ML20030A454
| ML20030A454 | |
| Person / Time | |
|---|---|
| Site: | Big Rock Point File:Consumers Energy icon.png |
| Issue date: | 01/18/1960 |
| From: | CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| To: | |
| References | |
| NUDOCS 8101090541 | |
| Download: ML20030A454 (36) | |
Text
_
S EC TIO N IX SAFEGUARD CONSIDERATIONS A.
INTRODUCTION The fundamental purpose of safeguard evaluations during these conceptual stages of the design is to show that the plant can be de-signed to be safe. It remains for the safeguard evaluation work during the detailed design stages to demonstrate that the plant has been safely designed. On this basis this section of the report presents:
1.
Basic safegua. a features important to the safety of the plant and the cbjectives and criteria guiding the design of those features.
2.
A preliminary analysis of the effects of certain accidents and plant >.:onditions that might be encountered through scheduled oper ation, operator error or equipment malfunction.
i.
B.
GENERAL SAFETY FEATURES Safeguard provisions can be considered in three broad categories:
control over receipt of radiation and release of radioactive material during normal operation; accident prevention; and mitigation of effects of credible accidents.
1.
Normal Operation Features important to the control of radiation exposure arising from normal operation include:
1.1 The design of the gaseous and liquid waste handling systems in such a manner as: to minimize the quantity of these wastes to be toutinely released to unrestricted area; to provide for adequate monitoring and measure-ment of the radioactive content of such materials; to permit absolute control of their release based on measured results.
i
- 1. 2 Location or shielding of sources of radiation inherent in j
j the system to the extent necessary to minimize personnel i
exposure during the performance of normal operating tasks in the plant.
glo[o 9 os<fI
IX-2
(
2.
Accident Prevention Features important in preventing serious nuclear accidents include:
2.1 The inherent safety of BWR's; that is, the negative void and temperature coefficients of reactivity plus the strong negative Doppler coefficient of reactivity in our conventionally low enriched fuels. These are of particular importance in limiting the extent of such classical accidents as the start-up accident or refueling accidents.
- 2. 2 Two separate and independent mechanisms to assure shutdown of the reactor. The principal mechanism involves a set of control rods capable of fast automatic shutdown of the reactor from any one of several potentially unsafe operating conditions. The other involves a liquid poison system to act as a back-up source of negative reactivity.
- 2. 3 Alternate systema for emergency removal of reactor heat. The primary full power heat removal system is of course the turbine main condenser. This unit may be used to remove reactor heat under some emergency conditions but in the event the reactor is isolated from the turbine building other means are required and provided to remove its decay heat. These systems as presently contemplated include:
2.3.1 An emergency condenser located within the reactor enclosure. Such a unit will be de-signed to safely remove reactor heat following scram for a number of hours with-out operator attention.
2.3.2 A core spray system designed to cool the reactor core sufficiently to prevent fuel meltdown following scram and loss of all other coolant measures.
2.4 A reactor safety system with sensing devices to detect and prevent potentially unsafe operating conditions from becoming too severe. This system includes a sensing device for all reasonably conceivable unsafe operating conditions that might arise from operator errors or equipment malfunction.
- l
IX-3 2.5 The design of control of the reactor and primary equipment in such a way as to minimize the possi-bility for operator errors or that the malfunction of equipment could lead to an unsafe operating condition.
3.
Accident Mitigation Though the likelihood of a serious nuclear accident is ex-tremely remote. by virtue of the foregoing-design features and the availability of strong procedural control, the protection of the health and safety of the public is further assured by:
3.1 The provision of c>nstant monitoring and automatically controlled isolation equipment on the primary system off gas discharge line, and
- 3. 2 Housing the reactor and its principal auxiliaries within a vapor tight enclosure.
C.
SAFEGUI..'lD OBJECTIVES The objectives in providing such features as have been discussed in the preceeding paragraphs may be briefly stated as follows:
1.
Normal operation of the plant must not result in the exposure of any persons on or off the plant premises to radiation in excess of the established permissible limits.
2.
Safety against a nuclear accident that might release dangerous amounts of radioactive materials must be preserved even in the event of equipment malfunction, operator errors, or other credible contingencies.
3.
Confinement of any significant quantity of radioactive materials that might be released from the reactor must be assured in the event a serious credible accident does occur to the plant.
D.
SAFEGUARD DESIGN CRITERIA Design of the major equipment and features important to the safety of the plant to achieve the above stated objectives are guided by such criteria as follows:
1 Reactivity Coefficients 1.1 The void coeffik:ient averaged over the interior of a fuel channel (the steam generating area) must always be
.v
-r
- - ~
IX-4 negative when the core is critical.
[
- 1. 2 The moderator temperature coefficient must be negative at operating temperatures and should be as negative as possible at lower temperatures consistent with good over-all design. In any event, the numerical value of any positive moderator temperature coefficient must be limited so as not to introduce any significant possibility of a destructive nuclear excursion.
- 1. 3 The fuel temperature coefficient must be negative.
- 1. 4 The numerical value of these negative coefficients should be as large as compatible with other require-ments.
4 2.
' Reactor Shutdown Systems The primary reactor shutdown and control system is designed to:
2.1 assure fast automatic shutdown of the reactor from any I
one of any reasonably potentially unsafe operating conditions; 2.2 include the use of a reasonably large number of control rods to minimize the reactivity worth per rod; 2.3 provide a shutdown maigin of at least 0.01ak in the cold clean condition with at least one control rod wholly out of the core and completely unavailable;
- 2. 4 permit the removal of only one control rod at a time (however, controlled group removal of rods may be permitted if the removal pattern, or the resultant rate of reactivity increase or other system effects, under all modes of operation will not intr oduce a reactivity or instability condition more severe than analysis to date have indicated may be acceptable for a single rod removal system);
- 2. 5 prevent the withdrawal (in the normal direction) of a control rod from the core except by use of the normal positioning device; i
s.s i
IX-5 2.6 insure that no significant danger would result from any reasonably conceivable failure of a rod; 2.7 limit the rate of control rod removal to a value that would not result in a credible "startup accident" in-volving fuel rod destruction even if the period scram circuitry were to fail coincident with the incident, (in this analysis credit may be taken for the negative fuel coefficient of reactivity and it may be assumed that the high flux scram circuitry operates to scram the s reacto r. );
2.8 indicate which rod is being moved and the axial posi-tion of its poison section; and 2.9 prevent control rod withdrawal on startup unless reactor safet f system circuits, including the short reactor period scram circuitry, are in an operable status.
The secondary reactor shutdown system involves a liquid poison system to serve as a manually-controlled backup source of negative reactivity. The system is designed to be operable with the reactor operating or shut down, and with or without the L
reactor head on.
l 3.
Emergency Reactor Geoling The primary full power cooling system will be the turbine and its main condenser. Alternate systems for amergency removal of the reactor heat following scram include:
3.1 An emergency condenser located within the enclosure.
Safeguard design features of this system include:
3.1.1 The system is sized to safely remove reactor heat for a number of hours w.thout operator attention following scram and isolation of the reactor from its main heat sink.
3.1.2 The system is to be brought into use auto-matically on high reactor pressure.
3.1. 3 Vapors arising from the shell side and pas-sing to the outside atmosphere are to be monitored by a radiation detection chamber.
(This feature would permit detection of an incident wherein there were radioactive fission-product vapors in the primary system
.s
IX-6 n
3 coincident with use of the emergency y
condenser and coincident with rupture of a tube bundle in the condenser. In such a case, the faulted tube bundle would be isolated from the primary system by closure of appropriate line valves.)
3.2 A core spray system; design features to include:
3.2.1 A size and arrangement to prevent sig-nificant clad or fuel melting following a rupture in the primary system of any magnitude up to and including one resulting in the rapid loss (in the order of 2 or 3 seconds) of all the coolant from the core while the reactor is operating at rated con-ditions. (In such an incident the reactor
^
would have been shut down automatically by a scram signal from either or both the low water level or high-enclosure pressure i
safety system sensors. It would also be effectively shut down due to loss of modera-to r. )
3.2.2 An automatic initiation from low reactor pressure--for example, about 200 psig, and/or low water level in the reactor (both should be provided but only one need act to initiate the system).
3.2.3 A reliable source of pumping power with automatic cut-in of a standby unit.
3.2.4 An appropriate circuitry to assure proper bypassing and reactivation of system during shutdown and startup operations.
l 3.2.5 A consideration of a spray supply line design to minimize rupture probability in the event of excessive movement of the reactor as a result of a severe rupture in the vessel or elsewhere in the primary system.
(
IX-7 i
4.
Reactor Safety System The safeguard objective of the reactor safety system is to scram the reactor in the event of an unsafe operating condition.
This system includes sensing devices for all reasonably conceivable unsafe opera-ting conditions that might arise from operator errors or equipment malfunction.
The system will include monitoring devices external to _the ~ reactor. ' De sign considerations for the system are as follows:
4.1 This out-of core system utilizes two paralleled safety channels, each channel with its separate power supply and sen-sing elements.
Both are of fail-safe design throughout (that is, de-energizing will cause a scram), and both must be de-energize to cause a scram.
In most cases, two or more sensing element con-tacts for a given condition are provided in a series in each channel for greater safety.
Sensors in this system are provided to monitor the following plant conditions:
4.1.1 High neutron flux; 4.1.2 high reactor pressure; 4.1. 3 low water level in the primary steam drum 4.1. 4 simultaneous closure of turbine stop valves and primary bypass valves; 4.1.5 c'..aure of backup primary steam sphere isolation valves;
. 4.1. 6 high enclosure pressure;
(
,---m.-.
IX-8 t
4.1. 7 short reactor period; 4.1. 8 low cendenser vacuum; 4.1. 9 low water level in the reactor vessel; cnd 4.1.10 simultaneous closure of recirculation water line valve s.
- 4. 2 In addition to scramming the reactor, scram signals from this system will also perform other important safeguard actions, such as:
- 4. 2.1 All scram signals will close the ventilation isola-tion valves.
4.2.2 Scram signals from either "high enclosure pressure" or " low water level in the reactor vessel" will close necessary isolation valves in lines penetrating the enclosure.
4.2.3 Scram signals from either
" simultaneous closure of the backup primary steam sphere isolation valves" or "high reactor pressure" will initiate emergency cooling via the emergency condenser.
An in-core monitoring system will be pro-vided to indicate. local power to permit more optimum utilization of the fuel.
The decision as to whether this system should be incorporated into the reactor safety system will be made at a later date when more operational data on large cores is available.
. (~
+.
4
. _ _ +.,, _
IX-9 5.
Special Control Features 5.1 Use of a master i. elector switch arrange-ment to permit the inclusion and/or neces-sary interlocking or bypassing of the reactor safety system circuits for the principal plant conditions--startup, run, shutdown, and refuel.
- 5. 2 Restriction of maximum rates of performing certain critical operations such as valve opening or closing rates to assure such operations do not cause undesirable system or reactor disturbances.
- 5. 3 Prevention of rod withdrawal upon loss of primary s ource of energy for scram inser-tion of control rods.
6.
Enclosure
\\
Design criteria important to the functional safety of this unit are discussed in Section III-B above.
E.
SAFEGUARD EVALUATIONS
~
The provision of the above described features to safeguard against the occurrence or effects of accidents are to be based on thorough analysis and evaluation of all types of accidents and contingencies that have any reasonable possibility of occurrence.
This work includes studies of reaction to off standard conditions; safety in the event of equipment malfunc-tion and operator errors, safety against any system instabil-itie s, fi re s, and other general hazards, and the effects of a hypothesized major accident - the " maximum credible accident" for the plant.
A detailed analysis of such events will be carried out during progress of the detailed design.
- However, a preliminary analysis based on the conceptual design features for this plant and the results of similar studies made for pre-viously proven designs is presented below to assure that the design as now conceived does not involve any significant hazard.
=
IX-10
(
1.
Reaction to -Off-standard Conditions Off-standard conditions for the' purposes of this analysis will be considered to be those abnormal conditions arising in the course of regular plant operation in the power range in which control is still held by the operator.
Typical of the events considered in this respect are:
1.1 Valve testing.
- 1. 2 Changes in pressure regulator set point.
4
- 1. 3 Control rod runout and in.
The bypass steam valves will be tested. at prescribed intervals to assure their proper ope ration.
The pres-sure disturbance to be expected as these valves are opened and closed under test will be controlled by appropriate design features (rate of opening and closing valves) to assure the absence of any serious pressure surges.
Fast changes in the pressure regulator set point could cause a pressure and flux transient.
It is expected that the flux transient in such a case could be large enough to scram the reactor at 125% of rated power.
Thus, the rate of change will be limited by appropriate design features to a value (about 1 psi /sec) that will not cause such a flux transient.
The continuous withdrawal of control rods at power we Id cause a flux peaking in the area from which the rods are withdrawn.
There would be no excursion how-ever, due to the strong negative void coefficient of reac-tivity.
The rate of increase of power in such a case would be a function of the rate of rod removal, the par-ticular rods removed, and the control rod and void config-uration at the time of the incident. In any event, the local power flux, and the over-all steam formation would increase t
=
4 5
IX-11 smoothly. The bypass valves would continuously increase their opening to receive the larger steam flow. Before the flow capacity of these valves is reached, the reactor would be safely shut down from the over-flux signal that would arise fr 'm the flux monitoring instrumentation.
During a similar continuous control rod run-in, the pressure will drop smoothly and slowly at first, then more rapidly. As the primary steam flow is reduced, the pressure regulator will direct the closure of the turbine steam admission valve in an attempt to maintain the set reactor pressure. If continued, the reactor would be shut down, t
2.
Safety in Event of Equipment Malfunction Typical events considered in this respect are malfunction or failure of:
2.1 Control rods
- 2. 2 Control rod normal or emergency drive power Re irculation pumps
- 2. 3 c
- 2. 4 Electric load on plant 2.5 Condenser vacuum
- 2. 6 Reactor Safety System -
- 2. 7 nel cladding 2.8 Feedwater heaters
- 2. 9 Feedwater system 2.10 System ruptures Safety in the event of most types of control rod failures is pro-vided by the large number of rods available for control and the fact that in the hot operating condition many rods at random could fail without impairing the ability to shut down. Even in the cold condition the reactorinay be shut down if a single rod of maximum worth is withheld from the core. In the event of
l
^
IX-12
(
a mechanical failure or aeparation of the normal working connection between the rod drive and the poison section of the rod, a special design feature of the rod will prevent t.ctual l
separation or loss of the poison section, thus assuring control at all times.
Loss of normal control rod drive power to a single rod would not create a serious condition and the reactor could be safely shut down. Since rod drive power is obtained from the feed-water system', loss of the entire supply would lead to low water in the steam drums and an immediate shutdown of the reactor from the low water level scram sensor. Such a loss of normal drive power would not affect the power for scram insertion of the rods which is obtained from a separate stored energy source.
Safety in the event of loss of the source of pressure for emer-gency scram is obtained by providing a separate and iniepen-dent pressure source for scram fcr each two rods. Thus, lo s s of one of these sources, a pressure accumulator, can only affegt two rods, and the location of any of these two rod grcaps will be such that the reactor can be s. tat down even if these two rods are not inserted.
In the event;of loss of the recirculation pumps the power level will drop slowly and settle out at a reduced rating dependent on the natural circulation flow rate. It is expected that this rate may be high enough to maintain a power level somewhat in exe cess of fifty per cent of rated power. In any event adequate cooling of the core would be provided by natural circulation to assure freedom from any core damage.
Sudden loss of electric load would cause pa-tial closure of the turbim admission valves. The bypass steam valves would open W.o-matica11y to hold system pressure constant. The control rods would be repositioned to reduce power. Su~ch operation should prevent the pressure or flux from reaching scram trip levels.
However, if it does not, the renctor would be shutdown auto-matica11y from one or both of these conditions without any damage to the fuel or reactor. The emergency condenser would be brought on automatically to assist in heat removelif the sys-tem preesure reached its trip setting.
Loss of condenser vacuum would initiate an immediate reactor shutdown from the v acuum sensors in the reactor safety cystem.
If the cause of'the incident was loss of circulating flow due to 1
,w
IX-13 power fcilure, the retctor would also receive cutomatic shutdown signals from the entire safety system which is
(
designed to be normally energized. If the condenser pres-sure continues to rise a higher trip setting will eventually close the turbine bypass valves, thus limiting further pressure rise in the condenser. Further rise in the sys-tem pressure would eventually initiate cooling via the emergency condenser.
Because of the failsafe design of the reactor safety system, significant malfunction would causein immediate insertion of control rods and reactor shutdown. Also because of the failsafe design and the number of sensors provided an?
ria-bles monitored failure of a sensor should not impair the ability to transmit a scram signal r effect a scram.
In the event of a fuel cladding failure protection would be pro-vided by the off-gas holdup system, its radiation monitor and valve isolation provisions. The system is designed for manual closure of the gas holder isolation valve at a noble gas concen-tration that could be reasonably expected to deliver the maximum permissible offsite ddse if the operation were to continue un-abated for a year. Automatic shutdown will occur at a slightly greater gas release rate in time to keep personnel exposures within acceptable limits.
Sudden loss of all the feedwater heaters would cause an im-mediate but smooth rise in flux. It is expected that the flux would reach the scram value of 125% of rated within a few minutes with no s'.gnificant overshoot or damage to the fuel.
Loss of feedwater would result in gradual lowering of the water level in the steam drum and if continued would automatically initiate reactor shutdown. Adequate reactor cooling would then be available through operation of the emergency condenser fol-lowing isolation of the reactor from the main condenser.
The problem of system rupture will be discussed in some detail later in conjunction with the maximum credible accident. How-ever, in general safety measures with respect to such accidents are provided by the basic integrity of the structural design, the provision of backup cooling systams, and in the final analysis, the containment structure.
't.
Safety in Event of Operator Errors Safety in the event of operator errors is provided primarily by
IX-14 the reactor safety systsm, cnd special features, i.e. inter-t, locks, are provided to prevent startup if the reactor safety syse m has not been properly activated. Safety against operato;e errors is also provided by careful selection and thorou~gh training of the operating staff, working conditions conducive to attention to duties, systematically planned operating and maintenance procedures, and by special design measures for control of certain operations. For example, with respect to the latter point, only one control rod can be withdrawn at a time and at a limited rate.
Typical incidents or conditions arising wholly or in part from operator errors which are analysed to establish the limits or response times of t14. teactor safety system or other features to limit the conseque.sces if such errors or other similar un-toward incidents do cccur are as follows:
3.1 The start-up accident
- 3. 2 The cold water accident 3.3 A fuel loading accident
- 3. 4 Misoperation of control rods at power
- 3. 5 Closure of steam line backup isolation valve 3.6 Failure to replenish cooling water in the emergency adenser The start-up accident involves the rapid sequential withdrawal of control rods at start-up such that the reactor is brought quickly from the cold shutdown condition to a critical state. If the rate of reactivity insertion is great enough, the reactor power level may overshoot the normal valva and if sustained for a few
- eeconds, could damage the fuel.
Conventionally it is assumed that the principal design measure (the period scram circuitry) protecting against such a power rise fails coincidentally with the incident. Under this and other conservatively assumed con-ditions (moderator temperature, condition of fuel, initial re-activity level, and the reactivity worth of the most " valuable" control rod), the " maximum credible" startup accident is ex-pected to involve a power rise to about 100 to 200 times rated.
This condition would exist for only a fraction of a second before the doppler coefficient would terminate the rise and reduce the
(
.m
IX-15.
power to nearly rated. Following almost immediately, the reactor would be shutdown by the high flux level scram sensors. Because of the short duration of this transient, it is not expected that any fuel damage would be encount-ered.
A cold water accident involves the sudden introduction of subcoeled water into the operating reactor. In such an incident Cure would be a rapid rise in the neutron flux and power and the extent of these would be dependent on the degree of subcooling and its rate of injection. The principal source of such subcooled water would be a " cold" recirculation loop in the system. However, it is possible that the final design and arrangement of the piping between the two recirculation loops will be such that there can be but little " cold" water in a non-operating loop of the system during reactor operation; thus, effectively eliminating the cold water accident as one of concern. However, in any event the rate at which the isolation valves in these loops may be opened will be limited by design to a value that will not generate a flux transient large enough to damage the reactor or fuel.
The " maximum credible" fuel loading accident is conceived to
(
involve the introduction of a fuel assembly of normal enrich-ment into the most reactive core arrangement at the maximum insertion rate of the loading hoist. It is also assumed that the reactor was just subcritical at the time and that the period -
scram circuitry fails to function. Thus, there must be both equipment malfunction and operator errors. Under such a situation it is expected that analyr.is will indicate that the nega-tive doppler coefficient and the high flux scram sensors will combine to effectively shutdown the reactor in time to prevent any fuel damage. The effects of this accident are not expected to be significantly different from those of the startup accident.
Misoperation of com tol rods at power could lead to a local high flux and power condition with ultimate fuel damage. Protection against this type of accident is provided principally by the in-ccre monitoring system with its automatic alarm and scram provisions. However, the external flux monitor may also serve as backup protection in some instances. It is also expected that analysis will show that many control rods will have to be removed from a given section of the core to set up such a con-ditio n.
Though it is not unreasonable to assume that sometime during the plant life an extra rod or two might be inadvertently
{
removed from a given area, it is unlikely that several rods would be so removed without deliberate intent.
-e t=-
IX-16
(
Closure of the steam line backup isolation valves effectively isolates the reactor from the main condenser. In such a case, the reactor pressure would start to rise but the rate of rise would be slow due to the relatively long time re-quired to close these valves. Initial protection against over-pressure is provided by a position sensor on the valve stem that will scram the reactor before the valve is fully closed.
Backup shutdown protection is also available from the high flux and high pressure scram sensors. If none of t! ese de-vices operate the steam safety valves on the stean crum would operate to limit pressure rise. The size of these valves will be large enough to pass the steam generated in such a case with the reactor operating initially at rated power.
Gradual evaporation of the shell-side water in the emergency condenser will occur during itr operation. Protection against failure to replenish cooling water in the emergency condenser is afforded by: an initial water supply sufficient to last for a number of hours without operator attention, and a low water level alarm. If the operators do neglect to replenish the cool-ing wate r, the reactor pressure and temperature recorders in the control room will indicate that the system is gradually 1
heating up.
Thus, there are several indications of this situ-ation available in the control room to the many operators and personnel who would be in this room in such a situation.
4.
Safety against Instability of the Reactor Operation A basic requirement of the react'or design is that it operate well within the stability limits during all phases of normal plant operation. It will be shown by extensive computer analysis that this system will operate stably under all expected plant operating conditions. The advanced feature of higher power density is not expected to introduce any significant problem with respect to the stability or safety of operation. From experience gained from past and anticipated future opt ration of the General Electric Vallecitos boiling water reactor and the General Electric heat transfer facilities, the final design will incorporate such features as necessary to ass ire that the syste m will be free from any sig-nificant tendency for power oscillations. Specific items in the design that contribute to the stability of operation include: forced circulation; relative high operating pressure; relative small change in reactivity per change in void content; and a relatively long fuel time constant.
(
--w-
IX-17 I
In the final analysis, the normal period and high flux sensors internal and external to the resctor should assure protection for the reactor and of parsonnel.
5.
Safety Against Fires and Other General Hazards J'
5.1 Fires There are no unusual fire hazards in the reactor portion A
4 of the plant, and fire protection measures will follow con-ventional steam plant practice.
- 5. 2 Floods i
There is no danger from flooding at the plant site. Further information relative to the flooding potential may be obtained by reference to the consultant's report on geology and hy-drology for the site contained in Appendix 3.
- 5. 3 Earthquakes The plant site is located in an area of low earthquake in-tensity, and plant construction will be in accordance with
(
the conventional design practice for nuclear facilities in such zones.
Further information on the seismology of the plant area may be found in Appendix 5 containing the consultant's report on seismology.
~
- 5. 4 Weather and Miscellaneous Loads All plant structures will be designed to withstand maximum wind and other potential loadings in accordance with standard codes atA normal engineering practice.
6.
The " Maximum Credible Accident" Included in the study of various types of contingencies that have a reasonable possibility of occurrence, is an evaluation of the worst reactor accident that it is reasonable to take into con-sideration in the design of the containment features for the Big Rock plant. Such an accident is identified as a " maximum credible r ccident. "
The core spray system is designed to cool the core after a primary system rupture, and thereby prevent release of fission products through fuel melting by decay heat. However, for the w.
95' wg e
IX-18
(
purposes of this preliminary analysis of a " maximum credible accident, " the core sprav was assumed to be unavailable and the fission product release was calculated on the basis explained below.
a)
General Considerations The primary purpose of considering a maximum credible accident is to provide a basis for the design of the reactor enclosure or other features affecting containment integrity.
For the Big Rock plant, these considerations are based upon reactor design in its present status and then analyzed by analogy to the Dresden Nuclear Power Station.
b)
Maximum Credible Accident Postulation Analysis of the accident will include the following con-side rations:
1.
A near instantaneous complete severance of One of the largest process lines to the reactor at a time when the reactor system contains maximum energy content % the coolant.
(This would involve a main steam c feedwater pipe break when the reactor was in the "h ot " standby condition. In this condition some of the system volume that would normally be occupied by steam would be filled with hot water which has a larger energy content per unit volume. )
2.
The release of pressurized hot water and steam con-tained in the reactor, steam drum and recirculation loops would develop witl$in approximately one minute after the rupture, an initial peak enclosure pressure of the order of 27 psig. Considering plant require-ments to demonstrate a gross electrical capacity of 75 MW, the containment shell will be designed to withstand the peak enclosure pressure resulting from a release at the higher reactor capacity of 240 MW, the rmal.
3.
For purposes of analyzing the radiological effects of the accident, it will be assumed that there are imperfections in the enclosure shell, through which a portion of the radioactive materials can leak out.
4.
It is not considered necessary to include an energy contribution from a severe nuclear excursion or metal-water reaction in determining the peak pressure
(.
because analysis of a similar system (Dresden) has not indicated that a nuclear excursion or metal-water
1 IX-19 i
(
reaction of credible proportion could result in a vessel rupture and because of the negligible like-lihood of a co-occurrence of either condition and a system rupture from other causes.
5.
After the initial presure peak, the enclosure pres-sure wonid undergo changes with time as a function of two comp 6 ting mechanisms:
5.1 There would be heat locses frorr. the enclosure atmosphere to the enclosure she?'., to the solid structures in the enclosure (which, on the average would be initially at a lower temper-ature than the vapor space), and to the environ-ment outside.
- 5. 2 There would be heat gain due to radioactive decay.
- 5. 3 Hect gain from chemical reactions would not be significant.
The net effect of these opposing mechanisms immediately after the accident, while the enclosure wall and solid masses inside are being heated up, would be to decrease i
the enclosure. pressure. However, later radioactive de-cay heat would be generated faster than the enclosure could surrender heat to the atmosphere so that the pres-sure in the enclosure vould tend to rise. Thus, a posi accident cooling system is provided to assure that the enclosure pressure would be reduced to about 3-5 psig by the end of the first day. Such pressure reduction reduces the amount of fission product material that might otherwise leak from the enclosure.
6.
The rate of release of fission products is taken to be proportional to the rate at which the cladding and fuel may melt. This rate is in turn a function of the fuel temperature, which would be much higher on the average at the time of the accident, if the react or were operating at rated conditions rather than in the
" hot" standby condition. Therefore, the fission product dispersion calculations will be made conservatively on the basis that the reactor was operating at 240 MW (cor-responding to 75 MW gross electrical output) at the time of the accident.
(
IX-20
(
7.
The rate of fuel meltdown with time considering core spray cooling to fail at the same time is es-timated to be as follows:
Time after Core per cent Accident-hours _
Melted 1/4 Starts 1/2 10 1
20 4
60 8
80 24 95 40
~100 l
I 1
i
\\
i 1
i 1
w i
4 y
-g--
e ne.,-m
-,----w-n -
m
l IX-21 c.
Radiological Effects A major contaminstion-releasing accident could have two kinds of radiological effects:
1.
Direct radiation from the radioactive-vapor-filled sphere.
2.
Contamination of some parts of the environi.nent with any radio-active materials that might leak out through imperfections in the sphere wall.
Table IX-El shows the possible radiological effects of a " maximum credible accident" to the Big Rock Plant.
The conclusions from consideration of:
1.
The data in Table IX-El, 2.
The conservative assumptions on which the data in Table IX-El were based (discussed later in this section),
3.
An analysis of the effects of other extenuating factors important to the problem (also discussed later in this section),
are as follows:
a.
No one in the environment of the plant site would, in all probability, receive as much as a roentgen of external 4
exposure from the direct radiation from the radioactive vapors in the enclosure or from the " cloud" or fallout contamination from the leakage of radioactive vapors 1
from the enclosure.
b.
No one in the environment of the plant site would, in all probability, receive more tha'n about ten rems internal exposure f rom radioactive material deposited in a crit-ical organ.
The area affected by contamination would be a sensitive c.
function of weather conditions after the accident. The general population in a small area near the plant might have to be evacuated for a short period (up to several months) as a result of ground contamination. Monitoring and possible confiscation of crops and milk might have to be resorted to over an area of up to about two square mile s.
~
t The principle methods employed in calculating the data in Table IX-El and the conservative assumptions on which the calculations were based are discussed below.
b
IX-22 f
Basic to all the calculations is the amount of the radioactive ma-(
terial present in the visible vapor space of the reactor enclosure at any time. This has been taken to be a function of:
1.
The rate of release of fission products from the fuel.
2.
The rate at which the halogens and particulate portion of the released material are Temoved from the vapor space by washdown.
3.
Radioactive decay.
The rate of release from the reactor of the gaseous and particulate fission products has been taken as equivalent respectively to the rate at which the cladding on the fuel and the fuel itself would melt following loss of all coolant. The washdown rate was obtained as a function of the natural condensation occurring within thu sphere as the temperature and pressure are reduced.
The direct radiation exposure from the enclosure is a sensitive function of the energy levels of the activity present, because of the significant shielding effect of the enclosure wall and the air, particularly at the 1/2 and one mile distances. For this reason, the exposure effect of each radioactive halogen and noble gas iso-tope and their principal daughter products were determined sep-i arately utilizing their individcal radioactive decay rates and corresponding energies. The exposure contribution from the "particulates, " however, were determined for the sake of ex-pediency, by the use of the average energy concept. This does not, however, introduce a significant over-estirra te in this case since the fraction of these fission prod.ucts present is quite small.
The rate of leakage of radioactive materials from the enclosure was determined on the basis of an estimated 0. 5%/ day initial leakage rate at a reference design enclosure pressure of 27 psig and the relationship between sphere pressure reduction with time.
The direct radiation exposure from the cloud of radioactive ma-terial was determined by application of the leakage rate data, obtained in accordance with the preceding discussion, to the cloud dosage procedure outlined in " Meteorology and Atomic Ene rgy. "
- This method of analysis is also conservative in that it assumes no fallout of radioactive material from the cloud up to the point of measurement.
- AECU-3066, " Meteorology and Atomic Energy, " by the United States Department of Commerce Weather Bureau, 1955.
T r
-r-
IX-23
'The fallout concentrations o' radioactive materials were determined I
on the basis of particle setiing by eddy diffusion since settling by gravity is expected to be negligible in this case.
(It is expected that the particulate radioactive material which might leak from the sphere will be only a few microns in diameter. If the material were of a significantly larger diameter it would be washed out at a much faster rate within the sphere and thus would not be avail-able for leakage. Also, if the particles were larger, they might not be able to escape from the sphere since the leakage that may occur is expected to be restricted to that which could pass through minute imperfections in the sphere wall or through penetration seals. )
The radiation exposure from the fallout material were calculated from the conventional relationship:
an infinite, horizontally uni-form deposit of I curie per square meter of fission products emit-ting O. 7 Mev gamma radiation will give a dose rate of approximately 10 r/hr at one meter above the surface. The resulting exposures are conservative since the above relationship does not take into ac-count either the finite size and inhomogeneity of the area of dep-osition or the probable shielding by surface irregularities.
The determination of possible internal exposures involved:
I 1.
The calculation of air concentrations for breathing by use of conventional methods.
2.
The individual evaluation of the exposure contributed to a critical organ by each appropriate fission product.
Additional important conservative assumptions on which the radi-ation exposure data in Table IX-El were based are as follows:
a.
The wind persisting in one direction.
(Wind direction changes would result in spreading contamination more widely and, thus, reducing maximum levels. )
b.
The subject remains on the center line of the " cloud" of radioactive materials for the entire period of ex-posure.
(For example, if the subject were even a few tens of feet from the center line in the inversion case, the exposure would be reduced significantly. )
The subject is in an unprotected area for the entire c.
period of exposure.
(If the subject were in a house, for example, rather than out in the open, the exposure would be reduced. )
(
IX-24 d.
No precipitation.
(Precipitation would bring down more contamination close to the plant, reducing contamination levels further away. )
(
The incident occurring during hot summer weather.
(In e.
cooler weather, less contamination would leak out of the enclosure. )
f.
The " release" occurring at about 10 meters above the ground.
(Release at a significantly higher level would result in lower concentrations of radioactive materials off-plant, whereas, r alease at a lower level would not increase off-plant cor centration significantly. )
g.
Solid particles in sphere vapor space small enough to leak through sphere-wall imperfections without being filtered out.
h.
A sphere leakage ra.e of 0. 5%/ day at 27 psig enclosure pressure.
i.
A release to the " visible" enclosure vapor space of 100 percent of the nobla gases, 25 percent of the halogens, and 2 percent of t te " particulate" fission products.
(Though it is possible that the noble gases with their low boiling points ( -242 *F for Kr, -164 *F for Xe) will nearly all eventur.11y reach the " visible" enclosure vapor i
space, it is unlikely that such a large percentage of the halogens will succeed in doing so.
The boiling temperatures of the halogens are 138 'F for bromine and 363 *F for iodine.
Since the temperature within the sphere vapor space should not initially exceed about 315 'F following the incident, and since this temperature should be reduced considerably as heat is removed from the sphe~re during the first day, the more abundant iodine should condense rather rapidly on leaving the reactor; thus, promoting its removal from the vapor phase and reducing the possibility of leakage to the atmosphere. Similarly, because of the high boil-ing points for most of the rest of the fission products, it is not expected that a large percentage of them will reach the upper " visible" vapor space or be available for leakage from the sphere. )
j.
No fallout of radioactive material from the " cloud" was considered in determining either the exte' nal dose rate r
from the " cloud" or the amount of radioactive material inhaled.
(Since some fallout would certainly occur, both the external cloud dose and internal dose results given in Table IX-El are higher than would be encountered. )
(
IX-25 k.
Reduction of dose rates in the contaminated fallout area I
by only radioactive decay.
(In this respect it is f ossible that the contamination will be removed from the ground surface or its dose rates effectively reduced at a much faster rate by the effect of the weather. Thus, it is pos-sible that re-entry of personnel to the affected areas:could be permitted in much less time than would be indicated by consideration of the effect of only radioactive decay. )
Other mitigating factors of importance in considering the exposure that might be encountered by off-plant personnel are as followc:
1.
Only in certain directions would the 1/2 mile exposures really apply. In other directions, due to the shape of the site and the presence of the lake, the exposures at one mile are far more representative of the probable exposures for people nearest the site.
2.
Only about 10% of the time does a certain 45 ' wind direction persist for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or more. Since it is estimated that plume width during inversion will be only about 150 feet at 1/2 mile and about 300 feet at one mile, the chances of the " cloud".
center line passing over any given point in a given 45' quadrant are much less than one in ten.
3.
Inversion meteorology may be expected to occur no more than 1/3 to 1/2 the time. Since an inversion condition is more likely to occur during the hours of darkness, it is not expected that personnel would be exposed to the inversion doses in an unshielded area for an extended period of time.
In this respect, it is important to, note that a house of con-ventional frame structure would reduce the external dose from the passing " cloud" by a factor of two or three. Sim-ilarly, being indoors will reduce the inhalation doses from those listed.
On the plant site itself, locations that might be occupied by person-nel needed to limit the consecuences of an ae.cident (e. g., the Con-trol Room) will be protected by shielding from post-accident radiation effects sufficiently to permit safe continuous occupancy.
Emergency action in other personnel locations at the plant would consist in prompt evacuation or prompt seeking of shielded shelter.
Because of the approximately ten minute delay in release of any fission products following the incident, no person promptly evacu-ating the site should receive any significant exposure from a radioactive fission product source. A small exposure, less than 4
Mt IX-26 one roentgen, could be possibly received by personnel close to
(
the sphere during the first mincte after the incident, principally from the radioactive nitrogen-16 rdeased with the coolant.
In summary, no person on the plant site would, in all probability, receive during the course of evacuation a radiation exposure even approaching a dose of 25 roentgens, the limit recommended by the National Committee on Radiation Protection and Measurements as the maximum permissible emergency dose.
=
f
,. ~.
IX-27 TABLE IX-El
' RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 1 of 10 Sheets A.
Basic Assumptions:
1.
" Maximum Credible Accident" as described in the text.
(This assumption includes that of very hot summer weath-e r.
In cooler weather, less contamination would leak out of the sphere )
2.
Initial leakage rate from the sphere of 0. 5%/ day.
( A lower leakage rate would reduce contamination spread and lower the exposures given on sheets 5, 9, and 10 in direct pro-portior. to the reduction in the leakage rate. )
3.
Exposures stated for unprotected subject, and except for the direct radiation exp0sure, it is assumed that the sub-ject also remains on the center line of the cloud for the entire period indicated.
4.
Solid particles in the sphere vapor space small enough to leak through sphere-wall imperfections without being filtered out.
5.
Wind persisting in one direction.
(Wind-direction changes would result in spreading contamination more widely and, thus, reducing maximum levels. )
- 6.
No precipitation.
(Rain would bring down more contr?.-
ination close to the plant, reducing contamination levels further away. )
B.
Basic Data:
The methods employed in calculating radiation exposures and in determining the course of radioactive material in the environment utilized the following general relationships and data:
1.
Dose rates from the reactor enclosure:
- 1. 48 x 10~7 [El e-px [ Bu = r/hr-Mw at I cm h
e n
7-w,
~-
= -,,,
---we
,v e
oe
TABLE IX - El IX-28 RADIOLOGICAL EFFECTS OF
" MAXIMUM CREDIBLE ACCIDENT"
[
Sheet 2 of 10 Sheets
- where, f
y photo.ss
=
sec-cm2-Mw y energy in Mev E
=
[e-Fx=
Total absorption effects, in water, steel, and air Total Buildup effects due to scatter in the various Bu
=
absorbing mediums Note:
At the distances d primary interest in this problem, the radioactive material in the reactor enclosure may be considered to act as a point source.
2.
Washout rates in the reactor enclosure:
The proportion of material in the enclosure vapor space de-posited per second was taken to be 3 x 10-4 for solids and 9 x 10-5 for halogens.
Reference Figure 7. 5, page 95, in i
" Meteorology and Atomic Energy. "
3.
Cloud Radiation Exposures:
Reference nomograph, Figure 8. 3, page 108, in " Meteorology and Atomic Energy. "
4.
Fallout Concentrn* ions:
a.
Inversion Meteorological Conditions z
12 z
2 E(x,y,z) =
20
- g -. 2, q2 avereip
- where, E
= curie - seconds cc Q
= Total curies emitted p
= Wind speed, meters /sec.
Of vi
= Standard deviation of concentration in the
{
y and z directions, respectively
.m 1-,.
IX-29 TABLE IX - El RADIOLOGICAL EFFECTS OF I
" MAXIMUM CREDIBLE ACCIDENT" Sheet 3 of 10 Sheets b.
Average Meteorological Conditions 2
2 E(x,y,z) 20 g-y
+
7
=
7 pCy Cz X2-n Cy X -n 4 4 Cz Xz-n z
in similar conventional units.
5.
Fallout Exposures:
Ground contamination of I curie of fission products per square meter emitting 0. 7 Mev gamma radiation will give a dose rate of approximately 10r/hr. at one meter above the surface.
6.
Internal Exposures a.
Air Concentrations for Inhalation Consideration:
v2+h2) 3(x,y) 2O 6~
FC2 X2-n C2X2-n I4 I
/
- where, X = concentration in c.uries per cubic mete r O = Emis sion rate, curies per second Other meteorological parameters (f or a conservatively assumed height of re!. a3 - of'10 meter 4) are as follows:
n C
C2 Atmospheric Condition 4
Neutral 5
0.25
- 0. 2 0.014 Inve rsion 1
- 0. 5 0.05 O.004 Differences between the.<e constant s and those for one hour ob-servation periods given by the Consultants ( Appendix 2, page 13) are noted. In the neutral ca se, the effect of using these instan-taneous diffusion coefficients is to increase the radiological ef-fects by an order of magnitude over that which would be expected over periods of an hour; in addition, a slightly lower (5 m/s vs.
6m/s), and thus more conservative, wind speed was used.
In the inversion case, the values of n and C used have minor vari-ations from H..e Consultants' suggestions without significant effect on the analysis. The conventionally assumed wind speed of 1 m/s was employed, in spite of the much higher wind speed believed to prevail at the site during 'nversion. This produces a very ( on-servativemnalysis believed appropriate until the site conditions are confirmed by observation.
IX-3 TABLE IX - El RADIOLOGICAL EFFECTS OF
" MAXIMUM CREDIBLE ACCIDENT" Sheet 4 of 10 Sheets b.
Effect of Internally Deposited Radioactive Material:
The calculation of radiation exposures from internally deposited radioactive material utilized the appropriate procedures and specific data for individual radioisotopes as given in " Recommendations of the International Com-mission on Radiological Protection, " Rev. 1954.
Direct Radiation from Reactor
Enclosure:
Dose Rate vs Distance & Time Distance from Dose Rate, Roentgens / Hour Center of After 10 Af te r 15 Af te r Afte r Afte r Afte r Reactor Enclosure Minutes Minute 4 1 Hour 1 Day 1 Month 1 Year i
1/2 mile 0
0.06 0.1 0.001 2x10-7 lx10-7 1 mile 0
1.0006 0.001 1x10-5 2x10'II 2x10'II Direct Radiation from Reactor
Enclosure:
Integrated Dose Distance from Integrated Dose, Roentgens Center of First First First Reactor Enclosure 15 Minutes Hour 8 Hours 24 Hours 1/2 mile 0.002 0.06
- 0. 3
- 0. 4 1 mile 0.00004 0.0008 0.004 0.006
(
IX-31 TABLE IX - El
- RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 5 of 10 Sheets (For Basic Assumptions and Data for Calculations, See Sheets 1 to 3)
Direct Radiation from Cloud Passage: Subject on Center Line of Cloud Path Time Integrated Dose, Roentgens of 1/2 mile from Reactor Enclosure 1 mile from Reactor Enclosure Exposure Neutral Severe Neutral Severe i
Meteoro-Tempe ra-Meteoro-Tempe ra -
l logical tu re logical ture Conditions Inversion Conditions Inversion First Hour O.003 0.1 0.002 0.08 First 4 Hours
- 0. 01
- 0. 5 0.008
- 0. 4 First 8 Hours
- 0. 03
- 0. 9 0.02
- 0. 8 First 24 Hours
- 0. 06 2
0.04 2
l l
.(
=
y
.-9
-r
IX-32 TABLE IX - El i
RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 6 of 10 Sheets (For Basic Assumptions and Data for Calculations, See Sheets 1 to 3)
Contaminated Areas Off-plant Off-plant Activity Distance from Enclosure Area
- Level, Mile s Square Miles
- Possible Microcuries per square Neutral Severe Neutral Severe mete r Meteoro-Tempe ra-Meteoro-Tempe ra-Effects logicc.1 ture logical ture Conditions Inversion Conditions Inve rsion 5000 0.05
- 0. 2 none none Evacuation of gen-e ral population for up to several years.
7 500
- 0. 2
- 1. 3 none 0.1 Evacuation of gen-eral population for up to several months.
50
- 0. 6 6
40.1 2
Moni,toring and possible confis.
cation of crops.
- Assumes distance to site boundary of 1/2 mile.
(
IX-33 TABLE IX - El RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 7 of 10 Sheets (For Basic Assumptions and Data for Calculations, See Sheets 1 to 3)
Fallout--External Radiation:
Neutral Meteorological Conditions Distance from Dose Rate. Roentgens /Hr.
Integrated Dose, Roentgens Reactor After Af te r First First First First Enclosure 8 Hours 24 Hours Hour 4 Hours 8 Hours 24 Hours 1/2 mile 0.0005 0,0006 0.00009 0.0007 0.002 0.009
(
1 mile 0.0001 0.0002 0.000009 0.00009 0.0005 0.003
- i Fallout--External Radiation: Severe Temperatur,e Inversion Distance from Dose Rate, Roentgens /Hr.
Integrated Dose, Roentgens Reactor Af te r Af te r First First First First Enclosu-e 8 Hours 24 Hours Hour 4 Hours 8 Hours 24 Hours 1/2 mile 0.005 0.006 0 Of05 0.007
- 0. 03 0.09 1 mile 0.002 0.003 0.0003 0.004 0.009 0.05 i_
~_..
IX-34 TABLE IX - El q.
t RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 8 of 10 Sheets (For Basic As sumptions and Data for. Calculations, See Sheets 1 to 3) l Total External Radiation: ' Subject on Center Line of Cloud Path 4
Time Integrated Dose, Roentgens (Radiation from Enclosure, Cloud, and Fallout) of 1/2 mile from Reactor 1 mile from Reactor Enclosure Enclosure Exposure Neutral Severe Neutral Severe Meteoro-Tempera-Meteoro-Tempe ra -
logical ture logical ture Conditions Inversion Conditions Inve rsion First 10 Minutes 0
0 0
0 t
First Hour 0.06
- 0. 2 0.003 0.08 First 4 Hours
- 0. 2
- 0. 5
- 0. 01
- 0. 4 First 8 Hours
- 0. 3 1
0.02
- 0. 8 First 24 Hours
- 0. 5 3
0.05 2
(
-r.
..-7
IX-3 5 c
T AB LE IX - El
(-
i RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT"
~
4 Sheet 9 of 10 Sheets f
. (For Basic Assumptions and Data for Calculations, See Sheets 1 to 3)
Internal Exposure: Neutral Meteorological Conditions Distance Lifetime Average Bone Dose, Rems from From Inhalation Period of:
Reactor Enclosure First Hour First 4 Hours 1/2 mile 0,03 0.1 1 mile 0.02
- 0. Cs g
Distance Lifetime Thyroid Dose, Rems from From Inhalation Period of:
Reacter Enclosure
~
First Hour First 4 Hours 1/ 2 mile 1
8 1 mile
- 0. 4 2
l I
i Distance Lifetime Lung Dose, Rems i
from From Inhalation Period of:
l Reactor Enclosure First Hour First 4 Hours 1/2 mile
- 0. 08
- 0. 5 i
(-
1 mile
- 0. 03
- 0. 2 D
t J
,e.,--
IX TABLE IX - El l
RADIOLOGICAL EFFECTS OF " MAXIMUM CREDIBLE ACCIDENT" Sheet 10 of 10 Sheets (For Basic Assumptions and Data for Calculations, See Sheets 1 to 3)
Internal Exposure: Severe Temperature Inversion
' Dis tance Lifetime Average Bone Dose, Rems from From Inhalation Period of:
Reactor Enclosure First Hour First 4 Hours 1/ 2 mile
- 0. 5 3
1 mile
- 0. 2 2
Distance Lifetime Thyroid Dose, Rems from From Inhalation Period of:
Reactor Enclosure First Hour First 4 Hours 1/2 mile 25 240 1 mile 10 17 0 s
4 Distance Lifetime Lung Dose, Rems from From Inhalation Period of:
i Reactor Enclosure First Hour First 4 Fburs l
l 1/2 mile 2
16 l
l l
1 mile 1
11 p
_ q -
.-p 9