Fast and thermal reactors with the same fuel burn-up have very similar fission product inventories, but the most likely causes of their atmo­spheric release in Severe Accidents are radically different. In a pool — type fast reactor, the core and all primary circuit components are contained within two strong nested tanks, which can be isolated from the secondary sodium pumps and steam generators by fast-acting valves. The primary sodium coolant at near atmospheric pressure provides an enormous heat sink for the decay heat (PFR ~ 1 GJ/°C), which is also extracted in an emergency by a thermal-syphon[64] heat exchanger [314]. These engineered safety features are considered capable of eliminating the possibility of overheating the fuel, if an actual loss of coolant were to occur in the reactor circuit. Severe Accidents in fast reactors therefore principally concern the following initiating events [177]

i. Gross power excursions as induced for example by the multiple mis-replacement of breeder rods by fuel pins (despite warning instrumentation); and then followed by failure of the automatic shutdown system.

ii. Loss of coolant flow to all subassemblies as a result of failures in primary pumps, pipes or ducts; and then followed by failure of the automatic shutdown system.

iii. Loss of coolant flow to a single subassembly followed by failure to effect a reactor-trip through the burst-pin detection system, or its outlet temperature measurement, or its boiling noise detection system.

It is relevant to examine in more detail the mechanism by which melting in a single subassembly can lead to a major release of a fast reactor’s fission product inventory. If for a particular subassembly there is an excessive burn-up of the fuel or a gross mismatch of gagging or a sufficiently high gas content in the sodium, then local overheating of the pins over a short time-scale would allow the ejection of molten fuel into the sodium. As described in Chapter 5, heat transfer between the two liquids can then potentially take the form of an explosive rate of vapor generation that redistributes the remaining fuel pins with a marked reduction of the interstitial sodium. By sufficiently reducing neutron absorptions in this way, the core could become prompt critical: thereby melting a major portion of its fuel with the subsequent possibility of an explosive vaporization of the liquid sodium coolant. This thermally driven explosion with molten fuel and liquid coolant is known as Molten Fuel-Coolant Interaction (MFCI). Its clear importance to fast reactor safety motivated worldwide research [88,146] which included that at AEEW. Similarly powerful explosions are observed with molten fuel and water, so the phenomenon was also investigated as part of the UKAEA water reactor safety program [89,185].

The superior economics of light water nuclear reactors and reasons for the wider adoption of PWRs rather than BWRs are outlined in Section 1.8. These arguments justified the construction during 1987-95 of the United Kingdom’s first PWR at Sizewell. Any proposed nuclear power plant in the United States must be shown to meet the generic safety criteria of its Nuclear Regulatory Commission (NUREG 0737) [91], whereas in the United Kingdom a safety case must satisfy the

Nuclear Installation Inspectorate for each individual plant.[65] Accord­ingly, though the Sizewell plant is in essence a Westinghouse Standard Nuclear Unit Power Plant System (SNUPPS) like in Figures 1.3 and 1.4, various design modifications [178,179] are incorporated to meet the particular UK licensing requirements for normal operation, mainte­nance and the mitigation of Severe Accidents. Specifically lower radiation doses for plant operatives are achieved by reduced concen­trations of Cobalt[66] in control-valve seatings and boiler tubing where Inconel 690 has replaced the original Inconel 600. Moreover improved radiological shielding of major plant items, remote or robotic mainte­nance and more alkaline water chemistry contribute to fulfilling the ALARP radiation exposure criterion.[67] Reactor scram is actioned by the proven AGR system of Laddics and physically independent self-validating m-processor units [127].

Because the reactor coolant in a PWR is under high pressure (15.5 MPa), leaks or fractures in primary circuit pipe work or the pressurizer or the single-skin pressure vessel have an expertly assessed aggregate probability of around 10“4 per operating year [59,65]. A double offset shear-break of a pipe carrying inlet coolant would create an extreme large loss of coolant accident (LLOCA). On the other hand, small breaks of 2-80 cm2 in the above components constitute a small loss of coolant accident (SLOCA), which by allowing the primary circuit to remain longer at higher pressures delays the intervention of the emergency core cooling systems (ECCS). Accordingly, as shown in Table 4.2, SLOCAs are expertly adjudged [65] as the more probable precursors of Severe Accidents. To reduce this risk the Sizewell reactor has four[68] inlet coolant nozzles and an enhanced ECCS. Specifically

i. Four larger pre-pressurised accumulators of aqueous boric acid, so that two rather than the standard three are sufficient for reactor shutdown.

Furthermore, decreasing coolant flow in the core increases voidage and thereby a loss of neutron energy moderation that reduces power to decay heat values even without scram. Removal of decay heat continues with the injection of more borated water into the reactor’s inlet nozzles by high-pressure pumps. After a further loss of pressure and the now open pressurizer relief valves, low-pressure pumps augment heat removal by recirculating water collected in the primary containment’s sump. Cold aqueous sprays and hydrogen recombiners mitigate over-pressurization of the building from flashing coolant or large hydrogen burns. If despite the considerable redundancy in the ECCS compound failures were to allow inadequate cooling over a protracted period,[69] then decay heat would initiate the Severe Accident sequence in Table 4.3. If the meltdown were to continue then all water except that shielded by the lower-core and lower — support plates in Figure 1.4 is expected to be vaporized. These plates would support a growing accumulation of semi-solidified core debris whose outer solidified crust would result from radiant and ablative heat transfer. Eventually, a loss of creep strength [96] in the lower core-plate would allow quantities of corium into the lower head giving the potential for an explosive MFCI that could rupture the reactor pressure vessel. However, experiments at AEEW show that the explosive energies released under such “fuel rich” conditions are markedly reduced probably due to

i. A shortage of coolant restricting the formation of a detonate — able coarse mixture (see Section 5.1)

ii. A reduced inertial constraint allowing less durable heat transfer.

Fuller descriptions of Severe Accident scenarios with Event Trees appear in References 59 and 65, but the quantities of molten fuel becoming available for an MFCI powerful enough to breach a reactor pressure vessel were not quantifiable in the 1980s. Accordingly, con­temporaneous reports by the Sizewell B Committee [59], Sandia National Laboratory [97] and the Gesellschaft fur Reaktorsicherheit [65], ascribe the wide Bayesian probability range of 10_1 to 10“4 per year for this destructive event. On the other hand, a Swedish govern­ment report [98] even denies its occurrence by virtue of the above mitigating factors and the efficacy of safety systems. Indeed post­incident investigation at Three Mile Island revealed a porous in-vessel debris bed of 8 to 16 tonne which had passively equilibrated rather than detonated. Thus even a late restoration of cooling appears to prevent an MFCI by increasing the viscosity of the molten debris: see Section 5.1. Moreover, world-wide operational legislation [108] now prescribes frameworks for operator command structures and training that render Severe Accidents far less likely. However, uncertainties in the Sizewell B report [59] persisted about sufficiently powerful MFCIs as a result of the 1965 analysis by Hicks and Menzies [85]. Assuming an isentropic (lossless) expansion of an explosive MFCI vapor bubble they predict bounding efficiencies of up to 30% for the conversion of heat into mechanical work. If such values were actually to be true, then the safety cases for fast and light water reactors would be compromised when not unrealistic quantities of molten core materials are involved. However, experiments [88,89,185] at AEEW with kilogram quantities of molten urania consistently gave conversion efficiencies with sodium or water coolants of around 4 to 5%, but scaling this value to tonne-sized reactor quantities was unacceptable due to the absence of an underlying physical mechanism. During 1990-92, the SEURBNUK-EURDYN — BUBEX simulation in Chapter 5 predicted conservative efficiencies[70] [71] of 4 to 5% by representing condensation at a liquid-vapor interface. Identification of this thermodynamic irreversibility allows a sound extrapolation of experimental values to fast and thermal reactor scales so materially consolidating their safety cases.

A large rupture in a PWR’s pressure vessel after fuel melting would allow fission product aerosols, fuel debris, steam and hydrogen from oxidation of Zircalloy clad to enter the reinforced concrete contain­ment. Its potential fracture by over-pressurization or a hydrogen explosion could patently allow an environmental release of radio­activity. Accordingly, hydrogen recombiners and doped cold-water sprays are activated at an over-pressure of about 2 bar, and these also dissolve fission products [104]. Accelerating plant fragments (missiles) could also be created from an MFCI so the concrete structure must be engineered strong enough to withstand their impact and in addition those from crashing aircraft [59,65]. Chapter 6 describes some experimental and analytical research at AEEW which addresses these issues. Though the human and environmental tragedies of Fukushima are harrowing, a positive outcome is that nuclear power stations can be engineered to successfully withstand a major earthquake of Richter scale 9.

A large quantity of core debris (corium) falling onto the con­tainment’s floor raises concern about a core-concrete interaction [181,182]. Despite the large quantities of hydrogen gas created, con­comitant steam concentrations and hydrogen combiners inhibit deto­nations [65]. Calculations [65,182] also suggest that the building’s structural integrity would be preserved by a limited atmospheric venting at 6 bar over-pressure and water injection from the sump or external means. While German studies [65] provide no evidence that extended melting through the floor could be avoided (the so-called China Syndrome), such melt progression did not actually occur at Chernobyl. Following a breach in a PWR’s pressure vessel, a high concentration of aerosol particles would initially exist in the containment building’s steamy atmosphere. However, they would be rapidly deposited by attaching themselves to the remaining 95% of non-radioactive ones or condense on fixed surfaces: thereby reducing the spread of environ­mental contamination [59,65,104,171,183].