Radioactive materials have to be kept from being released into the environment both in normal operation of the reactor and in the after­math of an accident. There are usually three substantial containment boundaries: the cladding of the fuel elements, the primary coolant

containment (i. e. the reactor vessel in a pool layout, or the reactor, pump and heat exchanger vessels and the connecting pipework in a loop layout), and the reactor building. Fuel and fission products are contained by all three; activation products including 24Na by the last two.

Failure of the fuel cladding is discussed in section 2.4.7. The fuel is designed so that failure of any one element is very unlikely, but there are so many elements in a reactor core (of the order of 105 in a 3000 MW (heat) reactor, each being renewed after each year or so of operation at full power) that the possibility of some failures has to be allowed for. Failure by fission-product corrosion or due to a defect in manufacture is likely to result in no more than a small crack in the cladding, which would release to the coolant just the fission-product gases and possibly some volatile fission products. The amount of radioactivity reaching the coolant would be small unless a much larger breach was made in the first place, or the small breach was enlarged by operating the reactor for a long time without replacing the failed fuel. Experiments have shown that even in the event of gross cladding failure the amount of fuel released is very small (Smith et al., 1978).

If there should be widespread cladding failure gaseous fission products would find their way to the cover gas over the coolant. They would be contained by the roof of the reactor vessel, but there might be some leakage through the seals on pump shafts, control rod actu­ators and rotating shields. The seals have to be designed to keep this, together with the leakage of 24Na, to a low level.

Apart from such minor leaks, the primary coolant containment also has to be designed to prevent a major breach. This means that it has to be able to withstand the effects of accidental loads that might be imposed from without, by a piece of heavy equipment being dropped, for example, or from within by a core accident (see section 5.4.4).

Any release of radioactive material from the primary coolant cir­cuit is contained by the reactor building, or “secondary containment” as it is often known. The building has to have a ventilation system with suitable traps and filters to control any radioactivity released to the atmosphere inside the building and to cope with the effects of the sodium fire that would result from a breach of the primary or second­ary coolant circuits. (Ways of preventing such a fire are described later in section 5.3.1.) The building itself has to withstand loads imposed by wind or snow, by earthquakes (if the reactor is to be built in a zone where these occur), by missiles from external sources such as an explo­sion in a nearby piece of plant or equipment, or by a crashing aircraft.

In summary although care has to be taken in design it is reasonably straightforward to ensure that the three containment boundaries are independent and will remain intact under the loads imposed by a wide range of less severe accidents, which are the ones most likely to occur. This is the principal foundation of the safety of a reactor of this type. Once this foundation has been established release of radioactivity is possible only if there are coincident independent failures of all three boundaries, which is very unlikely, or if some single initiating event can cause breaches in all three.