are the roots of its scalar numerator polynomial is in fact equivalent to definition (2.12).

[28] Because compensating networks should move them further still to the left.

[29] A linear partial differential equation over all t > 0 has a countably infinite set of eigenvalues, whose eigenvectors are linearly independent [110-111].

[30] Control rods or a start-up source, for example.

[31] Neutronic energies quantized to replicate their slowing down, etc.

[32] Though Table 2.2 lists just five, a sixth results from the interaction of g-rays with heavy water in an SGHWR or CANDU reactor.

[33] Doppler broadening alone affected restabilization of a growing neutron population in the University Argonaut “zero power” reactor at Risley.

[34] Fuel enrichments in thermal and fast reactors are some 3 and 20%, respectively. The inadvertent insertion of a fuel rather than a U-238 breeder pin in a fast reactor could cause a potentially serious neutron excursion, so extreme care is necessary in their refuelling.

[35] Similar situations occur in domestic hot water cisterns and in salt fingers around river estuaries.

[36] Some 2 MW in a 1000 MW(e) station.

[37] Allowances for in-service erosion and tube-to-tube variations.

[38] Some aircraft systems use 400 Hz to reduce core size (i. e., weight), but hysteresis losses are correspondingly greater [35].

[39] Electric intensity is inversely proportional to conductor diameter, so each phase of an overhead supergrid line in the United Kingdom is a tightly bunched bundle of four conductors.

[40] Allowable variations in the axial temperature profile of the SGHWR steam turbine corresponded to between 2 and 3 MW per min.

[41] Used as a means of Network power factor correction via their dc excitation [35].

[42] See Figure 3.9.

[43] For a coal-fired plant.

[44] Coal combustion is initially endothermic.

[45] An electrical machine carries a nameplate stating its (nominal) safe continuous rating, e. g., 33 KV; 500MVA.

[46] Refer to the fast reactor drum water-level control by Hughes in Section 3.1.

[47] If an increase in the scalar controller gain causes instability, the system is termed Conditionally Stable.

[48] Refer to Section 4.1

[49] CFR was never built, as attention moved to a European design (EFR) which also never materialized.

[50] A simulation of Jointed Construction for Boiler and Rig Kinetics, which was subsequently extended to include reactor, steam drum, feed train, and steam turbine modules. It was developed by Drs. A. Robins, D. Farrier and the author several years earlier.

[51] Given an electrically powered feed pump.

[52] This viewpoint is adopted in Reference [57].

[53] An aircraft impact on the containment is one exception; see Missile Studies Section 6.4.

[54] A double-offset shear-break of a cold leg of a PWR with all emergency cooling systems functional is one example of such a limiting event. US federal regulations require statements of modelling assumptions and risk assessment criteria.

[55] All exposed to a radiation hazard wear an obligatory film badge or monitor while on duty.

[56] Current evidence suggests that caesium iodides are the forms present in a fuel element, but their stability on release depends on temperature and the reducing or oxidizing character of the environment [104].

[57] Principally the b and g emitter I-131 with a half-life of about 8 days.

[58] Discoverer of the poliomyelitis vaccine.

[59] E. g., 0.1 ± 0.001 indicates a very well-understood phenomenon.

[60] 1 curie = 3.7 x 1010 Bq; 1 Sv = 100 rem and 1 man-rem is an individual dose of 1 rem.

[61] Clearly dependent on location.

[62] Very conservative; see statement (4-2-4).

[63] This is evidence of our body’s self-repair mechanisms, and the pessimism of a linear extrapolation of A-bomb casualty statistics.

[64] A natural convective heat exchanger with a NaK primary side and an atmospheric secondary side.

[65] Satisfactory reactor siting, as described in Section 4.4, involves local population density, weather patterns, and seismic activity.

[66] Neutron absorptions create Co-60, which is a penetrating g-emitter with a half-life of 5 years.

[67] As Low As Reasonably Practical.

[68] Earlier PWRs like Three Mile Island have just two.

[69] Calculations indicate no less than 1 hour, so there is time for emergency reconfigurations of a plant [65,93] or even attaching civilian fire pumps. For the fast reactor situation, refer to Reference 213.

[70] By virtue of the complex physical processes and uncertainties about physical properties, Severe Accident calculations are required to be only reasonably conservative, rather than the ±10% for normal engineering design.

[71] For example, civilian fire pumps [65].

[72] A detonation (rather than a deflagration) is characterized by a pressure wave spatially in front of a reaction [203]. ”Pinking” in petrol engines is a well-known example of an unwanted detonation rather than a deflagration.

[73] By increasing surface contact areas and decreasing heat diffusion distances.

[74] Refer to Section 5.6.

[75] Hereafter simply “coarse mixture” denotes the detonatable portion of melt.

[76] Thermal radiation flux is proportional to the 4th power of absolute temperature.

[77] Established by repetitions of this recovery procedure. Also individual debris particles are microscopically smooth with a water coolant, but they are pitted in the case of a sodium coolant, which suggests a chemical attack.

[78] See Section 5.5.

[79] Thermal diffusivities of liquid sodium and water are 50 x 10~6 and 0.14 x 10~6m2/s respectively.

[80] That is, without a shock wave.

[81] See Section 5.4.

[82] In a water reactor.

[83] See Ref. [206].

[84] Equation 4-5 in Ref. [219], which assumes the local speed of light is that in vacuo [218].

[85] — wavelength; r — electrical resistivity of the conductor m — magnetic permeability; c — speed of light in the conductor

In the case of liquid sodium, equation (5.24) reduces to

lab ‘ 13лА mm

which shows that a radiated heat flux entering the liquid is effectively absorbed at the actual interface. Similar to equation (5.20) the thermal radiation flux entering the interfacial liquid sodium [219] is derived as

(5.25)

Due to surface contamination the total emissivity of a sodium surface in Severe Accident conditions is certainly larger than the value measured [228] under clinically clean laboratory conditions as

el = 0.05

The total heat flux entering and absorbed by the interfacial liquid sodium with respect to the coordinate system in Figure 5.4 is therefore

[86] The Lax-Wendroff solution [238] scheme introduces artificial viscosity and thermal conductivity to achieve numerical stability.

[87] Thermophysical properties of molten urania vary markedly with temperature [245].

[88] For a source TM ^ TL; h ‘ aTM where a is the Stefan-Boltzmann constant.

[89] About 60 ms for a complete discharge from the MFTF thermite container.

[90] An unknown, but see later.

[91] Forty percent of fine fragmentation is found in some CORECT2 experiments [86], but this is more likely to result from multiple incoherent interactions and/or the debris recovery process from a sodium coolant.

[92] Refer to Section 5.2. Portions of a melt solidify or fail to develop the detonatable morphology.

[93] The ratio £(.D3)/£(D2) is often termed the Sauter diameter [308].

[94] The embedded BURST subroutine was developed by Dr. Kier at UKAEA, Culcheth.

[95] Hence the use of deaerators in boiler feed trains.

Nuclear Electric Power: Safety, Operation, and Control Aspects, First Edition. J. Brian Knowles.

© 2014 John Wiley & Sons, Inc. Published 2014 by John Wiley & Sons, Inc.

[97] An exceptional use of sodium is described in Ref. [271].

[98] A three-dimensional calculation is crucial for a reinforced concrete impact [275].

[99] Visualize shock propagation in terms of a cascade of lossy spring-linked point masses.

[100] At speeds as high as 100 m/s (216 mph).

where F is a homogeneous function. Based on the above, Buckingham’s Pi-Theorem asserts that

“The physical measure Pi of a quantity which depends only on other quantities with measures P2, P3,… Pn reduces to one with the minimum number m of their non-dimensional combinations.”

Its interpretation in physical terms is that two realizations of a process with the same complete set of Pi-terms have the same dynamic behavior.

Though a systematic procedure [280] exists for deriving the dimen­sionless Pi-terms of a physical process, those describing the interaction between a missile and a structure can be determined by physical insight when there is a negligible temperature rise in the latter from its plastic deformation. Table 6.2 lists the determining variables under this condi­tion, and the pertinent dimensionless terms can be deduced by adopting missile diameter, target density and target strength as the reference parameters. These can then be combined with impact velocity to provide the additional Pi-terms to characterize the target response as

F = (VyfpJS; h/d; L/d; r/d; w/d; a; b; Pm/Pt; s/S, e) = 0 (6.3)

[102] Different materials from a prototype are sometimes used: see Ref. [297], for example.

[103] Same Pi-terms.

[104] Percent EWEF — % of a cross-sectional area occupied by the same square (EW) steel mesh reinforcement just below the surface of each panel face.

Nuclear Electric Power: Safety, Operation, and Control Aspects, First Edition. J. Brian Knowles.

© 2014 John Wiley & Sons, Inc. Published 2014 by John Wiley & Sons, Inc.

[106] Reactor and boiler channels are routinely cleaned chemically during regular maintenance to minimize pumping power so as to promote efficiency.

[107] Output demand rather than reactor power to provide anticipatory control; see Section 3.1.

[108] A UK terminology when observed in the SGHWR around 1967 [301].

[109] See Refs. [63,64,117,297]. Burn-out can also occur as a result of nodules of higher enrichment appearing in a later manufactured batch of lower enrichment [301] fuel, or if porous magnetite deposits (crud) on fuel elements have their capillaries blocked by copper salts released from steam condensers [95]. After Dr. G. R. Hewitt identified the mechanism at AERE Harwell, it became known as dry-out, which is a more graphic description than CHF or burn-out for boilers.

[110] Temperature-induced density changes in water increase with decreasing pressure [208,209].

[111] Some PWRs have their lower head submerged in water to preserve its creep strength [315].

[112] See Section 5.8 regarding heat transfer with fine droplets.

[113] No “intelligent” signal inputs (i. e., activation and operation within the system itself).

2. Neither external power supplies nor forces required.

3. No moving mechanical parts.

4. No moving working fluids.

[114] Amounts of corium were also found in two steam generators and the pressurizer of TMI-2 [69].

[115] Higher porosities might have resulted from “Hanging fuel assemblies and control rods strewn about like pick-up sticks on top of a bed of rubble;” see Ref. [69] for the video image.

[116] Noble gas, iodine, and cesium isotopes vaporize out and so are excluded in this calculation.

[117] 1 ha approximates to 1 football pitch.

[118] By restricting differential thermal expansion between fuel pellets and clad.

The previous examples illustrate the practical value of linearized models in solving operational problems in both fossil and nuclear power stations. However, the large rapid power variations in accident situations invalidate linear models, and comprehensive non-linear simulations are crucial in order to provide confirmation that internal plant constraint boundaries are never breached (e. g., boiler and turbine temperature profiles). Statistics [59,65] indicate that a station’s con­nection to its Grid network will almost certainly be disrupted during normal operation by impacts on transmission lines from large birds, aircraft or lightning. Granted a functioning reactor shutdown (scram) system, a particular accident control strategy must be devised to restrict the induced thermal stresses across the plant so that its longevity is not compromised. For example a temperature difference of some 100 °C across a steam-generator tube potentially causes rupture. This fault situation belongs to a set of so-called Design Base Accidents,[48] and the following fast reactor example in Figure 3.9 demonstrates the necessity of

i. industry specific experience,

ii. a transparent one-to-one relationship between control and controlled variables, and

iii. a thoroughly validated non-linear simulation, for which the experimental data are acquired as far as possible from broadly similar plants and electrically powered heat-transfer rigs.

Because power is no longer extracted from a station’s turbo­alternators after a Grid disconnection, their steam control valves (TCVs) must be abruptly closed to prevent over-speeding and conse­quential damage. In the assumed circumstances, a safe shutdown of the nuclear chain reaction is achieved by unlatching a more than sufficient number of gravity-driven absorber-rods. Though the chain reaction is terminated, some 6% of pre-trip reactor power is initially produced from the radioactive decay of fission products and the significant thermal energy residing in plant coolants and metalwork [117,118]. The correspondingly diminished steam production can evidently be dissipated in the station’s condensers for which purpose heat transfer processes are first maintained by emergency power supplies and then by the promoted natural circulation. Thermodynamic efficiency is gener­ally promoted by preheating boiler feed water with steam bled from a number of points along a turbine, so closure of the TCVs causes a rapid fall in feed water temperature. The sodium coolant in fast reactors has an especially large thermal capacity and provides a highly efficient mode of heat transfer [64] which in these circumstances could aggravate temperature differences across tubes of the counter-flow steam genera­tors and Intermediate Heat Exchangers (IHXs). With a full recirculation boiler design [117,142] (Lamont), preheated feedstock from a deaerator is usually injected downwards [117] along the length of a steam drum or occasionally into downcomers, so as to make up some 10% of the boiler input. Consequently, water-inlet temperatures with this design are well buffered thereby reducing the induced hoop stresses in boiler tubing. However, economic considerations favor fast reactor stations with once — through boilers (Benson) [117] without a steam drum, so water-inlet temperatures can therefore change far more rapidly to aggravate the potential for damaging thermal shocks. Accordingly, some fast reactor

Figure 3.9 Once-Through Boiler Fast Reactor Simulation for a Grid Disconnection in a DBA at Full Load

plant designers in the United States advocate [152] an extra standby tank of preheated feed water. However, a simply implemented trip sequence for once-through boilers in fast reactor stations is now described that achieves acceptable thermal stresses without any addi­tional capital equipment [141].

A schematic diagram for the fast-reactor system under considera­tion is shown in Figure 3.9, and it includes components considered for a proposed. British commercial system (CFR) with helically tubed once-through boilers.[49] The plant actually consists of one reactor, eight counter-flow IHXs, four counter-flow boiler units and two turbo­alternators to generate an electrical output of 1320 MW. For detailed non-linear digital simulation studies with the JCBARK[50] program, symmetrical operation at full-power is first investigated. A typical or average channel is modelled for the reactor, IHXs and boilers with the actual power transfers derived by straightforward linear scaling. After the TCVs and reactor scram-rods are abruptly tripped [58], it is proposed that the primary and secondary sodium pumps are operated with mass flow rate control (rather than the more usual speed) to effect

W 1s(t) = 0.1 + [W 1S(0) — 0.1](1 + t/12) 1 — primary kg/s

W2s(t) = 0.1 + [W2S(0) — 0.1](1 + t/12)-1 — secondary kg/s

(3.14)

Matched primary and secondary sodium flows as above prevent exces­sive temperature differences and thereby damaging hoop stresses in IHX tubing. Over-pressurization of the steam generators is mitigated by steam dumping [142] which as a percentage wD of the full-load value is according to

wD = 0 for P < 165 bar

wD = 80(P — 165)/8.75 for 165 < P < 173.75bar (3.15)

wD = 80 for P > 173.75 bar I

Due to preheated water held initially in the feed trains and deaerators, the inlet water flow can be maintained for 10 s before colder liquid begins to enter the boiler unit with the shortest feed main. At this point in time tfeed the water feed pumps’ set point and control valves are switched to match the natural recirculation rates for the primary and secondary sodium circuits. The form of the waterside heat-transfer correlations suggests that this artifice broadly attenuates temporal rates of boiler-tube temperature changes by the inverse ratio of the pre-trip water-inlet flow rate to that existing any time thereafter. In addition to mitigating thermal stresses, the proposed shutdown strategy attempts to conserve density disparities between “hot and cold legs” of the sodium circuit so as to encourage natural circulation.

Simulated inlet and outlet temperatures for the IHXs in Figure 3.10 and the inlet temperatures of a steam generator in Figure 3.11 confirm the effectiveness of the proposed accident-control procedure for the full-load situation with tfeed = 10 s. Corresponding normalized waterside inlet and outlet flows in Figure 3.12 clearly reveal the closure of the TCVs, the opening of the steam dump to the station’s condensers, and the feed water flow switch at 10 s. Individual feed mains vary in length, and those of the PFR at Dounreay corresponded to a delay tfeed of 10-14 s. Robustness of the proposed control strategy is demonstrated by the predicted temperature transients in Figures 3.13 and 3.14, with the longest feed-water flow switch at 14 s. Though temperature changes at a boiler inlet have somewhat larger excursions

Figure 3.11 Waterside Temperatures rfeed = 10 s

than before, they remain acceptable and IHX temperatures are hardly affected. Because radioactive decay power decreases with pre-trip reactor power and time, a full-load trip appears as the worst-case scenario [59]. Additional simulation results (not shown) for a range of load factors and tfeed = 14 s confirm this inference as well as the desirability of identical primary and secondary sodium-pump run-down rates.

Industry-specific experience and a thoroughly validated non-linear simulation have been shown to be essential for devising normal and

_i_

150

accident control strategies in nuclear power plants at the preconstruc­tion stage. With this simulation available, Nyquist techniques using real frequency responses are the obvious choice for designing controllers for normal maneuvres. Personal experience and this example also suggest that ad hoc accident-control strategies cannot be humanly conceived if a controlled variable were to be a function of several control variables (i. e., via a scalar matrix). The interventions of reactor safety trip — systems and acceptable rates of thermal change intrinsically impose markedly different response times for the controlled variables in nuclear and fossil-fired power stations. These result in the desirable one-to-one

relationships between the control and controlled variables as illustrated in Sections 3.1,[51] 3.2, and 3.3. Widely different response times were also engineered in early self-adaptive systems for oil-well drilling [153], missiles [154] and communication receivers [155] in order to create more tractable SISO control problems.

Liquids possess elasticity as well as mass, so the interfacial liquid in Figure 5.4 does not move in unison with the application of a trigger pulse at its far end. Such lack of concomitance is often irrelevant, but here a typical experimental film destabilization period [207] of 20 ms is comparable with the 67 ms transit time of a pressure pulse. Conse­quently as illustrated in Figure 5.5, a distributed model of shock propagation is necessary, though some simulations [21,225,226] feature only point models. Moving boundaries often pose additional degrees of analytical difficulty, which are aggravated here by heat and mass transport phenomena. However, according to equation (5.23), heat diffuses only 3.5 mm during film collapse whilst the pressure shock travels16 about 0.3 m. Moreover, the mass of a 100 mm of steam film is totally negligible in relation to that of the 100 mm liquid slug. Thus heat diffusion and shock dynamics in the liquid can be advantageously decoupled (i. e., solved independently). Like other moving boundary problems, one-dimensional shock propagation is best formulated in terms of the “constant mass packet” Lagrangian equations (momentum) (5.31)

(mass) (5.32)

V = V

@I p dv dt dt

(energy) (5.33)

16 The isentropic sonic speed of 1500 m/s is slightly slower than the weak anisentropic shock propagation of a trigger.

P = P(I, v) (thermodynamic state) (5.35)

where

z — particle displacement along the x-coordinate axis (m)

V — particle velocity (m/s); P — pressure (Pa) v — specific volume (m3/kg); I — specific internal energy (J/kg) vo — unshocked specific volume

An experimental correlation relates the wave speed Xs to particle velocity and for water this takes the form

Xs = bo + biV + &V2 (5.36)

Published data [208,209] shows that the sonic speed c with

@P

c2 = — : S — entropy (5.37)

@P S constant

is strongly dependent on temperature but only weakly so on pressure, and therefore similarly for bo, bi, and b2. Because thermodynamic equilibrium is rapidly regained across a shock front, the Rankine — Hugoniot equations [203] closely approximate pressure and energy changes. Accordingly, close to a Rankine-Hugoniot curve the relation­ship between pressure and internal energy is found to be represented [237] by

P(y)= Po + G(v)(I — I °)/v (5.38)

with the appropriate constant value for the Gruneisen function Q.

Integration over the moving mesh points in the liquid and vapor is effected by Leibnitz’s theorem [112] to provide first of all ordinary differential equations, and then the required difference equations [206]. A necessary condition for the von Neumann Stability of the adopted explicit solution scheme is [208] where Ncfl is the Courant-Friedrichs-Levy Number. Because triggers evolve as relatively weak shocks their propagation is approximately sonic, so for water around STP

Ncfl = 1500 (dt/dx) < 1 (5.40)

The water slug approaches the (assumed) rigid melt according to the calculation

zn+1 = Z + Vn+1 dt; zn = z(k; ndt) (5.41)

and numerical breakdown is prevented by progressively reducing the time step with decreasing film thickness. Though explicit solutions [203,238] of the Lagrangian equations without added viscosity and thermal conductivity[86] lead to the progressive sharpening of a shock front, and then often to computational failure, the adopted solution scheme appears stable.

Neglecting relaxation effects [210,211], Fourier’s heat conduction equation and the first law of thermodynamics describe one-dimensional heat diffusion in an isotropic semi-infinite slab by [224]

@ T d2T

= a with a — thermal diffusivity = к/рЄр (5.42)

ot ox2

Corresponding central-space and backward-time linear difference equa­tions for a fixed or moving mesh have tridiagonal structures which are solvable by Gaussian elimination, but preserving second-order spatial accuracy at the boundaries requires special care [117,206]. Necessary and sufficient conditions for this solution procedure to be stable with a fixed Eulerian mesh are [238]

adt/(dx)2 <x/2 (5.43)

Low liquid compressibility and the relatively small mass of vapor ensure that matrix terms for the moving mesh are largely those for a fixed mesh.

Consequently, equation (5.43) is adjudged apposite for present pur­poses. During the time step of a shock-wave calculation, the thermal penetration distance in water evaluates from equation (5.22) as only 0.8 mm. Using this guide, sensibly converged thermal diffusion calculations are obtained with the lattice parameters

St = 1ms ; Sz = 1mm for which aSt/(Sx)2 = 0.16

Attempted shock calculations with these values would have Ncfl = 1500, so justifying the suggested decoupling of shock and heat diffusion calculations.

If the outer surface of a semi-infinite slab of an isotropic conductor is abruptly changed by T*, then according to equation (5.42), a temperature wave diffuses into its interior as

T(x, t) = T*erfc(yX/4<xt^ (5.44)

In order that T/T* ‘ 0.01, published tables [239] give

x/4a t = (1.83)2

Molten urania has a thermal diffusivity of order[87] 2 x 10“6 m2/s, so the penetration distance is 26.8t microns. Experiments [207] show that steam film destabilization occurs in far less than 1 s, so that negligible temperature change occurs at the far end of a simulated 30 mm thickness of melt. Furthermore, during the time step of a shock wave calculation, the thermal penetration in the urania is about 2.8 mm. Accordingly, satisfactory heat diffusion calculations in the molten urania are accom­plished with the lattice parameters

St = 1ms ; Sx = 3 mm for which aSt/(Sx)2 = 0.22

The previously justified uniform pressure in a simulated vapor film renders momentum conservation unnecessary, but mass and energy conservation still require formulation due to interfacial transport. Intuitively or formally from the Rankine-Hugoniot mass conservation equation, vapor particles in contact with the melt have zero velocity. Just one intermediate mesh point between liquid and vapor is recommended in order to ease numerical problems as the film approaches collapse. Now with respect to mass conservation for example, a linear spatial variation of particle velocity V across the thin film is reasonable so

V = vgb(z — Zb)/(zmb — Zb) (5.45)

where

VGb — interfacial vapor particle velocity

zB — interfacial position; zMB — melt position (fixed)

The Rankine-Hugoniot mass conservation equation then yields the interfacial velocity as

t

Zb = VLb — vlbGb with zb = j Zb (Z)dZ (5.46)

0

and mass conservation for the film as a whole in terms of the mid-point density ~G is evidently

d [(zmb — Zb)~g] — Gb = 0 with vg = 1/~g (5.47)

at

Reference [233] details all the required finite difference equations, physical processes and the flow chart for a digital simulation. It also demonstrates that in this situation the Knudsen effect [244] does not compromise Fourier’s heat-conduction equation. Though physical pro­cesses are usually described for both sodium and water, simulations concern only the latter. This bias occurs because steam film destabi­lization experiments are far more tractable, less expensive and were more immediate to the safety case for Sizewell B.

Cine recordings at AEEW of molten urania poured into water at 0.1 MPa depict an agglomerate of melt and steam descending in the coolant. Prior to a trigger, a state of disequilibrium exists in which latent heat transfer diffuses into the surrounding liquid that is continuously replenished and cooled by the induced turbulence. To replicate something of this situation in a simulation, the temperature of the surrounding mass
of water is taken as a uniform 20 °C at 0.1 MPa except for an initially saturated value at the interface. Initial temperatures of a 100 mm thick steam film are assumed saturated throughout, and the melt temperature is taken as 3000 °C. A simulation begins with a 50 ms-5 MPa trigger at the remote end of a 100 mm water column, and the resulting interfacial kinetics and temperatures are shown in Figure 5.8. Prior the shock front’s arrival at the interface, a state of quasi-equilibrium appears after initially strong interfacial condensation. Despite the subsequently weaker evap­oration and the absence of lateral mass convection in the model, the essentially constant film thickness in this period can be justified by a straightforward energy balance using Table 5.2. After a delay of 66 ms, the shock front arrives at the interface whose displacement to some 8 mm from the melt in 20 ms is largely unresisted. Due to the water column’s inertia, small oscillations occur but actual liquid-melt contact is pre­vented by interfacial evaporation from molecular conduction across the now much thinner film. The absence of a material increase in steam pressure during film collapse is supported by experiments [207] that involve an independent calculation of initial film thickness and the following analysis [206] of its collapse time as a function of trigger pressure.

A simulated trigger pulse appears as a weak shock with an almost (isentropic) sonic propagation speed, so the linear wave equation approximates water slug kinetics by

@2z _ 2 @2z dt2 C dx2

where

Under experimental conditions, the Acoustic Impedances19 of water and steam are respectively

ZL = 1.5 x 106 kg/m2 — s and ZG = 2.8 x 102 kg/m2 — s

19 In general Z = pc.

-10 • -20 —

Figure 5.8 Typical Simulation Results for a Melt Temperature of 3000 °C which yield the interfacial reflection coefficient

Г 4 (ZG — ZL)/(ZG + ZL)’-1 (5.49)

and this matches the essentially unresisted simulated motion of a liquid-vapor interface. Laplace transform analysis of equation (5.48) for a step function trigger of amplitude PT and the boundary condition in equation (5.49) gives the transformed interfacial velocity

VB = PT[(2/sZL)exp — 2st]exp — 2snt

n=0

where

t — one sonic transit time along the liquid slug = slug length/c n — number of forward and backward transits

In the simulated and experimental situations, film collapse occurs after just one transmit time so the relevant interfacial velocity is

VB = 2PT/ZL for t > t = 0 otherwise

Hence the predicted time for film collapse is

Tc = (Initial film thickness)/(2PT/ZL) (5.50)

Experimental measurements [207] using an electrical probe and an initial film thickness derived from an independent model confirm the above for a solid heat transfer surface below 500 °C.

Computer simulations predict that a steam film over molten urania largely fails to oppose its collapse by a weak shock wave. This prediction is supported by specific steam-film collapse experiments, and MFCI urania tests with sodium or water which are triggered by just the modes of contact. Reactor safety assessments must therefore assume a priori that a contact between molten corium and coolant would produce an MFCI. Moot questions remain concerning the quantity of participating melt and the mechanical energy released (yield). With specific regard to the cited aluminum-water tests in Rig A, Table 5.2 and the discussion of the results in Figure 5.8 suggest that hydrogen generation enhances the thermal conductivity of the steam film, and thereby its stability to the point where a military explosive trigger becomes necessary.

Natural uranium consists for the most part of very weakly fissile U-238 and 0.7% of highly fissile U-235. In broad statistical terms, neutrons in the natural substance very largely encounter U-238 atoms which usually slow them down. When neutronic energies are reduced to between 0.1 and 1.0 eV they are captured by the pronounced resonance absorption bands [58] of U-238 nuclei, which together with surface leakage obstructs a self-sustaining chain reaction in the natural material.

Thermal[15] nuclear reactors achieve a self-sustaining reaction by embedding uranium oxide[16] fuel rods in a carefully contrived matrix of moderating material. Collisions with moderator nuclei reduce neutronic energies to below the U-238 absorption bands in a short distance after fission, so thereafter fission with very largely U-235 atoms takes place to create a self-sustaining reaction with 32 pJ of heat released per fission. Moderators are usually constructed from graphite (AGR), heavy water (CANDU), light water (PWR, BWR) or a composite of any two of these (RMBK, SGHWR). The fissile concentration (enrichment) is often increased radially to an average of around 3% in order to achieve a more uniform and therefore more cost-effective power production. Unlike heavy water, light water is both an effective moderator and absorber [58], so its conversion to less dense steam reduces both neutron moderation and absorption. By astute design of core-lattice geometry and fuel enrichment, light water reactors outside Russia have always been designed to become under-moderated with increasing steam production [61], and this policy is vindicated by the Chernobyl disaster [12]. Indeed a negative power reactivity coefficient is now a necessary prerequisite for licensing by European Regulatory Authorities.

A self-sustaining chain reaction is achieved in a fast reactor by ensuring that the average neutronic energy remains well above the absorption resonances of U-238. Inelastic scattering and parasitic absorption of fast neutrons are overcome by a typically 20% enrichment

3

with a mix of U-235 and Pu-239 oxides. The power density (W/m ) is consequently so large that individual fuel pins can have only small diameters (‘ 5 mm). To avoid a significant moderation of neutronic energies these pins are closely spaced in hexagonal subassemblies and cooled by liquid sodium. Though parasitic absorption in structures and fission products (e. g., Xe-135) is relatively less in fast reactors, damage mechanisms are clearly aggravated and careful choices of materials are necessary. For example, liquid sodium leaches out carbon from stainless steel, so this fuel cladding must be niobium stabilized. Despite higher fuel fabrication costs than a thermal reactor, research has doubled its in-service life and capital installation costs are somewhat offset by a smaller reactor core. Uranium for the Russian nuclear program and Skandia for rocket motor exhausts were found in a very remote region around Aktau. Power, desalinated water and fish (farmed sturgeon[17]) for the mining complex were provided during 1973-94 by the BN350 fast reactor: chosen perhaps for the easier transport of its relatively smaller core. The unique advantage of fast reactors resides in their better “neutron economy” which enables the production of more fissionable material than that consumed. For this purpose the core of highly enriched subassemblies is surrounded by breeding blankets of natural uranium to give

U-238 + 1 neutron! Pu-239 fissile (1.10)

If the existing stock of UK nuclear materials were to be used in this way, the estimated energy would be comparable with recoverable coal reserves [60]. However, with uranium now so plentiful, economics and strategy favor the construction of thermal reactors, whose choice is now considered.

The engineered slowing down of neutrons from around 2 MeV at fission to thermalization at 0.025 eV is almost entirely done by elastic collisions with moderator nuclei. Applying the law of conservation of momentum and assuming spherically symmetric scattering in a center of mass coordinates the mean logarithmic decrement j of neutronic energy per collision is given by [58,61]

j = 1 + — log a with a = (A — 1/A + 1)2 (1.11)

where A is the mass number of moderator nuclei. A logarithmic compression is appropriate by virtue of the wide energy range involved. Though an effective moderator has a large j, the probability of colliding with a nucleus must also be large. Hence, the slowing down power of moderator is defined as j^s where ^s is its macroscopic scattering

supplies the saturated steam component of its 2-phase output [62] to steam turbines. By allowing water to boil at the lower pressure of 7-2 MPa, a BWR needs neither steam generators nor a pressurizer. Though the lower operating pressure appears to further reduce initial capital cost by way of thinner pressure vessels, core dimensions must be increased for the lower linear fuel rating (W/m) which is necessary to prevent a damaging dryout transition from nucleate boiling [63,64]. Also as described in Chapter 3, steam in boiling subchannels can give rise to flow instability which is another potential source of fuel damage. Furthermore, power control in a BWR is patently complicated by interactions between internal steam volumes, coolant flow rate and the insertions of its cruciform control rods. Despite the additional costs of components and a thicker pressure vessel to inhibit nucleate boiling at 15.5 MPa, PWRs are more generally favored as they are cost-effective in avoiding the above design and other operational or safety issues. Specifically, in the rare event of fuel melting, the separate steam- generator units of a PWR provide an excellent heat sink24 and additional isolation between the reactor and its environment. Under these circum­stances, secondary-side steam vented to atmosphere in an accident

A residual heat removal heat exchanger is also provided.

nstrumentation
Lifting lug
Thermal sleeve
	Hold down spring
Alignment pm
Core barrel
column
Inlet nozzle
Access port
Radial support
Figure 1.4 A Pressurized Water Reactor [178]

“bleed and feed strategy” would be far less radioactive than that released from a BWR.

Public confidence in nuclear power was shattered by the reactor incidents at Three Mile Island [66] (1979) and Chernobyl [12] (1986). However, the former galvanized the start of globally intensive safety research,[18] as well as new stringent operating legislation and decom­missioning techniques [69]. In this respect the author’s own research at AEEW was abruptly shifted from intact plant control studies to investigations of explosive boiling and its potential damage to internal reactor structures. Others conducted theoretical and experimental stud­ies [67,68] into the impact of a jet fighter (Tornado) on a reinforced concrete reactor building, or a dropped flask of highly radioactive reactor fuel, or the detection before their critical length [96] of embrittlement cracks in PWR pressure vessels. By 1992 international research had confirmed the effectiveness of active accident control measures to mitigate the consequences of fuel melting in both fast and thermal reactors. This research still continues into the design of passive emergency cooling systems [108-110] based on natural circulation to avoid auxiliary power supplies.

While this book was being written, the northeast coast of Japan experienced horrendous earthquakes, tsunami and a major nuclear incident at the Fukushima BWR plants. Some brief personal comments here concerning its impact on nuclear safety and future construction appear apposite. National licensing of nuclear plant operations requires a demonstrable engineered resilience to local seismic activity. In this respect all Japanese plants escaped unscathed from the earthquakes in 2009 and 2010. Also just prior to the 2011 tsunami, an effective neutronic shutdown was effected on all the West Coast and East Coast Fukushima plants: despite the Richter-scale 9 quake. Media reports and pictures indicate that structural and emergency core-cooling systems failed at Fukushima as a result of swamping by the subsequent tsunami whose estimated 14 m height grossly exceeded the design limit of 5.3 m. Historic data on tsunamis is therefore less complete than for their earthquake precursors, and flood defenses on the East Coast clearly proved inadequate. With hindsight, Japanese nuclear stations should have been built on the West Coast which is sheltered by mainland China. It is considered here that the resulting opposition to nuclear power station construction in locations not threatened by tsunami or serious flooding is an over-reaction. Likewise, whilst inadequate UK planning has allowed homes to be built on flood plains, this is no reason to refuse their construction elswhere on suitable sites. Also it is widely believed that diagnostic X-rays are our only exposure to radiation and that any exposure materially damages our health. In fact cosmic rays and natural radioactive decay in the earth’s crust cause a continuous pandemic exposure[19] [20] and though citizens in the granite city of Aberdeen receive about three times the background exposure of Londoners, no statisti­cally significant increase in pertinent cancer cases occurs. Though I-131 ingressed into Tokyo’s drinking water from Fukushima it was around only 1/5th the UK’s safe limit for all ages, and the Japanese advocated consumption by adults only. Moreover, very conservative exclusion zones and contamination limits on farm produce were imposed. However, it was the admission of falsified plant safety reports [170] in February 2010 that created the material loss of public confidence.

During 1993 numerous early retirements of UKAEA professional staff left a minority to develop successful decommissioning and waste glassification technologies that are now deployed worldwide by AMEC plc [70]. At Winfrith the Zero Energy Facilities and the High Tempera­ture Dragon Reactor have now been properly decommissioned, and the buildings of the SGHWR demolished. However, water reactors them­selves take relatively longer due to their thicker corrosion deposits which hold up larger quantities of radionuclides. Nevertheless progress to date suggests that the entire site will be outside nuclear regulations during 2039-48. While the storage of glassified radioactive waste raises public concern in some quarters, the Swedish towns of Forsmark and Oskarshamn actually competed [320] for a high-level waste facility to be built in their respective neighborhoods [72]. Construction at Oskar­shamn was approved in 2009 with a start date in 2013, and on completion concreted waste in 25 tonne copper-sheathed stainless steel drums embedded in impervious Bentonite clay cushions will be buried in stable igneous rock tunnels. A further safeguard is that these containers are to be retrievable for inspection because the waste itself has potential industrial or medical applications. Unlike the environ­mental release at Bhopal of dioxin with an indeterminate active life, the radioactivity in nuclear waste reduces to that of mined ores in about 7000 years [321]. The natural fission reaction at Oklo some 1800 million years ago provides evidence that igneous rock formations alone can contain fission products for well over this period.

Since the Three Mile Island incident in 1979 the worldwide deployment [73] of 269 PWRs has operated at high-capacity factors [25] and without a major failure of the nuclear technology itself. A contributing factor is the shared experience within the PWR Operators Club that has led to safety-enhancing retrofits and procedures. It is therefore contended that PWRs offer a technically sound and safe solution to an impending electric power deficit. Vindication of this strategy is further offered by the willingness of populations around existing AGR sites to accept replacement PWRs: particularly when endorsed by the families of local plant staff. However, technical and safety issues alone are insufficient for renewing the UK nuclear power program in the now privatized electricity industry. Specifically, the huge capital investment must be largely met by private equity rather than as previously from public funds. In this context a commensurate return on shareholder funds must be incipiently visible, and towards this end an appropriate financial framework must be pre-established by the government and its regulator OFGEM. Some pertinent factors for consideration are now described.

The lifetime cost breakdown [74] for new PWR plant is shown in Table 1.7 which reveals the largely dominant construction cost. Build — times, and therefore costs, vary between 4 to 7 years depending on national working practices and the number of repeat orders. No revenue is evidently forthcoming during construction, but capacity factors once operational are as high [25] as 90% over a design life [74] of 60 years with insignificant carbon emissions and highly efficient land use (see Section 1.6). However, due to the initially high capital expenditure and delayed revenue, an estimated payback period of 30 years is required [52]. On the other hand as explained in Section 1.7, CCGT generation

Table 1.7 Lifetime Percentage Costs of New-Build Nuclear [74] Cost Construction Fuel Decommissioning Waste Management % 60-70 17 5 10

is radically different and more favorable to private equity investment by virtue of its timely income and assured profit. Though nuclear appears to be the lowest cost source of low-carbon electricity generation [52], it has to compete under the present UK regulatory framework with the base-load costs of CCGT units, even though these are not compliant with the mandatory 2020 UK emission targets. Indeed the Chief Executive Officer of RWE Nuclear argues [75] that the government’s renewable obligations tariff should be changed to a low carbon obliga­tions tariff in order to fairly characterize the role of nuclear power. The financial similarity between wind and nuclear power investment clearly supports his argument. However, levelized costs for new-build nuclear are estimated [52] as $92 to $123 per MWh, which are well below[21] $246 to $308perMWh for offshore wind turbines: even before the cost of the necessary backup systems is included.

The first thermal reactor for commercial electricity was completed in 1956 at Calder Hall. Despite its description as “The Peaceful Use of Atomic Energy,” there remains public apprehension that commercial nuclear power stations are also sources of weapons material. In essence, nuclear weapons create an explosive growth of the neutron population in a mass of largely fissile material as an end in itself, or as the initiator for a fusion device. For the Hiroshima A-bomb an appropriate mass of uranium was highly enriched with U-235 to restrict parasitic absorp­tions by U-238. The Nagasaki weapon was designed around plutonium recovered from a specially contrived fuel cycle which ensured very high concentrations of fissile Pu-239 relative to that of the Pu-240 created by another neutron absorption. Because the higher mass isotope is an unstable a-emitter [76], a sufficiently high concentration would induce the partial triggering of a plutonium-based weapon. Accordingly weapons-grade plutonium has a specified Pu-240 concentration of less than 7%. During the in-service life of thermal reactor fuel, fission of created Pu-239 forms a partial and immediate replacement for “consumed” U-235 atoms, but burn-up of Pu-240 proceeds at a slower rate. Consequently the relative concentration of Pu-240 increases with increasing fuel burnup. Fuel pins for power reactors are precisely engineered fabrications that embody years of research to enhance safety and the economy of electricity generation. Burn-up targets[22]

for commercial power reactors have always been determined by these considerations so that Pu-240 concentrations in recovered plutonium are too high for weapons purposes. Nuclear power generation has been and is therefore still divorced from nuclear weapons.

4.1 REACTOR ACCIDENT CLASSIFICATION BY PROBABILITIES

The robustness of an engineering system is limited by economic factors in the sense that expenditure is only justified in making the plant adequate for its intended purpose. Failure to recognize this principle results in the equipment losing its market or not being built, through either excessive price, or on the other hand lack of reliability and performance. Where a catastrophic failure in components could be the precursor to loss of life, and a nuclear power station is not unique in this respect,1 reliability and performance necessarily include the safety of the plant’s operators and of the general public. Under these circum­stances, the statistical risks to life and to the environment must be quantified, provided with ranges of uncertainty, and compared with other risks present in everyday life. Such an unambiguous scientific approach orients designers toward definite goals, identifies “weak links” in a proposed system, and most importantly establishes quanti­tative criteria for a decision-making process [156].

1 Refer to Section 1.3 regarding failure of the Banqiao Dam.

Nuclear Electric Power: Safety, Operation, and Control Aspects, First Edition. J. Brian Knowles.

© 2014 John Wiley & Sons, Inc. Published 2014 by John Wiley & Sons, Inc.

The various fault conditions of a nuclear power station may be broadly classified in terms of the probabilities of their occurrence [59,65]. Historically the distinction made is according to

DESIGN BASE ACCIDENTS with a typical aggregate probability < 3 x 10“4 per operating year

SEVERE OR OUTSIDE DESIGN BASE ACCIDENTS with a typical aggregate probability of < 10“7 per operating year

Because of the considerable operating experience with conventional plant items like feedpumps, turbines and electrical distribution systems, the probabilities for many design base accidents can be specified with relatively small uncertainties. From a mathematical or philosophical view, data exists from which a relative frequency based estimate of a failure probability can be made in an a posteriori sense. On the other hand, Severe Accidents can involve events outside direct experience (e. g., fuel-coolant interactions involving tonne quantities). In this case, failure probabilities must be assessed a priori with relatively larger uncertainties by an informed judgment of the available indirect evi­dence. These two probabilities are patently quite different in concept, and in fact form the basis of the Venn and Bayesian philosophies [159,160]. However, by regarding the experience of plant component failures and current scientific knowledge about the underlying physical processes in a Severe Accident as information that allows judgments to be refined, it is possible to pursue a unified conceptual approach [176]. Thus all probabilities in nuclear power plant risk assessments may be considered as Bayesian in concept and having the familiar combinatorial properties.[52]

Design Base Accidents (DBA) usually originate from the failure of a single comparatively inexpensive component. On the other hand Severe Accidents which were described as hypothetical before Three Mile Island have relatively low probabilities because they generally[53] originate from multiple failures of massive static structures and/or plant protection systems whose reliability is deliberately enhanced by

redundancy. With these observations in mind, typical design goals may be related to the probability of a fault’s occurrence [59,65]. Thus normal operational fault transients with a probability of greater than 3 x 10“[54] per year are required neither to prejudice the design life of a plant nor progress beyond the failed item. Restricted progression of damage is permissible for less probable faults within the Design Basis, but there must be only a minimal release of fission products. From these more serious design base faults designers select by past experience, certain so-called “limiting events”4 for which the adequacy of safety systems is confirmed by experiments and digital simulations. All other events within the design basis are then argued to have less serious conse­quences (e. g., lower fuel temperatures, higher coolant flows, etc.) than the limiting events, thereby establishing the safety of the plant for Design Base Accidents. Section 3.4 illustrates the ad hoc methodology behind the design of DBA control strategies.

Severe Accidents in nuclear power plants are characterized by the melting of a significant part of their fuel inventory. Some 98% of a plant’s radionuclides are locked away in the fuel’s crystal lattice [65] and the actual amounts increase with operational life (burn-up). Melting allows their accrescence for a potentially large atmospheric release (> 1 kCi), and to protect the locality licensing regulations after Three Mile Island typically stipulate [59,65,91,108]

1. The aggregate probability of all Severe Accidents must be no greater than 10“7 per operating year.

2. The most exposed individual is subject to a quantified not unreason­able hazard. At Three Mile Island this person received less than 20% more than the natural background [66] dose[55] of 2-3 mSV.

3. The number of addition cancers expected is demonstrably very much less than the normal incidence [157].

4. The obligatory preparation of a well-conceived evacuation plan for plant staff and public. Fatalities at Three Mile Island were caused by road accidents in the panic exodus.

5. The mandatory simulator training of plant staff and a designated hierarchy of responsibility based on professional skills and ex­perience.

Measures to achieve these objectives will be outlined below. The dangers posed by some reactor fission products will be addressed next.

With a strong enough trigger and a large enough inertial mass of coolant (>0.1m), the liquid’s final oscillations in Figure 5.8 become large enough for localized contact(s) with the melt. At such instants
enormous heat fluxes into the liquid occur. If a relatively low thermal- conductivity blanket were then to re-form, a passive equilibration of melt and coolant would continue. However, the existence of MFCI implies that such vapor blanketing is somehow transiently suppressed, and research into possible mechanisms was initiated by Derewnicki and Hall [243]. Their analysis supported by visualization studies using a platinum wire indicates that acoustic loading (local pressure increases) and Marangoni flows20 inhibit vapor production during ultra-rapid boiling. It is now suggested that the violent return to thermodynamic equilibrium of locally superheated liquid at contact areas with a melt launches shock waves that create local melt fragmentation [244]. During propagation21 shock intensity is escalated by further melt fragmentation across its steep frontal pressure gradient, and direct coolant contact is sustained by viscous forces that strip embryonic bubbles from the fragments. Though the above description is in part conjecture the following analysis establishes that the creation of fine debris (< 250 mm) and a highly efficient heat transfer mechanism are necessary in order to match experimental MFCI time scales.

If an isotropic sphere at a uniform temperature TM is abruptly immersed in an infinite sea of perfectly stirred coolant, its spatially one­dimensional temperatures thereafter satisfy [224]

(5.51)

with the boundary condition

h[T (R; t)- TL ] =-k — 4 f(t)

dr R

where

r — radial coordinate; R — radius of sphere

k — thermal conductivity of the sphere; TL — coolant temperature

0 A surface tension gradient in a fluid pulls liquid toward the greater value to create a Marangoni flow.

21 At around 350 km/h in tin-water experiments [248].

h — external heat transfer coefficient; f — surface heat flux from the sphere

The above partial differential equation has a countably infinite spec­trum of eigenvalues, and its Laplace transform solution is the corre­sponding infinite series [224]. The thermal energy released from the sphere is

t

Surface area x j f(Z)dZ (5.53)

0

and when the external heat transfer process is highly efficient it is largely represented by the smallest eigenvalue term of the series. Under these conditions the reciprocal of the smallest eigenvalue is called the dominant time constant t*, and the heat released per unit mass is approximately

E(t) =Ei[1 — exp (-t/t*)]

where

Ei = CpDT; DT = Tm — TL lim t* = R2/p2d

hn

Because the dominant thermal time constants of square prisms are insignificantly different from those of spheres [224], heat transfer from irregular MFCI debris is taken as that from spheres. Dominant thermal time constants for uranium spheres as a function of external heat transfer coefficient are shown in Figure 5.9 for diameters of 30, 100, 250, and 500 mm. Heat transfer in experimental MFCI with sodium or water is completed within 2-4 ms. Consequently dominant time con­stants no greater than about 1 ms are involved, and to match these values Figure 5.9 shows that spherical diameters below 250 mm and heat transfer coefficients exceeding 100kW/m2 are necessary. Thermal radiation is immaterial because Section 5.4 shows that water is broadly transparent to infrared over these length scales, and even the heat absorbed by a black body from a source at 3500 K corresponds to a coefficient[88] of less than 2.5 kW/m2K.

After separation from the coolant experimental MFCI debris is graded using a cascaded nest of precision sieves. The size or equiv­alent diameter d of an individual particle is then taken as the arithmetic mean of the smallest and largest sieve sizes through which it can and then cannot pass. Particle diameters for both water and sodium coolant scan be characterized [246] by a Log Normal proba­bility density function

P(d’) = ■ P exp

‘ s’ 2p 2 V s’

where

d’ = log d; m’ = e(d’) and (s’)2 = e(d’ — m’)2

However, validation of an MFCI simulation code against experiment is best achieved using the particular a posteriori measured debris sizes. The energetics of an MFCI are clearly influenced by the contact rate of
melt fragments and coolant[89] as well as by their sizes. Accordingly if dM of a coarse mixture becomes finely fragmented, (< 250 mm) to N(0) particles over the time interval [0,0 + d0], then assuming spherical debris

N(0) 4 3

dM = — РрмГк(0) (5.56)

k=1 3

where

pM — density of solidified thermite mix

rk (0) — spherical radius corresponding the kth sieve-size at 0[90] The average of {rk(0)|1 < k < N(0)} is by definition

N(0)

N(0)Av. [r3(0)] = £ r — (0) k=1

which substituted into equation (5.56) gives

dM = 4ppMN(0)Av. [r3(0)] (5.57)

If each particle is assumed to liberate its heat independently, then the power released from those newly created during 0 to 0 + d0 is similarly derived from equation (5.54) as

where

E(t — 0; rk(o)) = energy released per unit mass of a spherical
particle of radius rk(o) at time 0 = 0 as in equation (5.54)

Expressing equation (5.57) in terms of the mass creation rate of fine debris W in an interaction

4

W(6)86 = 3ppMN(6)Av. [r3(6)] (5.59)

In the limit as 86 ! 0, substitution of the above into equation (5.58) yields

§ = W(6)Av. jr3(6) d6E[t — 6; rk(6)]}/Av. [r|(6)]

so

P(6) 4Av.<| r3(6) — E[6; rk(6)^ /Av. /1(6)]

If the creation of fine debris occurs at a constant rate W0 over a prescribed period [0, f] and thereafter is zero, then

W(t) = W0 [U(t) — U(t — tf)]

where U(t) is the unit step function. By effecting the variable change

6′ = t — 6 d6 = —d6

the convolution (5.60) expands into

t

Q(t) = W0 P(6)d6 for t < tf

0

Г t t—tf

00

which is still intractable unless further assumptions are made. Accord­ingly, it is conjectured that fine fragmentation by a shock wave is a

statistically stationary process [247], so the fraction of each debris size remains statistically constant throughout an interaction. Thus by virtue of the large sample sizes Av. [r|(0)] and Av. [r|(U) E[U; r(U)]] are largely independent of U, and can be represented by averages calculated a posteriori from the recovered debris, as

t

P(U)dU=(5.62)

0

In the BUBEX simulation of an MFCI test, a one-dimensional look-up table of the above integral (5.62) is first computed separately for each time step using equation (5.54) and the recovered debris spectrum. The mass creation rate of W0 of fine fragments is estimated from experi­ment. Alternatively, shock propagation at 100-150 m/s over the small volume of experimental coarse mixtures creates fine debris much faster than their energy release rates, which implies the simpler approximation

s,

Q(t)= dMn-E(t, rn) (5.63)

n=1

where dMn is the recovered mass from the nth of S sieve sizes.

The yield of an MFCI is defined as the mechanical work delivered by the expansion of its vapor bubble. Experiments at AEEW measure Yield in terms of the assumed isentropic pressurization of a coolant’s argon cover gas, and the efficiency of an MFCI is defined as:

MFCI Efficiency = Yield/Heat content of participating mass (i. e., debris < 250 mm)

(5.64)

However, even if the extrapolation of experimental MFCI efficiency to reactor-scale masses is valid, the resulting Yield alone does not repre­sent the potential damage to a reactor structure. Specifically, the containment vessel of a fast reactor in Figure 5.10 includes primary circuit pumps and intermediate heat exchangers which can focus explosively displaced coolant to exacerbate damage: particularly to the rotating shield. Analytical and corroborative experimental investi­gations of this phenomenon for a fast reactor are described later in

A. C. Induction motor incorporating flywheel

Fluid coupling -L™I

■■■ — rr

Figure 5.10 Vertical Section of PFR [60]

Section 6.1. In a PWR, the lower core-plate and support casting in Figure 1.4 would constrain the explosion to increase the mechanical loading at the base of its pressure vessel.

To place the explosive violence of an MFCI in perspective, consider a typical Rig A experiment in which 0.5 kg of molten urania thermite at 3500K reacts with 50 kg of water at 293K. If passive thermal equi­libration were to occur with the whole coolant mass, its temperature would increase to just a modest 299K. However, the experimental MFCI yield is about 0.16MJ which corresponds to the kinetic energy of a 1V2 tonne vehicle travelling at 55km/h. Because water reactors and fast reactors have typical fuel inventories of 100 and 20 tonne respec­tively, the very localized heat transfer in an MFCI appears as potentially catastrophic especially as a 1 GJ yield gives cause for concern with
regard to the failure of either reactor vessel. Specifically, granted a Hicks-Menzies isentropic efficiency of 16% and a participating mass of 20% of a fuel inventory,[91] the resulting yields for a molten fuel temperature of 3500 K are

Water reactor yield = 4.8 GJ Fast reactor yield = 1.4 GJ

Computer simulations involving equation (5.62) are clearly unlikely to precisely replicate experimental measurements of an MFCI yield. Nevertheless by also marrying the condensation mass flux equation (5.27) into apposite fluid dynamics, the BUBEX code in Section 5.8 confirms interfacial condensation as the principal thermo­dynamic irreversibility that saps material amounts of energy from an MFCI vapor bubble. Consequently, justification is derived for extrap­olating the 4 to 5% experimental MFCI efficiency to reactor-scale and thereby significantly enhancing a reactor safety case. Specifically, granted a 4 to 5% efficiency and a molten corium temperature of 3500 K for a Severe Accident in a PWR, then the required participating mass for a 1 GJ event evaluates as about 17 tonne or 17% of the entire fuel inventory. Because experiments indicate that just some 20% of a total melt mass has[92] particle sizes less than 250 mm, a 1 GJ yield corresponds to the non-credible event of the entire PWR fuel inventory in a molten state and in contact with enough water. On the same basis for a fast reactor, but with the highest predicted melt temperature of 5000 K, the required participating mass for a 1 GJ yield is 11 tonne or nearly three times the entire fuel inventory in a molten state! In this context, simula­tions of Severe Accidents [213,269,270] with distributed neutronics and thermal hydraulics indicate a progressive degradation of a reactor core. Confirmation is provided by the post-accident inspection of the Three Mile Island reactor in which just 8 to 16 tonne of its 100 tonne fuel inventory lay below the lower core-support plate [69]. Furthermore, Section 5.2 outlines the different molten fuel-coolant contact modes as

additional factors that would materially restrict the participating mass. For all these reasons the creation of the participating mass for a single coherent 1GJ event is considered very improbable especially with present safety systems, operational experience and legislation.

Though esoteric control engineering theory might be outside some reader’s interest, a brief overview of Nyquist’s [131] and Rosenbrock’s [123,134] theorems is necessary in order to appreciate the practical problems described in Chapters 2 and 3. Here the stabilities of neutron reactor kinetics, flow in boiling channels and a national electricity Grid are analyzed. At first sight it appears surprising that a national Grid stability criterion [80,84] can be formulated as a single input-single output problem when many plant controls and a myriad of ac generators and motors are intimately involved. This example particularly illus­trates the important engineering skill of identifying the reduced set of variables that dominate a complex physical system in order to effect a successful solution.

Subsequent chapters concern some research activities and opera­tional legislation that aim to underwrite the safety of nuclear power plant following the Three Mile Island incident [66] in 1979. In this respect international collaboration has been sponsored by individual governments, the OECD, the European Union[23] and the PWR Oper­ators Club. The success of these initiatives is confirmed by the absence of any later major technological or operational faults[24] with BWRs and PWRs.

Chapter 4 cites some European statutory probabilities [59,65] for the occurrence of Design Base and Severe Accidents (fuel melting) along with operational requirements [59,108] relating to the progres­sion of plant damage and the need for an operator command structure based on professional skills and training. Hazards and Risks from some pertinent fission products after an unlikely environmental release are described, together with the legislated exposure limits (Sv) for on-site operators and the neighboring public. Though Event Trees and

Risk analyses are increasingly deployed for safety assessments of many industrial processes, weaknesses in their application are identified as failures to address benefits and humanity’s greater acceptance of one manner of death from another. Nevertheless with no real alternative they are still used for assessing nuclear power plant, whose principal Risk to people is the development of thyroid cancers due to the natural concentration of absorbed radioiodides [163] after an unlikely environ­mental release of fission products. In this context, it should be noted that 80 to 90% of naturally presenting cases are successfully treated by surgery [164]. The Farmer-Beattie analysis, which is repeated here with the more appropriate Poissonian rather than a Normal distribution, demonstrates that the expected annual incidence of thyroid cancers from the spectrum of Severe Accidents in an AGR station is some two orders of magnitude less than the number of natural presentations. Granted rationality, nuclear power with its attendant benefits should therefore have gained full public approval! Accident precursors and safety systems for fast reactors and PWRs are briefly outlined. How­ever, because the latter appears to be the most widely adopted type of future civilian plant, the robustness and diversity of their safety systems is illustrated for a large loss of coolant accident (LLOCA).

There are rare circumstances when a coherent explosive rate of heat transfer occurs as a result of a high-temperature liquid mixing with a readily vaporized one. Though unimaginably powerful natural explo­sions took place at Krakatau and Santorini, the situation of Severe Accidents in PWRs with molten core debris (corium) is radically different. Specifically, the natural events involved a rapid violent mixing of Gigatonne quantities, whereas the spatial neutronics and hydraulics of water reactors allow only the progressive melting of their 100 tonne cores over hours [59,65]: and then only if all the diverse safety systems were to fail concomitantly. In nuclear safety assessments such an explosive heat transfer is called a molten fuel-coolant interac­tion (MFCI). The Three Mile Island incident in 1979 invigorated global research into the progression of core damage [59,65,213,269,270] and the physical phenomena in Severe Accidents. In this respect, the bounding Hicks-Menzies analysis of 1965 had raised concern that not unrealistic masses of corium in an MFCI could challenge the integrity of a fast or water reactor’s containing vessel. As well as releasing radioactive fission products, its rupture could create rapidly accelerating metal fragments (missiles) which could potentially breach the surrounding reinforced concrete containment building, and thereby allow an environmental release of radioactivity. However, a simulation developed by the author during 1989-92 confirmed the 4 to 5% conversion efficiency of heat into mechanical work that had been observed in many independent kilogram-sized MFCI experiments. This efficiency is some six times smaller than an isentropic Hicks — Menzies value which disregards the highly effective anisentropic heat transfer from an MFCI bubble into the bulk coolant by interfacial condensation. Identification of this physical process allows a valid extrapolation of the 4 to 5% experimental-scale value to tonne-sized reactor quantities thereby materially benefiting reactor safety assess­ments. Novel finite element models for the impact of plant missiles or aircraft on reinforced concrete structures or major pipe work were also validated during this same period. Following the foreclosure of the EFR project, European research on MFCI and impacts was discontinued. The pertinent UK reports were then archived leaving a much smaller staff complement to pursue successful reactor decommissioning, waste glassification and passive safety systems. Chapters 5 and 6 respectively outline these MFCI and impact research archives to assist engineers and scientists newly entering the resurgent nuclear industries.

After the Three Mile Island incident the nuclear power industry sought unremittingly to improve in-depth plant safety [298,302]. For example, more robust fuel cladding [300] and steel [276,277] or concrete containments [286] have been developed. In addition cooling circuits deploying natural circulation have been proposed [108] as potentially more reliable and cost-effective by eliminating the need for active power supplies and pumps. However, due to intrinsically smaller heat transfer rates than with forced convection, natural circulation cooling systems are relatively much larger. As about 60 to 70% of capital costs reside in civil engineering works, they do not appear economically viable for the main on-load cooling of water reactors of order 1 GWe. Nevertheless, because the radioactive decay of fission products peaks at around 10% of pre-trip (scram) power, passive safety circuits exploiting heat removal by natural circulation are cost-effective [108] and their development has become an ongoing activity [109] associated with proposed Generation IV plants [109,298,302]. Chapter 7 concludes the book with a discussion of further advantages and disadvantages of heat removal by natural convection and a passivity classification for reactor safety systems. All proposed passive safety systems address the problems of decay heat removal to ensure core debris-bed cooling [65], pressure relief inside a concrete containment [101] and the blocking of emergency core cooling systems (ECCS) by debris [100]. Because the driving forces from differential densities and gravity are relatively much weaker than with forced convection, careful design and validated analyses are necessary to be sure that these passive systems function as intended. Indeed the IAEA falls short of recom­mending them as direct replacements for the active safety systems in presently operational plants [10].

A final thought to ponder is that the human and environmental consequences of the Three Mile Island, Chernobyl and Fukushima nuclear incidents are all together dwarfed by the 171,000 deaths caused by the failure of the Banqiao hydro-dam [11]. It is hoped that Chapter 1 will contribute to an objective quantified debate on future electrical energy generation which encompasses national and global issues of Grid demand patterns and land resources [324].

Catastrophic breaches of a reactor vessel and its reinforced concrete containment by an MFCI, a disintegrating plant fragment or a hydrogen explosion are circumspectly engineered to be highly improbable. From all precursors the aggregate probability is typically no greater than 10“7 per operating year, or assuming a Poissonian distribution there is an expectation of one such rare event in 10 million years. However, granted such an event, the release of fission products would pose the principal danger to public health and the environment. In this context, the hazard is represented by the expected increased6 number of cancers induced in the surrounding population. The fission products from U-235 and Pu — 239 are quite similar, and toward the end of a 3-year fuel cycle the actual fission product inventories of fast and thermal reactors are broadly the same. Consequently the hazards from both reactor types are similar. With regard to plutonium it is neither a significant chemical poison nor a radiological hazard because

i. Its principal emission is a-particles which pose no threat outside the human body.

ii. The half-lives of Pu-239 and Pu-240 are about 24,000 and 6500 years respectively [76], so the radiation dose per unit of absorbed mass is relatively low.

iii. Though inhalation constitutes the most serious hazard, reten­tion in the lungs occurs in common with other aerosols for sizes 1 to 5 mm only. Particles below 1 mm tend to be exhaled while those above 5 mm are expelled in phlegm.

Those additional to the natural incidence.

Releases of some nuclides like Strontium and Caesium rapidly plateout, so serious effects on public health can be prevented by isolating the surrounding area from the food chain for a limited period of time. Noble gases like Krypton and Xenon form a significant portion of the fission product inventory, but their hazard is markedly reduced because there is negligible lung absorption of these gases. On the other hand wind-borne aerosols of radioiodides or their chemical salts[56] are readily absorbed, and this effect is aggravated by a selective accumulation in the thyroid. For these reasons, radioiodides[57] or their compounds are generally considered [161,162] to be the major hazard to public health in the unlikely catastrophic failure of a reactor and its containment system. Indeed, Farmer’s Reactor Safety Criterion [157] is based on the likely number of additional thyroid cancers if the iodides in a fission product inventory were to be released at ground-level. Developments in digital computer hardware and simulation techniques now allow dose-rates and induced cancer statistics to be calculated for many components of a fission product release and with more detailed representations of local population density and dispersion due to weather conditions. Even so, the predictions still over-estimate the hazards (grossly so according to some opinions [104]) by neglecting important alleviating factors. For example

1. With a water reactor, the mass of iodides available for dispersion would be markedly reduced by dissolution in the large quantities of water and vapor in the reactor and its containment [104]. With fast reactors, their sodium coolant would operate in a similar manner.

2. It seems likely that fission products would be released into the atmosphere as a hot rising plume. This effect, which promotes their dispersion and lowers the dose rate, is not represented in some computer simulations.

3. The hazard is defined in terms of additional induced cancers, whereas owing to highly effective surgery actual fatalities for the thyroid condition are only about 10 to 20% of all presentations [163,164].

4. Data on radiation-induced cancers is available only from the high- dose cases of Japanese A-bomb survivors. Predicting the incidence of cancers caused by an atmospheric release of reactor fission products necessitates a linear extrapolation to much lower dose — levels. However, no observable human health effects have been demonstrated below about 20mSv, due almost certainly to the regular natural replacement of body cells. Indeed, the Chernobyl exclusion zone is now populated by normal healthy families of wolves and bears [322]. This linear dependence can therefore be reasonably assumed to be pessimistic [163].

An abrupt release of pressurized Argon from the MFTF charge con­tainer and a record of the cover gas pressure transient were made as part of rig commissioning. Various one-dimensional fluid dynamics models proved unsuccessful in calculating this transient despite their use in other MFCI simulations.27 A spatially higher dimensional model is therefore necessary for authenticity. In fact a sufficiently accurate reproduction of this MFTF commissioning test became the first step in the validation of the MFCI dynamics code BUBEX. Because reactors and MFTF have a fair degree of axial symmetry, two-dimensional spherical coolant dynamics appear promising. In fact the two-dimen­sional code SEURBNUK had been extensively validated by the earlier WINCON experiments [276] that used scaled models of the fast reactor geometry in Figure 5.10 and contrived low brisance chemical explo­sives. Accordingly, the comprehensive MFCI model BUBEX was developed to replace SEURBNUK’s far simpler representation of a chemical explosion.28 Salient features of BUBEX are next outlined along with its application to the urania-sodium MFTF experiment in Figure 5.11, which presents just a single interaction.

Inviscid fluid dynamics can be described in general by the Eulerian conservation equations [256]

dp

+ V. p" = 0 (mass) (5.65)

See Refs. [249-254].

28 Essentially the expansion of a perfect gas.

Figure 5.11 Cover Gas Pressure Transient after an MFCI in the SUS01 Urania-Sodium Experiment

——Ь V. pIu + PV. u = 0 (energy) (5.67)

SEURBNUK solves the above equations using the Mark and Cell Method [257] assuming adiabatic flow and with boundary conditions corresponding to a cover gas space, internal structures and a chemical explosion. As illustrated by Figure 5.12 for the test in Figure 5.11, the interaction of a bubble with internal structures creates an irregular geometry so that calculations of the condensation mass flux and heat transfer to a surrounding coolant would be formidable. However, the simplifying approximation of a spherical bubble having the same instantaneous volume minimizes both the condensing and external heat transfer surfaces and thereby maximizes the computed MFCI yield. Provided that corresponding predictions evolve as small enough, the approximation is sufficient for reactor safety assessments.

Bubble growth in MFTF experiments occurs over some 20 ms, whereas vapor film destabilization in Figure 5-11 occupies just 10 ms. The linearized dynamics of equation (5.17) imply that longer time­scales allow the development of slower and longer wavelength

Figure 5.12 SEURBNUK Bubble Geometry in the Urania-Sodium Experiment of Figure 5.11. The Condensation Coefficient is 0.3

Rayleigh-Taylor instabilities for which viscosity is evidently less stifling. Experiments using ethanol-air [258] or liquid-vapor [259­261] systems show that planar interfacial decelerations create highly distended interacting “spikes” that eventually detach. Corradini [254] correlated liquid entrainment into vapor bubbles for scale-model tests at the Stanford Research Institute [264] and Purdue University [265] by

CrT = 11-6Рі[аь/(рь — Pg)]1/4€ for € > 0

(5.68)

0 otherwise

where

sL — surface tension of the liquid; € — a largely planar acceleration

However, its accuracy for MFCI simulations is compromised by the one-dimensional planar accelerations and the absence of developmental dynamics. Significantly, a lengthy numerical solution [263] of the non-linear R-T equations [262] for a spherical interface between

inviscid fluids indicates an entrained mass flux some 5 to 10-times less than equation (5.68) when radial deceleration R replaces €. In the absence of a real alternative, R-T entrainment mass flux GRT is represented in BUBEX by

t(t)GRT + GRT — Crt

where CRT is specified by equation (5.68), R replaces €,

(5.70)

and t*(t) is defined by equation (5.17). With decreasing deceleration t*(t) becomes ever larger, and to prevent numerical overflow t(t) is artificially restricted to 10 s. However, there are no adverse conse­quences as the durations of MFTF transients are markedly shorter (< 1 / 10s). Once an interfacial liquid accelerates into its vapor, the interface restablizes but no information on this behavior appears available. Under these conditions, BUBEX arbitrarily assigns the time constant of 1 ms. The above uncertainties dictate that MFCI simulations should be scoped with 5 to 10 factor scalings of the above mss flux GRT. In this respect, Severe Accident calculations are only required to be conservative rather than to meet the ±10% accuracy for engineering design.

Liquid entrainment into an MFCI bubble also occurs as the inter­face is scoured by turbulent vapor [236] or as it brushes around damaged internal structures [71]. There is a paucity of data on entrained droplet sizes, but aerosol experts [171,266] suggest a range of 1 to 100 mm. By virtue of their large surface area to mass ratio, entrained droplets are potentially efficient removers of released fission products by dissolution or adhesion [104,171,266,267]. Asymptotic values for the dominant thermal time constants of the suggested size range are obtained from equation (5.54) as

0.15 ms < t < 1s for water 0.53 ms < t < 3.6 ms for sodium

so smaller droplets are likely to be vaporized within a turbulent bubble. Their radioactive burdens would then be precipitated as larger

Table 5.5 Ratio of Expectations in Equation (5.72) for a	<< b
Probability	Falling	Symmetric	Rising
Density	Triangular	Triangular	Triangular	Uniform
£(D2)/£(D3)	1.67/b	1.56/b	1.25/b	1.33/b

agglomerates. Those larger than about 10 mm would rapidly settle-out under gravity to be trapped in the turbulent coolant. The expected area

29

of a mass MD of entrained droplets is readily derived as

£(A) = 6MDpL [£(D2)/£(D3)] (5.72)

where

D — a droplet diameter; £ — statistical expectation (mean)

If the probability density function of D has lower and upper bounds a and b with a < b, the above ratio of expectations for various rudimen­tary distributions closely approximates those in Table 5.5. Granted a wide size-spectrum the area available for aerosol scrubbing is seen to be largely dictated by the largest droplets: and not by the population’s detailed statistics. This fact should simplify experiments to provide a sounder basis for aerosol scrubbing simulations like those in BERTA [25] and BUBEX.[93] [94] The FAUST experiments [267] concerned liquid entrainment by permanent gas bubbles, so that droplet longevity was not foreshortened by evaporation or encounters with fuel fragments. Accordingly the observed highly efficient aerosol scrubbing process in FAUST might not be replicated in a reactor situation. Realistic lifetimes and heat-transfer data for entrained droplets are clearly essential pre-requisites for specifying the radiological source term in a safety assessment. In the absence of such data, BUBEX preferentially evaporates Rayleigh-Taylor droplets before those of the surrounding coolant, so as to provide a conservative assessment.

Experiments establish that the collapse rate of steam bubbles is reduced by just 10% with the presence of a 15% molar concentration of permanent gas. With the inhibiting effect of permanent gases on power station condensers[95] borne in mind [219], researchers [236,267] have concluded that violent turbulence must exist within an MFCI bubble. Also it is reasonable to conjecture that similar turbulence develops in its surrounding liquid, but an apposite correlation for heat transfer from the liquid interface was not available during BUBEX development. Previ­ously cited MFCI models adopt quite speculative heat transfer relation­ships or none. However, in order to discard Hicks-Menzies efficiencies in favor of the some six times smaller 4 to 5% experimental values for reactor safety assessments, a patently conservative representation of heat transfer from a liquid interface is required. If this heat transfer process were to be inefficient, then a weakened condensation mass flux would be less effective in sapping energy from a simulated MFCI bubble.

Turbulent fluid flow around a body results in an attached laminar flowing boundary layer whose periphery is scoured by eddies induced by viscous shear [219,268]. Steady-state heat transfer is then often represented by molecular conduction across the boundary layer augmented by a dynamic diffusion process associated with the eddies. Formally

f = -(k + p CpEff) — (5.73)

where beside the usual nomenclature,

EH = Eddy diffusivity of heat y — perpendicular distance outwards from the body

Due to their low molecular conductivities, steady-state heat transfer to turbulent water or steam is totally dominated by eddy diffusivity so experimental correlations [64,117,143,219] involve only Reynolds Number terms. On the other hand, correlations for highly conductive liquid metals involve a sum of k and EH terms [64,117]. To provide conservative predictions of MFCI yield, BUBEX models heat transfer

Table 5.7 Comparison of Bubble Expansion Parameters Experiment BUBEX Lossless Peak cover gas pressure (bar) 2.7 9.3 82 Work done on cover gas (kJ) 24 72 243

Table 5.7 compares the peak cover-gas pressurizations and correspond­ing work done on the cover gas for experiment SUS01 with this BUBEX calculation and a lossless bubble expansion (a = 0.0). The BUBEX simulation actually accounts for 78% of the energy dissipation relative to the lossless case. It is concluded that Hicks-Menzies efficiencies are indeed over-predictions and that sound reasons exist for using the some 6 times lower 4 to 5% experimental values at reactor scale.

2.1 LINEAR MODELS, STABILITY, AND NYQUIST THEOREMS

All forms of commercial power generation involve the controlled manipulation of plant variables to achieve a prescribed contribution to national demand. In fossil and nuclear plants the heat source, boiler feed pumps and turbine control valves are the pertinent items. For wind turbines the rotor-blade angle and generator excitation are the relevant quantities. When several plant variables require control, engineers describe the situation as a multi-input multi-output (MIMO) problem. On the other hand car speed control via fuel-injection rate exemplifies a single-input single-output (SISO) problem. Even over their intact operating regimes fossil and nuclear power plants are materially non-linear1 and distributed.[25] [26] In this framework control design cannot be implemented analytically by existing mathematics. However, for sufficiently small perturbations about a given operating point, plant

1 Consider typical heat transfer correlations; see Refs [63,64,143,219].

2 Necessarily described by partial differential equations.

dynamics can be approximated by a finite set of ordinary linear differential equations that enable methodical insight into the effects of negative feedback (control), variable interaction, and stabilization by means of linear compensating algorithms [79,124]. Aizerman [77,78] conjectures that an ordinary non-linear differential equation that has small signal (linearized) stability about every steady state also has global stability [77,126]. Though no general analytical proof of this exists, it forms a basis for the successful control of fossil and nuclear power plants.

First of all a number of linear models are derived that reasonably characterize plant parameter changes over the normal operating regime. Experience indicates that steps of about 10% of the maximum con­tinuous rating (MCR) are usually sufficient for the purpose. After engineering linear stabilizing algorithms for each power level, a compromise is generally sought that ensures adequate stability (tran­sient damping) for all. This problem is eased for power plants because unlike defense equipment speed of response is not the priority. With no certainty that normal maneuvres can be accomplished, confirmation is imperative using a detailed non-linear plant simulation [117,141] whose individual models have been validated as far as possible against existing plant items. This same non-linear simulation can also provide the required linear models as illustrated by examples in Chapter 3.

Linear control system theory is often couched in the abstract algebras of finite dimensional Banach or Hilbert Spaces [110-112]. However, for engineering design purposes linearized plant dynamics are specified in the state equation format [122,123,134]

x = Ax + Bu and y = Cx + Du (2.1)

where

x(t)—a state vector containing a finite number (n) of Laplace transformable functions

x—temporal derivative of x

A, B, C, D—real matrices with respect to a convenient Cartesian

coordinate system

u(t)—an input vector

y(f)—the output response vector

Defining the Laplace transform [119,120] of a vector of time function as that of each of its components, then from equation (2.1)

x = (xi — A)—1 Bu + (si — A)_1xo and u = Cu + Du (2.2)

where u denotes the Laplace transform of x(t) etc. and xo its initial value. In the present finite dimensional context the spectrum [110,111,121] of an arbitrary matrix L corresponds to values of s for which

det (si — L) = 0 (2.3)

and these roots are termed the eigenvalues of L. A determinant and eigenvalue spectrum are properties of the underlying linear mapping and are independent of the chosen Cartesian coordinate system. Equa­tion (2.3) defines the characteristic polynomial [110,111,121], and for a real transition matrix A it has real coefficients, so the eigenvalues of a linear MIMO system are real or in complex conjugate pairs.

Power series are one method [125] of defining functions and in particular for an arbitrary matrix L

exp (tL) = (tL)k/k! with (tL)° = i (2.4)

k=0

Like its “scalar relative,” the above series is absolutely summable [112,125] for all time t, and therefore

і 1 1 d

dt[eXp (tL)l = £ k! dt(tL)k = L exp (tL)

k=0

It follows that

IL xexp (tL) = L 1 — [exp (tL)| = exp (tL)
dt

or

L xexp (tL) = exp (tL)dt

Application of the above to the Laplace transform of exp (tL) yields exp [-Ф/ — Ц4, = (S, — L)-exp [-f(s; — L)]1 = (S; — L)-

o

so that

exp (tL) and (si — L)-1 are transform pairs (2.6)

For any matrix L it can be shown that a special linear change of Cartesian coordinates transforms L into the diagonal sub-block struc­ture of its Jordan Form J [110,121]. Each block corresponds to a different eigenvalue and Figure 2.1 illustrates a typical sub-block of J and exp (tJ) for an eigenvalue 1k. The literature [77,126] formulates various definitions of dynamic stability based on the mathematical concepts of a bounded variation about, or convergence to, a particular steady state. An appropriate criterion for present purposes is

MIMO system (2.1) is stable if and only if for all xo

and w(f)=0then (2.7)

lim x(t) =0

f! 1

Because dynamic stability is patently independent of the choice of Cartesian coordinates, those creating a transition matrix in the Jordan

Form can be adopted. Accordingly, equations (2.2) and (2.6) with Figure 2.1 translate the above into

MIMO system (2.1) is stable if and only if all eigenvalues of its transition matrix have strictly negative real parts (2.8)

Equation (2.2) provides the output of a linear MIMO system explicitly as

у = G(s)u + C(sI — A) 1xo where G(s) = D + C(sI — A) 1B

(2.9)

and G(s) is termed the Transfer Function Matrix which in practice is usually square. By augmenting the state vectors, transfer function matrices G1(s) and G2(s) in series or parallel combine as those for SISO systems—except for commutivity. Specifically [122,134]

In series : G(s) = G2(s)G1(s) and in parallel G(s) = G1(s) + G2(s)

(2.10)

A Resolvent (sI — A)—1 for finite n-dimensions has the rational form [111]

(sI — A) 1 = X sk XTk Y (s — Ik) with

k=1 k=1

{Tk<n} real matrices (2.11)

So the eigenvalues of state transition matrix are seen to be the poles of G(s) . Furthermore, by definition[27]

s is a zero of G(s) if and only if for some non-zero input

u(t) = exp (~s t) "u, no output response occurs; i. e., y(t) =0

Though these zeros appear to pose an intractable calculation, they are in fact the roots of the zero polynomial [122,123,134]

Z(s) = det (si — A)det G(s) (2.13)

Thus problems of dynamic stability, etc., can be couched in the potent algebra of complex variables [113,114].

For instance, residue calculus implies that the pth output of a stable linear MIMO system for a solitary non-zero input component uk (t) approximates after a “long enough” time to

yp(t) ‘ Residue of estGpk(s)uk at poles of Uk only (2.14)

In particular for

uk(t) = exp (ivt); Uk = (s — iv)—1; and uq(t) =0 forq = k

the pth component of the steady-state response is then evidently

Ур (t) ‘ Gpk (iv)eivt = |Gpk (iv) I exp [ivt + iArgGpk (iv)]

As real or complex pairs of eigenvalues are involved it follows from equations (2.9) and (2.11) that

Gpk(—iv) = IGpk(iv)Iff — ArgGpk (iv)

Consequently, by virtue of system linearity, its steady-state response to

uk(t)=sin vt = — [exp (ivt) — exp (—ivt)]; and uq(t)=0 forq = k is

yp(t) ‘ 1 G^k(iv)1 sin [vt+ArgGpk(iv)] (2.15)

Naturally enough G(iv) is termed the Real Frequency Response of a linear model, and it plays a pivotal role in questions of system stability.

Hc (s)

For design purposes, the controller K(s) in Figure 2.2a is partitioned into two parts

K(s) = Kp(s)F with F a diagonal scalar gain matrix (2.16)

and the feedback system is very often reconfigured [123,134] as in Figure 2.2b. Engineering experience usually matches the number of control inputs to the outputs requiring control, so Kp(s), F and G(s) are usually square (n x n). The overall closed-loop transfer function matrix

Hc (s) is

Hc(s) = [I + Q(s)F]_1Q(s)F where Q(s) = G(s)Kp(s) but Figure 2.2b shows that stability etc., is determined by

H(s) = [I + Q(s)F]-1Q(s)

R Z в

However, for actual MIMO systems in particular, the inverse transfer function relationship [124,135,136]

H(s) , H—1 (s)=F + Q(s) with Q(s) 4 Q"1(s) (2.18)

is evidently more tractable.

If Q(s) for engineering purposes is close enough to diagonal, then design reduces to a number of independent SISO systems. For each SISO system its closed-loop poles and zeros are derived from equation (2.17) as the zeros of 1 + Q(s)F and Q(s) respectively. The contour g in Figure 2.3 encloses all the unstable closed-loop poles, and using the classical Encirclement Theorem [112-114] Nyquist in 1932 showed that

A Unity Feedback SISO system is stable if and only if the mapped contour 1 + Q(g)F encircles the origin Po times anticlockwise, where Po is the number of unstable open loop poles.

A simple vector diagram shows that origin encirclements by1 + Q(g)F equate to encirclements of the critical point (—1,0) by Q(g)F. Also in practice Q(s) ! 0 as |s| !1, so the above reduces to

A Unity Feedback SISO system is stable if and only if its

Real Frequency Response locus Q(irn)F encircles (—1,0) (2.19)

anticlockwise Po times

Though some SISO defense systems have open loop poles at the origin due to kinematic integrations, these can be considered infinitesimally inside the stable region for design purposes.[28] Open loop systems are very often stable, and then the conformal mapping theorem [113,114,129] quantitatively relates transient closed-loop damping to the proximity of a Q(iv)F locus to (—1,0) in terms of Gain and Phase Margins [130,131]. Empirical rules [79,124] then also enable the design of analogue or digital controllers to achieve satisfactory closed-loop transient damping.

Presently MIMO feedback control systems can be designed in the frequency domain only if the pairs of transfer function matrices [Q(s), H(s)] or [Q(s), H(s)] are diagonally dominant [123,134]. Spe­cifically, the magnitudes of their diagonal elements must strictly exceed over the entire g-contour the sum of all others in the corre­sponding row or column. Diagonal dominance of [H(s),Q(s)] can often be contrived and then confirmed by the superposition [82,157] of Gershgorin Discs on all n x n elements of an Inverse Nyquist Array Q (iv) [123,134]. The apparently simplistic replacement of rows or columns by linear combinations with others appears to be an effective first step. Other techniques for achieving diagonal domi­nance are fully described in the literature [123,134]. In essence these procedures correspond to a scalar matrix operating on the control error vector and this matrix is then incorporated in Kp(s). Denoting diagonal elements of F and Q in equation (2.18) by fk and qkk(s), respectively, Rosenbrock’s stability criterion for open loop stable dynamics is

A diagonally dominant Unity Feedback MIMO system is stable if

and only if for allk < n the origin encirclements by the locus

Qkk(iv) equate to similarly orientated encirclements of (—fk, 0)

(2.20)

Thus diagonally dominant MIMO control systems can be engineered by well-established SISO techniques with readily computed Ostrowski Discs to assess residual loop interactions [82,134].

In general linear partial differential equations involve linear map­pings between infinite dimensional vector spaces,[29] and their matrices do not always exist [111]. On the other hand, a finite number of linear ordinary differential equations correspond to linear mappings between finite dimensional spaces whose matrices always exist [110,111] and are computationally tractable. Heat diffusion in power plant metalwork is characterized by linear partial differential equations [224] and so might appear outside the prescribed framework of equation (2.1). However, the vast majority of energy transfer is associated with the smallest eigenvalue [117,118], so that ordinary differential equations become reasonable approximations for suitably sized segments of an Eulerian mesh [117]. Though partial differential equations represent steam generator and reactor dynamics, finite difference equations as a finite number of non-linear ordinary differential equations satisfactorily match practical tests [117]. Their linearization therefore accords with equation (2.1) and with Aizerman’s conjecture, intact plant control via transfer function matrices can be engineered.

Practical studies [133,138-140] indicate that contriving diagonal dominance can require considerable skill: even with transfer function matrices much smaller than those for a complete power plant. Also, when manual intervention becomes imperative in some accidents, the control of an intact plant variable using a linear combination of several inputs appears to be humanly intractable. Moreover personal experience, exemplified by Section 3.4, is that ad hoc accident control cannot be conceived without an essentially one-to-one relationship between controlling and controlled plant variables. However, engi­neered rate constraints on nuclear plant temperatures etc. to ensure economic longevities or the intervention of trip circuits [127] intrin­sically impose such essentially one-to-one relationships. As a result, though fossil and nuclear power plants are MIMO systems, their control can generally be addressed in terms of SISO theory as illustrated in Sections 3.2 and 3.3.

Theoretical concepts necessary to appreciate Chapters 2 and 3 have now been briefly outlined. Their first application is in the control of nuclear reactor power.