A commonly accepted principle is that the direct responsibility for safety of a nuclear plant rests with the utility. This contrasts the role of the regulator whose function is to set the safety goals and to ensure these are met. As for differences in regulatory focus across different countries, there are also differences in relationship between utility and regulator. This relationship is more formal in some countries than others. However, in most countries, there is a desire from both utility and regulator to promote an increasingly collaborative working relationship and encourage open dialogue between the two parties.

It is the responsibility of the licensee to have in place emergency operating procedures for the plant and also emergency planning procedures for the whole nuclear plant complex (Pershagen, 1989). These include instructions for plant operation for accidents within the design basis but also procedures for severe accidents beyond the design basis (Table 3.7).

Operating rules for design basis accidents (event oriented)

Emergency operating procedures for beyond design basis severe accidents (symptom oriented)

Pershagen (1989).

Emergency planning procedures include the establishment of an organisation to implement the plan, including any required accident management actions. Emergency planning procedures beyond the plant boundary usually are the responsibility of other local and/or national authorities. However, the licensee must be prepared to liase and co-ordinate operations with these authorities.

The utilities are regularly audited by safety authorities to ensure that all the required frameworks/organisations are in place for the continued safe operation of their nuclear plants. An important principle is that the safety case is ‘owned’ by the plant, i. e. that a utility has in place a sufficient number of adequately trained staff who understand the relevant issues and are suitably qualified and experienced personnel (SQEP).

Reactor vendors clearly perform an integral part in ensuring the operational safety of a plant. They may be called upon by the utility to provide services not just at the design and initial licensing stages but also during the lifetime of the plant. There may be a requirement to back-fit more efficient safety systems, or to purchase fuel from a new fuel vendor (the latter is more performance — than safety-related). In the US, there has been a push by some vendors to license specific designs with the USNRC. It is expected that this would substantially simplify the licensing process of that particular design, e. g. in countries outside the US.

Waste management issues are discussed in more detail in the next chapter. Some countries have already put in place schemes for the disposal of high level waste in geological repositories; others have not yet committed to this approach.

There are additional safety issues associated with the storage of spent MOX fuel since MOX fuel generates more heat than UO2. It may, therefore, be necessary to down-rate dry waste storage. A further point is that storage pools may require additional neutron poison to ensure adequate sub-criticality.

8.1. INTRODUCTION/OBJECTIVES

Advanced reactors will need to meet continued demands for increased safety. This chapter reviews present legislation and possible future licensing requirements for the safety of advanced future reactor operation. The current generation of nuclear plants was designed to withstand accidents from a set of ‘design basis’ events. Most countries set limiting core damage frequencies and limiting probabilities for large fission product releases. An objective of many designers for advanced plants is to extend the current design basis to include accidents of increased severity and lower probability to meet expected more stringent future regulatory safety requirements.

The main focus of this chapter will be on the licensing and safety requirements for evolutionary reactors. Many regulators believe that the national frameworks already in place for existing plant remain adequate for evolutionary plant. However, there are increasing endeavours by international bodies such as the EC and IAEA to promote more harmonised agreement on nuclear safety criteria and therefore encourage a more harmo­nised approach to licensing in their member states. There is similar encouragement from the industry side with the development of standardised utility requirements (URs) for member states, e. g. the US and European URs described in the previous chapter.

At the present time, nuclear power supplies only a small contribution to the country’s energy requirements, generating 2.9% of the total (World Nuclear Association, 2003). Currently operating there are an old PHWR (125 MWe) supplied by Canada and the Chasnupp PWR (300 MWe) supplied by China. Both these reactors are operating under international safeguards. Pakistan also has a 9 MW research reactor.

There are also plans for another Chinese-designed PWR. This is proposed as a second unit at the Chasnupp nuclear plant at Chashma (Foratom e-Bulletin, 2003b).

The technologies that have been investigated for a gas-cooled fast reactor concept have been reviewed by Mitchell et al. (2002). The basic idea has been to extend the thermal reactor concept but with a fast reactor core. The existing technology gas-cooled breeder reactor (ETGBR) was based on an AGR technology with a carbon dioxide-cooled system. The gas-cooled fast reactor (GCFR) design of General Atomics takes a helium technology as its basis. The gas breeder reactor (GBR) covered four different design concepts in respect of carbon dioxide and helium as possible coolants, oxide pins vs. particle fuel, etc., see below. These are surveyed in Table 12.4.

13.9.3.1 Sodium-Cooled Fast ADS. ADS have more ‘inertia’ than the corresponding critical reactor in that they are less sensitive to both positive and negative feedbacks (Bell, 1994). For example, with the source still on, they have lower but wider power peaks than in the critical reactor. In the ADS, the power rises earlier due to the lesser influence of negative feedbacks such as Doppler, axial expansion and structural effects. It falls later due to the lesser influence of fuel dispersion. In the sodium voiding phase, pin failures could occur.

The more sub-critical the ADS, the more the above features are seen. To avoid core meltdown, the source must be switched off, before much sodium voiding occurs. As stated earlier, fuel slumping can lead to re-criticality and power excursion because in a fast system the core is not in its most critical configuration prior to the event (Theofanous and Bell, 1985).

The ADS has some advantages over the critical reactor in that the time constants for the power excursion are longer and rapid power excursions are not possible at least when the ADS is in its original configuration. There is similarly a longer time period to detect sodium boiling or pin failures and hence initiate a beam switch-off.

13.9.3.2 Gas-Cooled Fast ADS. Gas-cooled fast ADS share the similar advantages and disadvantages that gas-cooled fast critical reactors have compared with fast sodium systems. Advantages include the utilisation of a chemically inert gas, and it may be possible to use water for post-accident cooling, e. g. if an in — or ex-vessel core-catcher can be designed and concerns of re-criticalities can be addressed.

Gas-cooled systems can also clearly suffer cooling failure events, but since system pressures are comparatively much higher than the sodium coolant system, LOCA accidents are an additional issue. In all cases, shut-off of the beam is crucial for preventing a core melt. A disadvantage of the gas system is that decay heat removal cannot be achieved solely by natural convection, thus back-up diesel generators are needed to be on stand-by in the event of loss of power to the active circulation pumps.

13.9.3.3 Lead-Cooled Fast ADS. Lead coolant has a number of advantages as a coolant compared with liquid sodium. A lead system would not suffer from positive feedback effects on reactivity in the event of boiling. It is only a weak moderator and, therefore changes in reactivity do not result due to changes in density effects.

It is also relatively chemically inert to air and water. The one disadvantage is the relatively high melting point 327°C, which means electrical heating would be required during start-up and there may be the possibility of freezing and blockage in the event of electrical system failure.

The Rubbia design includes lead as a coolant and it has been analysed against cooling failure transients such as LOF due to pump failure and LOHS due to loss of feedwater. The system has good natural circulation cooling characteristics so LOF is not an issue. For LOHS, meltdown could occur if the beam is not shut-off. This could also occur for slow reactivity insertions under similar conditions. However, the Rubbia system incorporates a specific provision to shut off the beam, based on shielding of the target by a rising liquid lead level under accident conditions. Further provision is also included in the Rubbia design to ensure long-term removal of decay heat by air natural circulation of the guard vessel.

13.9.3.4 Thermal ADS with a Circulating Salt-Fuel Mixture. Thermal systems have generally larger cores than fast systems because power densities are lower. This has the advantage of greater thermal inertia under coolant failure accident conditions allowing more time for accident detection, prevention or mitigation. Without switch-off of the beam though, pressurisation, heat-up and boiling would occur. However, this could be mitigated by spallation target melting and material movement leading to neutronic shut-down.

The time-scale for decay heat-up of the larger core systems is of the order of tens of hours since the fuel is distributed around the core and primary circuit and the system is in natural circulation mode. Some long-term cooling system/procedure though would need to be established, i. e. the salt-fuel mixture may need to be drained into a cooled tank. For smaller systems it may be possible to remove all the heat via natural circulation.

An advantage of a liquid fuel system is that short-lived fission products can be removed to reduce the fission product inventory.

The precipitation of fuel or MA may be a concern in salt-fuel ADS. This phenomenon could lead to flow impedance and loss of cooling in selected areas but also the density variation around the circuit could lead to criticality concerns.

There is also some concern that loss of cooling could lead to power increases due to a positive temperature coefficient in pure salt/Pu/minor actinide mixtures, since no 238U or 232Th with their absorption resonances would be present.

There is also the issue of possible explosive contact between molten salt and water; there may be potential for this event in some designs (Hohmann et al., 1982).

Inspection of components is also difficult in molten salt-fuel systems because pumps and heat exchangers become contaminated with radioactive material. Furthermore leaks would result in contamination of the whole containment.

15.1. INTRODUCTION/OBJECTIVES

In connection with design optimisation, comprehensive experimental and theoretical programmes for component and integral design, testing and certification are carried out by vendors. In addition, safety-related projects are performed by major research institutes within various national and international programmes. Many data available for present generation plants are still applicable to evolutionary and advanced future reactors. However, additional data are required for certain physical processes which occupy increased significance in advanced passive systems, e. g. natural circulation, condensation and non-condensable gas-related phenomena. Relevant experimental research for both current and future reactor systems is summarised for some of the major designs under review in this book. In regard to international activities, particular reference is made to the extensive EC research programmes (FISA 2001, 2001; FISA 2003, to be published). The focus in this chapter will be on experimental programmes; theoretical work is covered in the next chapter.

The majority of research to date has been in support of the present generation and evolutionary plant. Many present day plants are coming up towards the end of their original design lives and with the dearth in new build there are strong incentives to consider extension of life. This has, therefore emerged as a key area of research. Severe accident research is being used to develop severe accident plans and support Level 2 PSAs; hence severe accident research is also prominent. Research specific to evolutionary passive designs includes work on natural convection cooling, with and without the presence of water. Many of the evolutionary designs also include improved provision against severe accident loads; research is carried out on passive heat removal from melts within the reactor cavity.

Significant areas of research to support the present generation programme include safety at all stages of the fuel cycle, reactor safety during plant operation, radioactive waste management, radiological protection, and other activities to benefit from ‘lessons learned’ in the past. There are active work programmes in all these areas; for example within the European Union there have been numerous activities funded by the EC Euratom Programme and corresponding counterpart national programmes.

In addition to research projects per se, there are a number of joint and other collaborative projects being co-ordinated under the auspices of the NEA, which primarily collect, make data available and perform analysis on the data. Some of these projects are of a general nature, e. g. the International Common-cause Data Exchange (ICDE) project

collects operating data related to common-cause failures. The Fire Project collects data related to fire events in nuclear environments and the OECD Piping Failure Data Exchange (OPDE) project collects and analyses pipe failure event data. More information is given in NEA Annual Report (2002).

There are a number of technical issues that will need to be addressed in regard to the innovative reactor systems that are envisaged for the future, e. g. the Generation IV concepts. These are covered briefly at the end of this chapter. Many of the concepts will require significant research effort. For some systems, R&D activities are already underway, e. g. in regard to the supercritical and high-temperature gas systems that are expected to be among the first Generation IV systems to become available.

In the first part of this chapter, research primarily relevant to current generation plant is considered.

Reactor kinetics codes are used to calculate assembly averaged neutron flux and power distributions in a reactor core under transient conditions. The UK PANTHER code developed by British Energy is a typical example (Hutt, 1996). It includes a neutron diffusion neutronics model, coupled with a 1D thermal hydraulics model for the core region. The code has also been coupled with the RELAP5 system thermal hydraulics code, see below, to provide a neutronic/primary circuit modelling capability. The code can perform reactor calculations, fuel management studies and safety transient analysis. It can also be used for on-line calculation support. Other codes include: RAMONA, PARCS (Joo, 1998), SIMULATE-K, CORETRAN and SAPHYR.

Whole-core events, such as macroscopic temperature changes cause global power changes and these can be modelled adequately with point-kinetics models. These models require as input, reactivity coefficients, the effective delayed neutron fraction, generation time and control rod worths. However, in some transient conditions such as rod ejection or control rod drop, localised events occur that require multi-dimensional neutron kinetics analysis with codes of the type mentioned above. One-, two — and three-dimensional models require neutronic input parameters such as assembly averaged neutron cross­sections and delayed neutron fractions that are obtained from the nuclear data codes. The neutronics codes typically model energy groups condensed into two energies. Delayed neutron fractions would usually be modelled on a nodal basis.

A review of applicable existing thermal gas cooled reactor experience and previous gas cooled fast reactor projects is given by Mitchell et al. (2001). Gas reactor physics methodologies have been established, e. g. WIMS and PANTHER for application in the UK gas reactor industry. Gas reactor physics methodologies are being extended to high — temperature reactor applications with pebble bed fuels, taking advantage of already existing experience. The fuel and core design for gas cooled fast reactors are necessarily different, e. g. the graphite pebble bed concept cannot be used because graphite is a moderator and also because of the fast neutron core reactivity sensitivity to geometry variation. The fast gas reactor core will probably be based on more conventional LMFBR design using MOX or UOX steel clad pellets, e. g. as in the ETGBR design.

A range of computer codes has been developed for fast reactor neutronics (IAEA-TECDOC-1083, 1999). These include codes based on classical diffusion theory, transport theory and Monte Carlo methods. Within the European fast reactor community, the European reactor analysis optimised system (ERANOS) code system has been developed. This system embodies a modular system of codes not only for performing neutronic system design calculations but also for experimental analysis of critical facilities.

Undoubtedly, more research will be needed to develop reactor physics methodologies for the evolutionary plants and certainly for the more innovative concepts. However, there already exists substantial pool of experience on which to build.

It is likely that nuclear power within particular sectors will decline over the next 20 years. However, increasing competition will encourage utilities to seek plant life extensions, tending to slow this decline and contribute to reducing carbon dioxide emissions. It is probable that with appropriate investment and refurbishment, the lives of some plants may extend up to 60 years and beyond.

Many present-day reactors are now approaching the end of their design life. There are considerable efforts to extend the operational life of such plants by various means such as backfitting of systems, changes in operational practices, etc. For many countries, the economics of extending the life of existing plants, compared with the capital costs of building new plant, is very favourable. However, the Chernobyl accident in particular has shown that reactor safety is an international concern and economic benefits have to be considered against global acceptability. Decisions on the extension of life depend on a range of technical issues, principally materials performance, chemistry and availability of sophisticated inspection techniques. These and other more general issues (Table 2.9) are reviewed in this section.

Table 2.9. Extension of lifetime issues

Technical feasibility — effect of the processes of ageing?

Plant safety for intended period of operation — ageing of critical safety components? Regulatory framework — establishment of procedures for licence extension?

Social acceptability in national climate — changes during plant lifetime and public perception? Economic considerations — are the economics favourable?

The plant operating envelope is agreed between the licensee and the regulator as part of the plant safety case. It is usually defined (Pershagen, 1989) by a set of rules and guidelines to ensure safe operation of the plant but also containing some degree of flexibility to enable the plant to operate in an optimal way. The degree of optimisation or the operating margins that can be achieved must be compliant with these rules and guidelines.

They include technical specifications, Table 4.2, which define bounding values for key safety-related parameters. If exceeded, the plant would need to shut down and the regulator would require a full investigation before operation could restart. There are requirements on the functioning of safety systems and components in order that the conditions of plant operation are met. If not all these requirements are met a reduced mode

Bounding values for the safety parameters and reporting arrangements to safety authorities if limits are exceeded

Allowable conditions for plant operation, including systems availability — how operations must be restricted if such systems functions are not in place

Specification and schedule for testing and inspection of components and systems — restrictions, if testing is not carried out or functionality is impaired

Rules for both normal and abnormal operation — reporting procedures for operational events and design modifications

Pershagen (1989).

of plant operation may be imposed. Conversely, a more optimised mode of operation may require more stringent performance of the systems and components, possibly a need for plant modifications. Similarly, the degree of optimisation that can be achieved may depend on the outcomes of inspection and testing programmes. Finally, any change in operating conditions must meet the rules for both normal and fault conditions.

The operating rules cover all plant states from start-up to shut-down and in all modes of plant operation. These are documented in detail and may be updated in the light of new experience on changes in plant, e. g. modifications.